BACnet protocol multicast traffic failure on NSX segment

Products

• VMware NSX

Issue/Introduction

The BACnet protocol, which relies on multicast traffic, fails to function when traversing an NSX logical segment.
Protocol traffic functions normally when virtual machines are attached to a traditional vSphere Distributed Switch (vDS) port group.
Traffic analysis and network packet captures confirm that UDP port 7808 traffic is dropped when traversing the NSX segment.

Environment

VMware NSX
VMware Cloud Foundation (VCF)

Cause

A configuration restriction on the physical network exists. The physical firewall or underlay infrastructure blocks UDP port 7808, which prevents multicast-dependent protocol traffic from traversing the transport network nodes

Resolution

Modify the configuration on the physical firewall and underlay network devices to permit bidirectional traffic on UDP port 7808.

Identify the physical firewall or security appliances in the transport network path.
Create a rule to allow bidirectional traffic on UDP port 7808 for all Transport Node IP addresses.
Ensure that any relevant physical network switches and routers are properly configured to allow the protocol payload.