Axis A1210 User manual

AXISA1210NetworkDoorController
AXISA1210-BNetworkDoorController
UserManual

TableofContents
Solutionoverview...........................................3
Getstarted................................................5
Findthedeviceonthenetwork....................................5
Openthedevice'swebpage.......................................5
Setanewpasswordfortherootaccount............................5
Securepasswords...............................................5
Verifythatnoonehastamperedwiththermware....................6
ebpageoverview..............................................6
Congureyourdevice........................................7
Thedeviceinterface.........................................8
Status........................................................8
Accesscontrol..................................................9
System........................................................9
Maintenance...................................................18
Learnmore................................................19
Security.......................................................19
Specications..............................................20
Productoverview................................................20
RequirementsforcompliancewithUL294...........................20
LEDindicators..................................................23
Buttons.......................................................23
Connectors....................................................24
Troubleshooting............................................29
Resettofactorydefaultsettings...................................29
Firmwareoptions...............................................29
Checkthecurrentrmwareversion.................................29
Upgradethermware............................................29
Technicalissues,clues,andsolutions................................30
Contactsupport.................................................31
2

Solutionoverview
Solutionoverview
ThenetworkdoorcontrollercaneasilybeconnectedtoandpoweredbyyourexistingIPnetworkwithnoneedforspecialcabling.
3

Solutionoverview
Eachnetworkdoorcontrollerisanintelligentdevicethatiseasilymountedclosetoadoor.Itcanpowerandcontroluptotworeaders.
4

Getstarted
Getstarted
Findthedeviceonthenetwork
TondAxisdevicesonthenetworkandassignthemIPaddressesinindows®,useAXISIPUtilityorAXISDeviceManager.Both
applicationsarefreeandcanbedownloadedfromaxis.com/support.
FormoreinformationabouthowtondandassignIPaddresses,gotoHowtoassignanIPaddressandaccessyourdevice.
Browsersupport
Youcanusethedevicewiththefollowingbrowsers:
ChromeTMFirefox®EdgeTMSafari®
indows®recommendedrecommended
macOS®recommendedrecommended
Linux®recommendedrecommended
Otheroperatingsystems*
*TouseAXISOSwebinterfacewitiOS15oriPadOS15,gotoSettings Settings
Settings> > >Safari Safari Safari> > >Advanced Advanced Advanced> > >Experimental Experimental ExperimentalFeatures Features Featuresanddisable
NSURLSessionWebsocket.
Ifyouneedmoreinformationaboutrecommendedbrowsers,gotoAXISOSPortal.
penthedevice'swebpage
1.OpenabrowserandtypetheIPaddressorhostnameoftheAxisdevice.
IfyoudonotknowtheIPaddress,useAXISIPUtilityorAXISDeviceManagertondthedeviceonthenetwork.
2.Typetheusernameandpassword.Ifyouaccessthedeviceforthersttime,youmustsettherootpassword.SeeSetanew
passwordforterootaccountonpage5.
Setanewpasswordfortherootaccount
Thedefaultadministratorusernameisroot.There’snodefaultpasswordfortherootaccount.Yousetapasswordtherst
timeyoulogintothedevice.
1.Typeapassword.Followtheinstructionsaboutsecurepasswords.SeeSecurepasswordsonpage5.
2.Retypethepasswordtoconrmthespelling.
3.ClickAdduser.
Important
Ifyoulosethepasswordfortherootaccount,gotoResettofactorydefaultsettingsonpage29andfollowtheinstructions.
Securepasswords
Important
Axisdevicessendtheinitiallysetpasswordincleartextoverthenetwork.Toprotectyourdeviceaftertherstlogin,set
upasecureandencryptedHTTPSconnectionandthenchangethepassword.
5

Getstarted
Thedevicepasswordistheprimaryprotectionforyourdataandservices.Axisdevicesdonotimposeapasswordpolicyasthey
maybeusedinvarioustypesofinstallations.
Toprotectyourdatawestronglyrecommendthatyou:
•Useapasswordwithatleast8characters,preferablycreatedbyapasswordgenerator.
•Don’texposethepassword.
•Changethepasswordatarecurringinterval,atleastonceayear.
Verifythatnoonehastamperedwiththermware
TomakesurethatthedevicehasitsoriginalAxisrmware,ortotakefullcontrolofthedeviceafterasecurityattack:
1.Resettofactorydefaultsettings.SeeResettofactorydefaultsettingsonpage29.
Afterthereset,securebootguaranteesthestateofthedevice.
2.Congureandinstallthedevice.
Webpageoverview
Thisvideogivesyouanoverviewofthedeviceinterface.
Towatchthisvideo,gotothewebversionofthisdocument.
elp.axis.com/?&piaId=74266&section=webpage-overview
Axisdevicewebinterface
6

