Johnson Controls P2000 User manual

VPN/DSL Security Option
Installation Manual
P2000
Security Management System
April, 2012
24-10618-155 Revision A

P2000
Security Management System
VPN/DSL Security Option
Installation Manual
April, 2012
24-10618-155 Revision A
Security Solutions
[phone]
www.johnsoncontrols.com

Copyright 2012
Johnson Controls, Inc.
All Rights Reserved
No part of this document may be reproduced without the prior permission of Johnson Controls, Inc.

Acknowledgment
Cardkey P2000, BadgeMaster, and Metasys are trademarks of Johnson Controls, Inc.
All other company and product names are trademarks or registered trademarks of their
respective owners.
If this document is translated from the original English version by Johnson Controls, Inc., all
reasonable endeavors will be used to ensure the accuracy of translation. Johnson Controls, Inc.
shall not be liable for any translation errors contained herein or for incidental or consequential
damages in connection with the furnishing or use of this translated material.
Due to continuous development of our products, the information in this document is subject to
change without notice. Johnson Controls, Inc. shall not be liable for errors contained herein or
for incidental or consequential damages in connection with furnishing or use of this material.
Contents of this publication may be preliminary and/or may be changed at any time without any
obligation to notify anyone of such revision or change, and shall not be regarded as a warranty.
Declaration of Conformity
This product complies with the requirements of the European Council Electromagnetic
Compatibility Directive 2004/108/EEC and the Low Voltage Directive 2006/95/EEC.
This equipment must not be modified for any reason and it must be installed as stated in the
Manufacturer’s instruction.
If this shipment (or any part thereof) is supplied as second-hand equipment, equipment for sale
outside the European Economic Area or as spare parts for either a single unit or system, it is not
covered by the Directives.

UNDERWRITERS LABORATORIES® COMPLIANCE VERIFICATION SHEET
P2000 or P2K SYSTEM
Page 1 of 3
This product is listed under Underwriters Laboratories UL™ 1076 for Proprietary Burglar Alarm Units and Systems.
When installed at the site the following requirements must be met to comply with this standard.
1. Transient protection devices that are installed must not be removed or defeated.
2. The computers audible alarm indicator must not be disabled.
3. All system components must be connected to a UL Listed Uninterruptible Power Supply that provides a
minimum of 24 hours of AC emergency power.
4. The maximum number of Panels that may be connected to the P2000 or P2K system is 1000.
5. The P2000 or P2K shall give priority to signals in the order given below and shall annunciate subsequent
signals at a rate no less than one every 10 seconds
Priority 0 Highest Priority Hold-up or Panic Alarm
Priority 1 Second Highest Burglar Alarm
Priority 2 Third Highest Burglar Alarm Supervision
Priority 3 Fourth Highest Other Supervisory Alarms
Priority 4 Fifth Highest Guard Tour
6. The “Pop-up” feature for input points must be enabled.
7. At the host computer (Central Station), alarms must not be filtered away from the host using the feature
“Message Filtering”.
8. Alarms must not be forwarded away from the host computer (Central Station) using the feature “Message
Forwarding”.
9. The “Panel Poll Interval” must not exceed 90 seconds.
10. The “Host Poll Delay” must not exceed 200 seconds.
11. P2000 or P2K server must use transient suppression devices on the LAN interfaces at the computers. The
table below specifies the devices that must be used for the various types of LAN interfaces.
LAN Interface Manufacturer of Device Device Part Number
10Base-2 Black Box® SP350A-R2 (In-line connector)
10Base-2 Black Box SP501A (“T” connector)
10Base-5 (AUI) Black Box SP362
10/100Base-T Black Box SP512A-R3
12. Systems requiring the use of a network hub, router, and/or serial port server shall have that equipment
installed in a temperature controlled environment. The temperature controlled environment must be
maintained between 13 - 35C (55 - 95F) by the HVAC system. Twenty-four hour standby power shall be
provided for the HVAC system.
13. The installer shall incorporate a supply line transient suppression device complying with the Standard for
Transient Voltage Surge Suppressors, UL 1449, with a maximum rating of 330 V. Supply line transient
suppression device is to be used with the power supply to the network hub, router, serial port server, serial-
to-ethernet converter and RS232-to-RS485 converter.
14. The 240 Vac configurations have not been tested by Underwriters Laboratories.
15. The workstation defined as “Server” must have the alarm monitor parameter set to “always active”.

