Building Automation Knowledge Base

Issue Content Types are not working correctly. A Content Type that was just created appears under the ES but not under the AS in which it was created in. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Workstation Building Operation Automation Server Premium Building Operation Software 1.9 or greater Cause Problems with or changes to the network configuration are affecting both the function and the lead shadow relationship of Content Types. Resolution   The following video will help us, Understand the Lead/Shadow aspects of Content Types Diagnosis and correct possible issues regarding the Lead/Shadow Online help topic for further information is also available here: Content Types (se.com)  

Issue How to perform the activation of an embedded demo license Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Premium (AS-P) Cause The embedded demo License is a temporary license used for demonstration purposes, training, site engineering, when waiting on a permanent license order, or license support. This license file has a .Bin extension and can be downloaded from the EcoStruxure Exchange (ecoxpert.se.com) and is valid for a limited time (3 months). Resolution This video will demonstrate where to download, and how to activate an embedded demo license on an Automation Server using the Device Administrator.

Issue MQTT data points are no longer published to MQTT broker with "MQTT - Buffer overflow" alarm. System alarm: Buffer overflow - Not all MQTT messages have been sent Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Premium Building Operation Automation Server Bundled Building Operation Enterprise Server Cause Long MQTT queue can be caused by, too many variables define in MQTT data groups, fast publishing, i.e. low interval or low delta value, Low CPU and RAM resources, or slow network. Resolution Once MQTT Buffer overflow alarm is generated, the below configuration shall be checked: Data points interval value, if the interval is enabled, make sure it is not a very low interval. Data points delta value, for event driven, make it is not very low value, especially for fast changing variables. Review the network performance. Make sure that the EBO server has sufficient CPU and RAM resources, and check Architectural guidelines for the effect of the Number of MQTT Data Points on the CPU Load. For Automation Server, the system memory usage should never exceed 80% and CPU usage should stay below 60%.

Issue There is no fully detailed explanation of how to install an SSL Certificate from an External CA Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server Cause When trying to install an SSL certificate from an external CA can fail Resolution Configure a DNS name for the AS/ES (This prevents the certificate from being locked down to a specific IP. I.E. Configure an A record for "AS_Name".com Purchase SSL Cert through a 3rd party, or use your organization's internal CA/ root CA Download and install OpenSSL or can use OpenSSL installed with EBO  Run Command Prompt as an administrator Use command "cd c:\program files\OpenSSL-Win64\bin Use OpenSSL to generate a CSR in order to obtain the certificate from the 3rd party openssl req -new -newkey rsa:2048 -nodes -keyout EcoStruxure.key -out EcoStruxure.csr Follow the prompts to fill out the information for the CSR Supply CSR, other certificate contact information, and a means of validating the request to the 3rd party CA Verify identity with CA (this may not be necessary if you use your company's internal CA/ root CA Receive host and intermediate CA certificates from 3rd party CA Make sure the CRT/CER files are in the C:\Program Files\OpenSSL-Win64\bin directory of Windows Explorer Use OpenSSL to convert the CRT or CER files into PEM files, as PEM is the only format EBO will accept openssl x509 -in certFileName.cer -outform PEM -out convertedCertFileName.pem Use OpenSSL to convert the private key file generated at step 6 from .key to .prv openssl rsa -inform pem -in filename.key -out filename.prv Run WorkStation as administrator In WorkStation, Control Panel > Certificates click on the server you are trying to add the cert to, either an AS or ES. Click on Manage Certificates > Add Existing  Put in a name for the certificate (it can be anything you'd like) Click the ellipsis next to host, intermediate, and private to add the appropriate PEM files and click ok  Select the newly added certificate from the drop-down and save the changes to activate Warm start the server After this process is completed, verify that connection to WebStation via HTTPS shows a secure connection/trusted certificate.

Issue In EBO BACnet device discovery, how is the BACnet MAC address defined? Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Building Operation Automation Server Premium Building Operation Automation Server Bundled Building Operation Enterprise Server Cause A BACnet device is uniquely identified by a network number and a MAC address. Resolution BACnet MS/TP A BACnet MS/TP device supports device MAC addresses in the range 0-127 for masters and 0-254 for slaves. Device MAC addresses are often configured using DIP switches or a configuration tool.   BACnet/IP MAC addresses for BACnet/IP devices are a combination of the IP address and BACnet/IP UDP Port expressed in hexadecimal notation. For example, if a BACnet/IP device is configured with an IP address of 192.168.1.5 and a UDP port of 47808 then:   IP address expressed in hexadecimal is 192 = C0, 168 = A8, 1 = 01, 5 = 05 UDP port expressed in hexadecimal is 47808 = BAC0   Therefore the MAC address will be, C0:A8:01:05:BA:C0   BACnet/SC BACnet/SC nodes are identified by their 6-octet virtual MAC (VMAC) address in form of a IEEE EUI-48 identifier which is randomly generated. A BACnet/SC device attempts to resolve its own VMAC in the network. If it detects another device is already using this VMAC, it will generate a new Random-48 VMAC address and try again.

Issue How do you see what authentication settings Security Expert was installed with? Product Line EcoStruxure Security Expert Environment Client/Server Authentication Cause When installing the Security Expert Client/Server three authentication settings for the Client to Server connection can be specified: To connect to the Security Expert Server using additional software, such as Data Sync or SOAP, the current authentication is needed so the additional software authentication can be set the same.  However, if this was not recorded at installation the only way to be 100% sure is to remove and reinstall. Resolution Navigate to the existing Security Expert installation folder:    C:\Program Files (x86)\Schneider Electric\Security Expert   Depending on the installed components there will be a file called either: SecurityExpertSV.exe.config - where only the Server component is installed SecurityExpert.exe.config - where only the Workstation component is installed Note: both files will be available if the Server and Workstation are installed on the same machine   Either file can be used.  Open the file using a text editor such as Notepad to find the current Security Settings used in the original installation. In the example below the authentication setting used was TLS 1.2 As illustrated in the image above the information is between the <netTcpBinding> tags.  The image below illustrates the settings for the three possible authentication types.  Look for the <security> tags to identify the authentication used:  

Issue The Data Sync Service Configuration Tool is showing an error when attempting to connect to the Security Expert Data Service. Failed to find operator where UserName = 'admin'. Exception: Access is denied Failed to find operator Product Line EcoStruxure Security Expert Environment Security Expert Data Sync Service Configuration Tool Cause The Authentication mode used by Security Expert is different from that used by SOAP. The Authentication mode selected during the installation of both software packages must be the same. Authentication mode Resolution Reinstall Security Expert or confirm the Authentication mode selected when it was installed. Consult the article Determining Security Expert authentication settings after installation. Reinstall Security Expert SOAP with the same Authentication mode used when Security Expert was installed.