Configureyourdevice
Configureyourdevice
Forhowtocongureyourdevice,seeAXISCameraStationusermanualorthird-partysolutions.
7

Thedeviceinterface
Thedeviceinterface
Toreachthedeviceinterface,typethedevice’sIPaddressinawebbrowser.
Note
Supportforthefeaturesandsettingsdescribedinthissectionvariesbetweendevices.
Showorhidethemainmenu.
Accesstheproducthelp.
Changethelanguage.
Setlightthemeordarktheme.
Theusermenucontains:
•Informationabouttheuserwhoisloggedin.
•Changeuser:Logoutthecurrentuserandloginanewuser.
•Logout:Logoutthecurrentuser.
Thecontextmenucontains:
•Analyticsdata:Accepttosharenon-personalbrowserdata.
•Feedback:Shareanyfeedbacktohelpusimproveyouruserexperience.
•Legal:Viewinformationaboutcookiesandlicenses.
•About:Viewdeviceinformation,includingrmwareversionandserialnumber.
•Legacydeviceinterface:Changethedeviceinterfacetothelegacydeviceinterface.
Status
TPsync
ShowsNTPsynchronizationinformation,includingifthedeviceisinsyncwithanNTPserverandthetimeremaininguntil
thenextsync.
TPsettings:ClicktogototheDateandtimepagewhereyoucanchangetheNTPsettings.
Deviceinfo
Showsdeviceinformation,includingrmwareversionandserialnumber.
Upgradermware:ClicktogototheMaintenancepagewhereyoucandoarmwareupgrade.
8

Thedeviceinterface
Accesscontrol
Alarms
Devicemotion:Itisenabledbydefaulttotriggeranalarminyoursystemwhendevicemotionofthedoorcontrollerisdetected.
Casingopen:Itisenabledbydefaulttotriggeranalarminyoursystemwhencasingopenofthedoorcontrollerisdetected.
Externaltamper:Itisnotenabledbydefault.Turnontotriggeranalarminyoursystemwhenexternaltamperisdetected.
Forexample,whentheexternalcabinetisopenedorclosed.
•Supervisedinput:Turnontomonitortheinputstateandconguretheend-of-lineresistors.
-Touseparallelrstconnection,selectParallelrstconnectionwitha22KΩparallelresistoranda4.7
KΩserialresistor.
-Touseserialrstconnection,selectSerialrstconnectionandselectaresistorvaluefromtheResistor
valuesdrop-downlist.
Peripherals
Upgradereaders:Clicktoupgradereaderstoanewrmwareversion.Onlysupportedreaderscanbeupgradedwhentheyare
online.
System
Dateandtime
Thetimeformatdependsonthewebbrowser’slanguagesettings.
Note
erecommendyoutosynchronizethedevice’sdateandtimewithanNTPserver.
Synchronization:Selectanoptionforsynchronizingthedevice’sdateandtime.
•Automaticdateandtime(manualTSKEservers):SynchronizewiththesecureNTPkeyestablishmentservers
connectedtotheDHCPserver.
-ManualTSKEservers:EntertheIPaddressofoneortwoNTPservers.henyouusetwoNTPservers,
thedevicesynchronizesandadaptsitstimebasedoninputfromboth.
•Automaticdateandtime(TPserversusingDHCP):SynchronizewiththeNTPserversconnectedtotheDHCPserver.
-FallbackTPservers:EntertheIPaddressofoneortwofallbackservers.
•Automaticdateandtime(manualTPservers):SynchronizewithNTPserversofyourchoice.
-ManualTPservers:EntertheIPaddressofoneortwoNTPservers.henyouusetwoNTPservers,the
devicesynchronizesandadaptsitstimebasedoninputfromboth.
•Customdateandtime:Manuallysetthedateandtime.ClickGetfromsystemtofetchthedateandtimesettings
oncefromyourcomputerormobiledevice.
Timezone:Selectwhichtimezonetouse.Timewillbeautomaticallyadjustedfordaylightsavingtimeandstandardtime.
Note
Thesystemusesthedateandtimesettingsinallrecordings,logsandsystemsettings.
Network
IPv4
9

