1- Right-click on Remote Systems, select "create new"
2- Select "Remote Device (not on the local subnet)"
3- Follow the prompted instructions.
Let us know if these instructions helped you!
In short, communication between the host and the cRIO has to be reliable and stable, so it's done via TCP/IP, a transport-layer network protocol that provides reliable, ordered, and error-checked delivery of data between two parties. This is also called one-to-one or unicast addressing.
Discovering devices without prior knowledge of their number or addresses requires sending a one-to-many message out into the network. This is called multicast (many receivers) or broadcast (all receivers) addressing. TCP/IP clearly doesn't support this communication scheme. The most common transport layer protocol to use multicast addressing is UDP.
There's a PDF giving a little insight into the mechanisms that MAX uses to discover devices:
Google any of the protocols and mechanisms, there's an abundance of information to be found.
Just stumbled upon a very nice explanation of "how packets get around":
@JKSHI'm curious: What mechanism does NI MAX us to find the the cRIO in this case?
To more directly answer your question: it doesn't.
MAX is not capable of spontaneously discovering controllers on other subnets, because as others have pointed out, discovery is fundamentally a link-local process — it doesn't cross network gateways. It can only connect to remote targets if you give its IP, or its hostname if it's registered in DNS.
FWIW, this has a couple of esoteric implications for target formatting and reimaging. If you reformat a controller on the local network, and its IP address changes, MAX is able to identify the new IP address based on its link-local broadcast announcements. But if a remote target's address changes — i.e., it's addressed by IP and its IP changes, or it's addressed by hostname and its hostname is changed or is removed from DNS — then you're out of luck.