How to Configure a MN-NIC-5 Module

INTRODUCTION

This guide describes how to configure a NIC-5 module (Model Numbers: MN-NIC-5 and MN-NIC-5-ENC)
for use with Symmetry M2150 nodes.

It is assumed that readers of this guide understand the architecture of Symmetry security management
systems, are competent and understand networking terms such term as IP address, DHCP, MAC address,
etc.

About the NIC-5 and LAN Chains

A NIC-5 module allows Symmetry to communicate with Symmetry M2150 nodes over a LAN (Local Area Network). The NIC-5 is the latest-generation Symmetry NIC module, which supersedes the previous-
generation NIC-4 module. The NIC-5 supports 10 Mbit and 100 Mbit connection speeds.

The M2150 architecture uses "LAN chains". Each LAN chain consists of one or more nodes (Figure 1).
Only the node at the head of the LAN chain requires a NIC module.

There can be multiple LAN chains connected to the same network, and the network can be used for other
purposes such as communications between the Symmetry server and clients, or for general office use.

All communication between a NIC module and LAN chain is managed by a nominated Symmetry client PC. For systems that contain a large number of nodes and high-volume transaction activity, this architecture allows load balancing across multiple Symmetry clients.

It is allowable to have more than one LAN chain managed by the same Symmetry client. Depending on the license purchased, each Symmetry client can manage up to 512 LAN chains. There can be a maximum of 1024 LAN chains.

The first node in a LAN chain must have a node address of 001.

The NIC-5 has a built-in web interface, which you must use to set up the module before you configure the
LAN chain and node in Symmetry.

 

IP Addresses and DHCP

You can configure the network settings of the NIC module using the built-in web interface.

Each NIC module must have a unique IP address, which can be static or DHCP-assigned. When the address is DHCP-assigned, Symmetry addresses the NIC module by name rather than by IP address.

Once you have configured the NIC module through its web interface, you need to define the LAN chain and node in Symmetry. One of the LAN chain settings in Symmetry is the IP address (or name) of the NIC module at the head of the chain.

 

Encrypted Communications

High-security installations may require encrypted communications between the NIC module and Symmetry. This can be achieved by purchasing the Symmetry Comms Encryption license (available separately). The NIC-5 supports Rijndael AES (the US government-approved encryption standard). 128-bit
or 256-bit encryption can be used.

The encryption settings must be configured in the web interface and in Symmetry.

It is possible for a client PC to control any combination of both encrypted and non-encrypted LAN chains.

Continuous and Periodic Polling

When setting up a LAN chain in Symmetry (using the "Install/Access Control/Chains/LAN" screen), you can choose whether to use continuous or periodic polling.

Continuous polling maintains a continuous communications link from the Symmetry client that manages communications with the LAN chain.

Periodic polling causes the nominated Symmetry client to initiate communications at specified intervals and when there is new data to download (e.g. changes to card holder details). However, if a chain detects an alarm, communications are automatically initiated from the chain, and the alarm message is uploaded. The "Maintenance/Access Control/Upload" screen can be used to upload event data at other nonscheduled times.

Dual NIC LAN Communications

M2150 nodes support the use of two NIC modules in a single node. The secondary NIC module is used if the network connection to the primary fails. Each NIC module uses a separate IP address, but only one LAN chain needs to be defined in Symmetry.

Note: An M2150 node requires its DIP switches to be set correctly to enable dual NIC communications.
Please refer to the M2150 Installation Instructions for details of how to set the DIP switches.

Configuring the NIC Module

Before you can use a NIC module, you must configure it through its built-in web interface, as described
next.

Note: Initially, the configuration process requires the use of one of the following applications to determine the default DHCP (or APIPA) IP address assigned to the module:

• The Lantronix Device Installer, which is available from the Lantronix web site:

https://www.lantronix.com/products/deviceinstaller/

• Cobox.exe, which is available from the Symmetry installation media

Step 1 – Find the NIC Module on the Network

Note: This step assumes that the module is in its factory-default state. You can reset the module to its
factory-default state using the Factory Defaults option (page 7).

