Skip to main content

OnGuard Access Control DataConduIT (2019

Daniel Crosby
  • Updated

Information

  • Manufacturer: Lenel/S2 (+1 (585) 248-9720 x4 | (800) 631-6046)
  • Product: OnGuard
  • Type:  Alarm Receiver

Supported Features

  • Event Receipt
    • With attached video
  • Output Control
  • Sync*

*If the Sureview relay type is "Reader" then clicking the "On" button in the Immux UI will pulse the door (and the Off button does nothing)

*If the Sureview relay type is "Output" then the On and Off buttons in the UI turn the relay on or off

Components and Communication

From To Port Use
Sureview Server Server running Onguard Router Service 80 / 443 TCP Integration actions (sync and relay control)
Server running Onguard Router Service Sureview Server 80 / 443 TCP Alarms
Onguard server Server running Onguard Router Service

TCP 135, 1024-65535

 WMI/DCOM, DataConduit

 

Prerequisites

  1. The OnGuard server must be configured correctly to allow access via DataConduIT. It must:
    1. Have a license which allows the use of at least one DataConduIT client for use by Sureview  for the features of the integration (note in older versions of OnGuard, DataConduIT is called "OpenIT")
    2. Have the "LS Linkage Server" and "LS DataConduIT Service" services running
    3. Have the "Linkage Server Host" setting configured in the OnGuard System Administration (Administration -> System Options... menu, then "General System Options" tab)
    4. Have a link for a Windows user account to an OnGuard account in the OnGuard System Administration (Administration -> Users... menu, then choose a user and go to the "Directory Accounts" tab to link it to a Windows user. May also need to add a directory in Administration->Directories... first)
    5. DataConduIT must be confirmed working by using the "wbemtest" built-in Windows tool - see the Troubleshooting section below for instructions
  2. The Onguard Router service must be installed and configured correctly. It must:
    1. Be installed and running on a server with access to the OnGuard DataConduIT server.
    2. Be running as a user with permissions to access DataConduIT (see linking an OnGuard account to a Windows user above).
    3. Be connectable from the Sureview server on the port set in the service config (default 443 or 80) i.e. firewall port open etc.
  3. If using Sync, the "SureView Sync" service must be configured to match whether you are using Segments to group panels in Onguard together as "sites" or not (see instructions section below)

OnGuard User Permissions

The OnGuard user account noted above in the prerequisites must have at least the following permissions in OnGuard:
  1. System Pemissions:
    1. Under "Access control hardware": "Query" on "Access Panels", "Readers", and "Alarm Panels"
    2. Under "Access control": "Query" on "Segments"
    3. Under "Software options -> Software Options - Applications": "Query" on "DataConduIT Service"
  2. Monitor Permissions:
    1. Under "Control": "Open doors"
    2. Under "Control": "Relay and reader outputs"
LenelUserPermissionsSystem.png

 

Operation

The Onguard Router service must be installed on a server with access to DataConduIT. This receives alarms from OnGuard and sends them to the Sureview server within a constant HTTP request, and also accepts connections for door control from the Sureview.

It can be installed on an intermediary server in custom cases as long as it has the required access into the DataConduIT server (remote WMI access must be enabled) - please notify SureView if that is required.

Allowing remote WMI access requires the following configuration:

  • The two servers must be on the same domain so you can run the Router service on the intermediary server/Sureview server as a user that has permissions into Onguard
  • The WMI/DCOM ports of 135 TCP and 1024-65535 TCP must all be open from the intermediary server to the DataConduIT server
  • It must all be confirmed working by running the wbemtest tool on the intermediary server as the windows user that has Onguard access and using "\\RemoteOnguardServerName\root\onguard" as the namespace and successfully running a standard Query and a Notification Query (see the full instructions in the Troubleshooting section below)
  • Then when wbemtest shows it is working, the "Onguard Computer" config setting of the router must be added and set to the remote DataConduIT server name.

