Question 1

2N Fortis deployment with 2N Access Commander and Fortis Commander

Accepted Answer

This FAQ article describes the initialisation and deployment of 2N Fortis Cylinders and Handles (also known as 2N Electronic locks) and configuration with 2N Access Commander.  This solution has the following prerequisites:    2N Access Commander version 3.5+At least one 2N OS device running FW version 2.50+ or 3.0+ or later, with a compatible RFID card reader (MIFARE ® DESFire® EV1/EV2/EV3 compatible) connected to the 2N Access Commander as well.For the configuration, the External RFID Card Reader 125kHz + 13.56MHz with NFC (USB) (part numbers 9137424E or 9137421E ) and the External USB driver (1.8.0 or higher) are required. It is also required to have a computer (laptop) equipped with Bluetooth and Microsoft Windows OS (recommended version 10+).   Some additional useful information: Supported cards are MIFARE ® DESFire® RFID cards EV1/EV2/EV3.2N provides MIFARE ® DESFire® RFID cards/fobs  EV3 4K (part numbers 11202601 and 11202602).One such 2N RFID access card can be used for access to up to 90 doors with the 2N Electronic locks, depending on the number of time profiles applied. However, the 2N Fortis Cylinders and Handles can be grouped so the 2N RFID access card can be used for more accesses. More information can be found in this FAQ article. If the card memory capacity is exceeded, data writing to the card will fail. A write failure event is recorded in the system access log.    Please make sure you have the External RFID Card Reader connected, the 2N Driver for External USB Readers installed, and set up with at least the following settings:      Where are credentials stored?  Unlike 2N OS IP devices, where access credentials are stored in the device, credentials for access are stored in MIFARE ® DESFire® cards as a list of allowed handles or cylinders.   How are the access rights updates made?  Information on user cards is updated by scanning the card on an RFID reader on a 2N OS device that the card is authorised for; therefore, at least one 2N OS device with a compatible RFID reader must be used.  To update information on cards, users must be authorized for that particular 2N OS device.    Table of article's content: Configuration of 2N Access Commander for 2N Electronic locks Configuring  2N Fortis devices in 2N Access Commander Configure each of 2N Electronic locks in your installation 2N Fortis Commander configuration Allowing an access to each lock in 2N Access Commander Program user cards and assign them to users Program additional maintenance cards Erase programmed card   Configuration of 2N Access Commander for 2N Electronic locks Go to the "Settings -> Electronic locks" section of the 2N Access Commander's web interface.  If there are no IP devices compatible with 2N electronic locks connected to 2N Access Commander, a message will be shown.     Add a compatible 2N OS IP device to Access Commander When a compatible 2N OS IP device is added to the 2N Access Commander, a message about the device not being configured will be displayed as well. It is because the encryption keys have not been generated in 2N Access Commander yet.  Click on the "Generate keys" button, select and confirm a Main Encryption key and continue by clicking on the "Generate" button. Note that the main encryption key is not visible in the application later on. We recommend making a copy of the selected key and storing it in a safe place.        After generating the key, the message about the 2N OS IP device configuration should disappear, and a message about encryption keys being set up should be shown (if the message about the device's configuration does not disappear, please refresh the page).  Double-check the 2N OS IP device in case the message is still showing up In case the message does not disappear even after a while or refreshing the page, please visit the configuration page of that particular 2N OS device itself and navigate to the section Hardware - Extenders (or Card reader) The Pair button associated to device's RFID reader needs to be greyed out. If it is not, click on it to pair the RFID reader in the device.     If all is set correctly, you shall see a message about encryption keys being set up in 2N Access Commander.     Configuring 2N Fortis devices in 2N Access Commander Now you need to add the 2N Electronic locks as devices to the 2N Access Commander. Initially, you need to add just a list of the names for each 2N Fortis device added.  Add the list of 2N Electronic locks to the 2N Access Commander Go to the "Devices" section, click on the +Device button, select the 2N Electronic lock option, name the lock and click on the Add button.            Add all your 2N Electronic locks and name them to suit their deployment locations or usage. After adding the 2N Electronic locks, it is possible to add the device to the correct zone (can be assigned later, after the lock is fully configured).     After all 2N Electronic locks are added to the 2N Access Commander, in the section "Devices", you can see the 2N electronic locks' status being NOT CONFIGURED.     Configure each of the 2N Electronic locks in your installation To fully configure the 2N Electronic locks with the 2N Access Commander, it is necessary to create a Lock setup & Service RFID card and export a 2N Fortis Commander project file containing a list of all your added 2N Electronic locks in 2N Access Commander, which will be imported into the 2N Fortis Commander software.   Create Lock setup & Service card First, go to the "Settings -> Electronic Locks" section and click on the Create button in the "Maintenance cards" section to create the Lock setup & Service card.     Select the Lock setup & Service option and the card expiration date, and click on Continue.     Place the MIFARE ® DESFire® card (EV1, EV2 or EV3) on the USB card reader and keep it there until the process is complete. You will hear a tone being played first and melody after a short while from the External USB RFID reader, signalling that the card is successfully configured. The pop-up window will disappear as well.     Please make sure you label the card in order to recognise what card it is later.   Export a 2N Fortis Commander project First, set up a password for the 2N Fortis commander project file.       After setting up the password, the option to download the 2N Fortis Commander and the project file will be available. After downloading the project file, please download the 2N Fortis Commander and install it on your computer.    2N Fortis Commander configuration When the 2N Fortis Commander is installed, it is possible to open the project file, which was downloaded from the 2N Access Commander on your computer.  The 2N Fortis Commander will automatically open and will ask for the password, which was created in the 2N Access Commander before the option for downloading the project file was available.      Or it is possible to open the installed 2N Fortis Commander software and open the project file which was downloaded from the 2N Access Commander by selecting the "Open project" option.     After selecting the project file, you will be asked for the password, which was created in the 2N Access Commander before the option for downloading the project file was available.     Now it is necessary to add the 2N Fortis electronic locks to the 2N Fortis Commander by connecting them to the 2N Fortis electronic locks.  Tap the service card to the electronic lock to enable the pairing mode. The lights on the 2N Fortis Cylinder or handle will be blinking with a blue light.  Pairing uses Bluetooth. Keep your laptop close to the 2N Fortis Cylinder/Handle throughout the pairing process. Service cards can be created for your project in the Access Commander (Settings > Electronic Locks > Maintenance cards) section of the 2N Access Commander.        Once the 2N Fortis Lock/Handle is paired and connected with the computer, it is possible to see the details about the device.  Now it is necessary to assign the connected 2N Fortis Handle/Cylinder to the device that was created in the 2N Access Commander. based on your preference.  Click on the "Assign" button, select the device from the list of 2N Fortis devices from the 2N Access Commander and confirm it.       After assigning the lock, the status will change to "Lock assigned", and it is possible to make adjustments (more can be found in this FAQ article).  When the 2N Fortis device is assigned and configured, you can disconnect from the 2N Fortis device.     After disconnecting, you can see a list of configured and assigned 2N Fortis devices.     To pair them with the 2N Access Commander, simply close the project and upload the same project file back to the 2N Access Commander. All changes in the 2N Fortis Commander are saved after every action.            After importing the 2N Fortis Commander file into the 2N Access Commander, the 2N Electronic locks should be shown as Configured in the "Devices" section    Allowing an acces to each lock in the 2N Access Commander Add 2N electronic locks to zones You can assign a Zone to the device if you have not done so before, and continue by assigning cards to users.       Program user cards and assign them to users When programming cards for users once the card is read in user's detail it has to be initialized specifically for 2N Electronic locks Place the MIFARE ® DESFire® card (EV1, EV2 or EV3) on the USB card reader and keep it there until the process is complete. You will hear a tone being played first and melody after short while from the External USB RFID reader signalling the card is successfully configured. The pop-up up window will disappear as well.   Do not forget to add the user to Groups.  HINT: The Zone has to be connected with Group of Users via Access Rules in 2N Access Commander in order to allow access.  Program additional maintenance cards Once a project in 2N Access Commander is generated, you can create additional Maintenance cards and select the expiration date of the card.  Please make sure you label the card in order to recognise what card it is later.   Lock setup & Service Used for switching locks to service mode and performing maintenance. Supports both factory default encryption keys (for new locks) and installation keys (for ongoing service).  Battery card This card is used for already programmed 2N Electronic Cylinders in the same 2N Access Commander project to remove the battery cover. You can check the 2N YouTube channel for a video about how to operate the Battery card.  Dissassembly card This card is used for already programmed 2N Electronic Cylinders in the same 2N Access Commander project to fix it to or remove it from the cylinder in the door.  You can check the 2N YouTube channel for a video about how to operate the Assembly/Disassembly card.    Erase a programmed card Programmed cards for 2N Electronic Locks can be erased in the "Settings - Electronic locks" section of 2N Access Commander.  Place the MIFARE ® DESFire® card (EV1, EV2 or EV3) on the USB card reader and keep it there until the process is complete. You will hear a tone being played first and melody after a short while from the External USB RFID reader, signalling that the card is successfully erased.

Question 2

2N Network Scanner - Locating 2N devices in the network

Accepted Answer

The 2N Network Scanner is a simple, freely available application for locating 2N devices in the network. After searching the network, the application shows the type, firmware version and IP address of all intercoms found on a chart. This simplifies the administration and installation of intercom systems.  Prerequisites A computer with Windows / MacOS operating systemSupported 2N devices 2N Access Commander2N Access Units2N Answering units2N IP Intercoms2N LiftIP units (not for 2N Lift8)2N SIP Speakers    Installation of 2N Network Scanner Download application from the product page and install it.   Locating 2N devices  After you run the software, it will scan connected networks and provide you with list of detected 2N devices.       If you need to rescan connected networks, please click on File - Refresh.      Or by right clicking on one device and choosing the Refresh option.       Changing IP settings of a detected 2N device Right click on the device and choose the Config option.If the device is grayed out and you can´t see the Config option,then the device does not support changing IP settings via 2N Network Scanner.     In configuration, you can change between DHCP and static IP settings.You need to confirm changes by entering a password used for the Admin user.    Browsing the web configuration of the device Double click on the detected device to browse its web configuration.    Or by right clicking on the device and choosing the Browse... option.       Filtering search results You have the option to filter search results by typing into the filter box.You can filter for IP address, serial number, display name or firmware version.

Question 3

Bluetooth - Encryption Keys for Location

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   Bluetooth is a technology for wireless communication between two devices in a short distance (up to 15 m). It is based on communication between two paired devices for secure authentication. It is possible to use this technology instead of RFID cards. This identification is provided by a unique code of the end-devices that contains this technology, like almost every smartphone these days. There is a direct communication between a smartphone and 2N IP Intercom or 2N Access Unit equipped with Bluetooth module. This communication is secured and based on public and private keys that are exchanged (we use RSA-1028 asymmetric encryption and AES-128 symmetric encryption). If you paired your smartphones by the offline method (not via My2N management platform), we recommended to change the Encryption Keys for Location every 3 months in order to keep a high level of security. If you are using the on-line method via My2N management platform, then the Encryption Keys are changed automatically.   Prerequisites 2N IP Intercom or 2N Access Unit equipped with Bluetooth module,we suggest to use the latest firmware, no additional license is required.Smartphone with enabled Bluetooth and My2N apppaired with 2N IP Intercom or 2N Access Unit by the offline method according to this instructions:Bluetooth Tap in App Mode - how to setup My2n App and use the feature     Changing the Encryption Keys for Location Go to 2N device web interface, section Services - Access Control - WaveKey, and generate the new Encryption Key.  Both the old one and the new one will be available simultaneously, so all authorized apps (which can open doors on that device) will be able to exchange the previous key for new one.It is recommended to keep the old key in device for a few days, till all mobile apps exchange the stored key to match the new one. Each app will do it automatically once it is in close proximity of 2N device with updated location authentication key. After you delete old key, apps which did not get in proximity of 2N device in time will lose their ability to open these doors and mobile phone needs to be paired with 2N device device again.

