Johnson Controls Tyco 8200-1466-01 User manual

Software House
IP-ACM Ethernet Door Module v2
Quick Start Guide
PART NUMBER: 8200-1466-01
VERSION: E0
SEPTEMBER 2019
Overview
The IP-ACM Ethernet Door Module v2 module provides connection and management of access control for two readers.
The maximum number of IP-ACM Ethernet Door Module v2 modules supported per iSTARUltra is 32, iSTARUltra SE
is 32, and iSTARUltra LT is 8 or 16, depending on the model.
The maximum number of readers can be accomplished as follows:
■ iSTARUltra or Ultra SE (in Ultra Mode): Up to 16 IP-ACMs with 2 readers per IP-ACM, 32 IP-ACMs with 1 reader
per IP-ACM, or any combination of these configurations.
■ iSTARUltra LT 16-reader board (0312-7188-02): Up to 8 IP-ACMs with 2 readers per IP-ACM, 16 IP-ACMs with
one reader per IP-ACM, or any combination of these configurations.
NOTE For the 8-reader iSTAR Ultra LT board (0312-7188-01), you can have up to 4 IP-ACMs with 2 readers per IP-ACM, 8 IP-ACMs with
one reader per IP-ACM, or any combination of these configurations.
The 16-reader iSTAR Ultra LT board has not been evaluated by UL.
The IP-ACMEthernet Door Module v2 supports the following features:
■ 12VDC or 24VDC local power or Power over Ethernet (PoE or PoE+)
■ Two RJ45 ports:
• Port 1: Ethernet port, internally bound to MAC with the MAC address and used as the network connection port
for the board (10/100/1000)
• Port 2: Switch port, not a secondary port, used for iSTARUltra LT connection (10/100, no PoE).
Caution: Do NOT plug this port into the same network as J1 or a loopback will occur.
■ Four supervised Inputs and two Outputs
■ Communication to readers through Wiegand or RS-485 ports

■ SSL network encryption from the unit to the GCM
■ IPv4 and IPv6 network protocols
■ 802.1X port-base authentication
■ HTTPS Web-based configuration
■ Offline mode for two readers that allows the last 1,000 previous card admits and/or a specific personnel group of no
more than 100
Table 1:Part numbers and descriptions of IP-ACM Ethernet Door Module v2 and enclosures
Part Number Description
IP-ACM2A-MB IP-ACM V2, 2 Reader, board only
IP-ACM2A-EM IP-ACM V2, 2 Reader in metal enclosure
IP-ACM2A-EP IP-ACM V2, 2 Reader in plastic enclosure
IP-ACM2-CAN IP-ACM metal enclosure without board
IP-ACM2-CAN-P IP-ACM plastic enclosure without board
IP-ACM2A-MB-5PK IP-ACM V2, 2 Reader, board only five pack box
Requirements and Specifications
The contents of this chapter explain the installation, power and wiring, grounding, and environmental requirements for
the IP-ACM v2.
Installation Requirements
Ensure the site is ready:
■ The module installation must be performed by a certified installer and must be installed within the same protected
premise as the controlling GCM.
■ For a UL-compliant installation, the power supply must be UL Listed to UL 294 and UL 603, low voltage Class 2
power limited with appropriate ratings.
Table 2: UL 294 Levels
Feature Level
Destructive Attack 1
Line Security 4
Endurance 4
Standby Power 1
■ All interconnecting devices must be UL Listed, low voltage Class 2 power limited.
■ The site must be approved and all wiring must comply with UL requirements and other codes, as appropriate.
Installation shall be in accordance with the National Electric Code, ANSI/NFPA 70-1993.
■ In this installation, the enclosure is mounted directly to a wall or uni-strut using suitable user-supplied hardware.
2