UNDERWRITERS LABORATORIES COMPLIANCE VERIFICATION SHEET
P2000 or P2K SYSTEM
Page 2 of 3
16. For P2000 or P2K software version 2.5 or later, when configuring “Service Startup” parameters the
following services shall not be disabled.
P2000 RTL Route Service
P2000 CK720 Download Service
P2000 CK720 Priority Service v1.0
P2000 CK720 Priority Service v2.1
P2000 CK720 Upload Service
P2000 Periodic Service
P2000 S321 SIO Handler Service, where S321-DIN controller is used
P2000 S321-IP Interface Service, where S321-IP controller is used
P2000 SIO Handler Service, where D620 or D6AP controller is used
P2000 Smart Download Service
17. For Line Security over the Internet, between the P2000 or P2K server and the controllers CK721-A version
3.1 or higher shall be configured to use an encryption method including an Authentication Header (AH) and
an algorithm capable of Triple-DES (3DES) or better that is NIST™ certified.
18. For Line Security over the Internet, between the P2000 or P2K server and the controllers CK705, CK720,
CK721, CK721-A version 3.0 or lower, and S321-IP the following equipment shall be used.
NetScreen®, Model NS-5XT-X0X (where X is any number 0 to 9), 4-Port VPN router
The P2000 or P2K server and router shall be configured to use an encryption method including an
Authentication Header (AH) and an algorithm capable of Triple-DES (3DES) or better that is NIST
certified.
19. For Line Security over the Internet, between the P2000 or P2K server and the controllers D620, D6AP, and
S320, the following equipment shall be used.
NetScreen, Model NS-5XT-X0X (where X is any number 0 to 9), 4-Port VPN router and
Digi® International, Model EtherLite2 serial port server
The P2000 or P2K server and router shall be configured to use an encryption method including an
Authentication Header (AH) and an algorithm capable of Triple-DES (3DES) or better that is NIST
certified.
20. For Line Security over the Internet, between the P2000 or P2K server and the controller S321-DIN, the
following equipment shall be used.
NetScreen, Model NS-5XT-X0X (where X is any number 0 to 9), 4-Port VPN router and
Digi International, Model Digi One SP serial-to-Ethernet converter or
B&B Electronics Mfg Co., Model 485OT9L RS232-to-RS485 converter
The P2000 or P2K server and router shall be configured to use an encryption method including an
Authentication Header (AH) and an algorithm capable of Triple-DES (3DES) or better that is NIST
certified.
21. The router and serial port server shall be installed within the same room as the controllers S320, D620 and/
or D6AP and within 20 feet of the controller when employed for encrypted line security.
22. P2000 or P2K systems use the Digi International Model Digi One SP converter or B&B Electronics Model
485OT9L converter to communicate to S321-DIN controllers.
23. The B&B Electronics Model 485OT9L converter shall be installed within the same room as the P2000 or
P2K server and within 20 feet of the server under all conditions of use.