Thedeviceinterface
AssignIPv4automatically:SelecttoletthenetworkrouterassignanIPaddresstothedeviceautomatically.erecommend
automaticIP(DHCP)formostnetworks.
IPaddress:EnterauniqueIPaddressforthedevice.StaticIPaddressescanbeassignedatrandomwithinisolatednetworks,
providedthateachaddressisunique.Toavoidconicts,werecommendyoutocontactyournetworkadministratorbeforeyou
assignastaticIPaddress.
Subnetmask:Enterthesubnetmasktodenewhataddressesareinsidethelocalareanetwork.Anyaddressoutsidethelocal
areanetworkgoesthroughtherouter.
Router:EntertheIPaddressofthedefaultrouter(gateway)usedtoconnectdevicesthatareattachedtodifferentnetworksand
networksegments.
IPv6
AssignIPv6automatically:SelecttoturnonIPv6andtoletthenetworkrouterassignanIPaddresstothedeviceautomatically.
Hostname
Assignhostnameautomatically:Selecttoletthenetworkrouterassignahostnametothedeviceautomatically.
Hostname:Enterthehostnamemanuallytouseasanalternativewayofaccessingthedevice.TheHostnameisusedintheserver
reportandinthesystemlog.AllowedcharactersareA–Z,a–z,0–9and-.
DSservers
AssignDSautomatically:SelecttoletthenetworkrouterassignsearchdomainsandDNSserveraddressestothedevice
automatically.erecommendautomaticDNS(DHCP)formostnetworks.
Searchdomains:henyouuseahostnamethatisnotfullyqualied,clickAddsearchdomainandenteradomaininwhichto
searchforthehostnameusedbythedevice.
DSservers:ClickAddDSserverandentertheIPaddressoftheDNSserver.ThisprovidesthetranslationofhostnamestoIP
addressesonyournetwork.
HTTPandHTTPS
Allowaccessthrough:SelectifauserisallowedtoconnecttothedevicethroughtheHTTP,HTTPS,orbothHTTPandHTTPS
protocols.
HTTPSisaprotocolthatprovidesencryptionforpagerequestsfromusersandforthepagesreturnedbythewebserver.The
encryptedexchangeofinformationisgovernedbytheuseofanHTTPScerticate,whichguaranteestheauthenticityoftheserver.
TouseHTTPSonthedevice,youmustinstallanHTTPScerticate.GotoSystem>Securitytocreateandinstallcerticates.
Note
IfyouviewencryptedwebpagesthroughHTTPS,youmightexperienceadropinperformance,especiallywhenyou
requestapageforthersttime.
HTTPport:EntertheHTTPporttouse.Port80oranyportintherange1024-65535areallowed.Ifyouareloggedinasan
administrator,youcanalsoenteranyportintherange1-1023.Ifyouuseaportinthisrange,yougetawarning.
HTTPSport:EntertheHTTPSporttouse.Port443oranyportintherange1024-65535areallowed.Ifyouareloggedinasan
administrator,youcanalsoenteranyportintherange1-1023.Ifyouuseaportinthisrange,yougetawarning.
Certicate:SelectacerticatetoenableHTTPSforthedevice.
etworkdiscoveryprotocols
10

