Building Automation Knowledge Base

Issue Are username and passwords encrypted during transmission from the remote client or the web client to the Sigma server? Product Line Satchwell Sigma Environment Sigma Remote Client WebClient Cause Are username and passwords encrypted during transmission from remote client to the Sigma server? Are username and passwords encrypted during transmission from web client to the Sigma server? Resolution Usernames are not encrypted during HTTP transmission from the remote client and web client to the Sigma server. Passwords are encrypted during HTTP transmission from the remote client and web client to the Sigma server.

Issue When external internet access is not possible an alternative NTP Server is required to allow ES and AS to by time synchronized onsite. Product Line EcoStruxure Building Operation Environment Enterprise Server / Automation Server on closed network Eg Windows 7 Cause AS will not synchronize the time with a local NTP such as Windows 7 (32 or 64 bit) without it first being configured. Even then, increasing Cyber Security features within EBO means that the use of a 3rd Party NTP is becoming a much better option. Resolution Preferred Solution The very best option for the latest versions of EBO would be to investigate. Meinberg NTP which is a third party NTP server that runs on the Win7 or Win10 OS and provides NTP by synchronizing with four or more Internet clocks and is a trusted time source in NTP.  It is not an officially supported PSS tool, but it does fix the issue of the ES/AS not trusting the time.   Windows 7  Config If you still wish to attempt the Windows 7 NTP option first the procedure to setup is as follows:    In the 'Services' window (part of Administrative Tools) Stop the 'Windows Time' service if already running. The 'Startup Type' could be set as Manual or Automatic depending on the user needs. In the Registry Editor following changes to be made under the Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time: ** Config -> AnnounceFlags = 5. ** HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\NtpServer -> Enabled = 1. Start the 'Windows Time' service in the 'Services' window(part of Administrative Tools). Note: NTP uses UDP Port 123 Below is a Wireshark capture using filter udp.port == 123 indicating the “Leap indicator” bits are 11, meaning “clock unsynchronized”. NOTE: The NTP client in the AS may ignore the time sent by the NTP server if the root dispersion is greater than 'X' seconds (unknown at this time). See Automation Servers ignore time sync message sent from Windows NTP server that uses local internal clock for information on how to determine whether this is a problem at the site and how to resolve it. Note: Test Lab results show that once validated and synchronized, the AS asks the time from the NTP about every 17 minutes. Two enhancements have been requested for a future release: Workstation gets an alarm if the NTP is not a valid reply A tick box setting in Workstation so the ES/AS can accept an invalidated reply(time)

Issue Some attributes used within Continuum PE programs on b3/i2 controllers are no longer appropriate with EBO Script programming Product Line EcoStruxure Building Operation Environment b3 Infinet Building Operation Server Script Programming Cause Some attributes used within Continuum PE programs on b3/i2 controllers are no longer appropriate or cannot be used with EBO Resolution An example of this would be the ElecValue attribute for an input or output. This can be used within the Conversion field of an input but cannot be used within a Script Program or Script Function. The Continuum example PE program for an STR502 or STR504 includes the line "If STR5xx ElecValue <= 0 then Return Upper" The correct result can be obtained within SmartStruxure by dropping the "ElecValue", so "If STR5xx <= 0 then Return Upper" Then ensure the STR5xx analog input is a Voltage type with no conversion configured. Note: The ElecValue keyword can still be used in the Conversion line of an Analog Inputs (e.g. for Counter input scaling). Some other Attributes not supported in Script Programming are: Size LogType

Issue When attempting to enable .NET Framework 3.5 on Windows using the DISM command mentioned in the WebReport installation guide, the attempt fails with error 1910 Command: dism /online /enable-feature /featurename:NetFX3 /all /Source:e:\sources\sxs /LimitAccess Deployment Image Servicing and Management tool Version: 10.0.14393.0 Image Version: 10.0.14393.0 Error: 1910 The object exporter specified was not found. The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log Product Line EcoStruxure Building Operation Environment WebReports Cause The Windows Modules Intaller service is not operating correctly, and has to be restarted. The service is however protected, so this can not be done through the services control panel. Resolution Kill "TrustedInstaller.exe" from the Windows task manager (CTRL+SHIFT+ESC) Start the "Windows Modules Installer" service from Windows services (Start->Run->services.msc) Try again, either using the command or the SBO Reports Preparation tool.