Issue Continuum Graphics (Pinpoint): How do point updates take place and how can I change the update interval and polling speed? Is it different for BACnet points? Product Line Andover Continuum Environment Pinpoint Graphics Bacnet Cause How do point updates take place and how can I change the update interval and polling speed? Resolution In Cyberstation V1.71 and greater, the graphics polling engine was significantly changed. Prior to this change, the Pinpoint application would poll the points within its graphic file directly. If several graphics were open, each graphic would perform its own polling, This engine also applied to Web.client. Each control on the graphic had a separate selection where you could set the polling rate on a per-point basis on the miscellaneous tab of each control. This was the only method to adjust the point polling interval. The main reason for the graphic engine change was for Web.Client graphics. Slow networks, multiple browsers accessing the same graphics, and slow browser machines could make Web.Client graphics unacceptably slow.   The current method to get data into graphics involves a separate graphics polling engine per workstation. When one or more graphics are opened on a workstation or a Web.Client IIS server, the graphics register the points into the polling engine on that workstation. The polling engine then begins updating the values and sends the data to the Pinpoint/web.pinpoint clients. After initially sending all the data values to the graphic, it then only sends the data that has changed since the last update in an XML document format. If several graphics are requesting the same point values, the data is only polled once for all the Pinpoint clients on that workstation or Web.Client. Efficiency was also achieved by registering the points in the polling engine which allowed the polling engine to decrease the number of data requests by 50% to retrieve the same data.   There are now additional settings to adjust the polling rates in a graphic. #11 General preferences "Time interval between requests" This is a global setting and affects all workstations. By default, all polled points which are in the polling queue are sequentially updated at a continuous rate with a default delay between requests of 30 milliseconds. It is often recommended to set this to 100ms (Additional considerations below  under Multiple Cyberstation graphics performance)   General Preferences are accessed by Right Clicking on the Continuum icon in the Windows system tray and selecting General Preferences     There are also a pair of settings in the workstation preferences: #24 Pinpoint active polling rate #25 Pinpoint inactive polling rate These settings are for each workstation individually and do not affect the polling rates of the polling engine, but merely determine how often the graphic requests data updates from the polling engine based on whether a panel is or is not the active window. Typically these settings can be left at their defaults R&D has indicated that #24 is not used as Pinpoint always uses the inactive polling rate whether the window is active or not. Therefore, adjust #25 "Pinpoint inactive polling rate".  It is recommended to set this to keep this at the default of 250ms.   Cyberstation Preferences are accessed by Right Clicking on one of the Cyberstations while logged into Continuum and selecting Edit   Multiple Cyberstation graphics performance Several workstations may be configured to display graphics that are pointing to the same controllers and the controllers being polled may be on a large Infinet or MSTP network. In this case, the controllers could be overwhelmed by simultaneous data requests from the different workstations, slowing down controller scans, the whole field bus and overall system performance. R&D indicates that when multiple Cyberstation Graphics are used there is some randomness as to how the polling requests are accomplished. If graphic or system performance is an issue, it is suggested that another 30 Milliseconds is added to the general preferences "Time interval between requests" (#11) and then measure system performance and add additional time if needed up to 500ms.   When using this setting it is necessary to consider how many Cybersations would be running simultaneous graphics. For example:4 workstations polling graphics simultaneously with "x" number of points in it for 1 Netcontroller could have about 20 requests per second (determined via Wireshark capture at the NC NIC) 30 ms per X 4 Cyber =120ms added In this case, the recommendation was to set the "Time interval between requests" value to 250ms for performance   Note: Individual millisecond settings in each point do not effect polling for the point. They are not used.   BACnet points Bacnet points can be managed differently. Continuum BACnet points can either be polled the same way that Standard continuum points are polled or by using a COV. Standard polling is done by using the point objects from the "Infinity" side of the object tree. If you want to use COV for the point updates which is much more efficient, you should use the "BACnet Points" in the graphic, from the BACnet side of the object tree. The polling engine will then subscribe for COV updates to the respective controllers. When the graphic is closed the polling engine will unsubscribe the COVs. Third-Party BACnet controllers have an additional method to adjust the poll frequency. If the third-party BACnet controller supports COV subscriptions, Cyberstation will subscribe to these points as COV's like the Continuum BACnet controllers however, if the devices do not support COV's their points will be polled. Since many third-party BACnet controllers cannot withstand frequent data requests, there are two additional settings on the BACnet device object editor. The settings are on the Details tab on third-party BACnet controllers only. 1. Max # of Async requests The max # Async requests specify how many requests we should send before we get a reply to the data request, or how many requests can I queue. Typically this should be set to 1. 2. Request interval in ms  The request interval setting will depend on the device. Does it use Ethernet or MSTP network architecture? Are you running "Enhanced MSTP"? How many third-party devices are on the mstp network that cannot run enhanced MSTP? Typically it would be safe to set this in the 1000 to 5000 ms range based on desired data update rates and the controller's capability to handle the polling.

Issue Information needed for Integrating Access Expert BACnet objects into Continuum and EBO Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted EcoStruxure Building Operation Andover Continuum BACNet Cause BACnet objects from Access Expert may show in Andover Continuum, but will not function. An integration using EcoStruxure Building Operation is needed. Resolution BACnet objects from Access Expert may show in Continuum when a BACnet discovery is done, but they will not function.  An integration using EBO with a SmartConnector is required to use Access Expert BACnet objects. Further details on the EcoStruxure Access Expert Smartconnector are available from the Exchange Marketplace.  