Question 4

Certification for web authentication

Accepted Answer

Certificates are commonly used to identify server or device to which we are trying to connect. Nowadays digital certificates for web application are used according to the ITU X.509 standard.    The certificate is issued by some trusted issuer or Certification Authority (also shortened to CA) and assigns public key to either domain name or IP address. If certificate is issued for different IP address or domain name, than the destination really has, modern web browser will usually inform us that the web page can be forged.   Certificates are issued on limited time (for security reasons), after this time it is needed to renew validity of the certificate (often a year for server and client applications with reserve of a few days). After the expiration of a certificate web browsers will point out that the certificate is invalid because of authentication fo server will not pass.   Connectivity to our devices web interface is provided by secured HTTPS protocol, which requires valid certificate. We are sure you have already encountered this "invalid security certificate" warning in your web browser...     Prerequisites 2N IP Intercom / 2N Access Unit / 2N Answering unit / 2N SIP Audio based on 2N OS with the latest firmwareno additional license is required    Issuing certificate   Certification authority on the InternetIt is possible to find many CAs on the Internet, most of them offer trusted certificates that are issued on the domain name. Many of these CAs are already assigned to trusted root CAs in your web browser.    Your own certification authorityIt is possible to create your own CA, however it is needed to import certificate of such CA in to the web browser.We will show you example of using OpenSSL certificate toolkit under a linux based system (e.g. Ubuntu).More information you can find also here: https://ubuntu.com/server/docs/opensslhttps://jamielinux.com/docs/openssl-certificate-authority/introduction.html  Open a linux command line (terminal)Create a Certification Authority Start the procedure by this command  admin@ubuntu:~$ openssl req -out ca.crt -new -x509         During command processing you will be prompted for password creation and verification. This password will be used to protect your private key so the key file cannot be used to issue assign unauthorised certificates with your private key. Enter PEM pass phrase:  YourPassword123 Verifying - Enter PEM pass phrase: YourPassword123          Now fill in data about your CA (use your own data, below is just an example)   You are about to be asked to enter information that will be incorporated into your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: CZState or Province Name (full name) [Some-State]: PragueLocality Name (eg, city) [ ]: PragueOrganization Name (eg, company) [Internet Widgits Pty Ltd]: 2NOrganizational Unit Name (eg, section) [ ]: TechsupportCommon Name (e.g. server FQDN or YOUR name) [ ]: TestUserEmail Address [ ]:         (we left this blank)              Two files have been created (you can find them in /home) ca.crtcontaining certificate of our CAprivkey.pemcontaining private key of our CA, needed to sign and issue new certificates by this CA                   Create CSR (Certificate Sign Request) with RSA (cryptographic algorithm) Private Key Start the procedure by this command (name IPINTERCOM can be changed) admin@ubuntu:~$ openssl req -newkey rsa:2048 -noenc -keyout IPINTERCOM.key -out IPINTERCOM.csr           This file has been created (you can find it in /home) IPINTERCOM.keyRSA (cryptographic algorithm) Private Key               Now fill in data about the certificate and its owner.(use your own data, below is just an example)Very important item is Common Name which must contain IP address or Domain Name under which the 2N device can be accessed. Without this correct parameter authentication won't be made correctly and web browser will inform you that this web page is untrustworthy.   You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: CZState or Province Name (full name) [Some-State]: PragueLocality Name (eg, city) [ ]: PragueOrganization Name (eg, company) [Internet Widgits Pty Ltd]: 2NOrganizational Unit Name (eg, section) []: TechsupportCommon Name (e.g. server FQDN or YOUR name) [ ]: intercom.localEmail Address [ ]:         (we left this blank)   Please enter the following 'extra' attributes to be sent with your certificate request A challenge password [ ]:         (we left this blank)An optional company name [ ]:         (we left this blank)             This file has been created (you can find it in /home) IPINTERCOM.csrcontaining new certificate request                Create configuration file containing the DNS entries Open a text editor and insert this content (this are not terminal commands), save as "Cert.conf".  authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE subjectAltName=@alt_names [alt_names] DNS.1=intercom.local  If you are generating for IP address, make sure to change "DNS.1" to "IP.1" instead.          Sign the CSR (Certificate Sign Request) with your CA (Certification Authority) Start the procedure by this command (use the files from the previous steps) admin@ubuntu:~$ openssl x509 -req -sha256  -CA ca.crt -CAkey privkey.pem -in IPINTERCOM.csr  -out CERT.crt -days 365 -CAcreateserial -extfile Cert.conf            Now just enter the pass phrase for the privkey.pem Certificate request self-signature oksubject=C =CZ, ST = Prague, L = Prague, O = 2N, OU = Techsupport, CN = intercom.local Enter pass phrase for privkey.pem: YourPassword123             This file has been created (you can find it in /home) CERT.crtcontaining the certificate for the device                  Loading CA certificate into browser This is step needed for certificates created by your own CA (e.g. by OpenSSL), in case of trustworthy CA from the Internet, you can pass this section. In the browsers go to Settings - Privacy - Security and just import the certificate authority file (in our case CA.crt).Here is an example for Firefox:              Loading device certificate into the device Please go to section System - Certificates - User Certificates and upload a new certificate.You will need the device certificate file CERT.crt, intercom RSA private key IPINTERCOM.key and the private key password.It is possible that some Internet Certification Authorities will give you just one file containing both certificate and private key. This file must be then uploaded in both User Certificate and Private Key boxes.       Please go to section Services - Web Server and assign this certificate for web interface.    Finally, please go to section System - Maintenance and restart the device.With new start new certificate and key will be used for HTTPS communication.

Question 5

Connecting an old intercom to a 2N Access Unit using a 2N Security Relay

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.  INFO: This FAQ describes, how to connect Legacy intercom to 2N Access Unit with 2N IP Security Relay.In few steps you will learn how to connect the Legacy intercom and configure the unit. If you are using an External RFID Card Reader 125kHz + 13.56MHz with NFC (USB)  You have to use   2N Driver for External USB Readers 1.6.2 - here  We strongly recommend using 2N Access Unit with the latest firmware  You can download the firmware here     Connecting an old intercom to 2N Access Unit along with 2N IP Security Relay and configure it  Electrical Connection  In first step simply connect output from your Legacy intercom to one of the inputs on 2N Access Unit via two wires we will use input marked IN1.  Connect two wires from OUT1 on 2N Access Unit to input on the 2N IP Security Relay      Why to use an 2N IP Security Relay 2N IP Security Relay  It significantly enhances security of the connected electric lock because it prevents the lock from opening by forced intercom or Acces Unit tampering.  It is a small device installed between 2N Access Unit which is placed outside the secured area and the electric lock installed inside the secured area.  It includes a relay that can only be activated if the valid opening code is received from the Acces Unit.  It is designed for any 2N Access Unit or 2N IP Intercom model with firmware versions 1.15 and higher.       Configuration  Connect to IP address of 2N Access Unit and go to section "Hardware-> Switches"Controlled Output: Output1 - the output we use to connect unit with 2N IP Security RelayOutput Type: Security - this is needed for the 2N IP Security Relay to work correctly  Go to section "Services-> Automation"      3. Create an automation as shown below      4. In this step we will add the RFID card entry.If you have External RFID Card Reader 125kHz + 13.56MHz with NFC (USB) -  9137421E, 9137424E, 9137420E You can skip directly to point 4 creating user If you do not have an external usb readerGo to section "Events-> Access Log"Swipe your Card/Fob and you should be able to see it as shown in the picture below and copy the Card ID      5. Go to section "Directory -> Users" and create a new user Name: Robert - name of the tennantPIN Code: 1234 - unique Code for unlocking the doorCard ID: C30B189D - the ID of your CardIf you have an external USB Reader you can click on the Card icon and by placing your Card on the Reader the Card will be send to 2N® Access Unit

Question 6

External IP Relay 9137410E & 9137411E - Controlling using HTTP commands from a 2N IP intercom or 2N Access Unit

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   Do you need an intercom to switch on lights or call a lift, but the switched devices are far away and laying cables all the way to the intercom isn’t an option? Use an external IP relay, which is controlled using HTTP commands from a 2N IP intercom or Access Unit. The command is sent to the relay in unsecured form.    Prerequisities 2N IP intercom or 2N Access Unit with the latest firmwareAdditional GOLD license is neccessary for 2N IP intercom External IP Relay from 2N 9137410E (1 output)9137411E (4 outputs)    Web interface of External IP Relay Control page If you have your IP relay in the default setting, open your web browser and enter IP address 192.168.1.2, then you should be able to see control page depending on the version of the product you own. If you are not able to access the IP relay web interface, then please check if your computer is in the same network as IP relay (PC must have an IP address 192.168.1.x).    Setup page For entering the IP relay setup page, type to web browser http://192.168.1.2/setup.htmlUsername: adminPassword: webrelayNow you can configure its parameters according to your needs.e.g. network parameters (change IP address), look of the control page, relay pulse duration.      Detailed information about the IP relay settings and additional features is found in the manual linked below. Manual for External IP Relay     HTTP commands to control External IP Relay outputs   External IP Relay with 1 output (9137410E) Pulsehttp://192.168.1.2/state.xml?relayState=2ONhttp://192.168.1.2/state.xml?relayState=1OFFhttp://192.168.1.2/state.xml?relayState=0    External IP Relay with 4 outputs (9137411E) Pulserelay 1http://192.168.1.2/state.xml?relay1State=2relay 2http://192.168.1.2/state.xml?relay2State=2relay 3http://192.168.1.2/state.xml?relay3State=2relay 4http://192.168.1.2/state.xml?relay4State=2ONrelay 1http://192.168.1.2/state.xml?relay1State=1relay 2http://192.168.1.2/state.xml?relay2State=1relay 3http://192.168.1.2/state.xml?relay3State=1relay 4http://192.168.1.2/state.xml?relay4State=1OFFrelay 1http://192.168.1.2/state.xml?relay1State=0relay 2http://192.168.1.2/state.xml?relay2State=0relay 3http://192.168.1.2/state.xml?relay3State=0relay 4http://192.168.1.2/state.xml?relay4State=0    Sending HTTP commands to External IP Relay by 2N IP intercom or 2N Access Unit Login to 2N IP Intercom web interface, section Hardware - Switches.For the used switch setup Switch-On Duration and Switch-On and Switch-Off HTTP Commands, use the commands from the previous table.   Now every time when the 2N IP Intercom´s switch is activated, the IP relay is triggered on and after 5 second triggered off.More information about Switch settings in our manual: 2N IP Intercom - Configuration manual