To find the NIC module:

1. Fit the module to the M2150 board, connect the module to the network and switch on power as
    described in the M2150 Installation Instructions.
2. If you want to use Lantronix Device Installer to find the module:
    a) Download and install the Lantronix Device Installer from the Lantronix web site.
    b) Open the Lantronix Device Installer. You should see the DHCP-assigned IP address and MAC
        address (Hardware Address) of the module:

If there is more than one NIC module connected to the network, you can identify each module in
from its unique Hardware (MAC) address, which is printed on a label attached to the network port
(shown as "SN" number).

3. If you want to use Cobox.exe to find the module:
    a) In Windows Explorer, double-click Cobox.exe. This is on the Symmetry server in the Symmetry
        installation folder (e.g. C:\Program Files (x86)\Security Management System). You can either run the            tool from that location, or copy Cobox.exe and SymmetryCryptographicModule.dll to a folder on                another computer and run it from that location.

    b) Click the Find button:

    c) You should be able to see the MAC address and IP address of the NIC module in the NIC                           Modules Found menu:

If there is more than one NIC module connected to the network, you can identify each module in from its unique Hardware (MAC) address, which is printed on a label attached to the network port (shown as "SN" number).

Note: You cannot connect to the module through Cobox.exe.

Step 2 – Open the Web Interface

To open the web interface:
1. Enter the DHCP/APIPA-assigned IP address into the search bar of a browser connected to the
    same network as the NIC module.

2. When prompted, enter the login details:

3. The web interface is displayed:

Note: You can factory reset the module at any time by selecting Device from the menu on the left side of
the window and selecting the Factory Defaults option. You may want to use this option if the module has been used on another node.

Step 3 – Change the admin Password

Change the password for the admin user as follows:

1. Select User from the bottom of the menu on the left side of the window.
2. Click the admin user (the admin user cannot be deleted, and the name cannot be changed):

3. Overtype the existing password with the new password:

Note: It is essential to remember the admin password. If you forget the password, it can be reset
only by the manufacturer. Enter the new password very carefully to avoid any mistake.

4. Click Submit.

Step 4 – Configure the Network Settings

Configure the network settings as follows:

1. Select Network from the menu on the left side of the window.

2. When prompted, log back in to the web interface using the new password. The following page is
    displayed:

3. Select eth0, Interface and Configuration near the top of the page (if they are not already selected):

4. If you want to continue to use DHCP:

• Make sure that DHCP Client remains set to Enabled.
• In the Hostname field, enter a unique name for the NIC module (such as the location of its
  node).

(The DHCP server will communicate the IP addresses of the default gateway and primary DNS.)

5. If you want to use a fixed IP address:

• Set DHCP Client to Disabled.
• In the IP Address field, enter the IP address you want the module to use (in CIDR format).
• In the Default Gateway field, enter the IP address of the default gateway.
• In the Primary DNS field, enter the IP address of the primary DNS server.
• In the Secondary DNS field, enter the IP address of the secondary DNS server (if applicable).

(The Hostname field is not used when a fixed IP address is used.)

6. Click Submit.

7. Select Device from the menu on the left side of the window.

8. Select Status near the top of the page (if it is not already selected).

9. Click Reboot near the bottom of the page, followed by Okay:

10. When prompted, log back in to the web interface.

Step 5 – Configure the Baud Rate (optional)

Carry out this step only if the node is using a baud rate other than the default of 38400.
To configure the baud rate:

1. Select Line from the menu on the left side of the window.

2. Select Line 1 and Configuration near the top of the page (if they are not already selected).
   

The following is displayed.

3. Set Baud Rate to match the baud rate of the node (set using DIP switches on the PCB). The default
    setting of the DIP switches is 38400.

4. Click Submit.

If you do not want to use encrypted communications between the M2150 nodes and Symmetry,
configuration of the NIC module is now complete and you can click Logout near the top-right corner of the window to exit the web interface.