Thedeviceinterface
Bonjour®:Turnontoallowautomaticdiscoveryonthenetwork.
Bonjourname:Enterafriendlynametobevisibleonthenetwork.ThedefaultnameisthedevicenameandMACaddress.
UPnP®:Turnontoallowautomaticdiscoveryonthenetwork.
UPnPname:Enterafriendlynametobevisibleonthenetwork.ThedefaultnameisthedevicenameandMACaddress.
WS-Discovery:Turnontoallowautomaticdiscoveryonthenetwork.
One-clickcloudconnection
One-clickcloudconnection(O3C)togetherwithanO3Cserviceprovideseasyandsecureinternetaccesstoliveandrecordedvideo
fromanylocation.Formoreinformation,seeaxis.com/end-to-end-solutions/osted-services.
AllowO3C:
•One-click:Thedefaultsetting.PressandholdthecontrolbuttononthedevicetoconnecttoanO3Cserviceoverthe
internet.YouneedtoregisterthedevicewiththeO3Cservicewithin24hoursafteryoupressthecontrolbutton.
Otherwise,thedevicedisconnectsfromtheO3Cservice.Onceyouhaveregisteredthedevice,Alwaysisenabledand
thedevicestaysconnectedtotheO3Cservice.
•Always:ThedeviceconstantlyattemptstoconnecttoanO3Cserviceovertheinternet.Onceyouhaveregisteredthe
device,itstaysconnectedtotheO3Cservice.Usethisoptionifthecontrolbuttononthedeviceisoutofreach.
•o:DisablestheO3Cservice.
Proxysettings:Ifneeded,entertheproxysettingstoconnecttotheproxyserver.
Host:Entertheproxyserver’saddress.
Port:Entertheportnumberusedforaccess.
LoginandPassword:Ifneeded,enterusernameandpasswordfortheproxyserver.
Authenticationmethod:
•Basic:ThismethodisthemostcompatibleauthenticationschemeforHTTP.It’slesssecurethantheDigestmethod
becauseitsendstheusernameandpasswordunencryptedtotheserver.
•Digest:Thismethodismoresecurebecauseitalwaystransfersthepasswordencryptedacrossthenetwork.
•Auto:Thisoptionletsthedeviceselecttheauthenticationmethoddependingonthesupportedmethods.Itprioritizes
theDigestmethodovertheBasicmethod.
Ownerauthenticationkey(OAK):ClickGetkeytofetchtheownerauthenticationkey.Thisisonlypossibleifthedeviceis
connectedtotheinternetwithoutarewallorproxy.
SMP
TheSimpleNetworkManagementProtocol(SNMP)allowsremotemanagementofnetworkdevices.
SMP:SelecttheversionofSNMPtouse.
•v1andv2c:
-Readcommunity:Enterthecommunitynamethathasread-onlyaccesstoallsupportedSNMPobjects.The
defaultvalueispublic.
-Writecommunity:Enterthecommunitynamethathasread/writeaccesstoallsupportedSNMPobjects
(exceptread-onlyobjects).Thedefaultvalueiswrite.
-Activatetraps:Turnontoactivatetrapreporting.Thedeviceusestrapstosendmessagesforimportant
eventsorstatuschangestoamanagementsystem.Inthedeviceinterface,youcansetuptrapsforSNMPv1
andv2c.TrapsareautomaticallyturnedoffifyouchangetoSNMPv3orturnoffSNMP.IfyouuseSNMPv3,
youcansetuptrapsthroughtheSNMPv3managementapplication.
-Trapaddress:EntertheIPaddressorhostnameofthemanagementserver.
-Trapcommunity:Enterthecommunitytousewhenthedevicesendsatrapmessagetothemanagement
system.
-Traps:
-Coldstart:Sendsatrapmessagewhenthedevicestarts.
11

Thedeviceinterface
-Warmstart:SendsatrapmessagewhenyouchangeanSNMPsetting.
-Linkup:Sendsatrapmessagewhenalinkchangesfromdowntoup.
-Authenticationfailed:Sendsatrapmessagewhenanauthenticationattemptfails.
Note
AllAxisVideoMIBtrapsareenabledwhenyouturnonSNMPv1andv2ctraps.Formoreinformation,see
AXISOSPortal>SNMP.
•v3:SNMPv3isamoresecureversion,whichprovidesencryptionandsecurepasswords.TouseSNMPv3,we
recommendyoutoactivateHTTPS,asthepasswordisthensentthroughHTTPS.Thisalsopreventsunauthorized
partiestoaccessunencryptedSNMPv1andv2ctraps.IfyouuseSNMPv3,youcansetuptrapsthroughtheSNMPv3
managementapplication.
-Passwordfortheaccount“initial”:EntertheSNMPpasswordfortheaccountnamed“initial”.Althoughthe
passwordcanbesentwithoutactivatingHTTPS,wedon’trecommendit.TheSNMPv3passwordcanonly
besetonce,andpreferablyonlywhenHTTPSisenabled.Oncethepasswordisset,thepasswordeldisno
longerdisplayed.Tosetthepasswordagain,youmustresetthedevicetofactorydefaultsettings.
Connectedclients
Thelistshowsallclientsthatareconnectedtothedevice.
Update:Clicktorefreshthelist.
Security
Certicates
Certicatesareusedtoauthenticatedevicesonanetwork.Thedevicesupportstwotypesofcerticates:
•Client/servercerticates
Aclient/servercerticatevalidatesthedevice’sidentity,andcanbeself-signedorissuedbyaCerticateAuthority(CA).
Aself-signedcerticateofferslimitedprotectionandcanbeusedbeforeaCA-issuedcerticatehasbeenobtained.
•CAcerticates
YoucanuseaCAcerticatetoauthenticateapeercerticate,forexampletovalidatetheidentityofanauthentication
serverwhenthedeviceconnectstoanetworkprotectedbyIEEE802.1X.Thedevicehasseveralpre-installedCA
certicates.
Theseformatsaresupported:
•Certicateformats:.PEM,.CER,and.PFX
•Privatekeyformats:PKCS#1andPKCS#12
Important
Ifyouresetthedevicetofactorydefault,allcerticatesaredeleted.Anypre-installedCAcerticatesarereinstalled.
Filterthecerticatesinthelist.
Addcerticate:Clicktoaddacerticate.
Thecontextmenucontains:
•Certicateinformation:Viewaninstalledcerticate’sproperties.
•Deletecerticate:Deletethecerticate.
•Createcerticatesigningrequest:Createacerticatesigningrequesttosendtoaregistrationauthoritytoapply
foradigitalidentitycerticate.
IEEE802.1x
12