Question 7

External USB readers - Driver installation & usage

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. Most of our external USB readers require 2N driver for their operation - to add access control method to the 2N IP Intercom´s and 2N Access Unit´s users directly from your computer.   9137420E : External RFID Card Reader 125kHz (USB) ... this does not require the driverExternal USB RFID reader 125kHz EMarine - Usage without any additional driver    9137421E : External RFID Reader 13.56MHz + 125kHz (USB) 9137424E : External RFID Reader 13.56MHz + 125kHz (USB), secured    9137422E : External Bluetooth Reader (USB)    9137423E : External Fingerprint Reader (USB)      Prerequisities 2N external USB reader requiring the 2N driver9137421E / 9137422E / 9137423E / 9137424 2N IP intercom or 2N Access Unit with the latest firmware, equipped with matching hardware for each mentioned technology. Optionally 2N Access Commander the latest version A computer with Windows based operating system (Windows 7 x64 or higher)     Driver Installation Download the driver from the 2N webpage and extract it from the archive.Please always use the latest driver.    Install the USB driver on your computer, ideally as administrator.In case of any warning message, please use Ignore button.     Launch the driver. A blue icon will appear in Windows notification.Please note that Windows may move the icon to the Notification overflow area, unless you set the icon to show permanently.    Connect your external USB reader to your computer.The driver will automatically detect it and you can start using it.When connecting any of external USB reader for first time, it may take few seconds (based on your computer) until the driver is properly set.     Driver configuration Opening driver's settings by right clicking on its icon and then left clicking on the Settings option.    When connected properly, the reader will be shown in the reader sections (COM port number may vary). Card ReaderIn default settings, the driver is enabled to read both 13,56MHz and 125kHz RFID cards.When using HID secured cards, please be sure to enable the support, otherwise only the UID will be read.The support must be disabled if you are using non-secured cards.    Bluetooth Reader    Fingerprint Reader    If you wish to start the driver along with Windows, you can set this in the General section.      Driver usage 2N IP intercom or 2N Access Unit Use your web browser to open the web configuration, section Directory - Users.  Add the RFID card / My2N app (Bluetooth) / Fingerprint to the user using connected USB reader - by clicking the buttons shown on following picture.    2N Access Commander Use your web browser to open the web configuration, go to Settings - Credentials section and enable each reader you intend to use.    In Users section add the RFID card / My2N app (Bluetooth) / Fingerprint to the user using connected USB reader.

Question 8

External USB RFID reader 125kHz EMarine - Usage without any additional driver

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   You can use our external USB RFID reader to add RFID cards/fobs to the 2N IP Intercom´s and 2N Access Unit´s users directly from your computer.This guide will show you how to use this USB 125KHz RFID reader (9137420E).  If you have our USB 13.56MHz+125kHz RFID reader (9137421E/9137424E),please follow another article below, because of necessary additional driver.External USB readers - Driver installation & usage    Prerequisities 2N USB 125KHz RFID reader (9137420E) 2N IP intercom or 2N Access Unit with the latest firmware, equipped with 125 kHz RFID reader Optionally 2N Access Commander the latest version English keyboard in the computer system   Installation To use the USB 125 kHz RFID reader, you do not need a specific driver. It works similar to a keyboard, sending codes of top (row) numeric keyboard.  Connect the USB reader to the USB port of your computer. Setup English keyboard in the system.   Reading 125 kHz RFID card 2N IP intercom or 2N Access Unit Go to the web interface of the device, section Directory - Users - specific user - User Cards.Click your mouse on the Card ID field. Make sure it is completely empty.Swipe your RFID card over the USB reader (the code is automatically translated from DEC to HEX) and save.     2N Access Commander Use your web browser to open the web configuration, go to Settings - Credentials section and enable the reader to use.     In Users section add the RFID card to the user using connected USB reader.

Question 9

Factory reset on 2N Access Units

Accepted Answer

To reset to factory values, follow the instructions below: For 2N Access Unit please see RESET button and LED position below:  For 2N Access Unit 2.0 please see RESET button and LED position below:  For 2N Access Unit M please see RESET button and LED position below:  To reset to factory values, follow the instructions below:  Press the RESET button.  Wait until the red and green LEDs in the right-hand bottom part of the motherboard shine simultaneously (approx. 20 s).  Wait until the red LED goes off (approx. 5 s).  Wait until the green LED goes off and the red LED comes on again (another 5 s).  Wait until the red LED goes off (approx. 5 s).  Release the RESET button.     Hold RESET button    This procedure can be applied to:  2N Access Unit  2N Access Unit 2.0  2N Access Unit M       2N Access Unit QR Located among the main unit connectors, the CONTROL button helps you reset the factory default values.   Follow the instructions below to reset the factory default values: Disconnect the device from the power supply.Press and hold the CONTROL button.Connect the device to the power supply.Keep holding the button for a few seconds and then release it.

Question 10

Firmware upgrade - How to make a firmware upgrade of 2N Access Unit?

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.    When updating from version lower than 2.15.2, please stick to the following update steps: Your version -> 2.15.2 -> 2.17.1 -> 2.18.1 -> 2.31.1 -> automatic update to the latest version (will be described later in this manual). If you are updating from version higher than 2.15.2, continue with the next higher version according to the procedure above up to the latest version.    Configuration backup We recommend saving a backup configuration file before each update. You can do so in System -> Maintenance -> Back Up Configuration:    Updating procedure: In the web interface of the 2N Access Unit, go to System > Maintenance.      Click the button Upgrade Firmware  The link will direct you to 2N webpage where you can choose the correct firmware version and download it.    Once the correct file is downloaded, don't forget to extract the zip file as the unit will only accept the .bin file that is a part ot the zip file.        The unit will be restarted after the upgrade. The process takes about 30 s This procedure can be applied to:  2N Access Unit  2N Access Unit 2.0  2N Access Unit M 2N Access Unit QR

Question 11

How to backup configuration and how to capture a trace on 2N Access Unit

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. Fill IP address of 2N Access Unit to your browser (IP address - How to get IP address of 2N Access Units?)  Backup configuration: Go to section System - Maintenance - Configuration In that tab, you can launch capturing of incoming and outgoing packets on the intercom network interface. Click button Backup Configuration  Configuration will be stored to your folder Downloads (file config.xml)    Trace download Go to section System - Diagnostics - Packet Capture 1) click red button for star capturing trace    2) click stop button   for stop the trace  3) download trace to your PC - click button download  (file hiptrace.pcap)   Captured packets can be stored either locally in the device buffer whose size depends on the device, or remotely on the user's PC, subject only to the specified storage duration and available disk space.      Press  to start remote capturing. Specify the capturing time interval (s)  for the incoming and outgoing packets. When the set time value passes, the packet capture file will be downloaded automatically to the user PC. Press  to stop capturing.  This procedure can be applied to:  2N Access Unit  2N Access Unit 2.0  2N Access Unit M

Question 12

How to provide all information to effectively resolve a technical issue on 2N Access Unit?

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   Dear customers, In case you have found any issue with the device, please report it to Technical Support. If you do not have access informations, contact your account manager.Or you can report your issue by creating a ticket - here. Reported issue should contain following information: 1. Please describe us your issue in detail, so that we will be able to replicate the behaviour based on that description.   Send us the description of the LAN topology, NATs, IP addresses, etc.If you have an issue regarding electrical circuit please send us a diagram of your eletrical circuit. Including specifications of the device being controlled by 2N Acces Unit    eg. Magnetic locks, Electro-magnetic locks, Lights etc. If your issue can be clearly visible or heard eg. LED blinking, bad sound quality, please take a picture or record a video (eg. on a phone) and send us this behaviour.        You can attach it to the e-mail or upload it to eg. WeTransfer, Dropbox or Google Drive and send us the download link. 2. Send us the current configuration file config.xml of the device - Please follow the instructions below  Note:  It is highly recommended to always use the newest FW version available on 2N web page (http://www.2n.com) before you report a technical issue!    3. Send us the information about FW version and the Serial Number.  4. Capture the Wireshark trace on 2N Acces Unit. First of all activate the capturing by "Start" button, make a call and deactivate the capturing by "Stop" button. Then download hiptrace.pcap file and send it to the support. Because the buffer for trace is limited, it is really necessary to start the trace right before you will make a test call!   5. Capture an internal Syslog on 2N Acces Unit.   If 2N Tech support asks you for a Syslog they usually want the setting that is shown in the picture below. Unlike in Wireshark trace the buffer is not limited by size but time. Please set the Required Saving Time + Severity level according to 2N Tech support needs.   After setting press the "Start" button and the Syslog will automatically stop after the time you defined in  Required Saving Time, then save the syslog.txt file and send it to us.  6. Capture an external Syslog on 2N Acces Unit. The external syslog is often use to capture syslog messages immediately after rebooting the device which often can't be done by internal Syslog.Please fill the Severity Level according to 2N Tech support needs. You will need a syslog server where the messages from the device will be sent.Set the Server Address in our example we use 192.168.1.15 - IP Address of a PC where SyslogWatcher is installed    7. Use SyslogWatcher - download here Start the server - it will take a few seconds until you see any messages   Stop server - press after you are done with capturingExport - press this button to export messages to fileExport Settings - Choose the time from/to according to what 2N Tech support demands (1h, 24h)Custom files (CSV/XML/TXT/JSON/etc) - type of file  Export folder - choose path to save the file   Filename - name of the file (in default it is date of Syslog capturing) -> export the file with .txt suffix and send it to usThank you!    This procedure can be applied to:  2N Access Unit  2N Access Unit 2.0  2N Access Unit M

Question 13

How to provide all information to effectively resolve a technical issue with 2N OS device

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   In case you have found some issue with 2N OS device, please report it to Technical Support. If you do not have access information, contact your account manager.Or you can report your issue by creating a ticket - here. The reported issue should contain the following information:  Describe us the issue in a close detail, so that we will be able to replicate the behavior at 2N Tech Support.   Send us the description of the LAN topology, NATs, IP addresses, etc.    If your issue can be clearly visible or heard e.g. LED blinking or bad sound quality, please take a picture or record a video (e.g. on a phone) and send us this behavior.   You can attach it to the e-mail or upload it to e.g. WeTransfer, Dropbox, Google Drive and send us the download link.    Know the Device Information The serial number and the current FW version of your 2N OS device.It is highly recommended to use always the newest FW version available on 2N web page - here  Backup the Configuration Send us the current configuration of the device - in the pictures below there is shown how to do that.   Capture the Wireshark trace Catch the Wireshark trace on 2N OS device. Here first of all activate the capturing by "Start" button, make a call and deactivate the capturing by "Stop" button. Then download hiptrace.pcap file and send it to the support. Because the buffer for trace is limited, it is really necessary to start the trace right before you will make a test call.    Capture an internal Syslog on 2N OS device.   If 2N Tech support asks you for a Syslog they usually want the setting that is shown in the picture below. Unlike in Wireshark trace the buffer is not limited by size but time. Please set the Required Saving Time + Severity level according to 2N Tech support needs.   After setting press the "Start" button and the Syslog will automatically stop after the time you defined in  Required Saving Time, then save the syslog.txt file and send it to us.  6. Capture an external Syslog on 2N OS device.     The external syslog is often use to capture syslog messages immediately after rebooting the device which often can't be done by internal Syslog.    Please fill the Severity Level according to 2N Tech support needs. You will need a syslog server where the messages from the device will be sent.    Set the Server Address in our example we use 192.168.1.15 - IP Address of a PC where SyslogWatcher is installed   7. Using SyslogWatcher - download here       Start the server - it will take a few seconds until you see any messages  Stop server - press after you are done with capturingExport - press this button to export messages to fileExport Settings - Choose the time from/to according to what 2N Tech support demands (1h, 24h)Custom files (CSV/XML/TXT/JSON/etc.) - type of file  Export folder - choose path to save the fileFilename - name of the file (in default it is date of Syslog capturing) -> export the file with .txt suffix and send it to us