Issue Examples of Permissions for specific actions needed for Access Expert Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause How to configure permissions in Access Expert for specific actions Resolution Permissions - Examples (User Groups)   Overview The Permission model in Keep is based on granular permissions at the API level. To review the Permissions basics, visit the User Group page. This article will break down permissions by the desired action within the Keep by Feenics application. *Note: The API level permissions mean that once permissions are set up in the windows client, they apply to the web client and mobile client.    Permissions Options The 5 options on individual permissions are listed below.   Create Read Update Delete Publish To ‘save’ a new object. To view existing objects. Once the object is created, changes can be made. To remove objects. Allows events related to the object to be published in the system. Example: publishing a pulse reader command requires the ability to Publish on that reader. Examples The examples listed below are showing the minimum requirements to do the action listed. To be able to do multiple actions, combine the listed permissions. How to log in to Instance Instance – Read   View Event History Event Message - Read    View Live Monitoring Event Message - Read   Acknowledge Events This permission group allows a user to view Live Monitor and Event History, open the Alarm, Acknowledge the Alarm, view the Person image associated with the alarm, and attach images to the alarm. Instance - Read Event Message – Read and Update Image - Read Person - Read Unlock Door Instance - Read User - Publish Controller - Read and Publish Downstream - Read and Publish Reader - Read and Publish Event Types: Mercury Commands - Unlock *Note: To Change the action allowed, simply change the Mercury Command allowed.   Update Reader Modes This permission group allows a user to view Live Monitor and Event History, open and modify reader modes. Instance - Read Event Message – Read Reader - Read, Update, Publish Add and Remove Linking Schedule - Read and Publish Add and Remove Linking Trigger - Read, Update, and Publish Add and Remove Linking on all object types. Procedure - Read, Update, and Publish Add and Remove Linking Downstream - Read and Publish Controller - Read and Publish Add and Remove Linking   To Add and Remove Favourites All Types - Add and Remove in Linking Column Add Widgets Keep Object - Read and Update Print Badges Badge type - Read Badge type field - Read (Note:If you are only allowing tagged badges, the badge type field must not have a tag associated). Image - Read Person - Read *Note: If the user needs to assign the badge type, then the "Add" column in the Linking section for Badge types must be selected on the Person permission.   To Play Sounds Image - Read Generic - Read Run "Access Request Report" (Reports on a persons access granted and denied events that day on ALL or specified  readers.) Instance - Read Person - Read Reader - Read Event Message - Read Access Rights for Person Report" or "Reader" Instance - Read Person - Read Reader - Read Event Message - Read Access levels - Read To view "Local Area's" Instance - Read Area - Read Controller - Read Person - Read To Add Admin HID Origo Mobile Credentials Advanced Actions "OrigoAdmin" Other permissions required will be dependent on other actions required for the user To View Elevator Floor Status Reader - Read Floor - Read   To Assign Elevator Floors to a Reader Reader - Read Floor - Read, Link Elevator Reader (add to add and remove to remove) Allow modifying objects with a specific Tag All Types – Read, Linking - Add, remove All Types - Read, Update, Delete, Publish, Linking - Add and Remove, Tags - specific desired tag Events - Desires Mercury/Bosch Commands Specify the desired tag in the Tags column. This permission group does not allow the group to ADD new objects simply modify or delete existing objecting with the specific tag.   Related articles:   Group Permissions  https://community.se.com/t5/Building-Automation-Knowledge/Access-Expert-User-Group-Permissions/ta-p/411404   Event History and Live Monitoring Site Permissions https://community.se.com/t5/Building-Automation-Knowledge/Access-Expert-Error-in-Live-Monitoring-document-while-trying-to/ta-p/411434  

  Issue Information needed to work with Access Expert Custom Forms Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause Access Expert Custom Form configuration Resolution Custom Forms Overview Forms can be designed and applied to maintain additional people & reader information outside of traditional documentation or notes. Unlimited customer forms/fields can be added to the system and associated with a person or reader. The layout of the forms can be built to accommodate customer needs and can even be segmented. A good practice is to group additional information into common groupings such as Car Information, Health Information or Department Information. This type of approach will make the data entry easier. Information captured in a Custom Form can also be searched on and reported on. Once a custom form is created it will be available for use from either the person menu or the reader menu. Custom fields can then be utilized for applications such as customizing people reports, capturing additional information about employees, doing system searches as well as badge designing.   New Custom Form To start creating a custom form: Select the ‘General Configuration’ Select "Custom Forms”. Click “Add Custom Form”. Choose which editor the form will apply Enter the name of the Custom Form in the Application Name. (OPTIONAL) Choose the casing for the form. This is only important when leveraging the API or LDAP integration. Click “Save” or “Save & Close”. Below is an example of a Custom Form that has been created. The header, fields, titles, and placement of information on the form is customizable by clicking, dragging and dropping. The initial series of editors that support the creation of the form are across the top of the screen. Add Text Box – Adds a free form text box. Add Combo Box – Adds a free form text box that allows for multiple pre-selected entries from a picklist. Add Date Time – Adds a time and date entry box. Add CheckBox – Adds a checkmark box. Add Group Box – Adds a split box where the top section can be used as a title then other fields can be added. Add Header – Adds a header field that can be used for a single line title. Group Box When one of the box types is added to the form, the Properties section can be used to apply additional information and modify the data as it resides in the box. Every Content field that is added to a Custom Form must have a name. In this example, we will add a Group Box to capture information about an employee. Clicking the ‘Add Group Box’ provided the initial field. The title was applied by clicking the blank box and adding the name in the Properties editor under Content. This information can also be positioned to the left, center, stretched or to the right. The overall box can be enlarged by clicking the perimeter and then dragging to the desired size. Text Box Additional fields of information can be added to the Group Box by clicking on the desired data field type and it is applied to the Group Box. To ensure the new field is added inside the perimeter of the Group Box make sure to click inside the Group Box prior to selecting the data field. The new field can be dragged into the Group Box if it is added outside the group box. Once the field is added to the Group Box the Properties editor will allow the same type of modifications to be made. Once the new blank field is added you can click into the Header field under Content to apply a descriptive name. This same process can be repeated to add as many fields as needed.   Combo Box A Combo Box is added to a Custom Form just like the other box types. With a Combo Box, the Properties editor will display a new field called Items. Clicking the “…” will allow the operator to add the information that will be available when data entry is being performed. The completed form will look like this from the custom data menu on the cardholder.