Thedeviceinterface
IEEE802.1xisanIEEEstandardforport-basednetworkadmissioncontrolprovidingsecureauthenticationofwiredandwireless
networkdevices.IEEE802.1xisbasedonEAP(ExtensibleAuthenticationProtocol).
ToaccessanetworkprotectedbyIEEE802.1x,networkdevicesmustauthenticatethemselves.Theauthenticationisperformedby
anauthenticationserver,typicallyaRADIUSserver(forexampleFreeRADIUSandMicrosoftInternetAuthenticationServer).
Certicates
henconguredwithoutaCAcerticate,servercerticatevalidationisdisabledandthedevicetriestoauthenticateitself
regardlessofwhatnetworkitisconnectedto.
henusingacerticate,inAxis'implementation,thedeviceandtheauthenticationserverauthenticatethemselveswithdigital
certicatesusingEAP-TLS(ExtensibleAuthenticationProtocol-TransportLayerSecurity).
Toallowthedevicetoaccessanetworkprotectedthroughcerticates,asignedclientcerticatemustbeinstalledonthedevice.
Clientcerticate:SelectaclientcerticatetouseIEEE802.1x.Theauthenticationserverusesthecerticatetovalidatethe
client’sidentity.
CAcerticate:SelectaCAcerticatetovalidatetheauthenticationserver’sidentity.hennocerticateisselected,thedevice
triestoauthenticateitselfregardlessofwhatnetworkitisconnectedto.
EAPidentity:Entertheuseridentityassociatedwiththeclientcerticate.
EAPOLversion:SelecttheEAPOLversionthatisusedinthenetworkswitch.
UseIEEE802.1x:SelecttousetheIEEE802.1xprotocol.
Preventbrute-forceattacks
Blocking:Turnontoblockbrute-forceattacks.Abrute-forceattackusestrial-and-errortoguesslogininfoorencryptionkeys.
Blockingperiod:Enterthenumberofsecondstoblockabrute-forceattack.
Blockingconditions:Enterthenumberofauthenticationfailuresallowedpersecondbeforetheblockstarts.Youcansetthe
numberoffailuresallowedbothonpagelevelanddevicelevel.
IPaddresslter
Uselter:SelecttolterwhichIPaddressesthatareallowedtoaccessthedevice.
Policy:ChoosewhethertoAllowaccessorDenyaccessforcertainIPaddresses.
Addresses:EntertheIPnumbersthatareeitherallowedordeniedaccesstothedevice.YoucanalsousetheCIDRformat.
Custom-signedrmwarecerticate
ToinstalltestrmwareorothercustomrmwarefromAxisonthedevice,youneedacustom-signedrmwarecerticate.The
certicateveriesthatthermwareisapprovedbyboththedeviceownerandAxis.Thermwarecanonlyrunonaspecic
devicewhichisidentiedbyitsuniqueserialnumberandchipID.Custom-signedrmwarecerticatescanonlybecreated
byAxis,sinceAxisholdsthekeytosignthem.
ClickInstalltoinstallthecerticate.Youneedtoinstallthecerticatebeforeyouinstallthermware.
13