Issue When importing an XIF into SmartStruxure, errors can be generated that vary in nature. Product Line EcoStruxure Building Operation Environment SmartStruxure Enterprise Server SmartStruxure Automation Server Building Operation Workstation Cause The XIF does not import successfully for a variety of possible reasons: There exists a device template in the server already that contains the same device ID as the XIF that is being imported.  The XIF does not comply with the LonMark Device Interface File Reference Guide published by LonMark. Resolution Before performing any of the steps below: Import the XIF file provided by the manufacturer of the Lon controller - if the manufacturer did not provide a XIF, try searching the LonMark product catalog If the provided XIF does not work, upload the XIF from the device to ensure that it is the correct file by following How to extract an XIF out of a Lon controller. Use the SBO SNVT Support tool found on The Exchange to identify unsupported SNVT's. Work through the troubleshooting steps below.   Device Template Fails without an Error This issue has been seen in some of the older versions of SmartStruxure (1.5 and older) and upgrading to the latest version will resolve the issue in many cases. If the issue occurs at the latest version of SmartStruxure: Use the SBO SNVT Support tool located on The Exchange to identify unsupported SNVTs. If the SBO SNVT Support tool does not identify any unsupported SNVTs, then send the XIF in to Product Support for further investigation.    Device Template Already Exists In order to complete the import of the XIF, follow these steps. Delete all controllers in that database that are using the device template that has the same device ID as the XIF file you are trying to import.  Now import the XIF again. Select the server in the system tree on the left and go to File > LonWorks import > Device Template. Click the Browse button and select the XIF you want to import. Click Import. Note: When the import is complete it will have overridden the old device template with that device ID. Two device templates with the same device ID will not be able to reside in the same database. For more information about device templates see Delete Device Templates.   Detailed Error Prompt with Specific Fields Listed Some examples of the detailed errors include but are not limited too: "Field X has error(s). The string must between X and X characters. nvoActualCapacity has X characters" on row X. "Field X has error(s). The number must between X and X. Field X has value X." on row X. "Field X has error(s). The value must be X but was X." on row X. Space or tab are not allowed in field 0Node Object on row X.   To Address these issues: Download Notepad++ to be able to better navigate the XIF by row number. Using Notepad++, open the XIF. NOTE: Backup the original XIF just in case there is a mistake when modifying. Find the row and field number prompted by the error messages and modify them accordingly. All the rules can be found in LonMark Device Interface File Reference Guide published by LonMark. Import the XIF again to verify whether it works. If not, contact Product Support for further investigation.

Issue Satchwell “M 1201” Actuator forming part of combined Actuator / 2-port Valve Body assembly requires replacement. Environment Stand alone Satchwell “M 1201” Actuator forming part of combined Actuator / 2-port Valve Body assembly M 1201 Actuator 2-port Valve Body Cause Obsolescence of Satchwell “M 1201” forming part of combined Actuator / 2-port Valve Body assembly. Resolution There is no direct replacement for the "M 1201" Actuator and as a result both the "M 1201" Actuator and the 2-port Valve Body to which it is connected will also require replacement.  Replace Satchwell “M 1201” combined Actuator & 2-port Valve Body assembly with Schneider Electric MD10B-230 Actuator, LMD-MB Linkage Kit and Satchwell MB series 3-port Valve Body of appropriate size. Details of the original Satchwell “M 1201” combined Actuator & 2-port Valve Body assembly may be viewed here. Details of the replacement Schneider Electric MD10B-230 Actuator may be viewed here. Details of the replacement Schneider Electric LMD-MB Linkage Kit may be viewed here. Details of the replacement Satchwell MB 3-port Valve Body may be viewed here. N.B. Satchwell MB series 3-port Rotary Shoe Valve Body may be converted for use as a 2-port Zone Valve by means of the installation of a plumber’s plug in Port 3 Install plumber's plug in Port 3 of MB series 3-port Rotary Shoe Valve Body. Tighten plumber's plug sufficiently to ensure PN 10 rating of Valve Body is not compromised. It is possible that the "M 1201" Actuator may have been fitted with an Auxiliary Switch. If so then an MD-S1 Auxiliary Switch may be fitted to the MD10B-230 Actuator if required. Details of the MD-S1 Auxiliary Switch may be viewed here.