  Issue Information needed for using Mercury downstream controllers with Access Expert Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause List of Mercury downstream controller and configuration information Resolution Mercury Downstreams    Overview Mercury controllers are an open architecture controller made by Mercury Security. Access Expert supports the series 2 and series 3 SIO boards.   Controller Equivalent    Features FN-RIM1 MR50 Single-card reader interface panel and supports Wiegand, clock and data, magnetic stripe, F2F, Supervised F2F, OSDP, keypad, and biometrics reader technologies. FN-RIM2 MR52 The MR52 is a dual-card reader interface panel. Each unit can connect two card readers, eight general-purpose input monitor points and six control relays to any Mercury EP series intelligent controller. FN-16IN MR16IN The  MR16IN interface panel can support 16 general-purpose input circuits and two dedicated programmable relay outputs. FN-16OUT MR16OUT The MR16OUT interface panel provides 16 general-purpose outputs as Form C relay contacts. FN-MR51e MR51e The MR51e is a single-door, network-ready interface panel.     Adding Downstreams to Access Expert Disconnect the power supply from the downstream and the controller. Set the RS485 jumper to the 2 wire position. Wire the RS485 communication from the downstream to the controller. Downstream Controller TR+ CLK/Data1 TR- DAT/Data0 GND GND Apply power to the downstream and the controller. In Access Expert, from the top bar menu (located at the top left corner of the screen) click on the ‘View All Hardware’ button to open the 'Hardware tree'. In the 'Hardware Tree', double click on the controller or right-click and select ‘Open’ top open the controller page. Alternatively, click on the 'Hardware Provisioning' tab (located a the top of the screen) to open the menu. Click on the 'Controllers' icon(located to the left of the 'Hardware Provisioning' menu to open the 'Controllers' page). Double click or right-click and select 'Open' on the controller, to open that controllers 'Controller Configuration' page. Click on the ‘Add downstream’ button (located at the top of the controller page) to add a downstream. From the drop-down menu, select the appropriate downstream model. Enter a unique ‘Display Name’ for the downstream. Set the ‘Panel Address’ of the downstream. Example: To set devices address to 3, DIP switch 1 and 3 must be ON and 2,3 and 4 OFF and 'Panel Address' in Access Xpert must be set to 3. The DIP switches on the downstream must match the ‘Panel Address’ in the 'Downstream Configuration' page. Note: DIP switches 1 through 5 sets the device address of the downstream and is binary. DIP switch 1 = 1, DIP switch 2 = 2, DIP switch 3 = 4, DIP switch 4 = 8, DIP switch 5 = 16 Confirm that DIP switch 6 and 7 are in the ON position to enable for 38.400BPS communication. Leave DIP switch 8 in the OFF position. Click on the ‘Save’ button (located at the bottom of the page) to apply changes to the downstream.   Downstreams are added to Access Expert from the Controller page. When adding a downstream, you will need to select the downstream type from the drop-down list. If the downstream you are trying to add does not match one of the types listed, it is either not supported on that port or not supported by that controller.     Downstream Addressing Chart     Common Issues Issue                                             Solution The EP/LP1501 has no SIO port The EP/LP1501 uses the CLK and DATA on Reader 1 to communicate to downstreams. This means that if you are leveraging a downstream device, the EP/LP1501 only supports 1 onboard reader. My MR52 is toggling on and offline. The MR52 has a conflicting address with another downstream. Confirm your dipswitches are set to the correct address. Addressing is done on dipswitch 1-5 and baud rate is set on dipswitch 6 and 7 (suggested both on). Dipswitch 8 should always be off. J3 - The jumper for 2 wire and 4 wire RS-485 also needs to be set. By default is set to 2 and should not need changing but this does happen. J5 is the Termination jumper that needs to be set on the last unit in the series. My MR51e is programmed for Static IP but won't connect Check the dip switches on the board. Make sure the dip switches are set back to static IP mode after programming. Check to make sure the static IP address programmed in is valid. Make sure the Downstream can be seen by the controller. My downstream will not come online but my other downstream did. If you have a Mercury downstream on the same port as an Engage Gateway, the Mercury downstream will not be able to come online. Engage Gateway's and Mercury downstreams cannot share a port. Confirm the addressing on your downstream is correct.  My downstream device says "Timeout" This is due to incorrect addressing or incorrect baud rate set on the downstream. Dipswitches 1-5 set the address in a binary fashion and dipswitches 6 and 7 set the baud rate. We suggest leaving both 6 and 7 on. My downstream device says it is in "loader mode" and will not leave that mode Follow the steps below to correct the loader mode: Remove Power from the controller and downstreams Disconnect all downstreams from the controller Bulk Erase the controller. Once the controller is powered back on, reconnect the downstream that is in loader mode only. Reboot the controller.

  Issue List of Mercury Controller Types and Features Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause Mercury Controller Types and features to use with Access Expert Resolution Overview Mercury controllers are an open architecture controller made by Mercury Security. Feenics currently supports the LP series boards, the series 2 and series 3 MR SIO series boards.   Mercury Controllers   Equivalent Features FN-C1501 EP1501 The EP1501 is an intelligent controller that is expandable up to 8 downstream SIO controllers and up to 16 MR51e network-ready door controllers (for a total of 17 doors/openings). 240,000 Cardholders 50,000 Transaction buffer 32 Access Levels per cardholder 2 Onboard Readers 1 SIO bus (note: connects via Reader Port 1) FN-C3202 EP1502 The EP1502 is an intelligent controller for controlling two connected doors and managing up to 64 doors/openings. 240,000 Cardholders 50,000 Transaction buffer 32 Access Levels per cardholder 2 Onboard Reader Ports 1 SIO bus FN-C3200 EP2500 The EP2500 is an intelligent controller for managing up to 64 doors/openings. 600,000 Cardholders 50,000 Transaction buffer 32 Access Levels per cardholder 2 SIO Buses FN-C4502 EP4502 The EP4502 is an intelligent controller for controlling two connected doors and managing up to 64 doors/openings and complies with the BACnet standard. 2,000,000 Cardholders 50,000 Transaction buffer 32 Access Levels per cardholder 2 Onboard Readers 2 SIO Buses FN-LP1501 LP1501 The LP1501 is an intelligent controller that is expandable up to 8 downstream SIO controllers and up to 16 MR51e network-ready door controllers (for a total of 17 doors/openings). 240,000 Cardholders 50,000 Transaction buffer 255 Access Levels per cardholder Supports up to 130 inputs and 130 Outputs 2 Onboard Readers 1 SIO bus (note: connects via Reader Port 1) FN-LP3202 LP1502 The LP1502 is an intelligent controller for controlling two connected doors and managing up to 64 doors/openings. 240,000 Cardholders 50,000 Transaction buffer 255 Access Levels per cardholder Supports up to 520 inputs and 516 Outputs 2 Onboard Reader Ports 1 SIO bus FN-LP3200 LP2500 The LP2500 is an intelligent controller for managing up to 64 doors/openings. 600,000 Cardholders 50,000 Transaction buffer 255 Access Levels per cardholder Supports up to 1024 inputs and 1024 Outputs 2 SIO Buses FN-LP4502 LP4502 The EP4502 is an intelligent controller for controlling two connected doors and managing up to 64 doors/openings and complies with the BACnet standard. 2,000,000 Cardholders 50,000 Transaction buffer 255 Access Levels per cardholder Supports up to 1024 inputs and 1024 Outputs 2 Onboard Readers 2 SIO Buses FN-M5-IC M5-IC An intelligent control device for the replacement of the Casi PX, PXN and PXNplus CPU controller. The single controller supports up to 64 readers across multiple enclosures. 128 Access Levels per cardholder FN-M5-ICS M5-ICS A multi-device interface panel that is a direct retrofit of Software House’s Pro GCM module. A 64 reader capacity 600,000 Cardholders Mercury - PW6K1IC Prowatch 6000  The PW6K1IC is an intelligent controller that is expandable up to 8 downstream SIO controllers and up to 16 MR51e network-ready door controllers (for a total of 17 doors/openings). 15,000 Cardholders 10,000 Transaction buffer 32 Access Levels per cardholder   EP Controllers - End of Life  Feenics used to support the EP Series controllers, however, they have been replaced with the LP series. Related article - Updating Mercury Firmware https://community.se.com/t5/Building-Automation-Knowledge/Access-Expert-Updating-Firmware-on-an-SSC-or-Mercury-Controller/ta-p/410961  