■ The anchoring system must be capable of sustaining, a proof load four times that of the assembly. Refer to the
enclosure dimensions for information on the weight of enclosures. This weight does not include the cables.
■ The cables are protected by using metal or plastic conduit, or using flexible cable grip strain relief.
■ The module can be powered from either a 12VDC or 24VDC local source, PoE or PoE plus.
■ UL testing was conducted with a product powered from UL Listed model POE36U-1AT-R injector, manufactured by
PHIHONG.
■ Do not connect to a receptacle controlled by a switch.
■ It is recommended to setup a private dedicated network for the connection between IP-ACMv2 panels and iSTAR
Ultra panels for more secure connection options.
NOTE ELECTROSTATIC SENSITIVE DEVICES:
• Observe precautions for handling.
• Before handling any internal components, discharge static electricity by holding a grounding lug or non-painted surface for three
seconds.
• Wear a grounding wrist strap and stand on a grounded static mat.
• Reduce movement during installation to reduce static buildup.
• Confirm work area is safeguarded.
• Transport components to static-shielded containers.
• Verify that all components, materials, and the installer are reference to a common ground.
The outsides of the ESD bags are not ESD protected.
NOTE LIFE SAFETY REQUIREMENT: A fail-safe override mechanism must be installed at each card reader exit to allow people to leave
the secure area in case of electromechanical failure.
CAUTION: Changes to the IP-ACM v2 that are not expressly approved by the party responsible for compliance could void your
authority to operate the equipment.
FOR BURGLAR ALARM INSTALLATIONS:
The IP-ACM v2 is not provided with backup power. An external power supply must be provided with the following characteristics:
• UL 603 Listed.
• Minimum four hours of standby power after notification of loss of AC Power.
Tyco/Software House Advanced Power Supply (apS) used in conjunction with the IP-ACM v2 will be sufficient in meeting the
requirement of UL 1076.
When using an external power supply, the supply shall be Class 2 and compliant with EN/IEC 62368.
All Burglar Alarm and Intrusion Zone inputs must be supervised and have Triggers configured to Alarm upon Tamper.
NOTE Data processing equipment and office appliance and business equipment used as computer equipment shall comply with the
Standard for Information Technology Equipment - Safety - Part 1: General Requirements, UL 60950-1.
• The installation shall supply line transient protection complying with the Standard for Transient Voltage Surge Suppressors, UL
1449, with a maximum marked rating of 330 V.
• Communication circuits and network components connected to the telecommunications network shall be protected by secondary
protectors for communication circuits. These protectors shall comply with the Standard for Secondary Protectors For
Communication Circuits, UL 497A. These protectors shall be used only in the protected side of the telecommunications network.
• Equipment shall be installed in a temperature controlled environment. A temperature controlled environment is defined as one
that can be maintained between 55°F (13°C) to 95°F (35°C) by the HVAC system. Twenty-four hours of standby power shall be
provided for the HVAC system. The standby power system for the HVAC system may be supplied by an engine driven generator
alone and in those situations a standby battery is not required to be used.
3

Environmental requirements
This product is for indoor use only and not intended for outside wiring as covered by article 800 in the National Electrical
Code, NFPA 70.
Status Range
Ambient temperature rating 32° to 120° F (0 to 49°C)
Maximum elevation 6600 ft (2000m)
Humidity 0 to 85% RH
Table 3:Environmental requirements of the IP-ACM v2
Grounding requirements
The grounding requirements for IP-ACM Ethernet Door Module v2 installation are as follows:
■ Grounding needs to follow NEC codes or the applicable local code.
■ On the plastic enclosure, ensure that all shields of the IP-ACM v2 cables properly connect and terminate to the
earth ground at the point indicated on Figure 2 on Page 6.
■ Shielded wires should have the shields grounded to the chassis enclosure as close as possible to where the cables
are entering the enclosure.
■ When disconnecting the wiring, disconnect ground wires last, to provide maximum protection to the equipment and
personnel.
Disconnect all power sources before modifying the wiring.
Supervision wiring
The IP-ACM v2 supports configurable supervised input circuits. The default selection is the double 1K circuit, as seen
in Figure 1 on Page 4. For more information regarding other inputs available and details of configuration, refer to the I/8-
CSI User Guide.
Figure 1:Supervised wiring
This method reports:
■ Short
■ Normal: 1K for Normally Open, 1K for Normally Closed
■ Alert: 500 ohms for Normally Open, and 2K for Normally Closed
■ Open: >30K
■ Line Fault: Any unexpected value usually due to wrong value or fault resistors
For more information regarding other inputs available and details of configuration, refer to the I/8-CSI User Guide.
4

