Tosibox Lock 500 User manual

1TABLE OF CONTENTS
LOCK & KEY USER MANUAL
Lock 100•
Lock 200•
Lock 500/500i•
Key•
Version 1.5.8

TABLE OF CONTENTS
2
TABLE OF CONTENTS
1. TOSIBOX®Overview 3
2. TOSIBOX®Introduction 4
2.1 Glossary 4
2.2 TOSIBOX®Lock Intended Use 4
2.4 Safety And Hazards 5
3. TOSIBOX®Key, Lock, User Interfaces,
Mobile Clients Overview 8
3.1 TOSIBOX®Key 8
3.2 TOSIBOX®Lock 9
3.3 Lock Connections 10
3.4 User Interface – Lock 13
4. Instructions for TOSIBOX®Key And Lock Setup 14
5. TOSIBOX®Lock 15
5.1.1 Deploying The Lock In “Lock Mode” 15
5.1.2 Deploying The Lock In “Client Mode” 16
5.2 Connecting Locks 17
5.3 updating the Lock software 17
5.4 USB Modem settings for the lock 18
5.5 Internal Modem Settings For The Lock(Lock 500i only) 18
5.6 WLAN settings for the Lock (Lock 100 and Lock 500 only) 18
5.7 Key connection settings for the Lock 18
5.8 Advanced settings for the Lock 19
5.9 Internet connection priorities 19
5.10 PoE (Lock 200 only) 19
5.11 Service Port 19
5.13 Mounting instructions for lock 200 20
5.14 Mounting Instructions For Lock 500 22
6. TOSIBOX®Key 26
6.1 Taking the Master Key into use 26
6.2 Renaming and using devices 29
6.3 Adding extra Keys 29
6.4 Remote matching of extra keys 35
6.5 PUK code for the Key 35
7. Mobile Client 36
7.1 Mobile Client for Android Devices 36
7.2 Mobile Client for iPhones and iPads 41
8. Lock 500 Digital I/O Features 46
8.1 Digital In/Out port with 24V DC out 46
8.2 Software Configurable I/O 46
9. Troubleshooting 48
10. Maintenance instructions 48
11. Technical data 49
11.1 TOSIBOX®Locks 49
11.2 TOSIBOX®Key 55
12. Limited Warranty 56
13. Legal Notices 57
14. Declarations 57
14.1 Lock 100 Declarations 57
14.2 Lock 200 Declarations 58
14.3 Lock 500 Declarations 58

3TABLE OF CONTENTS
1. TOSIBOX®OVERVIEW
Tosibox was born from the idea that secure remote access doesn’t
have to be complicated, expensive or time-consuming.
TOSIBOX®offers a new, automatic way to establish a remote
connection easily, quickly and securely. TOSIBOX®is the world’s
only remote access device with the patented Plug & GoTM
technology.
The solution consists of Key and Lock devices that are taken into
use by matching the Key physically using the USB port of the Lock.
TOSIBOX®Locks and Keys that have been matched together will
discover each other over the Internet and on separate local
networks regardless of how they are connected to the Internet.
This allows the control of network devices in the Lock’s LAN
network.
Tosibox delivers fast and easy remote access to your machines
and devices anywhere you can establish a network connection.
TECHNICAL SUPPORT:
[email protected]
FINLAND
[phone]
Opening hours:
from 8 am till 4 pm Mon – Fri (UTC+2 time zone)
GLOBAL
[phone]
Opening hours:
from 8 am till 4 pm Mon – Fri (UTC+2 time zone)
For country specific Technical Support contact details go to:
http://www.tosibox.com/support
VPN tunnel through Internet
PC
TOSIBOX®
Mobile
Client
TOSIBOX®
Key
W
A
N
L
A
N
Firewall
TOSIBOX®
Lock
HMI
PLC
Camera
PC

