Fuente: Genetec TechDocs — copia de respaldo interna, prueba de conector (15-ago-2026).
¶ Security Center SaaS Edition (Classic) Deployment Guide 5.12
Click here for the most recent version of this document.
Document last updated: May 20. 2026
¶ Legal notices
©2026 Genetec Inc. All rights reserved.
Genetec Inc. distributes this document with software that includes an end-user license agreement and is furnished under license and may be used only in accordance with the terms of the license agreement. The contents of this document are protected under copyright law.
The contents of this guide are furnished for informational use only and are subject to change without notice. Genetec Inc. assumes no responsibility or liability for any errors or inaccuracies that may appear in the informational content contained in this guide.
This publication may not be copied, modified, or reproduced in any form or for any purpose, nor can any derivative works be created therefrom without Genetec Inc.'s prior written consent.
Genetec Inc. reserves the right to revise and improve its products as it sees fit. This document describes the state of a product at the time of document's last revision, and may not reflect the product at all times in the future.
In no event shall Genetec Inc. be liable to any person or entity with respect to any loss or damage that is incidental to or consequential upon the instructions found in this document or the computer software and hardware products described herein.
Genetec™, AutoVu™, AutoVu MLC™, Citywise™, Cloud Link Roadrunner™, Community Connect™, Curb Sense™, Federation™, Flexreader™, Genetec Airport Sense™, Genetec Citigraf™, Genetec Clearance™, Genetec ClearID™, Genetec Cloudlink™, Genetec Mission Control™, Genetec Motoscan™, Genetec Patroller™, Genetec Retail Sense™, Genetec Traffic Sense™, KiwiVision™, KiwiSecurity™, Omnicast™, Privacy Protector™, Sipelia™, Stratocast™, Streamvault™, Streamvault Edge™, Synergis™, Valcri™, their respective logos, as well as the Mobius Strip Logo are trademarks of Genetec Inc., and may be registered or pending registration in several jurisdictions.
Other trademarks used in this document may be trademarks of the manufacturers or vendors of the respective products.
Genetec products, services, and innovations are protected by patents and other intellectual property rights in various jurisdictions, including the United States. For a detailed list of patents owned by Genetec Inc., visit www.genetec.com/patents.
All specifications are subject to change without notice.
¶ Document information
Document title: Security Center SaaS Edition (Classic) Deployment Guide 5.12
Original document number: EN.500.086-V5.12.2.0(1)
Document number: EN.500.086-V5.12.2.0(1)
Document update date: May 20. 2026
You can send your comments, corrections, and suggestions about this guide to
¶ About this guide
This guide is intended for integrators who are planning to purchase and deploy a Security Center SaaS Edition (Classic) system. It introduces Security Center SaaS Edition (Classic) services and provides the prerequisites for successful deployment of these services as part of your customer's Security Center ecosystem.
¶ Notes and notices
The following notes and notices might appear in this guide:
- Tip: Suggests how to apply the information in a topic or step.
- Note: Explains a special case or expands on an important point.
- Important: Points out critical information concerning a topic or step.
- Caution: Indicates that an action or step can cause loss of data, security problems, or performance issues.
- Warning: Indicates that an action or step can result in physical harm, or cause damage to hardware.
IMPORTANT: Content in this guide that references information found on third-party websites was accurate at the time of publication, however, this information is subject to change without prior notice from Genetec Inc.