Question 14

HTTP Commands – How to configure them in Answering units

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.    HTTP API TESTool  Intercom Setup Indoor Talk Indoor Compact  Indoor View  HTTP API TESTool You can find the HTTP commands in the HTTP API manual or by accessing the HTTP API TESTool which is part of every 2N IP Intercom and can help you create valid HTTP commands for the desired request type.  You can access the TESTool by entering the intercom’s IP address and writing /apitest.html at the end (for example https://192.168.49.88/apitest.html)  The HTTP command for triggering Switch 1 on the 2N IP Intercom is https://IP_address/api/switch/ctrl?switch=1&action=on   Intercom Setup First, configure the HTTP API Account in the 2N IP Intercom or 2N Access Unit:  Click on "Services" (1), then select "HTTP API" (2)  Make sure the HTTP Account is enabled (3)  Next, fill out the "Username" and "Password" (4)  Next, select the desired function (5) you wish to allow to be monitored/controlled with selected HTTP API Account  Lastly, save (6)   Indoor Talk Indoor Talk does allow only for one HTTP Command, by long-pressing on the unlock button:  Click on "Services" (1), then select "HTTP Command" (2)  Under the "HTTP Command Setting" - fill out the "URL", "NAME", "USERNAME" and "PASSWORD" (3):  URL - In this example "https://192.168.49.88/api/switch/ctrl?switch=1&action=on"  NAME - In this example called "Open Door"  USERNAME - Input the Username of the HTTP API Account created in the IP Intercom  PASSWORD - Input the Password of the HTTP API Account created in the IP Intercom  Lastly, save (4)  Indoor Compact Indoor Compact does allow up to three HTTP Commands, with selectable Icons that will show up on the display:  Click on "Services" (1), then select "HTTP Command" (2)  Under the "HTTP Command Setting" - fill out the "URL", "ICON", "NAME", "USERNAME" and "PASSWORD" (3):  URL - In this example "https://192.168.49.88/api/switch/ctrl?switch=1&action=on" ICON - In this example an icon of a "Door" is selected NAME - In this example called "Open Door"  USERNAME - Input the Username of the HTTP API Account created in the IP Intercom  PASSWORD - Input the Password of the HTTP API Account created in the IP Intercom  Lastly, save (4)  Indoor View Indoor View does allow up to three HTTP Commands with selectable Icons, per multiple categories of the commands:  Home Screen HTTP Command Setting - HTTP Triggers accessible from the homescreen display  In-Call HTTP Setting - HTTP Triggers accessible during a call  External Camera HTTP Command Setting - HTTP Triggers accessible while viewing an external camera   To configure the HTTP Command for the homescreen in Indoor View:  Click on "Services" (1), then select "HTTP Command" (2)  Under the "HTTP Command Setting" - fill out the "URL", "ICON", "NAME", "USERNAME" and "PASSWORD" (3):  URL - In this example "https://192.168.49.88/api/switch/ctrl?switch=1&action=on" ICON - In this example an icon of a "Door" is selected NAME - In this example called "Open Door"  USERNAME - Input the Username of the HTTP API Account created in the IP Intercom  PASSWORD - Input the Password of the HTTP API Account created in the IP Intercom  Lastly, save (4)

Question 15

Import of users from device

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   The nerve centre of our access control solution is 2N Access Commander. Use it for managing access to the building and monitoring the status of 2N access devices in real time. It also allows importing users from 2N IP intercom or 2N Access Unit, including their access methods (bluetooth and finger print as well), so you can keep already listed users from the current system.   Prerequisities 2N Access Commander the latest version, import is supported by a virtual machine (VirtualBox, VMWare, Hyper-V) and also by a Box (miniPC) distribution. 2N IP intercom or 2N Access Unit with the latest firmware version, containing users to be imported. No additional license is required for 2N Access Commander or 2N devices.   Feature properties The procedure works only if the device has never been registered in your Access Commander. Only unique users (according to UUID - User Unique ID) in the device can be imported. It is not possible to import from another device if it contains the same users (according to UUID). All the users from the device are imported into one Company at once,it is not possible to move users between companies.   Initial state of the system In the device there are users that we would like to import to our Access Commander.The device has never been used in our Access Commader.    In our example, 2N Access Commander contains no users at this moment. It is the typical scenario but not necessary for the import.    Backup configuration of 2N device and 2N Access Commander Go to device´s web management - System - Maintenance and make a configuration backup of your device.    Go to Access Commander´s web management - Settings and make a system backup of your Access Commander.    Importing users from the device to Access Commander Go to Access Commander´s web management - Devices and add your device to Access Commander.DO NOT ASSIGN ANY ZONE TO THIS DEVICE, ALL THE USERS WOULD BE DELETED FROM THE DEVICE.      Go to Companies and open your Company details.    In the three dot menu select Import users from device, select the device and confirm.     Users have been imported to your Access Commander.    Importing users in System log You can check the state of the import in System log.    Next steps  Now you can add the device to the zone and continue with access rule configuration.Video - 2N® Access Commander - Basic setup guide

Question 16

IP address - How to get IP address of 2N Access Units?

Accepted Answer

A) 2N Network Scanner Use 2N Network Scanner which can be downloaded here.  If 2N Network Scanner can not find desired 2N Access Unit then:   the device can have static IP address from different IP address pool than your network  the device can be placed behind the router or firewall  there can be some troubles with you router (check IP address pool, firewall, DHCP server, etc)   2N Access Unit is equipped with a RESET button. Follow the instructions below to identify the current IP address:    B) Hardware Procedure Press and hold the RESET button.Wait for the device do beep once (both the red and green LEDs will light up simultaneously) Release the RESET button.  The device announces the current IP address via the speaker automatically.  If the address is 0.0.0.0, it means that the device has not obtained the IP address from the DHCP server.   This procedure can be applied to:  2N Access Unit  2N Access Unit 2.0  2N Access Unit M  This procedure does not apply to 2N Access Unit QR      2N Access Unit  Access Unit 2.0   Access Unit M Press the button shortly (< 1 s) to restart the system without changing configuration.  Proceed with steps mentioned above

Question 17

Issues accessing the web interface on macOS

Accepted Answer

Our intercoms use HTTPS protocol for accessing their web interface. HTTPS unlike HTTP requires a certificate for authentication. The certificates for 2N devices are signed by the device itself (self-signed) and not by the certification authority hence the browser will mark it as a potential threat.    macOS 10  In macOS 10 when you entered the IP address of your 2N device you would have been presented with "Your connection is not private" as shown below.This had a simple solution -> click on Advanced -> Proceed to IP address (unsafe) and you were taken to the webpage of your 2N device:        macOS 11 Big Sur and newer (12 Monterey, 13 Ventura, 14 Sonoma, 15 Sequoia) With the new macOS update 11, you will not be given the option to Proceed to IP address (unsafe).But there is a workaround for you if you are using a chromium-based web browser e.g. Google Chrome.Workaround: Click anywhere on the blank background and type thisisunsafe on your keyboard and you will be taken to the login webpage of 2N Device      In order to access the web interface of our devices, they need to be on firmware version 2.31 and newer. If you don't own a Windows or a Linux machine, hence you don't have a way how to upgrade the unit, you can upgrade the firmware via a Remote Configuration tool iny My2N. This is a best optin to access the configuration using iOS or iPadOS.   Remote Configuration You can access the web interface via Remote Configuration in our My2N service. The Remote Configuration feature is free for any number of devices and is usable on both macOS and iOS devices. Here are the steps needed: 1. Create an account (if you don't have one yet) here. 2. Log in to your My2N account, click Devices, then ADD DEVICE and select 2N Device.  3. Enter the serial number and security code of the device. If you lost your paper card with the Security Code, this option is not available for you (the Security Code could be found only in the web configuration):  6. Now select the device in the Devices List. At the bottom of the page, you will see Remote Configuration Services.  5. When you click on the rectangle with the Remote Configuration Services, two options will appear. Click on Open configuration. The login page of the intercom will be open on a new tab.

Question 18

License Plate Recognition (LPR)