Issue Metasys® N2 Integration to SBO Product Line EcoStruxure Building Operation Environment Struxureware Building Operation Metasys N2 Cause This Quick Start Guide will assist the Schneider Electric branch or dealer installation team with the basic steps to bring the virtual BACnet devices emulated by the S4 Open: BACnet-N2 Router into the SmartStruxure environment as part of a Johnson Controls Metasys® N2 integration into SBO. This document is not intended to be a full tutorial or user manual for either the S4 Open: BACnet N2 Router or the SmartStruxure system. Refer to the manufacturer’s documentation for each of these systems for detailed information. S4 documentation, the complete Device Template library, and support utilities can be found on the support CD delivered with your S4 Open appliance. Please contact the S4 group for any questions on this process.  Resolution Step 1:   Follow the installation instructions provided with the S4 Open: BACnet-N2 Router to discover and publish the N2 devices in the Metasys® installation to BACnet IP. All operations in SmartStruxure will be against these emulated BACnet IP devices each representing the underlying N2 device. Investigate before you integrate! Validate the N2 bus to make sure that it is electrically in spec and that all N2 devices are working properly before starting the integration process. Assign a unique BACnet virtual network number to each S4 Open: BACnet-N2 Router. N2 devices connected to this S4 Open appliance are published as emulated BACnet IP devices under that network. The Configure Wizard in the S4 Open Management Console will assist you with generating a unique BACnet Device ID for each N2 device. Point instance numbers are included as attributes in our Device Templates for all application-specific controllers. Either of these can be manually overridden in the S4 Open Management Console to meet unique requirements. The S4 Metasys® Configuration File Conversion Utility can be downloaded from the S4 Group web site and will assist you in creating custom Device Templates for DX-9100 devices or application-specific controllers. You will need the corresponding .DMO or .PRN files as input to this utility. A detailed understanding of Metasys® N2 devices, the Metasys® system, and the associated configuration and commissioning utilities are necessary to support successful integrations. If you don’t have this expertise in-house, The S4 Group can recommend a consultant to assist you. NOTE: We highly recommend that you attend a two-day S4 Boot Camp to make sure that you have all the skills necessary to install and configure the S4 Open: BACnet-N2 Router. Step 2: Bring up the SmartStruxure BACnet discovery tab and select BACnet devices. In this example, you can see that the S4 Open BACnet-N2 Router was defined in Network 1 and the N2 devices are in Network 122. The other device in Network 1 in this example is a JCI NAE. The best practice is to assign the S4 Open: BACnet-N2 Router to the BACnet network that you are using as your BACnet backbone. As with any BACnet device, the BACnet-N2 Router must be assigned a unique BACnet device ID. Step 3: Expand the navigation pane to expose the BACnet Interface / IP Network folder. Then select and drag the N2 devices from the Device Discovery tab to the IP Network folder. SmartStruxure will tell you that an Upload is required. Respond OK. Step 4: Navigate to the IP Network folder, select the properties page for each device, and request an Upload operation. This will bring the device properties and point list for each N2 device into SmartStruxure. SmartStruxure will respond with the following confirmation as each upload is completed. Step 5: When the Upload process is completed for all N2 devices and the S4 Open: BACnet-N2 Router, you can continue your SmartStruxure installation process as you would for any BACnet device. Note that there will be no points published under the S4 Open: BACnet-N2 Router itself but you will be able to confirm the Operational Status of the system from SmartStruxure. The Schneider Electric support organization will supply pre-sales engineering support and first-level technical support for the Metasys® N2 to SBO integration solution. The S4 Group will be available to provide 2nd level support to these integration projects.  