Thedeviceinterface
Users
Adduser:Clicktoaddanewuser.Youcanaddupto100users.
Username:Enterauniqueusername.
ewpassword:Enterapasswordfortheuser.Passwordsmustbe1to64characterslong.OnlyASCIIprintablecharacters(code
32to126)areallowedinthepassword,forexampleletters,numbers,punctuation,andsomesymbols.
Repeatpassword:Enterthesamepasswordagain.
Role:
•Administrator:Hasfullaccesstoallsettings.Administratorscanalsoadd,update,andremoveotherusers.
•Operator:Hasaccesstoallsettingsexcept:
-AllSystemsettings.
-Addingapps.
•Viewer:Doesn’thaveaccesstochangeanysettings.
Thecontextmenucontains:
Updateuser:Edittheuser’sproperties.
Deleteuser:Deletetheuser.Youcan’tdeletetherootuser.
MQTT
MQTT(MessageQueuingTelemetryTransport)isastandardmessagingprotocolfortheInternetofThings(IoT).Itwasdesignedfor
simpliedIoTintegrationandisusedinawidevarietyofindustriestoconnectremotedeviceswithasmallcodefootprintand
minimalnetworkbandwidth.TheMQTTclientinAxisdevicermwarecansimplifyintegrationofdataandeventsproducedinthe
devicetosystemswhicharenotvideomanagementsystems(VMS).
SetupthedeviceasanMQTTclient.MQTTcommunicationisbasedontwoentities,theclientsandthebroker.Theclientscan
sendandreceivemessages.Thebrokerisresponsibleforroutingmessagesbetweenclients.
YoucanlearnmoreaboutMQTTinAXISOSPortal.
MQTTclient
Connect:TurnonorofftheMQTTclient.
Status:ShowsthecurrentstatusoftheMQTTclient.
Broker
Host:EnterthehostnameorIPaddressoftheMQTTserver.
Protocol:Selectwhichprotocoltouse.
Port:Entertheportnumber.
•1883isthedefaultvalueforMQTToverTCP
•8883isthedefaultvalueforMQTToverSSL
•80isthedefaultvalueforMQTToverWebSocket
•443isthedefaultvalueforMQTToverWebSocketSecure
Username:Entertheusernamethattheclientwillusetoaccesstheserver.
Password:Enterapasswordfortheusername.
ClientID:EnteraclientID.Theclientidentierissenttotheserverwhentheclientconnectstoit.
14

Thedeviceinterface
Cleansession:Controlsthebehavioratconnectionanddisconnectiontime.henselected,thestateinformationisdiscarded
atconnectanddisconnect.
Keepaliveinterval:Thekeepaliveintervalenablestheclienttodetectwhentheserverisnolongeravailablewithouthaving
towaitforthelongTCP/IPtimeout.
Timeout:Thetimeintervalinsecondstoallowaconnecttocomplete.Defaultvalue:60
Devicetopicprex:UsedinthedefaultvaluesforthetopicintheconnectmessageandLTmessageontheMQTTclienttab,
andinthepublicationconditionsontheMQTTpublicationtab.
Reconnectautomatically:Specieswhethertheclientshouldreconnectautomaticallyafteradisconnect.
Connectmessage
Speciesifamessageshouldbesentoutwhenaconnectionisestablished.
Sendmessage:Turnontosendmessages.
Usedefault:Turnofftoenteryourowndefaultmessage.
Topic:Enterthetopicforthedefaultmessage.
Payload:Enterthecontentforthedefaultmessage.
Retain:SelecttokeepthestateofclientonthisTopic
QoS:ChangetheQoSlayerforthepacketow.
LastWillandTestamentmessage
TheLastillTestament(LT)letsaclientprovideatestamentalongwithitscredentialswhenconnectingtothebroker.Ifthe
clientdisconnectsungracefullyatsomepointlater(maybebecausehispowersourcedied),itcanletthebrokerdeliveramessage
tootherclients.ThisLTmessagehasthesameformasanordinarymessageandgetsroutedviathesamemechanics.
Sendmessage:Turnontosendmessages.
Usedefault:Turnofftoenteryourowndefaultmessage.
Topic:Enterthetopicforthedefaultmessage.
Payload:Enterthecontentforthedefaultmessage.
Retain:SelecttokeepthestateofclientonthisTopic
QoS:ChangetheQoSlayerforthepacketow.
MQTTpublication
Usedefaulttopicprex:Selecttousethedefaulttopicprex,thatisdenedinthedevicetopicprexintheMQTTclienttab.
Includetopicname:SelecttoincludethetopicthatdescribestheconditionintheMQTTtopic.
Includetopicnamespaces:SelecttoincludeONVIFtopicnamespacesintheMQTTtopic.
Includeserialnumber:Selecttoincludethedevice’sserialnumberintheMQTTpayload.
Addcondition:Clicktoaddacondition.
Retain:DeneswhichMQTTmessagesaresentasretained.
•one:Sendallmessagesasnon-retained.
•Property:Sendonlystatefulmessagesasretained.
15