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   2N devices can use recognized license plates as another credential for entry or exit. License plates may be assigned to a user and their validity is controlled by the same access rules as their other credentials.   Prerequisites 2N IP Intercom (except 2N IP Uni) or 2N Access Unit with the latest firmware no additional license is required  optionally 2N Access Commander (latest version) no additional license is required  Axis network camera with ARTPEC-6 / ARTPEC-7 / ARTPEC-8 chip(verify the suitable camera with Axis according to chosen LPR app below)additional license from Axis can be required according to selected LPR app  License Plate Recognition app Vaxtor VaxALPR On Camera (version 2.2.15+) or Axis License Plate Verifier (version 2.1+)     Feature properties License plate recognition (LPR) works outside of Access Profiles set in Services - Access Control - Entry or Exit Rules, and as such can’t be combined with other credentials for combined authentication.  Version 3.0 or later If the feature is enabled and a valid HTTP request is received, this event is recorded into the event log of the 2N device as LicensePlateRecognized with the following parameters:   ap ... access control direction, entry (0) or exit (1) session ... ID of the authentication session  licensePlate ... the license plate recognized by the camera    valid ... whether the licensePlate has the right to enter (true) or not (false) uuid ... linking to a specific user ID, if licensePlate isn’t assigned to any users, the uuid parameter will be left out      Optionally, a snapshot containing a recognized license plate may be attached to the LPR HTTP request. The device receiving these requests can then store up to 5 most recent snapshots, downloadable by 2N Access Commander via access log.One license plate should always be assigned to one user, otherwise its access rules may not be applied correctly if different users have different access rules. The first match found in the directory will be used for authentication.      Version 2.50 (LTS) or earlier If the feature is enabled and a valid HTTP request is received, this event is recorded into the event log of the 2N device as LicensePlateRecognized with the following parameters:   ap ... access control direction, entry (0) or exit (1) session ... ID of the authentication session  licensePlate ... the license plate recognized by the camera   valid ... whether the licensePlate has the right to enter (true) or not (false) uuid ... linking to a specific user ID, if licensePlate isn’t assigned to any users, the uuid parameter will be left out       Optionally, a snapshot containing a recognized license plate may be attached to the LPR HTTP request. The device receiving these requests can then store up to 5 most recent snapshots, downloadable by 2N Access Commander via access log.One license plate should always be assigned to one user, otherwise its access rules may not be applied correctly if different users have different access rules. The first match found in the directory will be used for authentication.          2N device configuration Let’s configure the intercom or access unit first to have everything prepared for the integration. If you use Access Commander to manage your device, you only need to set up HTTP API access in this section, and then please continue to the next section: 2N Access Commander configuration      Version 3.0 or later Go to Integration - HTTP API section. Now click on the "Switch to the old interface" button to continue setup in the old interface (switch to the 2.50 (LTS) section for this setup)   Go to Access - Access Rules section. Enable Entry, Exit, or both, depending on whether the device your camera is connected to functions as an entry point, an exit point, or both.If the 2N device is connected to 2N Access Commander, then the following settings are managed by it.     After you enable either Access, Exit or both, go to the License plate recognition section on the same page click on the "Switch to the old interface" button to continue setup in the old interface (switch to the 2.50 (LTS) section for this setup)  Go to Directory section.If the 2N device is connected to 2N Access Commander, then the following settings are managed by it. Here, create a user and add their license plates in Credentials > Add credentials > License plateYou can enter up to 20 license plates, each license plate can contain up to 10 characters – spaces are ignored.             Version 2.50 (LTS) or earlier  Go to Services > HTTP API section.  In the Services tab, make sure Access Control API is enabled.We recommend using Secure (TLS) / Digest as connection / authentication type.       Then continue to Account # tab, enable it, enter credentials you’d like to use, and tick the Access Control privilege for CONTROL.         Go to Services - Access Control section.If the 2N device is connected to 2N Access Commander, then the following settings are managed by it. In the Entry Rules or Exit Rules tab, Advanced Settings part, select Opening by License Plate from the License Plate Recognition dropdown menu.         Go to Directory - Users section.If the 2N device is connected to 2N Access Commander, then the following settings are managed by it. Here, create a user and add their license plates under Car Fleet Management. You can enter up to 20 license plates separated by commas, each license plate can contain up to 10 characters – spaces are ignored.          2N Access Commander configuration (optional)     If the 2N device is connected to 2N Access Commander, then most of settings, incl. LPR, are managed by it.But still you have to configure the device’s HTTP API credentials directly in the device configuration as described in the previous section. Go to Devices section. Open details of the device you already prepared for LPR.        Assign the device to the proper zone.       If you see there "Lift control activated" message, please deactivate this feature first.          Go to Zones section.Open used zone details.      Enable License Plate Authentication.       Go to Users section.Assign one ore more license plates to the user.          Verify that this user is assigned to the correct group.        Go to Access rules section.Create an access rule matching the target group and zone.      Go to Settings - CAM logs section.Optionally, here you can configure getting photos of recognized license plates.Create a new CAM log.      Select the Car license plate recognized as monitored event.      Then select devices you want to receive photos from.         The function is ready to use.       Go to Access log section. You will see a record once a license plate is recognized. You can expand its details and if there are CAM Logs available, you will see this small icon. Once you click it, you should see an overview of all attached photos.                 If you have older version of the system with different look of the web interface, please click here.   When a 2N device is connected to 2N Access Commander, then most of its settings are managed by it. Thus, LPR settings will be managed by 2N Access Commander, but still you have to configure the device’s HTTP API credentials as those are device dependent.  Configure your 2N Access Commander as you normally would. Then open details of the device you already prepared for LPR  and make sure it has Lift Control turned off and that it’s assigned to the proper zone.  Then go to this Zone’s detail and enable License Plate Authentication.  Users can have their license plates assigned  under Accesses>Car License Plates, click ADD, enter one or more license plates, and confirm by clicking create.     Verify that this user is assigned to the correct group  and create an Access Rule for it.  Optionally, if you’d like to get photos of recognized license plates, you can create + NEW CAM LOGS. Name the log accordingly, select “Car license plate recognized” and click create.  Then ADD all devices you want to receive photos from to this CAM Log.  Once everything is configured, Access Logs will show up once a license plate is recognized.  You can expand its details and if there are CAM Logs available, you will see this small icon.  Once you click it, you should see an overview of all attached photos.          LPR app installation into Axis network camera and configuration   There are two options to choose from, click on the selected option to view the guide.    Vaxtor VaxALPR On Camera   We’ll only configure the most important settings, for detailed information please see the VaxALPR user manual:https://vaxtor.com/wp-content/uploads/2021/01/VaxALPR-On-Camera-Axis-Camera-Integration-EN_2.0-May-2020.pdf    Log in to suitable Axis network camera with ARTPEC-6 / ARTPEC-7 / ARTPEC-8 chipand enter Settings.       Go to the Apps tab and add the new one. Locate the .eap file from Vaxtor.Once appeared in the list of installed apps, click on it.           Activate your license key you have got from Axis for this scenario.     Then start the app and open it to go to its configuration.        Open the hamburger menu and select Reporting.        Scroll down to Optional reports and enable 2N. Fill in your 2N device’s IP address and configure the rest based on the security settings and credentials you entered in the HTTP API section of the 2N device. Save.      Open the hamburger menu again and enter Settings.       The Location part contains settings which define the countries whose license plates should be recognized. You can select up to 10.        In the Plate & Mode part you can set the minimum number of characters.       In the Video part you can set the minimum and maximum character height. Optimal settings are dependent on numerous factors, please see the VaxALPR manual for more details.        In the Environment part, you have the option to adjust how often can the same plate be authorized, what’s the maximum angle under which OCR should recognize license plates and most importantly, when to report a recognized plate.         The OCR part lets you fine tune the LPR confidence.        The Watermark part lets you adjust the images sent to 2N devices. Leave the Maximum JPEG size filter set to 0 as the maximum image size sent to 2N devices is 256 kB anyway – if the compressed file is bigger than that, it won't be sent. Thus you should adjust JPEG quality accordingly, we recommend setting it to 50 if your camera has a resolution around 1920×1080 px. For lower image resolutions or when "Perform report crop to 640×480" is checked you can set the quality to a higher value.      The Summary & Submit part contains an overview of all previously configured settings. Save the changes you made     Now, if everything is configured properly and a license plate is recognized, it’ll be sent into your 2N device. Based on whether this plate is valid or not, the barrier/door will open.      Received license plates will be shown in the 2N device web interface, section Status - Events Log.             Axis License Plate Verifier     We’ll only configure the most important settings, for detailed information please see the ALPV user manual:https://help.axis.com/en-us/axis-license-plate-verifier    Log in to suitable Axis network camera with ARTPEC-6 / ARTPEC-7 / ARTPEC-8 chipand enter Settings.       Go to the Apps tab and add the new one. Locate the .eap file from Axis.Once appeared in the list of installed apps, click on it.        Activate your license key you have got from Axis for this scenario.     Then start the app and open it to go to its configuration.     We will go throw the initial settings wizard.Select Access control type of system.      Select Barrier mode to Open to all.      If your camera view is upside down, change Image rotation to 180.    Next steps do not require any changes.         After the wizard we will adjust one more parameter in the Settings tab. Please enable Self-signed certificate in the Security part.      In the Integration section, Direct integration part, Enter your 2N device’s IP address and HTTP API credentials.Select HTTPS as connection type and enable the integration.     Now, if everything is configured properly and a license plate is recognized, it’ll be sent into your 2N device. Based on whether this plate is valid or not, the barrier/door will open.    Accordion summary… Received license plates will be shown in the 2N device web interface, section System - Events Log.      Version 2.50 (LTS) or earlier  Received license plates will be shown in the 2N device web interface, section Status - Events Log.

Question 19

Management over the Internet

Accepted Answer

The nerve centre of our access control solution is 2N Access Commander. Use it for managing access to the building and monitoring the status of 2N access devices in real time. Its intuitive user interface lets you set up the system quickly and delegate everyday activities directly to the customer.   You can easily manage 2N IP Intercoms and 2N Access Units with 2N Access Commander over the Internet as well as 2N Access Commander web interface itself. Since all of them behave like any standard IP device, you can use standard network techniques for interconnection.   Prerequisites 2N Access Commander, no additional license is required.2N IP Intercom or 2N Access Unit, no additional license is required.Device is connected to different network than 2N Access Commander.     Manage 2N IP devices with 2N Access Commander over the Internet    NAT and Port forwarding Since connection is established from 2N Access Commander to each 2N IP device, all 2N IP devices must be reachable over the Internet. In standard environment, such 2N IP devices will have private IP addresses and only one shared public IP address actually reachable from the Internet.You need to use NAT / Port forwarding on the site with 2N IP devices (SITE B and Router B on the image below).Each 2N IP device listens on port 443 for an incoming connection.You do not need to perform this action on SITE A, just make sure that 2N Access Commander is allowed to access the Internet.    When network configuration on SITE B in our example is set correctly, you can add each 2N IP device from SITE B to 2N Access Commander on SITE A manually using SITE B´s Public IP and assigned Public port in the format :.The device scanner inside 2N Access Commander cannot be used in this scenario.With its specific implementation on your sites and network devices, any company network administrator will be able to help you.               Site-to-site VPN Connects two portions of a private network or two private networks.For example, this allows to have routed connections with separate offices, or with other organizations, over the Internet.Both 2N IP devices and 2N Access Commander can act as in the same local network.   With its specific implementation on your sites and network devices, any company network administrator will be able to help you.         Manage 2N Access Commander web interface over the Internet The same network techniques you can apply also to allow different users to connect to 2N Access Commander web interface which listens on port 443 as well.

Question 20

Milestone XProtect - Alarm event from 2N device on Milestone XProtect

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   With physical and cyber security threats on the rise, it’s more important than ever to level up your business security systems. Milestone XProtect video management software (VMS) connects your cameras, sensors, analytics, and sites in one easy-to-manage interface.  Our 2N Access Units, 2N IP Intercoms and 2N Access Commander via 2N Plugin for XProtect Access integration for XProtect Access tool can be part of it and it is also possible to configure an Alarm event in the Milestone XProtect Smart Client such as door opening, door forced open, tamper switch activated, or other actions. Prerequisites  2N Access Commander 3.3.0  2N Access Unit or 2N IP Intercom connected to the 2N Access Commander Configured Milestone XProtect with 2N Access Commander via 2N Plugin for XProtect Access integration(According to this article: Milestone integration - How to setup with 2N Access Commander | FAQs | 2N )   Configuration steps  Device Event Configuration  Rules and Events Configuration    Device Event Configuration  After successfully adding a device to the Access Commander and synchronizing the devices with Milestone via a plugin, add the desired event:  Select the Access Control (1) tab and the Access Commander (2)  On the bottom of the screen, click on the Access Control Settings (3)  Lastly enable the selected event and configure it as an Alarm (4)   After finishing the setting up the events save the configuration      Changes should take effect and the configuration will be detected in the Milestone Smart Client (5):     Rules and Events Configuration You can assign a custom rule which triggers an action, based upon an event:  Go under Rules and Events (1) in the Milestone XProtect Management Client  Right-click on the Rules tab on top and then select Add Rule (2)      Event can be configured by selecting the desired rule type (3)   Click on the highlighted link (4)  Then select the desired Access Control Event (5)      Select the desired 2N Units from the Sources list (6)  Click Add (7) to import the device into the Selected list (8)       Set up the performed action, in this case Start recording on an assigned device (9) Click "OK" and "Next"     Then set up the action duration or stop action  Lastly - click on the Finish (10)