NOTE Not all configurations can detect all states. For more information regarding states, refer to the I/8-CSI User Guide and the con-
figuration tables and images relevant to the configuration of your unit.
IP-ACM Ethernet Door Module v2 power and wiring requirements
Table 4 on Page 5 describes the power and wiring requirements for the IP-ACM v2.
Table 4:Power and wiring requirements for the IP-ACM v2
Signal Power Requirements To AWG Shield Maximum Length
RS-485 Comm,
Data half duplex 2-
wire
RM & I/O modules 22 Yes 4000ft (1212m)
NOTE: If using tthe TST-100
Touchscreen Terminal
reader, then the
maximum distance is
32ft (10m).
RS-485 Power 12Vdc 1RM & I/O modules 22/18 Yes Maximum length depends on
application and AWG2
RJ45-Ethernet Level 3 Switch, Hub, or
Host
CAT-5E
or better
No 328ft. (100m)
Request to Exit
(REX or RTE)
Switch Contact 22/18 No 2000ft. (606m)
Door State
Monitor (DSM)
Switch Contact
Supervised Input
(UL) Note3
Input 22 Yes 2000ft. (606m)
Reader Data
(Direct Wiegand
Connection)
12Vdc 4Proximity/Wiegand
signaling read head
22
20
18
Yes 200ft. (60.96m)
300ft. (91.4m)
500ft. (152.4m)
Wet Relay
Contacts
12 or 24Vdc (jumper
selectable), 0.5A (per lock)5
2000ft. (606m)
Dry Relay
Contacts
0 to 30Vdc , 5A max. NO,
3A max. NC
2000ft. (606m)
1It is important to note that the aggregate load of each pair of RS-485 and Wiegand connections together must not exceed 750mA. Each set of RS-485
and Wiegand can support 750mA.
2Check wire lengths to verify that voltage drops are acceptable. Calculations are based on a single RM-4 reader with keypad and LCD (250mA). Using
22AWG, distance = 600ft. (.0165 ohms/ft.). Using 18AWG, distance = 1500ft. (.0065 ohms/ft.).
3To comply with UL requirements, use shielded, minimum 22 AWG stranded, twisted pair cable for monitor points, DSMs, and REXs. Use Belden 9462 or
equivalent.
4It is important to note that the aggregate load of each pair of RS-485 and Wiegand connections together must not exceed 750mA. Each set of RS-485
and Wiegand can support 750mA. Maximum combined output limit for readers, locks, and board logic is 20W.
5Voltage depends on selection of power feed (L1 or L2). Maximum combined output limit for readers, locks, and board logic is 20W.
5

Signal Power Requirements To AWG Shield Maximum Length
Power over
Ethernet (PoE)
IEEE 802.3af (PoE) and 802at
(PoE Plus), 25.5W max. LLDP
supported for PoE Plus1
Switch Contact 24 Yes 328 ft. (100m)
Local Power 12 or 24Vdc 25.5W
max.2
P1 18 No Maximum length depends on
application and AWG
Installation and Enclosures
The following sections describe features and installation procedures of the plastic and metal enclosures with the IP-
ACM Ethernet Door Module v2.
Plastic enclosure
Figure 2 on Page 6 and Table 5 on Page 6 describe the dimensions of the plastic enclosure. The plastic enclosure is not
acceptable for use in a plenum.
Figure 2:Plastic enclosure mounting hole dimensions
Table 5:Plastic enclosure dimensions
Plastic Enclosure Dimensions
Item Dimension
Weight 1.6lb (.72kg)
1Compliance with IEEE 802.3 (AT or AF) specifications was not verified as part of UL294/B.
2Maximum combined output limit for readers and locks is 17W (+/- 10%).
6