Thedeviceinterface
•All:Sendbothstatefulandstatelessmessagesasretained.
QoS:SelectthedesiredlevelfortheMQTTpublication.
MQTTsubscriptions
Addsubscription:ClicktoaddanewMQTTsubscription.
Subscriptionlter:EntertheMQTTtopicthatyouwanttosubscribeto.
Usedevicetopicprex:AddthesubscriptionlterasprextotheMQTTtopic.
Subscriptiontype:
•Stateless:SelecttoconvertMQTTmessagesintoastatelessmessage.
•Stateful:SelecttoconvertMQTTmessagesintoacondition.Thepayloadisusedasthestate.
QoS:SelectthedesiredlevelfortheMQTTsubscription.
Accessories
I/Oports
Usedigitalinputtoconnectexternaldevicesthatcantogglebetweenanopenandclosedcircuit,forexamplePIRsensors,dooror
windowcontacts,andglassbreakdetectors.
UsedigitaloutputtoconnectexternaldevicessuchasrelaysandLEDs.YoucanactivateconnecteddevicesthroughtheVAPIX®
ApplicationProgrammingInterfaceorinthedeviceinterface.
Port
ame:Editthetexttorenametheport.
Direction:indicatesthattheportisaninputport.indicatesthatit’sanoutputport.Iftheportiscongurable,
youcanclicktheiconstochangebetweeninputandoutput.
ormalstate:Clickopencircuit,andforclosedcircuit.
Currentstate:Showsthecurrentstateoftheport.Theinputoroutputisactivatedwhenthecurrentstateisdifferentfromthe
normalstate.Aninputonthedevicehasanopencircuitwhenit’sdisconnectedorwhenthereisavoltageabove1VDC.
Note
Duringrestarttheoutputcircuitisopen.hentherestartiscomplete,thecircuitgoesbacktothenormalposition.Ifyou
changeanysettingsonthispage,theoutputcircuitsgobacktotheirnormalpositionsregardlessofanyactivetriggers.
Supervised:Turnontomakeitpossibletodetectandtriggeractionsifsomeonetamperswiththeconnectiontodigital
I/Odevices.Inadditiontodetectingifaninputisopenorclosed,youcanalsodetectifsomeonehastamperedwithit(thatis,cut
orshorted).Tosupervisetheconnectionrequiresadditionalhardware(end-of-lineresistors)intheexternalI/Oloop.
Logs
Reportsandlogs
16

Thedeviceinterface
Reports
•Viewthedeviceserverreport:Clicktoshowinformationabouttheproductstatusinapop-upwindow.TheAccess
LogisautomaticallyincludedintheServerReport.
•Downloadthedeviceserverreport:Clicktodownloadtheserverreport.Itcreatesa.ziplethatcontainsacomplete
serverreporttextleinUTF–8format,aswellasasnapshotofthecurrentliveviewimage.Alwaysincludetheserver
report.ziplewhenyoucontactsupport.
•Downloadthecrashreport:Clicktodownloadanarchivewithdetailedinformationabouttheserver'sstatus.The
crashreportcontainsinformationthatisintheserverreportaswellasdetaileddebuginformation.Thisreportmight
containsensitiveinformationsuchasnetworktraces.Itcantakeseveralminutestogeneratethereport.
Logs
•Viewthesystemlog:Clicktoshowinformationaboutsystemeventssuchasdevicestartup,warningsandcritical
messages.
•Viewtheaccesslog:Clicktoshowallfailedattemptstoaccessthedevice,forexamplewhenawronglogin
passwordisused.
etworktrace
Important
Anetworktracelemightcontainsensitiveinformation,forexamplecerticatesorpasswords.
Anetworktracelecanhelpyoutroubleshootproblemsbyrecordingactivityonthenetwork.Selectthedurationofthetracein
secondsorminutes,andclickDownload.
Remotesystemlog
Syslogisastandardformessagelogging.Itallowsseparationofthesoftwarethatgeneratesmessages,thesystemthatstores
them,andthesoftwarethatreportsandanalyzesthem.Eachmessageislabeledwithafacilitycode,whichindicatesthesoftware
typegeneratingthemessage,andassignedaseveritylevel.
Server:Clicktoaddanewserver.
Host:EnterthehostnameorIPaddressoftheserver.
Format:Selectwhichsyslogmessageformattouse.
•RFC3164
•RFC5424
Protocol:Selecttheprotocolandporttouse:
•UDP(Defaultportis514)
•TCP(Defaultportis601)
•TLS(Defaultportis6514)
Severity:Selectwhichmessagestosendwhentriggered.
CAcerticateset:Seethecurrentsettingsoraddacerticate.
17