TABLE OF CONTENTS
4
2.1 GLOSSARY
KEY
An intelligent USB-connected device that contains a secure
cryptoprocessor. The Key is used to establish a secure connection
to the Lock.
SUB KEY
An additional Key that has restricted access rights.
BACKUP KEY
A duplicated backup copy of the Key. All matched Keys and Locks
are automatically synchronized between the original Key and the
Backup Key.
LOCK
Device that accepts remote connections from matched Keys
and creates private and secure access to connected network
devices. The network devices that are connected to the Lock´s LAN
port are automatically found. The Lock automatically distributes
IP addresses for the Keys, Sub Keys and the network devices
connected to LAN port(s) of the Lock. The Lock can also control
network devices with fixed IP addresses.
SUB LOCK
A Lock that has been converted to Sub Lock mode of operation.
When connecting two Locks to each other, one must be in Sub Lock
mode of operation.
2.2 TOSIBOX®LOCK INTENDED USE
The Lock is used for controlling other devices remotely over the
Internet via a VPN connection. To be installed into a DIN rail, inside
a cabinet with the controlled devices. Alternatively, the Lock may
be standing on its rubber feet on a table or a shelf. The product
conformity with the requirements is guaranteed only when using
the antennas supplied with the product. The use of other antennas
will void the conformity and is not allowed.
Lock 100:
• Office and residential environment
Norway: Use of this radio equipment (Wi-Fi) is not allowed in the•
geographical area within a radius of 20 km from the centre of Ny-Ålesund,
Svalbard, Norway.
Lock 200• : Office, residential and light industrial environment
Lock 500:
• Office, residential and light industrial environment
NO
Norway: Use of this radio equipment (Wi-Fi) is not allowed in the•
geographical area within a radius of 20 km from the centre of Ny-Ålesund,
Svalbard, Norway.
2.3 IMPORTANT NOTICE FOR WIRELESS OPERATION OF
TOSIBOX®LOCK
Because of the nature of wireless communications, transmission
and reception of data can never be guaranteed. Data may be
delayed, corrupted (i.e., have errors) or be totally lost. Although
significant delays or losses of data are rare when wireless devices
are used in a normal manner with a well-constructed network,
TOSIBOX®Lock with cellular modem should not be used in situations
where failure to transmit or receive data could result in damage
2. TOSIBOX®INTRODUCTION

5TABLE OF CONTENTS
of any kind to the user or any other party, including but not limited
to personal injury, death, or loss of property. Tosibox Oy and its
affiliates accept no responsibility for damages of any kind resulting
from delays or errors in data transmitted or received using
TOSIBOX®Lock with cellular modem, or for failure of the TOSIBOX®
Lock with cellular modem to transmit or receive such data.
2.4 SAFETY AND HAZARDS
At least 20 cm separation distance between the antennas and
persons must be maintained at all times.
Do not operate your Lock with internal or external cellular modem:
In areas where blasting is in progress
•
Where explosive atmospheres may be present including refuelling•
points, fuel depots, and chemical plants
Near medical equipment, life support equipment, or any equipment
•
which may be susceptible to any form of radio interference. In
such areas, the Lock and the cellular modem MUST BE POWERED
OFF. Otherwise, the cellular modem can transmit signals that could
interfere with this equipment.
In an aircraft, the Lock and the cellular modem MUST BE POWERED
•
OFF. Otherwise, the Lock and the cellular modem can transmit
signals that could interfere with various onboard systems and
may be dangerous to the operation of the aircraft or disrupt the
cellular network. Use of a cellular phone in an aircraft is illegal in
some jurisdictions. Failure to observe this instruction may lead to
suspension or denial of cellular telephone services to the offender,
or legal action or both. Some airlines may permit the use of cellular
phones while the aircraft is on the ground and the door is open. The
Lock and the cellular modem may be used normally at this time.