Question 21

My2N App Offline Pairing - Opening doors via Bluetooth

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.  Bluetooth - in general Bluetooth is a wireless technology for communicating over short distances (15m) between two devices. The devices can communicate with each other after they are paired and the communication is secure.   Minimum Android/iOS platform version requiredAndroidiOSAndroid 10 or lateriOS 16.0 or later Functionality Bluetooth identification is based on the unique code of the end device. Communication between the 2N IP Intercom (or 2N Access Unit) and the smartphone is secure and based on the principle of public and private keys, which are exchanged between the devices during pairing (the RSA 1028 asymmetric encryption mechanism and AES-128 symmetric encryption are used).  Requirements 2N OS Firmware version 2.44 or later.IP Style, IP Verso 2.0/IP Verso/LTE Verso/Access unit 2.0/Access unit M.My2N App version 3.1.3 for Android or later/3.1.1 for iOS or laterBluetooth enabled on the phoneLocation Services Enabled (iOS) How to set up a connection between the My2N App and the 2N Device (offline pairing) Offline pairing is not compatible with online pairing. You may use only one option.   First, you must open the 2N device configuration web interface in the Hardware -> Extenders -> Bluetooth Module section. The default mode here is "in-app".  "On device" or "via motion detection" can also be selected. It is also possible to change the signal range here (5 options): 1 Shortest range 2 3 4 5 Longest range    The default signal range is 0 - 2m (shortest range), which is the best option in terms of safety, as the Bluetooth reader will only communicate with a mobile phone in the immediate vicinity. The value can be changed depending on the need and desired functionality. It is important to keep in mind that each mobile phone may have a slightly different Bluetooth antenna sensitivity, which means that the distance of detectable signal may vary between phone types. The effective signal range depends on these parameters: Transmitter signal output powerReceiver sensitivityPhysical obstacles in the signal pathAntenna parameters   In App - Authentication has to be confirmed by tapping on an icon in the application running on a mobile phone. On Device - Touch the card reader having a phone paired with the My2N App to confirm authentication. Via Motion Detection - Set the motion detection profile for the module authentication via a mobile phone.     You will then be able to open the door in the app by clicking on the door icon after successful pairing. The second step is to install the My2N App from the Apple Store or Google Play on the phone that will be used for access.The next step is to generate a pairing code on the 2N device side in the Directory -> Users section for the user who will have access via Bluetooth.   It is necessary to fill in the user name and then open the WaveKey section. Then click on the Bluetooth symbol and a matching code will be generated. This code must then be entered into the phone.  The default code validity is 1 hour - you must pair the phone with the 2N device until the code expires.    The validity of the code can be changed in the Services -> Access control -> WaveKey -> Pairing mode settings -> Pairing PIN validity.   For pairing it is necessary to be close to the 2N device (1-2 meters).On the My2N app, go to the "home" screen. click on the + symbol and choose the option "Pairing PIN".  Enter the PIN generated in the 2N device and click on the button "next".  Click on the button "Start pairing" when you are close to the 2N device.  Next screen will appear saying "paired successfully". Click on "OK" to confirm.  How to open the door (in app mode) using the My2N App  If the My2N application is already paired with the 2N device, it is necessary to be in the vicinity of the intercom/access unit.Open the My2N app, on the "home" screen, you should see all paired 2N devices with mobile phone.All you need to do is to click on the unlock button of the  device on which you want to open the door.  If the user is allowed to enter, the door is opened and signalled in the application.  If the 2N devices are managed using 2N Access Commander, it is not necessary to pair each intercom separately. If the app on the phone detects a new Bluetooth device, the app connects and checks whether the user has access.

Question 22

Offline Bluetooth pairing and modes (Tap In App, Touch On Device, Card, Motion Detection)

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   To be able to use BT in My2n App , you have 2 different ways to pair your mobile with another 2N intercom or another 2N Access Unit. Online Pairing and Offline Pairing. We do recommend using cloud pairing exclusively as you can then easily manage all credential types for all users in My2N at one place. But you can use Offline pairing in case you are using Access Commander or if some users have some old mobiles (Android 8 or 9 , or iOS 15) and cannot use anything else that the old MobileKey App. For already running My2N site - If your site in My2N already uses offline paired credentials which you have created on the devices by enabling online pairing (enable My2N app access for at least 1 user) all offline paired credentials will be revoked. We recommend switching those offline paired users to online pairing. If not possible, you must create offline paired access for those users again.    Prerequisites 2N IP intercom or 2N Access Unit with Bluetooth interface and the latest firmware,no additional license is required (except the Motion Detection mode requiring GOLD license)My2N app the latest version on the mobile phone (Android 10 and later or iOS 16 and later) with enabled BluetoothOptionally for a centralized management you can choose from those two solutions (then you do not need to pair with each door device)2N Access Commander (at least Advanced license tier)My2N platform (access control is free of charge)          Pairing the My2N app with 2N device  2N device configuration Go to 2N device web interface, section Directory - Users, here open an existing user or create a new one.      In the User Basic Information part, fill in at least the name and save.    In the Access Settings part, you can limit the access validity, typically for guest access purposes.    In the WaveKey part, click the middle button with the Bluetooth symbol to generate the Pairing PIN.     In default, the pairing PIN validity is limited to 1hour. You can adjust this in the section Services - Access Control - WaveKey.      My2N app configuration       Tap the + icon and enter the prepared pairing PIN.      Go nearby the pairing device and start the pairing.         WaveKey modes configuration and usage by My2N app Bluetooth (WaveKey) authentication is available in 4 modes, please click on the one you are interested in:  Tap In App mode    Go to 2N device web interface, section Hardware - Extenders, here locate the Bluetooth module.Check that In App mode is activated as Start Authentication. It is also possible to specify the distance (Signal Strength) within which your smartphone will communicate with the Bluetooth module.     Go to close proximity of the device, open the My2N app and select the door you wish to access.            Touch On Device mode    Go to 2N device web interface, section Hardware - Extenders, here locate the Bluetooth module.Check that On Device mode is activated as Start Authentication. It is also possible to specify the distance (Signal Strength) within which your smartphone will communicate with the Bluetooth module.    Go to My2N app settings - Access cards section and enable background scanning.      Go in front of the device and tap the reader part or Bluetooth symbol (according to used 2N device) to open the door.                   Card mode    Go to My2N app settings - Access cards section and enable background scanning and card mode.  Swipe the smartphone across the Bluetooth symbol as you would have a card.Please be advised that sensitivity will be increased within confined metallic spaces such as small elevators.               Motion Detection mode    Please be advised that this mode requires GOLD licence because of using motion detection.     Go to 2N device web interface, section Hardware - Extenders, here locate the Bluetooth module.Check that Via Motion Detection is activated as Start Authentication. It is also possible to specify the distance (Signal Strength) within which your smartphone will communicate with the Bluetooth module, the optimal is Long.    Go to section Hardware - Camera - Internal Camera and enable the Motion Detection feature. You can also select how sensitive you wish to set the motion detection to be by adjusting the Sensitivity Threshold and Detection Area.     Go to My2N app settings - Access cards section and enable background scanning.     Walk towards the 2N device to activate the motion detection. If you are authorized, the door will open.                If you are using the no more supported 2N Mobile Key app ...  If you are using the no more supported 2N Mobile Key app, click here to see the instructions for it.     Pairing the 2N Mobile Key app When in close proximity to 2N IP Intercom equipped with a Bluetooth module, run the application and tap on the PAIR NEW DEVICES button      Android  iOS        The app will start searching for devices in close proximity.      Android  iOS        The app will ask for authorization. Please insert the pairing code you generated in the previous steps and tap on CONFIRM button.      Android  iOS                Using the 2N Mobile Key app  Tap In App mode If you have already paired the 2N Mobile Key app with the 2N IP Intercom equipped with a Bluetooth module, go to close proximity of BT reader.Open the 2N Mobile Key app and select the door you wish to access. Tap the button in the app to open the door.      Android  iOS     If you are authorized, the door will open, and a green circle will appear.       Android  iOS             Touch On Device mode  In the app settings enable Unlock door on the background (Android) or Background scanning (iOS).       Android  iOS      Go in front of the device and tap the reader part or Bluetooth symbol (according to used 2N device) to open the door.      Card mode  In the app settings go to Modes (Android) or Advanced (iOS) and enable Card mode, you can also adjust its sensitivity.       Android  iOS           Android  iOS           Android  iOS     Swipe the smartphone across the Bluetooth symbol as you would have a card.Please be advised that sensitivity will be increased within confined metallic spaces such as small elevators.                                                Motion Detection mode   Please be advised that this mode requires GOLD licence because of using motion detection.        Go to 2N device web interface, section Hardware - Extenders, here locate the Bluetooth module.Check that Via Motion Detection is activated as Start Authentication. It is also possible to specify the distance (Signal Strength) within which your smartphone will communicate with the Bluetooth module, the optimal is Long.                                       Go to section Hardware - Camera - Internal Camera and enable the Motion Detection feature. You can also select how sensitive you wish to set the motion detection to be by adjusting the Sensitivity Threshold and Detection Area.                                       In the app settings enable Unlock door on the background (Android) or Background scanning (iOS).       Android  iOS             Walk towards the 2N device to activate the motion detection. If you are authorized, the door will open.