Plastic Enclosure Dimensions
Item Dimension
Height 7.2in (183mm)
Width 12.1in (307mm)
Depth 2.46in (62.4mm)
Installing the plastic enclosure and IP-ACM Ethernet Door Module v2
To install the plastic enclosure, complete the following steps:
1. Remove the screws using the Software House security screwdriver (not included, part number: 132-183) and lift
the enclosure cover off of the plastic enclosure.
2. Secure the enclosure to the selected wall or support surface using the holes provided in the enclosure’s molded
base. See Figure 2 on Page 6 for dimensions and hole pitch for mounting.
NOTE It is essential to use all five securing screws when mounting the plastic enclosure. Ensure that the mounting hole at 131.1 across and
26.3 up is used as this is required for the "whole unit off the wall" anti-tamper feature to be operational.
3. Remove the IP-ACM v2 from the packaging and place in a safe location using ESD proper procedures while
handling equipment.
4. Secure the IP-ACM v2 to the right of the enclosure.
5. Fit and connect all customer cables. Refer to the power and wiring requirements for more information.
6. Secure the cover with two tamper-proof screws using the Software House security screwdriver.
Metal enclosure
Figure 3 on Page 8 and Table 6 on Page 7 describe the dimensions of the metal enclosure. The metal enclosure is
approved for use in a plenum.
Mounting hardware is not included with the metal enclosure. Hardware used for mounting should be able to support four
times the weight of the enclosure not including cabling.
Table 6:Metal enclosure dimensions
Metal Enclosure Dimensions
Item Dimension
Weight ~2.6lb (~1.2kg)
Height 8.25in (209.6mm)
Width 7.34in (186.5mm)
Depth 3.46in (87.8mm)
7

Figure 3:Metal enclosure mounting holes
Installing the metal enclosure and the IP-ACM Ethernet Door Module v2
To install the module and metal enclosure, complete the following steps:
1. Open the door of the metal enclosure.
2. Secure the enclosure to selected wall or support surface using holes provided in the enclosure’s base. See Figure 3
on Page 8 for dimensions and hole pitch for mounting.
3. Remove the IP-ACM v2 from the packaging and place in a safe location using ESD proper procedures while
handling equipment.
4. Secure the IP-ACM v2 to the enclosure.
5. Fit and connect all cables. Refer to the power and wiring requirements for more information.
6. Close and secure the metal enclosure cover.
8

IP-ACM v2 Ethernet Door Module features
Figure 4 on Page 9 shows the switches, jumpers, ports, and connectors of the IP-ACM Ethernet Door Module v2.
Figure 4:IP-ACM Ethernet Door Module v2
Switches and jumpers
See Figure 4 on Page 9 for the locations of the switches and jumpers on the IP-ACM v2.
SW1
Table 7 on Page 9 describes the positions of switch SW1.
Position Description
SW1-1 OFF: Normal Operation
ON:Standalone Operation
Refer to the Initial Configuration section for details.
SW1-2, SW1-3, and SW1-4 Not used. Must be in the OFFposition.
Table 7:Switch SW1 descriptions
9

SW2 used for factory reset
Position D of rotary switch SW2 is used for factory reset. All other positions of the rotary switch are not used in this
release.
Factory reset
1. Switch the position of the rotary switch SW2 to position D.
2. Press and release SW3 Reset button.
3. Wait until LEDs DS4 and DS8 flash. Factory reset is successful if DS4 and DS8 flash in a sequence of two flashes
in quick succession then pause and repeat continuously. If there are more than two quick flashes in the sequence,
the factory reset has failed.
4. Switch rotary switch SW2 to position 0.
5. Press and release SW3 Reset button.
Ports and connectors
See Figure 4 on Page 9 for ports and connectors on the IP-ACM v2.
J5
The second RJ45 port (J5) used for connection to the iSTAR Ultra LT when mounted in the same enclosure. If this use
case is being implemented, two IP addresses are needed: one for the IP-ACMand another for the iSTAR Ultra LT.
Caution: Do not plug this port into the same network as J1 or a loopback will occur.
DO NOT PLUG INTO THE SAME NETWORK AS PORT 1 OR A LOOPBACK WILL OCCUR!
Specific requirements for the second RJ45 port are:
■ Full duplex wiring
■ 10/100 speed (Gigabit Ethernet not provided)
■ Power over Ethernet (PoE) not provided on this port
P1
This port supports local power of 12 VDC or 24 VDC, 25.5W max. However, the maximum combined output limit for
readers and locks is 17W (+/-10 %). See Table 4 on Page 5 for more information regarding power and wiring
requirements.
P3 and P4
Figure 5 on Page 11 illustrates the wiring for a Wiegand reader on the IP-ACM v2.
10