Issue When discovering the SLP Series Living Space Sensors they show up in the BACnet discovery summary as Non-conformant. Attempting to add this non-conformant sensor results in a WorkStation error similar to the following:  Validation Error Workstation Error in "~/BACnet Interface/MSTP Network/Living Space Room Unit 4E5932F5_«1»_07/ForeignAddress". Property value "<device, 10000>" already assigned to "~/BACnet Interface/MSTP Network/SLPSTC2/ForeignAddress". COML Validator0 Product Line EcoStruxure Building Operation Environment BACnet MSTP Living Space SLP Series Air Quality Sensors Living_Space_REV2.05.21 Cause Building Operation does not allow duplicate BACnet IDs and hence, during discovery, if a device is found with a BACnet ID (Object Identifier) the same as an existing device it shows as a non-conforming BACNet device. The default device ID for SLP devices should be equal to (Vendor ID * 1000) + MAC Address. Where vendor ID is our Schneider Electric BACnet vendor ID = 10 and the MAC address is unique to each devices MAC address DIP switch setting. This will be corrected in a future release of the Living Space firmware.  Until corrected, and since the Device ID is a read/write attribute the customer is able to change it to avoid duplicates on the bus. Unfortunately, Building Operation does not currently have a method to write a new device ID. Resolution The current workaround is to use a third-party BACnet Explorer such as Yet Another BACnet Explorer (YABE) to write a new device ID value. Once the new ID has been updated the SLP device can then be rediscovered within Building Operations'. 

Issue Unable to find details on all commands that have been added to Security Expert objects to implement new functionality. Having this information available would help determine feature set possibilities. Product Line Security Expert Environment Security Expert Client, SP-C Cause Commands used in objects such as Controllers, Doors, and Access Levels may not be documented in the online help, installation, or operation manuals as they are being used to implement new functionality that has not been added to the Security Expert yet. There is no stand-alone list of all available Commands. Resolution Commands are listed in the firmware Release Notes and defined further in Application Notes.

Issue Firewall issues when trying to reach out to the activation server for a license Product Line EcoStruxure Building Operation, Satchwell Sigma, TAC Vista Environment Building Operation Licensing Firewall Cause If the corporate network has a very restricted firewall policy or rules, the port needed to reach and activate a license may be blocked. Note: The same license server is used for EcoStruxure Building Operation, Satchwell Sigma and TAC Vista software licenses. Resolution Open Port 443 (HTTPS) for the server hosting the license server, and ensure that the routing paths to the Flexnet Licensing server URL's are all fully open. The Licensing Server URL should be opened from the site, and it is: https://schneider-electric.flexnetoperations.com If the site of the old server has issues with the non secure communications or the communications forwarding between the previous and the new server, there is a tool available to configure EBO to only use the new server. See the Exchange Community article for the download: SBO License Setup Note: From EBO V2.0 only the new license server is used, port 80 is no longer required and HTTP is redirected to HTTPS.

Issue Controller loses data following power failure or mains noise (from transients or spikes). Product Line Andover Continuum Environment All CX, ACX, i2, bCX, b3 controllers Cause Controllers are exposed to operating conditions outside their operating envelope and tested limits. This can cause them to reset, go offline or lose data. In extreme circumstances, poor installation can take controllers outside their operating envelope and cause damage requiring a repair. Resolution If a controller is setup on a bench with a clean power supply and the correct grounding, you will be able to turn off/ on the power and the controller will warm start every time. This test will confirm the controller is operating correctly, not faulty and that the software settings are correctly set for warm starting. Also that the RAM backup battery is connected and operating. If site resets, lockups, loss of memory or other corruption are seen on a site, then here are some of the installation issues to consider: Grounding - All controllers require a clean low impedance earth to sink all of the noise and emission energy a controller may be exposed to. The noise protection circuitry within a controller is designed to dissipate this energy down to earth, if this path is not low impedance the energy can cause a controller to reset or even be damaged permanently. Shared Ground - The earth cable to the Controller should not be shared with any other equipment that is a high inductive or capacitive load, these can generate noise spikes back into the controller. This includes motors (pumps/ fans etc) lighting circuits (capacitive loads), inverters (high frequency noise). Induced emissions - The controller should not be installed near any equipment that may induce excessive radiated emissions into the unit, the radiated emissions from Motors, inverters, radio & microwave equipment, lighting circuits, power wiring can all produce radiated emissions that could exceed the specified limits of the Controllers. By fitting the controllers into earthed metal enclosures you can minimize the external emissions by effectively creating a Faraday cage protecting the controllers circuitry. Power feed - The power requirements for every controller is defined in its datasheet with the defined tolerance, taking the power levels outside these limits can cause incorrect operation. Power spikes - Surges or spikes in power feeds or connection I/O cabling can cause controllers to reset, lose data or even become damaged. Fitting varistors to the power supplies and across any output loads can minimize the impact on the controller, See What Varistors should be used?. Shared Supply - The power feed to a controller should never be shared with other equipment that can generate electrical noise. Never use the same supply to power both controllers and field equipment like valve/ damper actuators in BMS systems or magnetic door locks in Access control, both actuators and the solenoids in Mag locks can generate large back EMF pulses into the controllers that can cause resets or even damage.. Fitting power filters or an external UPS on the controller can protect it from spikes on power up/ down, it is however always best to remove the noise spikes at source, so fit filters the generators, motors, contactors etc. It is also possible for the above issues to cause Infinet networks to Reconfig as well as other networking problems. Note: All controllers are approved and tested to the defined limits for FCC and CE induced and radiated emissions as detailed in the datasheets, for a controller to fail, restart or lose data it must be exposed to levels exceeding these specifications. They are not however power equipment and cannot be exposed to the noise levels power and industrial controls equipment is designed to withstand.