UNDERWRITERS LABORATORIES COMPLIANCE VERIFICATION SHEET
P2000 or P2K SYSTEM
Page 3 of 3
24. The Digi International Model Digi One SP may be mounted at the central supervising station or the
protected premise. When used at the central supervising station, a Cylix™ Model TSP-4B-E transient
suppression device shall be used on the RS485 communication line. When used at the protected premise, a
Black Box Model RS512A-R3 transient suppression device shall be used on the LAN communication line.
25. A spare router, serial port server, serial-to-Ethernet converter and RS232-to-RS485 converter shall be
available and put in to service within 6 minutes when they are employed for encrypted line security with the
controllers CK705, CK720, CK721, CK721-A version 3.0 or lower, S320, S321-DIN, S321-IP, D620 and/or
D6AP.
26. P2000 workstations, network hubs, routers, serial port servers, serial-to-Ethernet converters, and RS232-to-
RS485 converters must use signal line transient suppression devices complying with the Standard for
Protectors for Data Communications and Fire Alarm Circuits, UL 497B, with a maximum marked rating of
50V.
27. Alarm signals received at a remote P2000 or P2K server via the Remote Message Services from a different
P2000 or P2K server are supplementary.
28. Alarm signals received at a P2000 workstation are supplementary.
29. Alarm signals received at a personal computer or personal digital assistant, through the Web Access feature,
are supplementary.
30. P2000 or P2K systems use the PC232-S4-1 Protocol Converter to communicate to D620, D6AP and/or S320
controllers; a controller must be connected to the port defined as Loop 1 at the P2000 or P2K for Protocol
Converter’s tamper switch to report as an alarm.
31. The communication medium between the protected property and communications service provider shall be
for the exclusive use of the protected property and is not to be shared with other communications service
provider subscriber.
32. The following features have not been investigated by Underwriters Laboratories:
BACNet® interface
Dial-Up
Fire server
Intercom server
Intrusion server
Isonas interface
Kone™ IP elevator interface
Otis® elevator interface
TopGuard ANPR interface
33. The following products have not been investigated by Underwriters Laboratories and shall not be used in a
listed system:
Aritech intrusion panel
Assa Abloy® door service router (DSR) and reader
Notifier® fire alarm panel
OSI product line
P900 product line
34. The P2000 or P2K and HID® Edge access control unit may be used for access control monitoring purposes
only.
35. A Panel Down alarm message received at the central station may be an indication of a compromise attempt.
36. For the S321-IP, the “Heartbeat Transmit Interval” must not exceed 90 seconds and the “Host Reception
Timeout” must not exceed 200 seconds.
37. Alarm signals received from the Bosch® D9412GV3 are supplementary.
38. An external speaker device shall be provided for audible indication of change of status of a protective circuit
initiated at the protective premise.

TABLE OF CONTENTS
24-10618-155 Rev. A vii
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
Chapter 1: Introduction
Chapter Summaries ................................................................................................................................. 1-1
Manual Conventions ................................................................................................................................ 1-1
Chapter 2: Configuration
IPSEC Parameters................................................................................................................................... 2-1
P2000 Server IP Address................................................................................................................. 2-1
VPN Router WAN IP Address.......................................................................................................... 2-1
VPN Router LAN IP Address ........................................................................................................... 2-2
Hardware Installation and Configuration.................................................................................................. 2-2
P2000 Server to Back End Router Connection................................................................................ 2-4
NetScreen-5XT Router Installation and Configuration..................................................................... 2-5
NetScreen-5XT Installation ......................................................................................................2-5
NetScreen-5XT Configuration .................................................................................................. 2-6
Resetting the NetScreen-5XT Router .................................................................................... 2-13
Linksys BEFVP41 Router Installation and Configuration............................................................... 2-13
Linksys BEFVP41 Installation ................................................................................................ 2-13
Linksys BEFVP41 Configuration ............................................................................................ 2-14
Linksys BEFSX41 Router Installation and Configuration............................................................... 2-15
Linksys BEFSX41 Installation ................................................................................................ 2-15
Linksys BEFSX41 Configuration ............................................................................................ 2-16
Resetting the Linksys Router ................................................................................................. 2-18
Installing the Digi EtherLite Device (S320 Connection Only)......................................................... 2-18
Installing the Digi One® SP (S321 Connection Only) .................................................................... 2-19
Appendix A: Glossary

Table of Contents VPN/DSL Security Option
viii 24-10618-155 Rev. A
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.

24-10618-155 Rev. A 1-1
Chapter 1
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
INTRODUCTION
This document describes how to provide end-to-end security between the P2000 server and
CK721-A, CK721, CK720, S321, or S320 controllers or P2000 workstations using a Virtual
Private Network (VPN).
A VPN provides a means of securing communications between a P2000 server and one or
more remote CK721-A/CK721/CK720/S321/S320 controllers and/or P2000 workstations
across an untrusted public Wide Area Network (WAN).
A VPN connection can link two Local Area Networks (LANs). The traffic that flows
between these points passes through shared resources such as routers, switches, and other
network equipment that make up the public WAN. To secure communication while passing
through the WAN, the two participants create an IP Security (IPSec) tunnel.
CHAPTER SUMMARIES
Chapter 1: Introduction describes the purpose of this document and the manual
conventions.
Chapter 2: Configuration contains information on IP addresses and VPN
configuration.
Appendix A: Glossary explains some of the terms used in this manual.
MANUAL CONVENTIONS
The following items are used throughout this manual to indicate special circumstances,
exceptions, important points regarding the equipment or personal safety, or to emphasize a
particular point.
NOTE
Notes indicate important points or exceptions to the information provided in
the main text.