 

Immix_Server_Layout__OnGuard_.jpg

Intermediary_Server_Layout.jpg

The items in OnGuard map to Sureview as follows (OnGuard -> Sureview):

  • Segment -> Site
  • Panel -> Device
  • Door/Output -> Relay
  • Alarm -> Alarm

Installation and Configuration

Adding the root server (one time)

  1. On your Sureview server:
    1. Install the Onguard device and receiver packages if you have not already.
    2. If using Sync, edit the SyncClient.exe.config file with the <add key="LenelSyncOnPanels" value="true"/> app setting set to either "false" to sync on segments if you are using those in Onguard or "true" to sync on Panels if you are not (see the explanation in the pre-reqs above).
  2. In Sureview:
    1. Add a site called "Onguard Root" or similar and add an "Onguard Panel"-type device to it, providing the host and port of the server hosting the router service.
    2. Add a Sync System of type "Onguard Panel" with the settings of:
      1. Host: the IP of the server where you will install the SureView Onguard Router service)
      2. Port: 443 (default for Router service)
      3. Panel ID (extra): not used
  3. On your Sureview device tier server or other server:
    1. Install the Onguard Router service and set it to run as the Windows user that you gave permissions in Onguard in the prerequisites steps.
    2. Optionally download and run the attached Tool to test that you can connect to DataConduIT and fetch data such as the list of panels and readers.

At this point alarms will now be received into the root site saying "UNMATCHED PANEL [PanelID]" because they do not exist on a site yet.

Site setup

In each of your Sureview sites do the following to add the panels:

  1. If using Sync:
    1. Add a sync entry to the site providing either the Segment ID or Panel ID depending on the sync mode you chose (see explanation in the pre-reqs above):
      1. Syncing by Segment ID: this will cause all of the panels under the segment you specify to be added to the site and kept up to date as new panels are added.
      2. Syncing by Panel ID: this will cause the given panel to be added to the site. Unfortunately when syncing by panels you must add a sync entry for each panel and manually add/delete the entries if you add/remove panels on the site.
  2. If manually entering details:
    1. Run the attached tool at the bottom of the page on the OnGuard server to find the IDs you will need in the next steps.
    2. Add a device of type Onguard Panel and set the following details:
      1. Host: IP of server running the router service
      2. Port: 443
      3. Panel ID (extra value): The ID of the panel from the tool.
    3. Add relays to the panel as follows:
      1. For a reader:
        1. Type: Reader
        2. Input1: ReaderID (from the attached tool)
      2. For an output:
        1. Type: Output
        2. Input1: OutputID (from the attached tool)
        3. Input2: 1=ReaderOutput1, 2=ReaderOutput2, 3=AlarmOutput
    4. Add alarms to the panel as follows:
      1. Input1: ReaderID/InputID (from the attached tool)
      2. Input2: 0=Reader, 1=ReaderInput1, 2=ReaderInput2, 17=ReaderOutput1, 18=ReaderOutput2

Once the PanelID exists on a site, all alarms for that panel will go to the site instead of the root site.

If there are some panels that you do not wish to add sites then you can disarm the system site to not receive any alarms that do not match to sites (saying "UNMATCHED PANEL").

Alarm Acknowledgements

Alarms will be automatically acknowledged in Onguard once they are sent to the receiver. This can be disabled by updating the router config file, and changing the value of AcknowledgeAlarms to false.

Troubleshooting

Panel Matching ("UNMATCHED PANEL")

Alarms received in Sureview that do not match a panel in a site will be prefixed with "UNMATCHED PANEL: [panel ID]". In order to match them to the correct site, add a panel to the site with that ID in the Extra Value.

Custom Event Types ("UNKNOWN TYPE")

Like most access control systems Onguard allows custom event types to be created. If a received alarm is prefixed with "UNKNOWN TYPE: [some text]" this means the type is a custom type that does not exist in the Sureview database yet. As with most access control integrations the Onguard integration supports adding custom types to the database to make them match - please contact your SureView support representative for help adding your custom event types to the Sureview database.

Sync'ing Large Databases

Integration version 1.2.x.x has been tested against a very large database containing 1922 Panels. This database takes about 10 minutes to synchronize into Sureview. Re-Synchronization takes about 15 minutes.

It will be necessary to amend the Sync service applications configuration files to increase timeouts to ensure synchronization runs to completion:

In SyncClient.exe.config set the ClientTimeout as follows

<add key="ClientTimeout" value="20" />

In SyncClient.exe.config and SVSync.exe.config increase the sendTimeout

<binding closeTimeout="00:00:15" openTimeout="00:00:15" receiveTimeout="00:01:00" sendTimeout="00:20:00">

Sync not bringing in Panels

Check that you can telnet to the port of the router from the Sureview server using the details you added for the Sync System and check the Sync Client trace log on the Sureview server for errors.