Issue Security Expert is denying user entry to a door and generating an event message stating waiting for Bio Mode Card Input Credentials.  Biometric credentials are not being used for the door. Product Line EcoStruxure Security Expert Environment Security Expert Client Cause Custom credential settings are not correctly configured for the door and reader.  The door is set to use a Door Type expecting a Custom Credential but the Reader is configured to use a standard card format.   Resolution To fix the issue the Reader must also be configured to use a Custom Credential.  Navigate to Reader Expanders and select the associated Reader Expander. For the Reader set the Reader(x) Format to Custom Credential as expected in the Door Type Right click the Reader Expander, select Update Module, and after a successful update test the operation.

Issue When using the 20k (Honeywell) thermistor type on an EcoStruxure IO Module, the temperature value does not change and reads an inaccurate value. Product Line EcoStruxure Building Operation Environment Building Operation Workstation Building Operation Automation Server IO Module Cause The 20k (Honeywell) thermistor type does not work properly in Automation Server IO module firmware versions 2.009 and older. Resolution Check and upgrade the Automation Server IO module firmware to the latest version. Follow the steps below: Select the module in the System Tree (1) and on the Properties tab (2) check the Firmware version (3) If the firmware requires upgrading the latest version can be downloaded from The Exchange Download Centre.  For instructions on how to upgrade the firmware see Upgrading Automation Server IO Module Firmware.

Issue How to upgrade Automation Server IO module firmware. Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Building Operation Automation Server Premium Building Operation I/O Module  Cause Occasionally new firmware builds will be released for the Automation Server IO Modules to address issues or add enhancements to the products. These firmware builds must be downloaded to the modules through Workstation. Resolution Upgrading IO Module Firmware The latest version can be downloaded from The Exchange Download Centre.  Once the firmware is downloaded right click on the IO module in the System Tree and select "Update IO module firmware..." The "Update IO Module File" browse window will automatically open.  Browse to the new firmware file and click "Open". The latest IO firmware files can be downloaded from The Exchange Download Centre.  Once the IO module update is complete, click "Exit". To check the firmware version in the IO module, select the module in the System Tree (1). Click on the Properties tab (2) and check the Firmware version (3). For additional information refer to Updating Central IO Module Firmware

Issue IO module status shows 'Bootloader' Product Line EcoStruxure Building Operation Environment Building Operation Workstation Building Operation Automation Server IO Module Cause The most likely cause is a failed upgrade process.  During an upgrade, the IO module's firmware is deleted allowing it to be replaced with the new firmware.  If the process fails before completion the module will be left without the application and in bootloader mode. Resolution Upgrade the firmware by following the instructions at Upgrading Automation Server IO Module Firmware. The operation takes less than a minute and the Module status should show status 'Configured' or 'Unconfigured' depending on whether points have been created on the module.

  Issue Cannot communicate to an ADV3 connected to the USB port of an AS-P or AS-B. The error message “Website not available” is displayed. Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation Advanced Display v3 (AD v3) Cause The AS-P or AS-B’s USB port uses a IP network connection to the ADV3 that defaults to 192.168.42.116. If the AS-P’s primary port is in the same range, for example the main LAN network range is 192.168.42.* there is a conflict with the USB IP network. Resolution Change the sites main LAN, which the AS-P or AS-B primary port connects too, to another network range.