¶ Contents
| Preface | |
|---|---|
| Legal notices. About this guide. |
ii iii |
| Chapter 1: Security Center SaaS Edition (Classic) overview | |
| What is Security Center SaaS Edition (Classic)?. | 2 |
| Limitations of hosted Security Center deployments. | 3 |
| Chapter 2: Security Center SaaS Edition (Classic) requirements | |
| Presale checklist for Security Center SaaS Edition (Classic). | 8 |
| Network requirements for Security Center SaaS Edition (Classic). | 9 |
| Ports required by Security Center SaaS Edition (Classic). | 10 |
| Chapter 3: Deploying hosted products in Security Center SaaS Edition (Classic) | |
| Deployment overview for Security Center SaaS Edition (Classic). | 13 |
| Connecting to Security Center in the cloud for the first time. | 15 |
| Activating the Synergis Cloud Link cloud connection. | 16 |
| Adding access control units to a hosted Access Manager. | 17 |
| Configuring the NTP server for access control units. | 18 |
| Configuring the NTP server on Synergis Cloud Link and Roadrunner units. | 18 |
| Configuring the NTP server on Axis Powered by Genetec units. | 19 |
| Configuring access control units for peer-to-peer communication. | 20 |
| Disabling internet connectivity testing on access control units. | 21 |
| Connecting a Genetec Intrusion Protocol Bridge to a hosted Intrusion Manager role. | 22 |
| Setting up a Security Center Federation in a hosted system. Adding Federation users in Stratocast. |
24 25 |
| Chapter 4: Federation through reverse tunneling | |
| What is reverse tunneling?. | 28 |
| Deploying Security Center Federation using reverse tunneling. | 30 |
| Creating reverse tunnels on the Federation host. | 31 |
| Opening reverse tunnels between remote sites and the Federation host. | 33 |
| Connecting the Federation host to remote sites through reverse tunnels. | 35 |
| Resetting reverse tunnels. | 37 |
| Chapter 5: Sipelia SaaS | |
| About Sipelia SaaS. | 40 |
| Configuring your Sipelia plugin in Security Center SaaS Edition (Classic). | 41 |
| Configuring your Sipelia Mobile plugin in Security Center SaaS Edition (Classic). | 42 |
| Adding a VoIP device in Sipelia SaaS. | 43 |
| Establishing a call in Sipelia SaaS. | 44 |
| Glossary | 45 |
| Where to find product information | 50 |
| Technical support | 51 |
¶ Security Center SaaS Edition (Classic) overview
This section includes the following topics:
• "What is Security Center SaaS Edition (Classic)?" on page 2
¶ What is Security Center SaaS Edition (Classic)?
The Security Center SaaS Edition (Classic) is Security Center offered by subscription. Subscription-based ownership simplifies the transition to cloud services and provides an alternative way to purchase, deploy, and maintain the Security Center unified platform.
¶ What does Security Center SaaS Edition (Classic) offer to customers?
With Security Center SaaS Edition (Classic), you can:
- Purchase Security Center on an annual basis. Only the Security Center SaaS Edition (Classic) allows customers to purchase Security Center on a subscription.
- Benefit from connected services such as the Genetec™ Update Service (GUS) for on-premises subscription systems. This is not applicable for cloud systems because the updates are managed by us.
- Access Genetec™ Technical Support at no additional cost. NOTE: Support is only available to technicians certified by us.
¶ What deployment options are available with the Security Center SaaS Edition (Classic)?
Security Center SaaS Edition (Classic) can be deployed on-premises, in the cloud, or as a hybrid system.
- On-premises System: Security Center software is deployed on customer hardware on-premises with a subscription license. Security Center on-premises subscription supports all Security Center features and is not limited by the cloud constraints. For more information about on-premises deployment, see the Security Center Administrator Guide and Security Center User Guide on the TechDoc Hub.
- Hosted System: Security Center software is deployed by Genetec in the cloud. We provide a system for you to use and configure.
- Hybrid System: You can combine on-premises and cloud-based systems in a Security Center SaaS Edition (Classic) hybrid deployment. For example, customers can have their video management system onpremises and use cloud-based, central monitoring (Federation™). Hybrid deployments require a local Directory to connect to a Federation™ host in the cloud.
The following deployment options are available with Security Center SaaS Edition (Classic) systems:
| System | On-premises | Hosted | Hybrid |
|---|---|---|---|
| Omnicast™ 1 | ✔ | Not available | ✔ |
| Synergis™ | ✔ | ✔ | ✔ |
| AutoVu™ | ✔ | ✔ | ✔ |
1 Security Center Omnicast is not available as a hosted solution. To view video in your hosted system, you can federate local Security Center systems that include a Directory and one or more Archivers.