When the router service receives a sync request it will log either "ITEMSGET;PANEL;[SegmentId]" (for sync of panels under a segment ID) or "ITEMSGET;PANEL1;[PanelId]" (for sync of an individual panel) to the trace.

  1. If the message is not seen when sync runs on the Sureview server then the integration running under the sync client is not connecting to the router service, so either your Sync System entry is incorrect or your ports are closed (check your Sync Client log).
  2. If you see "PANEL" (sync by segment) but are expecting to see "PANEL1" (sync by panel) or visa versa then it means you have not changed the sync mode in the Sync Client config correctly as per the instructions at the top of the page.

Description Matching

By default, Sureview decode alarms against the first description field. The reason being the first description field contains the base event type. For example, if the first description field contained the event type "Door Forced", Sureview would match the event type against "Door Forced", as listed in Sureview event type list. If users wanted to use a custom event type, they can do so by entering it in the second description field. When configured, as an alarm comes in rather than matching against the base type in the first description field. The alarms will match against the custom event type from the second description field.

To enable matching alarms within Sureview, you'll first need to include the following key to the receiver config file:
<add key="LenelDecodeDescription" value="1" />

There are three ways in which Sureview can match alarms within Onguard, these can be configured via the config file. Changing the setting 'LenelDecodeDescription' will have the following effect:

  1. Setting LenelDecodeDescription to '1', blank or is missing. The decoder will decode the event type against the first description field. if the event type fails to match, the alarm will output 'UNKNOWN TYPE: [first description field]'
  2. Setting LenelDecodeDescription to '2', the decoder will decode the event type against the second description field. If the event type fails to match, the alarm will output 'UNKNOWN TYPE: [second description field]'
  3. If LenelDecodeDescription is set to '3', the decoder will decode against whichever description field matches against the event type. If the event type fails to match, the alarm will output 'UNKNOWN TYPE: [first description field] / [second description field]'
Note: For any changes in the config file to be applied, the Onguard Receiver service requires a restart.
 

Service not starting (DataConduIT troubleshooting)

If the service does not start this either means:

  1. The username that the service is running as does not have permissions to connect to DataConduIT - go through the pre-requisite steps above to ensure it has access.
  2. DataConduIT is not working correctly - test that you connect to it by:
    1. Running the Windows built-in WMI tool called "wbemtest" as the user that has access into Onguard via Start->Run
    2. Connect to the "root\onguard" DataConduIT namespace (or "\\RemoteOnguardServer\root\onguard" if running remotely from a server other than the DataConduIT server) via the "Connect..." button
    3. Run a WMI query such as "SELECT * FOM Lnl_panel" via the "Query..." button
    4. Run a WMI notification query such as "SELECT * FROM Lnl_SecurityEvent" via the "Notification Query..." button
    5. If it is not working, try restarting the OnGuard DataConduIT and Linkage services and contact your Onguard support representative if you still cannot connect.

WbemTestConnectToDataConduITWMI2.png

Why am I only seeing panels marked as "Is Online"?

By default, Sureview will only sync on Panels that are marked as online. It is possible to ignore this and bring all panels in regardles of being marked as online or offline. Simply add the following configuration key to the SyncClient.exe.config file: <add key="IgnoreOfflinePanels" value="false"/>

I cannot use SSL, how can I use this integration?

The updated Onguard integration uses SSL by default. If for some technical reason you are unable to use SSL, you can disable it simply by completing the following steps:

  • In the app config file for device proxy worker or devic worker, add the following to the app settings section: <add key="SSLDisabled" value="true"/>
  • In the Onguard Receiver configuration file, change the ReceiverEndpoint setting to use http instead of https.
  • In the Onguard Router configuration file, change the ReceiverAddress setting to use http instead of https. Also do the same for the CommandsEndpoint setting.

OnGuard Tool

The tool is attached to this page and must be run from a server with access to DataConduIT. The tool allows you to:
  • List the items in OnGuard and their IDs such as panels, readers, reader outputs, alarm outputs, reader inputs, and alarm inputs
  • Control readers and outputs

Comments

0 comments

Please sign in to leave a comment.