TABLE OF CONTENTS
6
TOSIBOX®Lock 200
USB Cable
DIN Rail Bracket
AC Adapter *)
Ethernet Cable
LOCK 200 SALES PACKAGE CONTENT
Cable Saddle
DC Feed Plug
Rubber Feet
*) AC Adapter model is subject to change according to the market area.
LOCK 100 SALES PACKAGE CONTENT
TOSIBOX®Lock 200
USB Cable
DIN Rail Bracket
AC Adapter *)
Ethernet Cable
Antennas (2)
DC Feed Plug

7TABLE OF CONTENTS
LOCK 500/500i SALES PACKAGE CONTENT
MODEL REGION WLAN LTE POWER KIT WLAN ANT LTE ANT
TBL5 EU/Global x x
TBL5PS EU/Global x x x
TBL5iA EU/US x x x x
TBL5iAPS EU/US x x x x x
TBL5iB APAC x x x x
TBL5iBPS APAC x x x x x
TOSIBOX®Lock 500/500i
(LTE ports only in Lock 500i)
Ethernet Cable
*) AC Adapter model is subject to change according to the market area.
AC Power Source*
LTE-Antennas (only Lock 500i)
DC-Conversion Cable
AC Plug Adapters
WiFi-Antennas
Digital I/O
Connector
SIM Card
Slot Cover
POWER SOURCE KIT SALES PACKAGE CONTENT
Power
Connector

TABLE OF CONTENTS
8
3.1 TOSIBOX®KEY
An intelligent USB-connected device that contains a secure
cryptoprocessor. The Key is used to establish a connection with
the Lock.
All TOSIBOX®Keys and Locks are interoperable.
Key user interface (installed from the Key device). In the image you can see
TOSIBOX®Lock devices which are matched with the TOSIBOX®Key and the
network devices connected to each TOSIBOX®Lock.
3. TOSIBOX®KEY, LOCK, USER INTERFACES, MOBILE CLIENTS OVERVIEW
Key

9TABLE OF CONTENTS
3.2 TOSIBOX®LOCK
TOSIBOX®Lock is a device that accepts remote connections from
matched Keys and provides access to connected network devices.
For more information, please see glossary ( on page 4.).
Web user interface of the Lock
The Lock settings can be changed via:
Service port
•
Encrypted TOSIBOX• ®VPN connection
Local network
•
Lock 100
Lock 200
Lock 500/500i

TABLE OF CONTENTS
10
LOCK 100
3.3 LOCK CONNECTIONS
WLAN ANTENNA
PORTS
DC Power Input
Reset Button
(Not used)
Service port
LAN3 Port
LAN2 Port
LAN1 Port
WAN Port
USB Port
(for matching and USB-
Modem)
WAN
LAN1
LAN2
LAN3
Service
WLAN
Power

11 TABLE OF CONTENTS
LAN3 Port
LAN2 Port
LAN1 Port
Service port
WAN Port
Info (led indicator)
Power (led indicator)
Reset Button
(Not used)
DC Power Input
USB Port
(for matching and USB-
Modem)
LOCK 200

TABLE OF CONTENTS
12
LED indicators:
Power
Internet
WiFi
LTE
WiFi Antenna Port 1
LTE Antenna Port 1
(Lock 500i only)
Ethernet Port Leds:
LAN2
WAN
LAN3
LAN1
WiFi Antenna Port 2
LTE Antenna Port 2
(Lock 500i only)
LOCK 500/500i
SIM card slot
USB Port
(for matching
and USB-modem)
Digital I/O -Connection
Ethernet Connections:
WAN Port
LAN2 Port
LAN1 Port
LAN3 Port*
Power Connection
* LAN3 Port can be configured as a Service port

13 TABLE OF CONTENTS
3.4 USER INTERFACE – LOCK
Status bar shows
general information.
Locks and Keys
Green: Connected
Red: Disconnected
Remotely controlled
devices
Green: Connected
Red: Disconnected
Login using “admin”
user.
Password can be
found on the bottom of
the Lock
Details of the remotely
controlled devices

TABLE OF CONTENTS
14
4. INSTRUCTIONS FOR TOSIBOX®KEY AND LOCK SETUP
1. 2.
3. 4.
5.
1. Make sure the Lock is powered before
proceeding to matching the Key with the Lock.
Insert the Key into the USB port of the Lock.
When the LED on the Key turns off, the matching
is complete (approximately 10 seconds)..
Remove the Key from the Lock. You can also
match additional Locks to the same Key.
2 - 3. Connect the Lock to your network according to
your use case. Remember to make sure that the
Lock has a working internet connection.
4. Connect the Key to your computer and install the
Key software. Follow the section ”Deploying the
Key”.
5. The TOSIBOX®connection is now ready to be
used to control and monitor remote devices.
THE FIRST DEPLOYMENT