Figure 5:Wiegand wiring for the IP-ACM v2
P5 and P6
You can wire these RS-485 ports either full or half duplex depending on the reader you are using. See Figure 6 on Page
11 for reference on wiring these RS-485 ports.
Figure 6:Full duplex and half duplex wiring
NOTE lWiring for the RS-485 ports are straight-through. Ensure that pin 1 of the RS-485 port on the IP-ACM v2
connects to pin 1 of the RS-485 port on the corresponding reader.
lFull duplex has not been evaluated by UL.
P15 Tamper
Normally Closed (NC) when the enclosure is secure.
11

Inputs
See Figure 4 on Page 9 for the four supervised inputs, P11 to P14, of the IP-ACM v2. Use standard Software House 1K
dual EOL configuration. Further configurations may be selected through the IP-ACM v2 editor in C•CURE 9000.
Output Relay Wet or Dry Jumpers
The two output relays can be Dry or Wet, based on the position of these jumpers.
■ When Dry, the integrator must supply the external power that the relay switches. When set to Dry, use the C, NO,
or NC connections.
■ When Wet, the IP-ACM sources the power. When set to Wet, use the GND, NO, or NC connections.
Jumper Settings
■ 12 VDC Wet sourced from Jumper 1 to 2
■ 24 VDC Wet sourced from Jumper 3 to 4
■ Dry use external power - Park Jumper on 2 to 3
Figure 7:Wet/Dry Relay Jumper
Initial Configuration
The IP-ACM v2 requires:
■ iSTAR Ultra/Ultra SE/Ultra LT firmware version 6.5.4 or higher
NOTE If the iSTAR Ultra, Ultra SE, or Ultra LT is running firmware v6.6.B and higher refer to the latest respective Controller Installation and
Configuration Guide, available from the website, for iSTAR controller configuration information.
■ C•CURE 9000 version 2.60 SP1 and higher
Initial configuration of the IP-ACM Ethernet Door Module v2 can be performed in two modes:
■ Normal Operation mode
■ Standalone configuration mode
Use Normal operation mode when using DHCP network addressing, and use Standalone configuration mode when
configuring a static IP address for the IP-ACM v2.
NOTE The IP-ACMEthernet port (J1) defaults to using DHCP.
The MAC Address of the IP-ACM Ethernet Door Module v2 is located on the module, enclosure, or shipping carton.
Software House strongly recommends that you use a Static IP address when configuring iSTAR controllers.
12

The following limitation applies to iSTAR controllers with member connected controllers and iSTAR Ultra controllers
with connected IP-ACMs that use DHCP IP address assignments:
■ If DHCP is used, the lease may expire and assign a new IP address to the iSTAR controller. If this happens, all
members and IP-ACMs are not able to connect to the iSTAR controller with the new IP address. You need to
reassign the IP address:
1. Update the iSTAR controller IP address in the ICU.
2. Update the IP address in the IP-ACM Configure/Status web page.
3. Update the IP address in the iSTAR Controller Editor (members).
NOTE • When you initially configure the IP-ACM v2 using the iSTAR Configuration Utility (ICU), you can only use one IP address of the
Ultra GCMboard for configuration. The GCMboard has two Ethernet connections, so if the GCM switches to a different IP
address from the initial configuration, communication from the IP-ACM v2 to the GCMboard is lost.
Normal operation mode
To configure the IP-ACMv2 in Normal Operation mode, complete the following steps:
1. Ensure the SW1-1 is OFF.
2. Apply power using the PoE (J1) or the local power port.
3. Push the SW3 reset switch.
4. Connect the IP-ACM v2 board to the Ethernet port directly on a DHCP network and run the iSTAR Configuration
Utility (ICU), version 6.5.4 or later, on the same subnet using an Ethernet cable. Ensure you have previously
configured the iSTAR Ultra controller in order to obtain the iSTAR IP address for the IP-ACM configuration.
5. To discover the IP-ACM, click the IP-ACM icon in the ICU. A list of IP-ACM modules appear.
6. Right-click the IP-ACM, identified by its IP address or MAC Address, you want to configure and select Configure
IP-ACM.
NOTE • There is limited access to the IP-ACM v2 Configuration/Status Web Page on a system with Windows 8 or Windows 10 operating
system using Internet Explorer 11 or Edge browser on IPv4 and IPv6.
• Internet Explorer 9 does not display content correctly for the IP-ACM v2 web page.
• If using Internet Explorer and you receive a Certificate Error indicating "There is a problem with this website's security certificate”,
click Continue to this website (not recommended).
• If using Goggle Chrome and you receive an error indicating “Your connection is not private”, click ADVANCED and then click
Proceed to x.x.x.x (unsafe).
7. Enter the password: iSTAR, and click Login. The IP-ACM Configuration/Status web page appears.
8. In the Configuration section, enter the iSTAR IP address assigned to the iSTAR Ultra controller.
NOTE Ensure you click Logout on the IP-ACM Configuration/Status Web Page instead of exiting the browser through the X in the
upper-right corner so you can access this web page when you want to. If you close IP-ACM Configuration/Status Web Page from the
X in the upper-right corner and then re-open a new web page to the same URL, a message appears stating that the IP-ACM session
is currently locked by the IP Address of the machine where you closed the web page. The locked session times out after being idle for
five minutes. You can then try accessing the URL again.
9. Click Save.
NOTE • Saved changes do not take effect until the board is rebooted.
• When you initially configure the IP-ACM v2 using the iSTAR Configuration Utility (ICU), you can only use one IP address of the
Ultra GCMboard for configuration. The GCMboard has two Ethernet connections, so if the GCM switches to a different IP
address from the initial configuration, communication from the IP-ACM v2 to the GCMboard is lost.
13