Step 6 – Configure Encryption (optional)

Follow this step if you want to use encrypted communications between the M2150 nodes and Symmetry.

Note: You should carry out the configuration procedure on an isolated network. This is to ensure that there is no chance of the encryption key being intercepted during the programming process.

Note: You will also need the Symmetry Comms Encryption license (available separately) to configure
encryption in Symmetry.

To configure encryption:

1. Select AES Credentials from the menu on the left side of the window.

2. Enter any name for the AES credential (e.g. "AmagAES256"):

3. Click Submit.

4. Select the AES credential you have just created.

5. Enter any 64-character (256-bit encryption) or 32-character (128-bit encryption) hexadecimal string            into the Encrypt Key and Decrypt Key fields:

6. Click Submit.

7. Select Tunnel from the menu on the left side of the window.

8. Select Tunnel 1 and Accept near the top of the page (if they are not already selected).

9. For the Protocol option, select TCP AES:

10. In the Credential field, enter the credential name you entered in the AES Credentials page. You can
      view the AES Credentials page to see the name you used.

11. Click Submit.

12. If you see a prompt near the top of the page to kill an active connection, click Okay.

That completes the configuration of the NIC module. You can click Logout near the top-right corner of the window to exit the web interface.

Configuring Symmetry

The following provides an overview of the steps you need to take to configure Symmetry when using
a NIC-5 module.

Step 1 – Add an Encryption License and Privileges (optional)

If you want to use encrypted communications between the M2150 nodes and Symmetry, a Symmetry user
with appropriate privileges needs to:

1. Open the "Maintenance/Licensing/System Licenses" screen and add the Comms Encryption license.

2. Open the "Maintenance/User & Preferences/Roles" screen and select the Assign System Admin                  Privileges permission to your user role (under Options):

Note: You need to log back in to action the change to your role privileges.
The encryption options in Symmetry are available only if you have carried out the above.

Step 2 – Set up the Client Ports

For each Symmetry client that is to communicate with a LAN chain:

1. Open the "Install/System/Client Ports" screen.

2. In the Selection screen, select the client from the Client Name menu.

3. Click New.

4. In the Port menu, select Network.

5. In the Allocation menu, select LANnode Chain:

6. If you are using encrypted communications, select Encrypt and enter the 128-bit or 256-bit key you
    entered into the NIC module's web interface.
7. Click OK.

Step 3 – Set up the LAN Chains

For each LAN chain:

1. Open the "Install/Access Control/Chains/LAN" screen.

2. Click New.

3. In the LAN Chain Name field, specify a unique name for the LAN chain.

4. Set LAN Port Name to Network.

5. Set LAN Interface to CoBox/XPort.

6. In the Network Address field, enter the IP address of the NIC module (if a fixed IP address is used)
    or the hostname of the NIC module (if a DHCP server is used).

7. If you are using encrypted communications, select AES128 or AES256 (depending on whether you
    are using 128-bit or 256-bit encrypted communications), and reselect the LAN Interface.

8. If dual NIC communications is used, select Secondary (under Options), then in the Secondary
    Connection tab displayed, configure the IP address or hostname of the secondary module.

9. Configure any other options as required (if necessary, please refer to the Online Help).

10. Click OK.

Step 4 – Define the Nodes

For each node:

1. Open the "Install/Access Control/Node" screen.

2. Click New.

3. In the Node Description field, specify a unique name for the node.

4. From the Chain Name menu, select the LAN chain.

5. From the Node Type menu, select the M2150 node type you are using.

6. From the Node Address menu, select address of the node, as set using the DIP switches on the
    PCB. The address must be 1 if the node is the first in the chain (i.e. is fitted with a NIC module).

7. In the LAN tab, set LAN Chain First Node to Yes if the node is the first in the chain.

8. Configure any other options as required (if necessary, please refer to the Online Help).

9. Click OK.

That completes the configuration of the NIC module in Symmetry. The NIC module should now be fully
operational and communicating with the Symmetry nodes.