Introduction VPN/DSL Security Option
1-2 24-10618-155 Rev. A
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.

24-10618-155 Rev. A 2-1
Chapter 2
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
CONFIGURATION
IPSEC PARAMETERS
An IPSec tunnel consists of a pair of unidirectional Security Associations (SAs)—one at
each end of the tunnel—that specify the security parameter index (SPI), destination IP
address, and security protocol (Authentication Header or Encapsulating Security Payload)
employed.
Table 2-1: IPSEC Parameters
Mode Tunnel
Protocol Encapsulating Security Payload (ESP), Authentication
Protocol (AH)
Authentication SH1 Secure Hash Algorithm-1 (SHA-1)
ESP Encryption Triple DES (3DES) 168-bit Key
Key Management AutoKey IKE with a preshared key
Diffie-Hellman Exchange Group 2 1024-bit modulus
Perfect Forward Secrecy (PFS) Enabled
Phase 1 3DES
Main Mode (six message exchange)
Group 2:
Preshared Key
Phase 2 Quick Mode
ESP
PFS
P2000 Server IP Address
IP Address: 200.0.0.1 (static IP address)
Subnet Mask: 255.255.255.0
VPN Router WAN IP Address
IP Address: 201.0.0.2 (static IP address)
Subnet Mask: 255.255.255.0

Configuration VPN/DSL Security Option
2-2 24-10618-155 Rev. A
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
VPN Router LAN IP Address
IP Address: 192.168.1.1
Subnet Mask: 255.255.255.0
HARDWARE INSTALLATION AND CONFIGURATION
The hardware listed below is not provided in the P2000 hardware package. In order to
implement the VPN/DSL Security Option, you must purchase the necessary equipment from
your local computer supplier or by contacting the manufacturer directly.
The VPN/DSL Security Option can be configured with the Linksys® and/or NetScreen®
routers listed below. Linksys routers are less expensive, but are not National Institute of
Standards and Technology (NIST) certified or Underwriters Laboratories (UL®) compliant.
Select the routers according to your site requirements.
Table 2-2: Required Hardware
Make/Model Description
Combination of two of the following (see
router combination information below):
NetScreen-5XT (NIST Certified) 
Linksys BEFVP41
Linksys BEFSX41

VPN Routers with 4-Port 10/100 Switch
You must have one of the following router combinations:
Two (2) NetScreen-5XT routers
One (1) Linksys BEFSX41 (front end) router and one (1) Linksys BEFVP41
(back end) router
One (1) NetScreen-5XT (front end) router and one (1) Linksys BEFVP41
(back end) router
Contact Information: NetScreen www.juniper.net
Linksys www.linksys.com

Figure 2-1: Router Hardware Configuration
2
200.0.0.1
255.255.255.0
192.168.1.1
255.255.255.0
192.168.1.1
255.255.255.0
P2000
Server
IPSec Tunnel
NetScreen VPN Router
Model 5XT
Linksys VPN Router
Model BEFSX41
OR
201.0.0.x
255.255.255.0
Wide Area Network (WAN)
201.0.0.x
255.255.255.0
Wide Area Network (WAN)
Controller
192.168.1.x
255.255.255.0
OR
192.168.1.x
255.255.255.0
Workstation
201.0.0.x
255.255.255.0
Wide Area Network (WAN)
201.0.0.x
255.255.255.0
Wide Area Network (WAN)
200.0.0.x
255.255.255.0
200.0.0.x
255.255.255.0
NetScreen VPN Router
Model 5XT
Linksys VPN Router
Model BEFVP41
OR
FRONT END
ROUTER
BACK END
ROUTER
Wide Area Network
(WAN)
VPN/DSL Security Option Configuration
24-10618-155 Rev. A 2-3
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.