Thedeviceinterface
Maintenance
Restart:Restartthedevice.Thisdoesnotaffectanyofthecurrentsettings.Runningapplicationsrestartautomatically.
Restore:Returnmostsettingstothefactorydefaultvalues.Afterwardsyoumustrecongurethedeviceandapps,reinstallany
appsthatdidn’tcomepreinstalled,andrecreateanyeventsandPTZpresets.
Important
Theonlysettingssavedafterrestoreare:
•Bootprotocol(DHCPorstatic)
•StaticIPaddress
•Defaultrouter
•Subnetmask
•802.1Xsettings
•O3Csettings
Factorydefault:Returnallsettingstothefactorydefaultvalues.AfterwardsyoumustresettheIPaddresstomakethedevice
accessible.
Note
AllAxisdevicermwareisdigitallysignedtoensurethatyouonlyinstallveriedrmwareonyourdevice.Thisfurther
increasestheoverallminimumcybersecuritylevelofAxisdevices.Formoreinformation,seethewhitepaper“Signed
rmware,secureboot,andsecurityofprivatekeys”ataxis.com.
Firmwareupgrade:Upgradetoanewrmwareversion.Newrmwarereleasescancontainimprovedfunctionality,bug
xes,andcompletelynewfeatures.erecommendyoutoalwaysusethelatestrelease.Todownloadthelatestrelease,go
toaxis.com/support.
henyouupgrade,youcanchoosebetweenthreeoptions:
•Standardupgrade:Upgradetothenewrmwareversion.
•Factorydefault:Upgradeandreturnallsettingstothefactorydefaultvalues.henyouchoosethisoption,youcan’t
reverttothepreviousrmwareversionaftertheupgrade.
•Autorollback:Upgradeandconrmtheupgradewithinthesettime.Ifyoudon’tconrm,thedevicerevertstothe
previousrmwareversion.
Firmwarerollback:Reverttothepreviouslyinstalledrmwareversion.
18

Learnmore
Learnmore
Security
Signedrmware
Signedrmwareisimplementedbythesoftwarevendorsigningthermwareimagewithaprivatekey.henarmwarehasthis
signatureattachedtoit,adevicewillvalidatethermwarebeforeacceptingtoinstallit.Ifthedevicedetectsthatthermware
integrityiscompromised,thermwareupgradewillberejected.
Secureboot
Securebootisabootprocessthatconsistsofanunbrokenchainofcryptographicallyvalidatedsoftware,startinginimmutable
memory(bootROM).Beingbasedontheuseofsignedrmware,securebootensuresthatadevicecanbootonlywithauthorized
rmware.
AxisEdgeVault
AxisEdgeVaultisasecurecryptographiccomputemodulewhichcanbeusedforcryptographicoperationsonsecurelystored
certicates.EdgeVaultprovidestamperprotectedstorage,enablingeachdevicetoprotectitssecrets.Itsetsafoundationforsafe
implementationofmoreadvancedsecurityfeatures.
AxisdeviceID
AxisdeviceIDworkslikeadigitalpassport,uniqueforeachdeviceunit.ItissecurelyandpermanentlystoredinEdgeVaultasa
certicatesignedbyAxisrootcerticate.AxisdeviceIDisdesignedtoprovetheoriginofthedevice,enablinganewlevelof
devicetrustthroughthelifecycleoftheproduct.
TolearnmoreaboutcybersecurityfeaturesinAxisdevices,gotoaxis.com/learning/wite-papersandsearchforcybersecurity.
19

Specifications
Specifications
Productoverview
1Networkconnector
2Groundingposition
3Relayjumper
4Powerconnector
5Relayconnector
6Doorconnector
7Readerconnector
8Auxiliaryconnector
9Externalconnectors
10Controlbutton
TextmarkedwithULisonlyvalidforUL294installations.
RequirementsforcompliancewithUL294
ThissectioncontainsinformationandinstructionsrequiredforULcompliance.TomakesuretheinstallationisULcompliant,follow
theinstructionsbelowinadditiontothegeneralinformationandinstructionsprovidedthroughoutthisdocument.Incaseswhere
piecesofinformationcontradicteachother,therequirementsforULcompliancealwaysreplacegeneralinformationandinstructions.
Performancelevelsforaccesscontrol
20