Warning   Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Issue Using sensors, other than the D?T range in a Sigma controller Product Line Satchwell Sigma Environment Sigma Release 4_05-SEB (Build 3_43_18) Sigma Release 4_05-SP2 (Build 3_42_48) Sigma Release 4_06 (Build 3_44_14) Sigma Release 4_06 SP1 (Build 3_44_16) Sigma Release 4_07 (Build 3_45_48) Sigma Release 4_07-SP1 (Build 3_45_51) Sigma Release 4_07-SP2 (Build 3_45_58) Sigma Release 4_08 (Build 3_46_57) Cause Using 10k Type 2 and type 3 Thermistor causes hardware alarm Resolution The lookup value for a Sigma resistance input is calculated as a percentage of a 2 volt signal (that's what is measured at the A/D convertor). If using a sensor other than a standard D?T range sensor, a calculation needs to made, to obtain the value to be entered in the input column (a % of 2 volts) of the look up table.   The calculation is as follows: - ( 10^6 * R1 )      /4000 ( 14700 + R1 ) Where R1 = resistance of the input 14700 =resistor on AI card The circuit shown below is a typical example of an AI channel for a resistance input.     It is suggested to put a 10K resistor in parallel therefore, the resulting circuit resistance can never be higher than 10K.   Attached is information for both the 10K type 2 and 10K type 3 sensors. Column C is the raw sensor resistance. Column D is the controller input resistance with a 10K shunt resistor connected. Column E and F example of the look up table.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Bringing a MicroNet LON controller/network into EcoStruxure Building Operation Product Line Satchwell MicroNet Environment Satchwell MicroNet MNN-30-100 Satchwell MicroNet MNN-44-100 Satchwell MicroNet MNN-50-100 Satchwell MicroNet MNN-62-100 Satchwell MicroNet MNL-C Cause Satchwell MicroNet 100 series LON networks are not supported in EcoStruxure Building Operation as a MicroNet LON network Resolution From the introduction of the MicroNet 50 series range in 2008, the MicroNet 100 series controllers with LON cards has no longer been supported and the MicroNet LON network is not supported in EcoStruxure Building Operation. Workaround: The MicroNet 100 series LON controllers can be bound to a standard LON network, using a third party network management tool such as LonMaker®  for Windows®  from Echelon. The complete MicroNet LON network could then be brought into an AS-P as a standard LON network. If this is not possible, the supported option to bring the MicroNet 100 series controllers into an AS-P or Enterprise server (ES) would be to remove the LON cards, from the MicroNet 100 series controllers and convert them to use an NCP network. The top two pairs of pins of the auxiliary card plug, would need the jumpers restored. The LON network cabling may need to be changed for a RS 484 compatible type, such as Belden 8762 or equivalent. The controller’s program would need to be re-configured for NCP using VisiSat. Then the MicroNet controller network can be imported into the AS-P, under a MicroNet NCP interface. If the LON network contains MicroNet LON touchscreens, these cannot be converted to NCP and would need to be removed from the NCP network.   The MicroNet 100 series data sheets are available here https://community.se.com/t5/Building-Automation-Knowledge/MicroNet-100-series-controller-MLi-s-and-Data-sheets/ta-p/6784   VisiSat 2.1 Build 196 – Software is available here https://ecoxpert.se.com/search?documentUUID=c93346a7-9d82-48e7-9b54-a866ac75bb71&title=VisiSat%202.1%20Build%20196%20-%20Software   VisiSat Release 2.1.196 Service Pack 1 https://ecoxpert.se.com/search?documentUUID=fd2e9849-1ffe-4c10-b3a6-5f27bac91870&title=VisiSat%20Release%202.1.196%20Service%20Pack%201%20(2.1.200)%20-%20Software   VisiSat Release 2.1.196 Service Pack 2 https://ecoxpert.se.com/search?documentUUID=839c09d2-400d-4434-8b1e-97f339545034&title=VisiSat%20Release%202.1.196%20Service%20Pack%202%20(2.1.201)%20-%20Software

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Issue Need to replace an AVUE, AVUX or AVUM Mark 5 Actuator Product Line Field Devices Environment AVUE5305 AVUE5355 AVUE5304 AVUE5354 AVUX5202 AVUM5601 Cause Need to find a replacement for the obsolete AVUE, AVUX or AVUM Mark 5 actuator, that will allow the valve to be retained. Resolution The AVU* Mark 5 range of actuators can be replaced from the MZ300S range. AVUE5305 replace with MZ300S-24M AVUE5355 replace with MZ300S-24M AVUE5304 replace with MZ300S-24M AVUE5354 replace with MZ300S-24M AVUX5202 replace with MZ300S-24F AVUM5601 replace with MZ300S-230F The AVUE, AVUX, AVUM Mk 5 Datasheet is attached   MZ300S Specification sheet   MZ300S-24M Installation Instructions MZ300S-24F Installation Instructions   MZ300S-230F Installation Instructions