15 TABLE OF CONTENTS
With its factory default settings, the Lock is connected to the
Internet via its WAN port or a USB modem which can be connected
to the USB port of the Lock. In this mode, the Lock creates its
own protected local network for the connected devices. In this
configuration, only devices that are connected to the Lock by cable
or via WLAN access point are accessible with the Key.
Notes:
See “USB Modem settings for the lock” (page 18)•
to connect a USB modem to the Lock’s USB port.•
If the Lock is connected to a DHCP enabled network via any of its LAN ports•
(LAN1, LAN2 or LAN3) the Lock’s own LAN functionality can be restored by
resolving any DHCP conflicts by removing improper LAN connections to the
Lock.
CONNECTING NETWORK DEVICES TO THE LOCK
A) Connecting device(s) that use dynamic IP addresses (DHCP)
Devices with a DHCP client enabled will automatically connect to the
Lock. Plug the device(s) into the Lock’s LAN port(s) and go!
B) Connecting device(s) with Fixed IP addresses by configuring
the DEVICE to the LOCK:
5.1.1 DEPLOYING THE LOCK IN “LOCK MODE” Before connecting device to Lock, connect to device per device1.
manufacturer’s instructions on your PC and assign a new static
IP address to device(s) from the Lock’s IP range printed on
the bottom label of the Lock. Do not add same IP address. We
recommend adding the next IP sequential address ABOVE the IP
address on the lock, and so forth for each additional device. (*Note:
Lock’s IP and netmask address can also be found in the service port
at Network > LAN)
Plug the device(s) into the Lock’s LAN port(s) and go!2.
C) Connecting device(s) with Fixed IP addresses by configuring
the LOCK to the DEVICE:
Get the device(s’) IP address(es) and netmask.1.
Connect your PC to the Lock’s service port and log in following the2.
step 1 on page 15 “Updating the Lock software”.
Go to Network->LAN and change the IP address in the “IPv43.
address” field to the next IP address above the IP address of
the device (step 1). Also check that the “IPv4 netmask” field
corresponds to the netmask set on the device and change it if
necessary.
Plug the device(s) into the Lock’s LAN port(s) and go!4.
ADVANCED/ENTERPRISE USERS ONLY: Go to Network>LAN DHCP5.
SERVER and set the “Start” value so that it’s higher than all used
static addresses. Set the limit value to a suitable value so that it
covers the rest of the unused addresses in the LAN range. For
example, the range 192.168.5.50 – 192.168.5.254 contains 205
addresses so the “Start” value would be 50 and the “Limit”value
would be 205.
VPN tunnel through Internet
PC
TOSIBOX®
Mobile
Client
TOSIBOX®
Key
W
A
N
L
A
N
Firewall
TOSIBOX®
Lock
HMI
PLC
Camera
PC
5. TOSIBOX®LOCK

TABLE OF CONTENTS
16
5.1.2 DEPLOYING THE LOCK IN “CLIENT MODE”
Client mode can be used for connecting the Lock to an existing
network (e.g. an office network). In this mode, the Lock joins the
network like any other device (e.g. a PC) and provides remote
users with access to other devices in the same network. The Lock
will obtain its address from the DHCP, so the local network needs
to have a working DHCP server that allocated IP addresses.
A) Connecting network devices in Client Mode
Log into the Lock’s web user interface as admin and open the LAN1.
settings by clicking Network > LAN.
Change the LAN interface protocol field to “DHCP Client”. Click the2.
“Switch Protocol” button and click “Save”.
Plug in a cable from the local network into one of the Lock’s LAN3.
ports and go!
Notices in Client Mode:
Do not connect the internet to the Lock’s WAN Port or a USB modem to the•
USB port. Doing so will automatically deactivate the client mode and revert the
Lock’s LAN settings back to factory defaults.
Do not connect any LAN port directly to the internet.
•
Do no connect the controlled devices to any LAN port.•
The lock will scan the entire LAN network for connected devices and will grant•
device access to any user with a matched Key. Please keep this in mind when
considering network and information security.
In cases where access rights need to be restricted, switch on MAC/IP
•
Filtering (under Advanced Settings) or set up the Lock in its factory default
configuration.
In this mode, the Lock’s inbuilt firewall does not protect the devices in the LAN
•
network.
VPN tunnel through Internet
PC
TOSIBOX®
Key
Server
PC/Laptop
Printer
PC
TOSIBOX®
Lock
Router
L
A
N