Standalone configuration mode
To configure the IP-ACMv2 in Standalone mode, complete the following steps:
1. If there is no DHCP network, or the installer prefers configuring the IP-ACM v2 before putting it on the network,
switch SW1-1 to ON.
2. Apply power using the PoE (J1) or the local power port.
3. Perform a factory reset, see Factory reset on Page 10, while SW1-1 is in the ON position.
4. The IP-ACM starts with a static IP address of: 192.168.1.111. Connect a laptop or PC, statically configured in the
192.168.1.0/24 subnet, directly to the IP-ACM v2 with an Ethernet cable.
5. Open a web browser and enter the IP address: https://192.168.1.111.
NOTE • There is limited access to the IP-ACM v2 Configuration/Status web page on a system with Windows 8 or Windows 10 operating
system using Internet Explorer 11 or Edge browser on IPv4 and IPv6.
• Internet Explorer 9 does not display content correctly for the IP-ACM v2 web page.
• If using Internet Explorer and you receive a Certificate Error indicating "There is a problem with this website's security certificate”,
click Continue to this website (not recommended).
• If using Goggle Chrome and you receive an error indicating “Your connection is not private”, click ADVANCED and then click
Proceed to x.x.x.x (unsafe).
6. Enter the password: iSTAR, and then click Login.
7. Make edits that you require to the following fields on the IP-ACM web page: IP-Type,Alloc Type,IP-ACM Addr,
IP-ACM NetMask,IP-ACM Gateway,IP-ACM DNS, and iSTAR IP Addr.
8. Click Save.
NOTE Ensure you click Logout on the IP-ACM Configuration/Status Web Page instead of exiting the browser through the X in the upper-
right corner so you can access this web page when you want to. If you close IP-ACM Configuration/Status Web Page from the X in the
upper-right corner and then re-open a new web page to the same URL, a message appears stating that the IP-ACM session is
currently locked by the IP Address of the machine where you closed the web page. The locked session times out after being idle for
five minutes. You can then try accessing the URL again.
9. Switch SW1-1 to OFF.
10. Reboot the IP-ACM v2 before putting the module back on the network.
NOTE • Saved changes do not take effect until the board is rebooted.
• When you initially configure the IP-ACM v2 using the iSTAR Configuration Utility (ICU), you can only use one IP address of the
Ultra GCMboard for configuration. The GCMboard has two Ethernet connections, so if the GCM switches to a different IP
address from the initial configuration, communication from the IP-ACM v2 to the GCMboard is lost.
802.1X port-based authentication configuration
802.1X is a port-based authentication. Credentials, such as user name and password or digital certificate, are
forwarded to the authenticator. The authenticator then forwards the credentials to the authentication server for
verification. If the authentication server determines the credentials are valid, access resources located on the protected
side of the network are allowed.
■ 802.1X is supported on IP-ACM v2.
■ 802.1X is disabled by default.
■ EAP-TLS authentication and EAP-PEAP authentication with MSCHAPv2, MD5, or GTC are supported.
■ Factory reset clears the 802.1X configuration and sets 802.1X back to disabled.
14