Question 23

OpenVPN server & client

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   This guide describes connecting 2N IP intercom, 2N LTE intercom or 2N Access Unit to the user’s remote LAN by OpenVPN server.   Disclaimer    Please note that this guide and its content is provided "as is" without warranty of any kind, express or implied. Therefore by using it you hereby agree that you are aware of this content functionality, limitations and consequences, you acknowledge that the guide content is provided for limited purpose.   2N TELEKOMUNIKACE a.s. shall not be held liable for function limitations, security limitations or damage, if any, incurred as a result of using this guide.   Please also note that various Linux distributions or versions may not accept all commands shown in this guide and 2N TELEKOMUNIKACE a.s. does not provide support for Linux.        Prerequisites     2N IP Intercom / 2N LTE Intercom / 2N Access Unit with the latest firmwareno additional license is requiredLinux PC with this applications: openvpn (server)stunnel4bridge-utilslshw Network requirements: Public IP address at the router on local network side where OpenVPN server is, accessible from the Internet with a possibility of redirecting TCP port 443 to LAN (DMZ for OpenVPN server optional).DHCP at the local network side where OpenVPN server is.Intel PRO/1000T Server compatible network controller with enabled Promiscuous Mode   IT knowledge requirements: bash scripting,certificates, Linux command line (bash),networking,SSL,VPN        Technical network information Solution is designed for OpenVPN to be installed on Linux.2N OpenVPN server is designed to connect 2N devices exclusively, 3rd party devices or software may not be able to connect properly.This connection creates network bridge and thus enables connection to 2N device in the same way as it would be in the local network, so it can be used as usual (for calls, video surveillance of its IP camera, 2N Access Commander connection, etc.). Device which is in the same local network as OpenVPN server does not need to be connected to VPN, since all devices connected over VPN will have local network IP addresses from local DHCP.      2N device obtains IP address from local network DHCP where OpenVPN server is, uses network protocols like ARP, can perform broadcast and so on.VPN connection is pushed through stunnel for additional level of security.In case you cannot put OpenVPN server machine to DMZ and you need to use standard LAN and private address, you need to setup port forwarding so incoming connections from Internet to OpenVPN server reach target machine. You will also need to allow such communication on router's firewall.   Configure the local network on its router – set DHCP IP reservation for OpenVPN server virtual machine (based on MAC address of virtual machine's ethernet port). DHCP server will always assign the same IP address.Configure port forwarding if needed - forward public port to port 443 TCP on IP address assigned by DHCP for OpenVPN server.Choose public port number above 1024 TCP to avoid using privileged ports.    2N OpenVPN server installation   All examples shown in this article are for Debian 10 and require to be run with elevated rights, either login as root or use proper command to gain required rights. On the Linux machine, deploy stunnel4, openvpn, bridge-utils and lshw via command in the command line.apt-get install -y stunnel4 openvpn bridge-utils lshw >/dev/null Create certificates for OpenVPN. You need server certificate, server key, ca and intercom certificate with intercom key. Then you need to put those certificates to correct folders for stunnel, openvpn and intercoms. You can do it manually or use the script below. This script will generate unique certificates each time it is run and put them in /tmp/certs folder. Then it moves all required certificates to appropriate folders. It also generates client certificates for IP Intercoms / Access Units and place them to folder /root/certs from where you can download them.To make script run, you need to save it in EOL conversion to UNIX and encoding UTF-8 format as .sh file, then upload it and apply chmod a+x to make script executable.In the script example, the intercom.key password is set to Test1234, but due to security we recommend to create your own certificates with own password and settings, use this example as a reference only. 2N TELEKOMUNIKACE a.s. does not hold any responsibility if example certificates will not be secure enough. #!/bin/bash ################################################################################ # Settings                                                                     # ################################################################################ # Certificates C_C=""     # Country Name (2 letter code) C_ST=""    # State or Province Name C_L=""     # Locality Name C_O=""     # Organization Name C_OU=""    # Organizational Unit Name C_CN=""    # Common Name ################################################################################ VERSION=1.0 ################################################################################ print_step() {     echo -n "${1} ... " } print_ok() {     echo "[ OK ]" } check_error() {     if [ $1 -ne 0 ]; then         echo         echo         echo         echo "Error: $2"         echo         exit $1     fi } print_step "Generating certificates" TMP_CERTS=/tmp/certs EC=prime256v1 EC_PARAMS=ec-${EC}-params.crt PASS=Test1234 rm -rf ${TMP_CERTS} mkdir ${TMP_CERTS} check_error $? "can't generate certificates" touch ${TMP_CERTS}/index.txt ${TMP_CERTS}/index.txt.attr check_error $? "can't generate certificates" echo "01" > ${TMP_CERTS}/serial.txt check_error $? "can't generate certificates" cat ${TMP_CERTS}/openssl.cnf [ ca ] default_ca      = CA_default [ CA_default ] database        = ${TMP_CERTS}/index.txt serial          = ${TMP_CERTS}/serial.txt policy          = policy_default [ policy_default ] commonName      = supplied EOF check_error $? "can't generate certificates" openssl ecparam -name ${EC} -out ${TMP_CERTS}/${EC_PARAMS} &>/dev/null check_error $? "can't generate certificates" subj="/C=${C_C}/ST=${C_ST}/L=${C_L}/O=${C_O}/OU=${C_OU}/CN=${C_CN:-Certificate Authority}" openssl req -subj "${subj}"                                                  \             -passout pass:${PASS}                                            \             -new -x509 -newkey ec:${TMP_CERTS}/${EC_PARAMS}                  \             -days 3650 -sha256                                               \             -keyout ${TMP_CERTS}/ca.key -out ${TMP_CERTS}/ca.crt             \         &>/dev/null check_error $? "can't generate certificates" subj="/C=${C_C}/ST=${C_ST}/L=${C_L}/O=${C_O}/OU=${C_OU}/CN=${C_CN:-Server Certificate}" openssl req -subj "${subj}"                                                  \             -new -nodes -newkey ec:${TMP_CERTS}/${EC_PARAMS}                 \             -keyout ${TMP_CERTS}/server.key -out ${TMP_CERTS}/server.csr     \         &>/dev/null check_error $? "can't generate certificates" subj="/C=${C_C}/ST=${C_ST}/L=${C_L}/O=${C_O}/OU=${C_OU}/CN=${C_CN:-Intercom Certificate}" openssl req -subj "${subj}"                                                  \             -new -nodes -newkey ec:${TMP_CERTS}/${EC_PARAMS}                 \             -keyout ${TMP_CERTS}/intercom.key -out ${TMP_CERTS}/intercom.csr \         &>/dev/null check_error $? "can't generate certificates" openssl ca -config ${TMP_CERTS}/openssl.cnf                                  \            -passin pass:${PASS}                                              \            -cert ${TMP_CERTS}/ca.crt -keyfile ${TMP_CERTS}/ca.key            \        -outdir ${TMP_CERTS} -days 3650 -md sha256 -batch                 \        -in ${TMP_CERTS}/server.csr -out ${TMP_CERTS}/server.crt          \         &>/dev/null check_error $? "can't generate certificates" openssl ca -config ${TMP_CERTS}/openssl.cnf                                  \            -passin pass:${PASS}                                              \            -cert ${TMP_CERTS}/ca.crt -keyfile ${TMP_CERTS}/ca.key            \        -outdir ${TMP_CERTS} -days 3650 -md sha256 -batch                 \        -in ${TMP_CERTS}/intercom.csr -out ${TMP_CERTS}/intercom.crt      \         &>/dev/null check_error $? "can't generate certificates" print_ok ################################################################################ rm -rf /etc/stunnel/keys mkdir /etc/stunnel/keys cp ${TMP_CERTS}/ca.crt /etc/stunnel/keys/ca.crt check_error $? "can't set stunnel service" cat ${TMP_CERTS}/server.crt >/etc/stunnel/keys/server.pem check_error $? "can't set stunnel service" cat ${TMP_CERTS}/server.key >>/etc/stunnel/keys/server.pem check_error $? "can't set stunnel service" rm -rf /etc/openvpn/server/keys mkdir /etc/openvpn/server/keys cp ${TMP_CERTS}/ca.crt /etc/openvpn/server/keys/ca.crt check_error $? "can't set openvpn service" cp ${TMP_CERTS}/server.crt /etc/openvpn/server/keys/server.crt check_error $? "can't set openvpn service" cp ${TMP_CERTS}/server.key /etc/openvpn/server/keys/server.key check_error $? "can't set openvpn service" rm -rf /root/certs mkdir /root/certs cp ${TMP_CERTS}/ca.crt /root/certs check_error $? "can't copy intercom certificates" cp ${TMP_CERTS}/intercom.key /root/certs check_error $? "can't copy intercom certificates" cp ${TMP_CERTS}/intercom.crt /root/certs check_error $? "can't copy intercom certificates"        Configure stunnel via command in the command line. cat /etc/stunnel/stunnel.conf   [openvpn] accept  = 443 connect = 1194 CAfile  = /etc/stunnel/keys/ca.crt cert    = /etc/stunnel/keys/server.pem verify  = 2 EOF     Configure OpenVPN service via command in the command line. cat /etc/openvpn/server/server.conf     local 127.0.0.1 server-bridge dev   tap proto tcp-server port  1194 ca   /etc/openvpn/server/keys/ca.crt cert /etc/openvpn/server/keys/server.crt key  /etc/openvpn/server/keys/server.key dh   none tun-mtu 1500 script-security 2 auth-user-pass-verify /bin/true via-file client-to-client duplicate-cn auth   none cipher none up   "/etc/openvpn/server/up.sh" down "/etc/openvpn/server/down.sh" verb 0 EOF        Configure scripts for OpenVPN service and give them the proper file rights via commands in the command line. cat /etc/openvpn/server/up.sh    #!/bin/bash TAP="\${1}" MTU="\${2}" . ./settings.sh dhclient -x \${ETH} ip link set \${ETH} promisc on mtu \${MTU} ip link set \${TAP} promisc on mtu \${MTU} up brctl addbr \${BR} brctl setfd \${BR} 0 brctl addif \${BR} \${ETH} \${TAP} dhclient \${BR} EOF    chmod +x /etc/openvpn/server/up.sh     cat /etc/openvpn/server/down.sh     #!/bin/bash . ./settings.sh dhclient -x \${BR} ip link set \${BR} down brctl delbr \${BR} ip link set \${ETH} promisc off dhclient \${ETH} EOF     chmod +x /etc/openvpn/server/down.sh   cat /etc/openvpn/server/settings.sh     ETH=$(lshw -quiet -class network -short | awk '/^\/0\//{print $2}')  ETH=${ETH} BR=br0 EOF     chmod +x /etc/openvpn/server/settings.sh                  Bridge network traffic properly via commands in the command line. Do not run commands in this step over SSH as they include bringing ETH interface down which will result in connection loss.  sed -i 's/inet dhcp/inet manual/' /etc/network/interfaces   sed -i '/br0/d' /etc/network/interfaces     cat >/etc/network/interfaces      # openvpn bridge br0 allow-hotplug br0 iface br0 inet manual EOF      ifdown ${ETH} &>/dev/null   ifup ${ETH} &>/dev/null    systemctl enable stunnel4.service &>/dev/null    systemctl enable openvpn-server@server.service &>/dev/null                             Restart OpenVPN and asociated services via commands in the command line.  systemctl restart openvpn-server@server.service    systemctl restart stunnel4.service        Check if stunnel and openvpn service are running via commands in the command line,otherwise repeat previous step.   lsof -i 4                     If firewall is installed, enable ports 1149 and 443 to be accepted via commands in the command line. (example configuration uses TCP protocol for OpenVPN)  ufw allow 1149/tcp   ufw allow 443/tcp     systemctl restart ufw        Connect 2N device to 2N OpenVPN server  You need to upload certificates downloaded from OpenVPN server to 2N device and configure OpenVPN connection in 2N device. You will use same client certificates for every 2N device connecting to this VPN. After successful connection, 2N device will receive DHCP address from local network where 2N OpenVPN server is and will appear to local network as local device. Go to 2N device (you want to connect to 2N OpenVPN server over Internet) web interface, section System - Certificates, Upload ca.crt file to CA Certificates, upload intercom.crt and intercom.key files to User Certificates.           Go to section System - Network - OpenVPN, enable it, set the following and save.Default Interface: NoSet to Yes if 2N device connected via VPN is supposed to communicate outside local network connected over VPN.Otherwise, 2N device will route such traffic via its own connection and will not route it to VPN.Server Address: Public IP (which belongs to router where 2N OpenVPN server is)Server Port: Public Port (port used for forwarding on router where 2N OpenVPN server is - for example 1443)Trusted Certificate: Select the uploaded certificateClient Certificate: Select the uploaded certificate     Press Start button to connect to 2N OpenVPN server.