17 TABLE OF CONTENTS
Lock
Sublock Sublock Sublock
5.2 CONNECTING LOCKS
With TOSIBOX®Locks one can connect machines in separate
places so that the connection between them is permanently and
automatically on. One example is a real-time protected connection
between home and office. This is made with a Lock/Sub Lock
solution (see accompanying image Connecting Locks). Up to 10 Sub
Locks can be connected to one Lock.
First match the Key to all the Locks to be connected as described
in section “Instructions for TOSIBOX®Key and Lock setup”.
CONNECTING LOCKS
Insert a matched Key to the USB port of the computer.1.
Choose ”Devices” from the Key user menu and ”Connect Locks”2.
from the drop down menu.
Choose the Locks that you want to connect together and choose3.
”Next”.
Choose the Lock that you want to attach the Sub Locks. The other4.
Locks will be changed to Sub Lock operating mode.
Confirm the selection > Save > matching is ready.5.
Note: The connections will come into effect when the Locks have
access to the Internet.
The Sub Lock ends of the connection in the picture do not have
their own DHCP service. If the connection between the Lock and
the Sub Lock is interrupted, the network devices connected with
the Sub Lock can no longer connect to the Internet and each other.
5.3 UPDATING THE LOCK SOFTWARE
a. Connect the computer to the service port of the Lock with1.
an ethernet cable. First check that you have access to the
Internet via the service port. Open an internet browser and type
http://172.17.17.17 into the address field to access the Lock user
interface. Do not type “www” before the “http://” in the address.
b. Alternatively you can also log in remotely. When the connection
between the Key and the Lock is active, double click the Lock symbol
in the Key user interface.
Log in using “admin” for the user ID. The default admin password is2.
visible on the bottom of the Lock.

TABLE OF CONTENTS
18
Choose “Settings” > “Software update”. If there is a software3.
update available for the Lock, you can start the update by clicking
the “Start software update” button.
Wait until the update has been downloaded and installed. Do not4.
interrupt the power of the Lock during the software update
process. The update is complete when the software gives a notice
“Software updated successfully”.
Automatic software updates are activated as a default setting.
You can select the time when the automatic update of the released
software is allowed. You can deactivate the automatic software
update from the Lock user interface.
Choose “Settings” > “Software update” > uncheck the box “Auto-
update enabled”.
5.4 USB MODEM SETTINGS FOR THE LOCK
You can connect the Lock to the Internet with a USB Modem. For
information on supported modems go to:
http://www.tosibox.com/support.
Log in as admin user, select “Network” > “USB Modem”.1.
Either use the Automatic APN setting or fill in the APN and if2.
necessary the PIN field according to the SIM card settings. For APN
settings information, please contact your mobile operator.
Confirm the selection > Save.3.
Connect a Tosibox supported USB Modem to the USB port of the4.
Lock
5.5 INTERNAL MODEM SETTINGS FOR THE LOCK
(LOCK 500I ONLY)
You can connect the Lock to the Internet with an internal Modem.
Before inserting or removing the SIM card(s), disconnect the Lock
power supply.
Log in as admin user, select “Network” > “Internal Modem”1.
Either use the Automatic APN setting or fill in the APN and if2.
necessary the PIN field according to the SIM card settings. For APN
settings information, please contact your mobile operator.
Confirm the selection > Save.3.
5.6 WLAN SETTINGS FOR THE LOCK
(LOCK 100 AND LOCK 500 ONLY)
On Lock 100 and Lock 500 you can configure the WLAN as Client
(providing Internet access for the Lock) or as Access Point
(providing access to Lock LAN and Internet for wireless devices).
For detailed set-up instructions go to
http://www.tosibox.com/support.
5.7 KEY CONNECTION SETTINGS FOR THE LOCK
You can change the Key connection type from Layer 3 -routed
(default) to Layer 2 -bridged (“Connection type” > “Layer 2
-bridged”).
On Layer 2 connections you can allow connections from Lock to
Key. Log into the Lock as admin, select “Settings” > “Keys and
Locks” > remove selection “Deny access towards client”