Prerequisites
■ An Internet browser with JavaScript and cookies enabled.
■ IP-ACM v2 firmware version 04.01.00.30093, or greater.
■ A configured network switch with 802.1X capability.
• Port control enabled:
— Set the ports to be authorized to avoid authentication.
— Set the ports to auto to automatically detect port status for authentication.
■ A Radius Server running on the network.
■ You need to know the location of the following files generated by the Radius Server configuration:
• User Certificate
• CA Certificate
• Private Key
• Authentication password
Configuration
To configure the IP-ACM v2 to use 802.1X authentication:
1. Ensure that the Ethernet cable is plugged into a port that does not require authentication.
2. Connect to the IP-ACM v2 Status/Control web page. You must prefix the IP address with HTTPS://. The ICU
automatically adds the IP address prefix.
3. Click in the radio button to select the authentication type, PEAP or TLS. The fields change depending on the
authentication type selected.
•Disabled: 802.1X is disabled.
•TLS requires Identity, Private Key Password, CA, Client Cert, and Private Key.
•PEAP requires Anon Identity, Identity, Password, and CA.
•Anon Identity can be any string you want.
4. Complete the required fields with the appropriate values.
a. The sum of the sizes of all files uploaded must be less than 10K. The web page does not accept any configuration
where the sum of the file sizes is greater than 10K.
b. The suggested file type for certificates is: .pem.
c. The suggested file type for private keys is: .key.
5. Click Upload to upload the 802.1X configuration settings.
6. Click Reboot at the top of the page.
7. Move the Ethernet cable of the IP-ACM v2 to the port that requires authentication.
a. If the cable is not moved, the IP-ACM v2 retains network access even when it's configured for 802.1X.
b. Once plugged into the required port, the IP-ACM v2 attempts to authenticate.
8. Check the radius server to ensure that the IP-ACM v2 is authenticated.
15

a. If authentication fails due to an invalid configuration, move the Ethernet cable back to a non-authenticated port
and re-configure the 802.1X settings that confirm to the radius server.
b. A factory reset disables 802.1X and removes all configuration information.
9. The IP-ACMv2 firmware version can be verified by accessing the IP-ACMStatus/Control page by entering the IP
address of the IP-ACM into a browser address bar.
Offline configuration
In Offline Mode, there is a limited level of access and control if communication is interrupted between the IP-ACM v2
and the iSTAR. The offline functionality of the IP-ACM v2 allows up to the last 1,000 previous card admits and/or a
specific personnel group of no more than 100. Offline Access stores a set of credentials in non-volatile memory on the
IP- ACM v2. Clearances are not downloaded to the IP-ACM v2 and are not stored.
Refer to the C•CURE Hardware Configuration Guide for more information regarding IP-ACM Offline Mode
Configuration. Offline mode is configured in C•CURE 9000 in the iSTAR Controller editor dialog box in the IP-ACMs
tab.
Card + PIN access is not supported in Offline Mode. Card,-only access with no PIN is supported.
Predefined credentials
Predefined credentials are downloaded from the iSTAR controller in the form of raw data, also called Static Card Data.
When the IP-ACM v2 is offline, access is granted when the predefined credentials, from the Static Card Data stored on
the IP-ACM v2, are presented to the readers.
The following restrictions apply to stored predefined credentials in offline mode:
■ Personnel groups configured for Offline Mode must all share the same card format and facility code.
■ Card formats supported are:
• Wiegand 26
• Wiegand 37
• Two-parity bit style formats
• 32-bit serial number type formats
■ The Offline Mode Personnel Group can only be configured or edited in C•CURE. Offline Mode Personnel Group
changes are sent to the IP-ACM immediately including deleting credentials, if necessary, if the iSTAR controller
and the IP-ACM are online. Any change in the Personnel Group deletes and recreates the IP-ACM static records.
Credentials last granted access
In Offline Mode, the IP-ACM v2 board admits cards that are among the last xxx previous admitted cards in addition to a
pre-defined personnel group.
■ A total of 1000 credentials (not personnel) for both previous admitted credentials and credentials in the personnel
group.
■ Maximum 100 personnel in the personnel group.
■ If you set the Personnel system variable Maximum Cards Per Person, then that value must be taken into
consideration.
16