Issue On a system requiring Semantics after adding Enterprise Servers to an Enterprise Central alarms are generated that cannot be cleared.  Changing the password for the Servers does not fix the issue. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Central Building Operation Enterprise Server Building Operation Workstation Cause Incorrect method used when setting up Semantics during installation, Semantics were enabled on the Enterprise Server as well as the Enterprise Central.  After adding to the Enterprise Central the Enterprise Server points to a different address where the alarm is for the original Enterprise Server address.   Resolution On the Enterprise Server the alarm needs to be verified against the original connection, this involves removing the lead object link and changing the settings to look at the original Semantic Database.   On the Enterprise Server Semantic Settings remove the lead object entry pointing to the Enterprise Central.  Open the Services Manager and Stop and Re-Start the GraphDB service, if stopped start it. Additionally, Stop and Start the Enterprise Server service, this can also be done in the Services manager using Software Administrator to stop and start will show any errors if evident. Log back into the Enterprise Server and the password alarm should be cleared, this may take a minute or so but not any longer.  This is only if the password has been changed, please see Semantic DB authentication failure" alarm. Also, in the EC the password alarm should have cleared. Once the alarm is cleared the GraphDB service can be disabled from within services as it is not required. Re-instate the lead object entry pointing to the Enterprise Central that was initially removed. For more information on Semantics please see Semantic Overview

  Issue After adding a new group with limited permissions to a User, the User cannot change their password or Login to the Instance. The Error 'Password is incorrect' is displayed When trying to change the password the dialog box may flash, but not continue. If you click the Ok button again, it will show the 'Password is incorrect' box. Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause A User Group with restricted access to specific objects didn't have permissions to the Instance object Resolution Add permissions to the User Group If 'All Types' are a part of a UserGroup then the 'Instance' object is included. However, if specific object permissions are selected for the User Group then the 'Instance' Read permission must be added at a minimum for the User to have access to the Instance. If the User is required to change their password then they will also need Publish permissions. Original Changed

Issue Procedures and processes to secure I/A Series Niagara 4 Systems Product Line TAC IA Series Environment  I/A Series Niagara 4 Systems Cause Users accessing system without permission Potential damage done by malicious entry to the system Resolution The attached document describes how to implement security best practices in an I/A Series Niagara 4 system.  While it is impossible to make any system completely impenetrable, there are many ways to build up a system that is more resistant to attacks. In particular, this document describes how you can help make an I/A Series Niagara 4 system more secure by carefully configuring and using: Passwords System Passphrase Platform Account Management Station Account Management Role and Permission Management Authentication TLS and Certificate Management Module Installation Additional Settings External Factors Please note that while all of these steps should be taken to protect your I/A Series Niagara 4 system, they do not constitute a magic formula. Many factors affecting security and vulnerabilities in one area can affect security in another; it doesn’t mean much to configure a system expertly if your JACE is left physically unsecured where anyone can access it. Note: Schneider Electric strongly recommends upgrading to the latest I/A Series N4 version maintenance build that implements numerous security updates.  Before updating any system, make sure to review the build-included documentation to understand the behavioral impacts of the security enhancements and JACE hardware platforms supported. Download the Niagara 4 Hardening Guide_2023 for more details.