19 TABLE OF CONTENTS
For more details on Layer 2 and Layer 3 connections go to:
http://www.tosibox.com/support.
5.8 ADVANCED SETTINGS FOR THE LOCK
On the Advanced settings page you can configure LAN and Internet
access restrictions and security related settings.
Log in as admin1.
Choose “Settings” > “Advanced settings”2.
Confirm changes > Save3.
5.9 INTERNET CONNECTION PRIORITIES
Several alternative Internet connections can be used by the Lock:
WAN1.
USB modem2.
WLAN (Lock 100 Lock 500 only)3.
Internal modem (Lock 500i only)4.
One of the available connections can be selected as a main
connection and the other connections can be set as backup
connections. In the event that the main connection is interrupted,
the connection is automatically shifted to preselected backup
connections according to the priority setting (eg. WAN port > USB
Modem). The connection is switched back to the main connection
once it is available again.
5.10 POE
(LOCK 200 ONLY)
The “PoE out” port supports PoE output, with auto detection
feature. This means you can connect laptops and other non-PoE
devices without damaging them. The PoE on “PoE out” outputs
approximately 2V below input voltage and supports up to 0.58A (So
e.g. 24V PSU will provide 22V/0.58A output to the “PoE out” port).
The device accepts powering from the power jack or from the “PoE
in” port (passive PoE)
DC power jack (5.5mm outside and 2mm inside diameter, female1.
center pin positive) accepts 8-27V DC +/-10%
The “PoE in” port accepts passive Power over Ethernet 8-27V DC2.
+/-10%
Under maximum load, the power consumption of this device is 7W.
5.11 SERVICE PORT
On Lock 100 and Lock 200 a dedicated Service Port is available.
On Lock 500, LAN3 port can be configured as Service port by
pressing the reset button for 3 seconds when there is no cable in
LAN3. When completed, the Internet status LED will blink for three
seconds. Lock Management Interface can then be accessed by
entering http://172.17.17.17 on the address bar of your browser.
Assigning the port back to LAN range can be done following the
same procedure or by restarting the device.

TABLE OF CONTENTS
20
5.12 MOUNTING INSTRUCTIONS FOR LOCK 100
QUICK INSTALLATION TO DIN RAIL
The bottom of the Lock has integrated hooks that allow a quick
installation to DIN rail with the LAN/WAN ports facing upwards.
SECURE INSTALLATION TO DIN RAIL
For environment where a more robust installation method is
needed or another installation orientation is wanted, the Lock
can be installed to DIN rail with the clip and screws included in
the sales package. There are M4 threaded mounting holes on the
bottom of the equipment. The screws shall be placed through the
bottom sticker which has the hole locations indicated. Use only the
Lock 100 with DIN clip
screws included in the sales package. Using longer screws pose
a risk of damaging the device internal electronics. More versatile
installation options to DIN rail, such as angle brackets are available
from an authorized TOSIBOX®reseller as an accessory.
WALL MOUNTING
The bottom of the Lock has two keyhole shaped openings that allow
the Lock to be installed on the wall with countersunk screws.
5.13 MOUNTING INSTRUCTIONS FOR LOCK 200
INSTALLATION TO DIN RAIL
The Lock can be installed to DIN rail with the clip and screws
included in the sales package. There are M3 threaded mounting
holes on three sides of the equipment. For attachment on either of
the narrow sides, the screws with length of 10 mm shall be used.
For attachment on the bottom of the Lock, the screws with length
of 6mm shall be used. The screws shall be placed through the
bottom sticker which has the hole locations indicated.
Please see pictures 1 - 4 for the mounting options.