Question 24

Password recovery in 2N OS devices

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   Have you forgotten your login password to the web interface of 2N OS based device and there is no other authorized administrator?      Then the only possible solution is a hardware factory reset returning the password back to "2n", after first using it, you will be required to setup a new strong password.    Factory reset procedure Please follow one of these articles: Video - 2N OS devices - Factory Reset procedure(universal video guide)2N IP Intercoms - Factory reset(deeper look on location of factory reset button on IP Intercoms)    Changing login password in the web interface After successful login in the web interface, you can go to section Services - Web Server and change the login password.

Question 25

REX button connectivity

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.    In certain situations (e.g. in areas with higher level of security such as an ATM room or kindergarten), you want to control the door opening even when person is leaving. For this purpose you can connect REX (Request To Exit, or just "Exit") button to 2N IP Intercom or 2N Access Unit and once the button is pressed, device triggers the lock.       Prerequisities 2N IP Intercom or 2N Access Unit with the latest firmware; no additional licence is required.The device must be equipped with at least one free input.Most of our devices have at least one input on the main unit, here is an exception:2N IP Force & 2N IP Safety & 2N IP Variorequiring additional module2N IP Unidoes not have input at all, does not support REX button connectivity Any REX (exit) button with prepared two wirese.g. the one from 2N: https://www.2n.com/products/exit-button   Connectivity Connect REX button to the device input via two wires. Here is a demonstration on 2N IP Verso, another models can be little different, please check their installation manual.Normally opened (the first picture) or normally closed (the second picture) type, both have the same connectivity, but the configuration will be different.     Configuration Go to device web interface, section Hardware - Digital Inputs.Check the assigned switch to see if it is the one used for access control, usually the default Switch 1 value is the right one.Assign the input to which you´ve connected the REX button in previous step (in our case "Input 1")and set the right input mode; Non Inverted for Normally opened type, Inverted for Normally closed type.

Question 26

REX button - How to connect to a 2N Access Unit

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.   This FAQ describes, how to connect REX button (Request To Exit) to 2N Access Unit. In few steps you will learn how to connect the button and configure the unit to enable this feature. FAQ describes situations with both types of button - normally opened and normally closed contact.    What is a REX button? In certain situations (for instance in premises with higher security level like ATM room etc.) you want to control the door opening even when person is leaving. For this purpose you can connect REX button to 2N Access Unit and once the button is pressed, the device will trigger the lock. You can see typical scenario with REX button below.    How to connect a "normally opened" REX button to a 2N Access Unit and how to configure it In the first step simply connect REX button to one of the inputs on 2N Access Unit via two wires.   For 2N Access Unit M, use one of the pairs of wires for input, marked INPUT1 or INPUT2:     In the second step connect to IP address of 2N Access Unit and go to section "Hardware->Door". Choose a switch which you want to control via the REX button (in our case it is "Switch 1") and the input to which you connected the REX button in the previous step (in our case "Input 1"). Set "Input mode" to "Non Inverted".     How to connect a "normally closed" REX button to a 2N Access Unit and how to configure it In the first step simply connect REX button to one of the inputs of 2N Access Unit with two wire.     For 2N Access Unit M, use one of the pair of wires for input, marked INPUT1 and INPUT2:   In the second step connect to IP address of 2N Access Unit and go to section "Hardware->Door". Choose a switch which you want to control via the REX button (in our case it is "Switch 1") and the input to which you connected the REX button in previous step (in our case "Input 1"). Set "Input mode" to "Inverted".       This procedure can be applied to:  2N Access Unit  2N Access Unit 2.0  2N Access Unit M 2N Access Unit QR

Question 27

RFID Card/RFID Tag Configuration

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.    Adding a card using internal RFID Reader  Internal Reader Card Log  Directory - User Card Setup   Adding a card using USB RFID Reader  USB RFID Reader Driver  Directory - User Card Scan   Card has been successfully assigned to a user  Adding a card using internal RFID Reader To add a new RFID card to the unit, you need first to find the ID of the card. Internal Reader Card Log  Put the card on the reader  Open up the unit web Interface  Select green tab "State" (1) and "Events" (2)  You will see the event "CardEntered" (3)  Copy the parameter behind "uid" (3)   Directory - User Card Setup  Now go to the "Directory" (4)  Select "Users" (5)   Copy the RFID uid under the "RFID Card ID" (6)  Lastly save the configuration (7)   Adding a card using USB RFID Reader Saving a new RFID card's ID can also be done with 2N USB RFID reader.    USB RFID Reader Driver A driver is needed for this device, you can find it here.  Install the driver as an administrator and connect the RFID Reader to your computer  Make sure the USB Reader is found and ready (1)   Directory - User Card Scan Open the "Directory" (2) and "Users" (3)Tap on the card icon (4)   Put the card on the RFID Reader     Card ID will be inserted under the "RFID Card ID" (5)  Make sure to save (6)   Card has been successfully assigned to a user Once the card is swiped on the reader module after it has been assigned to a user, it will appear together with it:  Click on the green "State" (1) and "Events" (2)  As you can see, the card has been successfully linked to an existing user - "Card Entered" and "UserAuthenticated" (3)

Question 28

Static IP address - How to set up static IP address on 2N Access Units?

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.  A) Web interface  Enter the IP address of a 2N Access Unit to your browser   Go to System - Network - Basic  Fill in IP addresses and save settings  This procedure can be applied to:  2N Access Unit  2N Access Unit 2.0  2N Access Unit M Access Unit QR     B) 2N Network Scanner You can set the Static IP (or DHCP) in the 2N Network Scanner tool (you can download it here).  Right-click on the device in the device list  Click Config  Field Password needs the password to the device's web interface.  This procedure can be applied to:  2N Access Unit  2N Access Unit 2.0  2N Access Unit M Access Unit QR       C) Reset button To switch on the static IP address mode (DHCP OFF), follow the instructions below:  Press and hold the RESET button.  Wait until the red and green LEDs in the right-hand bottom part of the motherboard shine simultaneously (approx. 20 s).  Wait until the red LED goes off (approx. 5 s).  Release the RESET button.  The following network parameters will be set after restart:  IP address: 192.168.1.100  Network mask: 255.255.255.0  Default gateway: 192.168.1.1     This procedure can be applied to:  2N Access Unit  2N Access Unit 2.0  2N Access Unit M  This procedure does not apply to Access Unit QR     2N Access Unit    2N Access Unit 2.0  2N Access Unit M

Question 29

The example of OSDP module  connecting and using on 2N Intercom

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.  2N IP Intercom Log into 2N IP Intercom (default login is admin and password 2n), open the menu Hardware / Extenders, and find the connected OSDP module. Select the Baudrate compatible with your CP. Change the Mode to Installation to be able to establish a secured communication. PD address can be set in range 0 – 126, Genetec can manage the address up to 63. Save the configuration by clicking on the Save button.    Wiring example        Parameter explanation Transmitted Code Format – It is the same as for the Wiegand module if you need to specify the format (length) of the credential to be sent via OSDP. For E.g., some access control or security system can handle formats like 26-bit, 45-bit, and so on. If there is an Auto format set, credentials from cards are sent as they are. Encryption Key – That is the key for secured communication between our OSDP module with a connected control panel. On both ends, there must be the same key to establish encrypted communication. There are some differences between Axis CP (A1001, A1601) and Genetec (Mercury security CP), which we tested, and others are similar.  Axis CP – The Encryption key is set manually. It means, that a 128-bit key should be entered into this field in the 2N Intercom web UI and on Axis CP using VAPIX API.  Genetec + Mercury security CP – When the Installation mode is set on the 2N Intercom, it can be configured automatically from Genetec. So, when the secured OSDP is enabled on the Genetec side and an admin starts pairing with the connected device (with 2N Intercom), the key is exchanged via OSDP protocol on the line, 2N Intercom remembers it, switches from Installation mode to Normal mode and encrypted communication begins.   Mode  Normal – Normal operation mode  Installation – In the installation mode, the 2N Intercom awaits Encryption Key exchange from the Control panel side.  Automatically switches to Normal mode:  When The key is received  After a 30-minute timeout  When the Intercom is restarted      Installation mode should be switched by purpose by the administrator, as that is potentially insecure in case of “men in the middle” attacks.     Force Encryption – If this option is off, the 2N OSDP can communicate both unencrypted and encrypted. When Force Encryption is enabled, the 2N OSDP module doesn’t accept unencrypted messages on the OSDP line.    Mercury Security CP Connect to your Mercury Security CP web GUI. Set up the connection to your Genetec server in the menu Host Comm. Set the Connection type to IP Server, Data Security could be set to None, but it should be set to TLS Required later. The Authorized IP Address Required can be set too according to Genetec IP Address. Then accept all changes and apply them by selecting Apply Settings menu.     Genetec – Security Centre Open your Genetec Config Tool, and enter the Access control menu and Peripherals section. Click on the green "plus" button.   Chose the Manufacturer of your CP you want to add and a Model. Then configure its IP address and check the Port number.   Roll up the newly added CP, double-click on a reader you connected the 2N OSDP module to, and set the Type of reader to OSDP 2. Check Baudrate and Address, save the configuration and Apply it.   In the Genetec Config Tool, enter the Area view menu and Hardware section. Click on Add an entity and chose Door.   In the Creating a door dialog, enter an Entity name and chose Location.   Then chose the Access control unit and find the Interface module you added in the last steps.   Configure Connected Readers, Door lock, and other inputs if needed.   Now switch to the Access rules section, chose the CP you added, and click on the green "plus" button. In the opened window click on the preferred Access rule, confirm it by clicking on the OK button, and then Apply.     Pair OSDP devices to establish secured communication In your browser open the IP address of your Genetec server and Log on.    In the menu click on Secure OSDP button.   There should be the connected CP waiting for Pairing with its reader (2N ODP module). Click on Pair and wait for a while until it's done.   When it switches to Paired state, you can open the 2N IP Intercom web GUI, menu Hardware / Extenders, there you should find an Encryption Key agreed with Genetec server. You can switch Mode to Normal Operation and Save.     Last updated: 04.10.2022 Used devices in manual:  2N IP Verso (firmware version 2.34)  2N OSDP Module  Mercury LP1501   List of compatible Hardware:  2N IP Style  2N IP Verso  2N Access Unit 2.0

Question 30

Time Profiles

Accepted Answer

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface.    You can create and assign time profiles to limit usage of various functions, e.g. calling a user or opening the door by the access method.   Prerequisites 2N IP Intercom or 2N Access Unit with the latest firmware;no additional license required (however some functions mentioned here can require a license)   Time Profiles description You can create up to 20 time profiles in the web interface, section Directory - Time Profiles,and use them globally during functions configuration.    In section Directory - Holidays, you can define the bank holidays and then assign them different time intervals in section Directory - Time Profiles.Permanent holidays are green and variable holidays (valid for the particular year only) are blue.    Apart mentioned 20 globally accessible time profiles, you may also set individual time profiles used just for specific function.     Examples of where you can use them User Phone numbers(only for 2N IP Intercoms)You can determine when to call a phone number of a user according to a set time profile.    User Access SettingsYou can restrict user access during a certain time.    Switch HoldAdditional GOLD license is requiredYou can determine how long you want to keep the switch triggered.    Multi-factor authenticationYou can set different authentication mode according to different time profile.    Automation functionAdditional GOLD license is requiredUse the ProfileState condition to limit triggering Action by the Event.

ファクスの一覧