Example:
If you set the Maximum Cards Per Person value to 3, then only 1000 - 100 x 3 = 700 is allowed in the Admit the last
admitted cards field for configuration.
Door configuration
NOTE In Offline Mode, all components of the door must come from the same IP-ACM v2 board.
Door configuration in Offline Mode does not support RS-485 wiring for readers.
In Offline Mode, you must configure the readers, inputs, and outputs on the IP-ACM v2 as detailed below:
■ A reader configured on Wiegand Port 1 as the entry reader.
■ A reader configured on Wiegand Port 2 as the exit reader.
■ An input configured on Input 1 as the DSM (Door State Monitor).
■ An input configured on Input 2 as the REX (Request to Exit).
■ An output configured on Output 1 as the Door lock.
NOTE • Door configurations not complying with the above restrictions may result in unexpected operation between online and offline
modes. However, any of the above readers, inputs, or outputs may be omitted from the door. See the following note about not
using these reader, inputs, or outputs for other purposes.
• If the readers and inputs/outputs are configured for a different purpose in C•CURE, the Offline Mode door controller uses them
for the door control function listed above, even if they are not configured for the door in C•CURE.
The door operation parameters are fixed when the IP-ACM v2 goes into offline mode and cannot be changed. The door
parameters revert to their configured settings when the IP-ACM v2 goes back online.
Offline fixed parameters:
■ Shunt time: 10 seconds
■ Unlock time: 5 seconds
■ Relock delay time: ½ second
■ Debounce time: ½ second
■ Unlock on RTE: Enabled
■ Shunt on RTE: Enabled
■ DSM shunted full shunt time: Disabled
■ Delay Relock full shunt time: Disabled
Upgrading the IP-ACM v2 Firmware
To Upgrade the IP-ACM v2 Firmware to version 04.01.00.30093 or Higher:
1. Power on the IP-ACM v2. Ensure the Ethernet cable is plugged into a port that does not require authentication.
2. Configure the IP-ACM v2 to connect to the controller.
3. Connect to the IP-ACM Status/Control web page:
a. Enter the IP address.
b. Enter the IP-ACM v2 password and click Login.
17

NOTE NOTE: The default case-sensitive login password is iSTAR.
4. Wait for the IP-ACM v2 to download the new firmware and Reboot.
Copyright and Trademarks
©2019 Johnson Controls. All rights reserved. JOHNSON CONTROLS, TYCO and C•CURE 9000 are trademarks and/or registered trademarks.
Unauthorized use is strictly prohibited. Product offerings and specifications are subject to change without notice. Actual products may vary from
photos. Not all products include all features. Availability varies by region; contact your regional sales representative.
Canadian Radio Emissions Requirements
The digital apparatus does not exceed the Class A limits for radio noise emissions from digital apparatus set out in the Radio Interference
Regulations of the Canadian Department of Communications.
Le present appareil numerique n’emet pas de bruits radioelectriques depassant les limites applicables aux appareils numeriques de la class A
prescrites dans le Reglement sur le brouillage radioelectrique edicte par le ministere des Communications du Canada.
FCC Digital Device Limitations
Radio and Television Interference
This equipment has been tested and found to comply with the limits for a digital device, pursuant to Part 15 of the FCC rules. These limits are
designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This
equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may
cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which
case the user will be required to correct the interference at his own expense.
Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any
interference received, including interference that may cause undesired operation.
In order to maintain compliance with FCC regulations, shielded cables must be used with this equipment. Operation with non-approved equipment
or unshielded cables is likely to result in interference to radio and television reception.
Caution: Changes or modifications not expressly approved by the manufacturer could void the user’s authority to operate this
equipment.
18