Issue Using a VPN with I/A Series Niagara Systems Product Line TAC IA Series Environment I/A Series Systems Cause A VPN's purpose is to provide a secure and reliable private connection between computer networks over an existing public network, typically the Internet. Resolution What is a VPN? "Virtual Private Network" or VPN is a mechanism to extend a private network across a public network such as the Internet. A VPN creates a point-to-point connection or "tunnel" across the Internet between two computers. The tunnel encrypts the data between VPN endpoints, preventing data from being deciphered without the required encryption keys. Why use a VPN? VPN provides an additional layer of security to your Niagara system without compromising your ability to access Niagara. A VPN can help protect your Niagara system from Internet-based attacks by requiring an additional layer of authentication to access Niagara resources. It can prevent automated Internet port scan tools from detecting the Niagara system. How can I set up a VPN? The following document describes how to use an Internet Security Gateway to provide VPN access to your ENC/JACE.  Click on the link to download Using a VPN with Niagara Systems for more details. In addition, the document describes setting up a VPN using a ZyWALL gateway.  The ZyWALL USG-20 unified security gateway (from ZyXEL) is a cost-effective device that you can add to an existing installation to provide VPN server capability. IMPORTANT NOTE: The information in this document is based on the assumption that the only IP devices on the network are Niagara devices. If Niagara devices share a network with other devices (such as a corporate LAN), DO NOT follow the approach described in the following pages. Instead, work with the customer’s IT department to determine the best method to protect both the Niagara and corporate systems while providing required access to the Niagara systems. In any scenario, if the VPN is installed or configured improperly, you can expose devices to the public Internet. If you are unsure about how to best configure and test your configuration, please consult an IT expert. Frequently Asked Questions I already use SSL, do I still need to use a VPN? The use of a VPN is still recommended as an additional layer of security. Attacks can come from both inside and outside of your network. Once I set up a VPN, do I still need to use SSL? Yes. The VPN only provides encryption between the VPN endpoints – the VPN client and server. Traffic from the VPN endpoint to and from the Niagara Station is not encrypted unless SSL is used. I’m running AX 3.6 or earlier without SSL support – should I still install a VPN? Yes. The VPN still helps protect against Internet-based attacks on your system. Do I still need a firewall? Yes. You should set up firewall rules to restrict Internet access to the VPN server port only. You should also consider setting up rules with the VPN server to restrict VPN access to only the required IP addresses and ports. For example, there may be non-Niagara devices on the LAN, but the VPN should be configured to only allow access to the Niagara systems. Additionally, you should only allow access to required Niagara services. Will a VPN affect LAN access to ENC/JACEs? No. LAN access to the Niagara devices remains the same as always. VPN only affects the ability to reach Niagara devices from external networks such as the Internet. If I use a VPN, will Niagara HTTP, Fox, and Platform tunneling work? Tunneling works normally over a VPN. You will need to update IP address assignments. What is the impact of VPN on Niagara Networking? Niagara Networking between systems on the LAN still functions the same whether or not there is a VPN installed. When I connect to a VPN, do I lose all other network connectivity? While your VPN client is connected to the remote VPN network, your Workbench (client) PC will have a new "Default Gateway" to allow you to make connections to stations on the VPN network. Typically, this happens without your knowledge and is mostly transparent. The change is undone after disconnecting from the VPN, and re-done when you reconnect. However (while you are connected to the VPN network) if your Workbench (client) PC tries to connect to sites on the [public] Internet or any other network through any router, you will find that you cannot reach those sites. If you must be able to reach those sites while connected to the VPN network, you will need to add static routes (temporary or permanent) to your Workbench PC’s TCP/IP configuration. The setting of those routes is beyond the scope of this document because they are specific to your PC’s network, your VPN network, and any other networks you try to reach. It is possible (but unlikely) that you cannot resolve these routing issues. This may happen if one or more of these networks have overlapping addresses. Consult with a TCP/IP expert if necessary. Likewise, if you use L2TP, PPOE, PPTP, or PPP for any part of your underlying network connection, the VPN client will probably conflict with it. Specifically, Windows only allows one connection of these four protocol types to be active at any given time. What is the impact on Single Sign On? You will need to define the SSO Domain and the hosts of the SSO Domain in your Workbench PC’s "hosts" file or default DNS server. The DNS server of the VPN will not be able to provide name services without changing your Workbench PC’s TCP/IP configuration. I use Dynamic DNS, can I still use a dynamic DNS provider with VPN? Yes. You will need to register the IP address of the VPN gateway and firewall with the DDNS provider. What is the impact of VPN on my system performance? Impact on performance should be minimal. It does take a little longer to set up the connection. References: Microsoft TechNet VPN Overview 

Issue MNB-1000 BACnet MS/TP communications do not auto-baud (synchronize). Product Line TAC IA Series Environment I/A Series MNB-1000 Firmware 1.2 and above Cause I/A Series MNB controllers with firmware 1.2 and above support baud rate synchronization (auto-baud) for BACnet MS/TP communications. This auto-baud feature is available if the device is configured for BACnet MS/TP communications only.  If the MNB-1000 BACnet Ethernet (or BACnet IP) communications are enabled, even though this is not being used in normal operation, it will cause the auto-baud to be disabled. Resolution 1. Disable the BACnet Ethernet (or BACnet IP) communications on the MNB-1000. Use a compatible RS-232 to RS-485 converter or the Roam IA to access the MNB-1000 via BACnet MS/TP communications. 2. Set the baud rate of the MNB-1000 MS/TP port to a fixed speed that matches the configured baud rate of the RS-485 port of the Jace. - Connect to the MNB-1000 using the WorkPlace Commissioning Tool. - Go to the MNB-1000 device properties, MS/TP tab, and set the baud rate of the MNB-1000 MS/TP port. See the example below.