Issue Access Expert Integration Setup with Microsoft Active directory Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Microsoft Active Directory Resolution Overview The Feenics Appliance by Feenics runs the Feenics Active Directory Service. This service allows for secure communication between Active Directory Servers and Access Expert. The service is installed on the appliance by Feenics and is ready to use upon arrival.">The Feenics Appliance by Feenics runs the Feenics Active Directory Service. This service allows for secure communication between Active Directory Servers and Access Expert. The service is installed on the appliance by Feenics and is ready to use upon arrival. How to set up the Appliance The appliance is ready to use out of the box. Feenics will supply the password to log onto your appliance once you receive it. The appliance will need to communicate outbound over port 443 to https://api.Feenics.com  in order for the service to reach your instance in Keep by Feenics. The appliance will also need to have inbound and outbound communication to your Active Directory Server. The default ports used for this communication are either port 389 or 636 depending on if SSL is used. Why an Appliance The nature of Active Directory requires Access Expert to access the Domain Controller for Access Directory. For security purposes, Feenics has created an appliance that communicates via the LDAP protocol on the internal network and then makes outbound calls to the Feenics API server in AWS. What is on my Appliance Feenics installs 2 things on your Windows 10 appliance, the Active Directory Service and the logging software for the appliance: Active Directory Service SEQ Logs The LDAP Service is installed on the C:\\ drive of the appliance. The files will reside within the C:\Program Files (x86)\Feenics\Active Directory Service folder. It is important to not modify or alter this folder in any way. If you open your 'Services' from the windows key you will see the status of the Feenics Active Directory Service. The Active Directory service is designed to interface with 1 (one) Keep Instance. We install SEQ logs to allow the collection of a structured log of all events from the service. In most cases, these events are not needed or reviewed, however, in the case of an issue these logs provide critical information for Feenics to diagnose the problem. To access your SEQ logs, open Internet Explorer and enter the web address HTTP://localhost:5341    Active Directory Requirements Active Directory user that has appropriate read permissions on the sections you wish to pull data from. The local network must allow the Active Directory to connect to the appliance. The Active Directory Appliance must be able to connect to "https://api.Feenics.com" on port 443. Active Directory Service The Active Directory Service has the last ping associated with the Keep by Feenics UI. Open the LDAP Agent to see the most recent ping to confirm that the Active Directory Appliance is talking to the Keep Server. To check the Active Directory Service, Navigate to the General Configuration tab, select LDAP Agents Service, open one of the LDAP Agents, and view the Last Ping at the top of the page next to the user drop-down menu. This last ping shows the last communication between the Active Directory service and Keep by Feenics. Active Directory Agent The Active Directory Service will need to talk to the appliance.  When adding the LDAP Query, the IP address of the Domain Controller, the password for the panel, and port for communication will need to be specified. No two installations of the LDAP module will be the same, so it is important to work with the customer IT support team. Adding an LDAP Agent Navigate to the General Configuration tab and select LDAP Agents from the sub-menu. This will open a new tab with the LDAP Agents window. From the top left of the page, you can select the 'Add LDAP Agent’. Give the Agent a Display name. Assign an LDAP User. Click ‘OK’. This will add the Agent to the list of LDAP Agents. Double click to open the Agent and to add a query. The new LDAP Agent will need to have all the information filled out. See the above section for detailed information on each section. LDAP Query Once the LDAP Agent is created, the LDAP Query will need to be created to indicate the AD being connected to, the authentication, and the mapping required. The minimum required fields are: Display Name of LDAP Query. Person Mapping Display Name. First Name. Last Name. The LDAP Query is composed of Instance: This is the instance that the Query will reside it. This is used in enterprise instances where the query may populate a shared instance. Display Name: The name of the Query that is used throughout the instance. Username: The username that will authenticate to the AD domain controller. Password: The password associated with the username to authenticate to the AD domain controller. Host Name: The hostname or IP address of the AD domain controller. Bind Path: This is a path that limits the search within AD. This is not required but can be used to limit the query to only search a certain subset of data. Port: The port that connection will be made (selecting SSL will change the port). Query: The specific requirements that a record must meet in order to be returned. Frequency: The time in seconds between syncs. Disable: Turns off the Query. Directory Sync: Changes the Sync type to Directory Synchronization. Use SSL: Turns on or off SSL. Preserve Cards: By default, Keep turns off all assigned cards to a cardholder if they are disabled in AD. This can be overridden by checking this box. Person Mapping & Common AD References used by Keep. Note: All AD installations are different, and these examples may not accurately represent your mapping requirements. Display Name: cn First Name: givenname Last Name: sn Email: mail Home Address: true Home Phone: homephone Work Phone: telephonenumber Mobile: mobile Identification Photo: thumbnailphoto Badge Type: title Mapping Custom Forms Create a custom form. Add a new field which matches the fieldname from Active Directory. Within the AD Person mapping, add custom form. (OPTIONAL) If you are querying based on this information, ensure the field names match exactly within the query. **If your custom form was created using Pascal Case (default) then your query fieldname requires an uppercase leading character. i.e. if the AD field is ’employeeID’ the custom form field should read ‘EmployeeID’. USNChanged When a domain controller modifies an object, it sets that object's uSNChanged attribute to a value that is larger than the previous value of the uSNChanged attribute for that object and larger than the current value of the uSNChanged attribute for all other objects held on that domain controller. An application can find the most recently changed object on a domain controller by finding the object with the largest uSNChanged value. The second most recently changed object on a domain controller will have the second-largest uSNChanged value and so on. Our LDAP service keeps track of the most recent uSNChanged attribute that it has assessed and compares that when it runs its query to check if there is anything new or changed that it must import. However, the uSNChanged attribute is not replicated, therefore reading an object's uSNChanged attribute at two different domain controllers will typically give different values. Therefore, to use this method effectively we must bind to a controller to ensure we are not missing anything. If there is a load balancing operation that prevents binding to a controller then it would be better to set up the service to use Directory Synchronization. Directory Synchronization (DirSync) When you perform a DirSync search, you pass in a provider-specific data element (cookie) that identifies the directory state at the time of the previous DirSync search. For the first search, you pass in a null/blank cookie and the search returns all objects that match the filter. The search also returns a valid cookie and stores the cookie in the same storage that you are synchronizing with the Active Directory server. On subsequent searches, the cookie will be retrieved from storage and passed with the search request. The search results should now include only the objects and attributes that have changed since the previous state identified by the cookie. The search always returns a new cookie to store for the next search. Our LDAP service, when using DirSync, stores the cookie in the LDAP Query as Metadata. It is a good idea to initialize the DirSync with a very general query as the more the initialization finds the more items will be tracked moving forward. The way we have set up the LDAP DirSync is to find all the interesting objects rebind to them and ensure all the needed information is caught (we do not want to think a security roll has been removed which is our default if we can not find one in the changeset) and that it is a valid item we are searching for (initialized generally). The DirSync control is powerful, but has two significant limitations: Only for highly privileged applications: To use the DirSync control, an application must run under an account that has the SE_SYNC_AGENT_NAME privilege on the domain controller (Domain Administrator and higher). Few accounts are so highly privileged, so an application that uses the DirSync control cannot be run by ordinary users. No subtree scoping: The DirSync control returns all changes that occur within a naming context. An application interested only in changes that occur in a small subtree of a naming context must wade through many irrelevant changes, which is inefficient both for the application and for the domain controller. Example Queries objectClass=user – This query looks for all users within Active Directory. (&(ObjectClass=Person)(employeeID=ps*)) – This query looks for all Persons in Active Directory with an employee ID that starts with “ps”. (&(ObjectClass=Person)(givenname=A*)) – This query returns all Persons in Active Directory with a first name that starts with “A” (&(ObjectClass=Person)(givenname=A*)(|(department=Engineering)(department=Sales))) – This query returns all Persons in Active Directory with a first name that starts with “A” and is in either the Sales or Engineering departments. (objectClass=user)( mail=*@mail.gov)(userAccountControl=512) – This query returns all users in AD with an email at the ‘mail.gov’ domain and whose account status is normal. (&(objectClass=User)(employeeID=*)(displayName=*)(division=*)(!(principalAccount=*))(userAccountControl=512)) – This query returns all users with an employee ID, display name and division who are not a principal account and whose account is normal. (&(ObjectClass=Person)(|(company=CompanyA)(company=CompanyB)) – This query returns all people in Active Directory that work for Company A or Company B. (objectClass=user)(mail=*@mail.com) – This query returns all users in Active Directory that have an email at the ‘mail.com’ domain. (&(&(&(objectCategory=person)(objectClass=user)(employeeID=*)(| (division=1)(division=2)(division=3)(division=4) )))) ))) – This query returns all Persons in Active Directory with a user account, an assigned employee ID and are in division 1, 2, 3, or 4. Common Issues Issue Fix My LDAP Sync is pulling in people with no information Confirm you have completed the person mapping from within the LDAP Query window. If the person mapping is blank, the information has not been assigned a field within Keep. My LDAP Agent ping is recent but my last sync time on the query is not. Check your query frequency and confirm that the frequency is set to the expected value and that the last sync is within that time frame. Note: The frequency is in seconds. My query is returning zero results. Check your query spelling and formatting. A single parenthesis can change the query. Check to make sure the user given in the query that is logging into Active Directory has the proper permissions to read the information being queried. I am having trouble and have checked everything else. Check the SEQ logs at HTTP://localhost:5341  to see if any errors are being reported. For help writing a query see SEQ help site at HTTP://docs.getseq.net/docs  My query was working but stopped recently. Check to make sure no users have modified the query accidentally via the Audit Logs. Check with IT to make sure no network changes have been made recently. Even small changes can have big impacts.  