Figure 2-3: P2000 Server to Linksys BEFVP41 Router Connection
Figure 2-2: P2000 Server to NetScreen-5XT Router Connection
P2000 Server
(Rear View)
Ethernet
WAN
Linksys BEFVP41 Router
1234 POWER
Reset II X
WAN
Configuration VPN/DSL Security Option
2-4 24-10618-155 Rev. A
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
P2000 Server to Back End Router Connection
To connect the P2000 Server to the back end router, connect a network cable from
one of the Router’s Trusted (or available LAN) ports to the P2000 Server.
P2000 Server
(Rear View)
Ethernet
UNTRUSTED
NetScreen-5XT Router
TRUSTED
43 2 1
DC POWER
CONSOLE MODEM
WAN

VPN/DSL Security Option Configuration
24-10618-155 Rev. A 2-5
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
NetScreen-5XT Router Installation and Configuration
This section describes how to install and configure the NetScreen-5XT router.
Figure 2-4: NetScreen-5XT Back End Installation
NetScreen-5XT Installation
The NetScreen-5XT router may be used as the front end router, back end router, or
both.
To install the NetScreen-5XT router:
1. Connect the power adapter to the rear panel of the NetScreen-5XT.
The NetScreen-5XT device runs a 100-240 V
AC +/- 10% and 12 watts. When
properly connected to an AC power source, the power LED on the faceplate
illuminates solid green. When power fails, the power LED turns off.
2. Connect a network cable from a laptop or PC to one of the NetScreen-5XT’s
available Trusted ports.
This connection will be used to configure the NetScreen’s settings.
3. Back End Installation: Connect a network cable from the P2000 Server to a
Trusted port of the NetScreen-5XT router. See Figure 2-4.
Laptop or PC
UNTRUSTED
NetScreen-5XT Back End Router
Ethernet
TRUSTED
43 2 1
DC POWER
CONSOLE MODEM
Used for Configuration
Purposes Only
P2000 Server
(Rear View)
Ethernet
WAN

Figure 2-5: NetScreen-5XT Front End Installation
Configuration VPN/DSL Security Option
2-6 24-10618-155 Rev. A
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
4. Front End Installation: Connect a network cable from the NetScreen-5XT’s
Untrusted port to the WAN. See Figure 2-5.
Connect a network cable from an available Trusted port on the
NetScreen-5XT to the Controller or Workstation.
Laptop or PC
UNTRUSTED
NetScreen-5XT Front End Router
Ethernet
TRUSTED
4321
DC POWER
CONSOLE MODEM
Used for Configuration
Purposes Only Controller or
Workstation
WAN
NetScreen-5XT Configuration
This section provides instructions for configuring the NetScreen-5XT’s parameters
using the WebUI.
To access the NetScreen using the WebUI:
Follow these steps to access the NetScreen-5XT device with the WebUI
management application.
1. Connect a local PC or laptop to one of the Trusted interfaces on the router.

VPN/DSL Security Option Configuration
24-10618-155 Rev. A 2-7
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
2. Change the IP address of the PC to 192.168.1.xxx (where xxx can be
between 2 and 254) and change the subnet mask to 255.255.255.0.
3. Open your browser and enter the NetScreen’s default LAN IP address of
192.168.1.1 in the Address bar.
Example: http://192.168.1.1
The Enter Network Password dialog box appears.
4. Enter netscreen in the User Name and Password fields. Use lowercase
letters only. The User Name and Password fields are both case sensitive.
5. Click OK.
The Initial Configuration Wizard appears.

Configuration VPN/DSL Security Option
2-8 24-10618-155 Rev. A
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
To configure the NetScreen with the Initial Configuration Wizard:
1. Select NAT Mode and click Next.
2. Enter master into the Password and Confirm Password fields; click Next.
3. Select Static IP, enter the following, and click Next:
Untrusted Zone Interface IP: 200.0.0.2
Netmask: 255.255.255.0
Gateway: 200.0.0.1
4. Enter the following and click Next.
Front End Router:
Trust Zone Interface IP: 192.168.1.1
Netmask: 255.255.255.0