  Issue Access Expert Information is needed for Elevator Access Levels Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause Access Expert Elevator Access Level configuration information  Resolution Overview The Elevator Access Levels are used to determine when a person can access certain floors. Floors can be assigned scheduled access within the Elevator Access Level to determine what floors a person has permissions to gain access to.   Elevator Access Levels Elevator Access Levels use the same Schedules as other aspects of the Keep system. Floors can be added by individual numbers or by groups of numbers with a “-“ between them.  It is important to note that People are not added to the Elevator Access Level. People are added to the Access Level for either traditional reader-controlled points such as doors or gates while at the same time being granted access to the reader controlling elevator access. This approach means that management of where and when a person can go places can all be controlled from one page.   Creating Elevator Access Levels To create a new Elevator Access Level: Select the ‘Access Configuration’ tab. Choose the “Elevator Access” button From the menu. Click “Add Elevator Access Level”. Enter a Display Name. (OPTIONAL) Select a Default Reader Mapping. Select “Add Elevator Floor Entry”. Select a Schedule. Enter the desired Floor Numbers. Click “Save” or “Save & Close”.   The Default Reader Mapping will apply the floor names assigned at the Elevator Reading Page to all readers that use the Elevator Access Level. This also allows for the selection of floors for the Elevator Access Level based on the named floors.   To Assign an Elevator Access Level: Select the ‘Access Configuration’ tab. Select “Access Levels” from the Menu. Open the desired Access Level. Select “View Elevator Access”. Click “Add Elevator Access Level Entry”. Choose an Elevator Access Level & associated Elevator Reader.  Click “Save” or “Save & Close”.   It is important to note the flow of the different type of Access Levels: Elevator Access Levels are applied to Access Levels. Access Levels are applied to People.

Issue Port information is needed for Access Expert Visitor Management Integrations   Product Line EcoStruxure Access Expert   Environment Access Expert V3 Hosted   Cause LAN port requirements for each VMS integration   Resolution   Overview The VMS connection is an important step to the setup of your VMS. Below is a chart of supported VMS and required ports. This article is valid as of 15 November 2019. It should also be noted that many of the VMS allow for the customization of ports and that is not be accounted for in this article.    Ports OpenEye Port Usage  80 TCP 2000 TCP Center/Command Incoming Port 2002 TCP Video/Image Incoming Port 2003 TCP Search Incoming Port 9876 TCP Clip Backup Incoming Port 3100 TCP 4007 TCP Live Incoming port 80 TCP 443 TCP 3478 TCP 1024-655335 In/Out Range Outgoing Ports 3001 TCP 4006 TCP DVR Incoming Port ExacqVision Port Usage 80 excaqVision Web Service (customizable) 8082 excaqVision Web Service - Web Socket (customizable) 22609 exacqVision Client computers communicating with exacqVision servers. Default port 22609.   Milestone Milestone maintains its own knowledge base with an article on ports. Management Server service and related processes Port number Protocol Process Connections from... Purpose 80 HTTP IIS All XProtect components Main communication, for example, authentication and configurations. 443 HTTPS IIS XProtect Smart Client and Management Client Authentication of basic users. 6473 TCP Management Server service Management Server tray controller, local connection only Showing status and managing the service. 7475 TCP Management Server service Windows SNMP service Communication with the SNMP extension agent. Do not use the port for other purposes even if your system does not apply SNMP. In XProtect Advanced VMS 2014 systems and older, the port number was 6475. 8080 TCP Management Server Local connection only Communication between internal processes on the server. 8080 TCP Management Server Local connection only Communication between internal processes on the server. 9000(*) HTTP Management Server Recording Server Services Web service for internal communication between servers. 9993 TCP Management Server service Recording Server services Authentication, configuration, token exchange. 12345 TCP Management Server service XProtect Smart Client Communication between the system and Matrix recipients. You can change the port number in the Management Client.    Recording Server service Port number Protocol Process Connections from... Purpose 25 SMTP Recording Server service Cameras, encoders, and I/O devices Listening for event messages from devices. The port is disabled by default. 5210 TCP Recording Server service Failover Recording Servers Merging of databases after a Failover Recording Server has been running. 5432 TCP Recording Server service Cameras, encoders, and I/O devices Listening for event messages from devices. 7474 TCP Recording Server service Windows SNMP service Communication with the SNMP extension agent. Do not use the port for other purposes even if your system does not apply SNMP. In XProtect Advanced VMS 2014 systems and older, the port number was 6474. 7563 TCP Recording Server service XProtect Smart Client, Management Client Retrieving video and audio streams, PTZ commands. 8966 TCP Recording Server service Recording Server tray controller, the local connection only Showing status and managing the service. 9001(**) HTTP Recording Server service Management Server Web service for internal communication between servers. Note: Every Recording Server service needs a port. Additional ports will be 9002, 9003, and so on. 11000 TCP Recording Server service Failover Recording Servers Polling the state of the Recording Servers. 65101 UDP Recording Server service Local connection only Listening for event notifications from the drivers.   Client components (outbound connections) XProtect Smart Client, XProtect Management Client, Milestone Mobile server, Log Server Port number Protocol Connections to... Purpose 80 HTTP Management Server service Authentication 443 HTTPS Management Server service Authentication of basic users. 7563 TCP Recording Server service Retrieving video and audio streams, PTZ commands. 22331 TCP Event Server service Alarms. 22337 TCP Log Server Server Logs (System, Audit, Rule-triggered)   Web Client, Milestone Mobile client Port number Protocol Connections to... Purpose 8081 HTTP Milestone Mobile Server Retrieving video and audio streams. 8082 HTTPS Milestone Mobile Server Retrieving video and audio streams.   DataCollector Port number Protocol Connections to... Purpose 7609 TCP Recording Server Collecting data   Avigilon Port number Protocol Connections to... 50080 HTTPS Server 55080 HTTP Default Camera Device Port 80 HTTP Streaming / Configuration 443 HTTPS Streaming / Configuration   Salient CompleteView Port number Connections to... 80   6970-7225 Completeview Server for cameras using General RTSP/UDP 4242 Data 4243 Command 4250 Config Server 4255 Admin Service 4502-4534 Webserver (optional)   Wavestore The default connect port is 8601. This is configurable.