¶ How is hosted Security Center SaaS Edition (Classic) different?
Hosted deployments of Security Center SaaS Edition (Classic) offer centralized administration and monitoring. Operators can connect to the Security Center system from any part of your organization using Security Center applications installed on-premises (Security Desk and Config Tool), Genetec™ Web App, Security Center Web Client, and Genetec™ Mobile app.
A hosted system can provide Access Control as a Service (ACaaS). In an ACaaS model, Security Center Synergis is installed in the cloud as a subscription service that is billed based on the required number of connected readers. Your hardware, such as door controllers, electronic locks, and readers, is installed on-premises and connects to the cloud through a Synergis™ Cloud Link appliance. Other access control units that connect to the cloud are Cloud Link Roadrunner™ and Axis Powered by Genetec units A1210 and A1610.
When using Security Center SaaS Edition (Classic) for cloud-based central monitoring, the Federation host is installed in the cloud as a subscription service. Billing is based on the required number of federated sites.
¶ What does hosted Security Center SaaS Edition (Classic) include?
- Roles: The following roles are included with Security Center SaaS Edition (Classic):
- Directory
- Health Monitor
- Map Manager
- Media Router
- Mobile Server
- Report Manager
- Intrusion Manager (only if specified in the order)
- Access Manager (only if specified in the order)
- Security Center Federation™ (equal to the number of federated sites specified in the order)
- Web Server
- Backups: Daily snapshots of your system are taken and retained for seven days. The Genetec cloud operations team uses these snapshots for disaster recovery situations. Operator errors are covered separately by an optional database recovery service. For more information, contact Genetec Channel Sales.
¶ Limitations of hosted Security Center deployments
Some features offered by Security Center are not applicable to cloud deployments, are not supported, or offer limited functionality.
As a cloud service, some Security Center features require intervention by us.
¶ Unsupported features
The following features are not supported:
| Features | Description |
|---|---|
| Administrator access | Administrator accounts, with all Security Center privileges, are not available in hosted deployments of Security Center SaaS Edition (Classic). These deployments are administered by Genetec. A user account is provided to configure the system. |
| Centralized multi-device firmware upgrade | Not supported. |
| Create Security Center roles | Roles are created by Genetec based on the subscription. |
| Security Center role failover | In a Security Center SaaS Edition (Classic) offering, this is currently administered through Azure cross-region data replication. |
| Federation™ of the Security Center SaaS Edition (Classic) Directory from an on-premises Federation role |
Not supported. |
| HID VertX and Edge EVO | Not supported. |
| KiwiVision™ | Not supported. |
| Macros | Not supported. |
| Mobile device camera streaming | Not supported. |
| Move unit tool | Not supported. |
| Synergis™ primitive rules | Not supported. |
| Security Center Omnicast™ | Archiver roles cannot be connected to hosted deployments of Security Center SaaS Edition (Classic). To view video in your hosted system, you can federate local Security Center systems that include a Directory and one or more Archivers. |
| Remote Config Tool | Not supported. |
| Remote Desktop Protocol (RDP) access to the cloud instance | Only Security Desk, Config Tool, Genetec™ Web App, Security Center Web Client, and Genetec™ Mobile can access the system. |
| Saving reports to disk from Report Manager | You can download reports directly from the user workstation and email them. Scheduled reports saved on the VM disk are not supported. |
| Features | Description |
|---|---|
| Server Admin | No access to the Server Admin tool. |
| Unit discovery tool | Units are discovered automatically after synchronizing federated entities. |
¶ Limited features
The following features are limited and require intervention by Genetec:
| Features | Description |
|---|---|
| Active Directory (AD) integration | To authenticate users for cloud systems, you can use third-party OpenID or SAML2 identity providers such as Azure AD. |
| Synchronizing cardholders with the Azure AD requires the Synergis™ Card Synchronization plugin. |
|
| Fusion stream encryption | • In transit from archiver encryption is supported. |
| • In transit and at rest encryption is not supported. |
|
| Global cardholder management | In a Security Center SaaS Edition (Classic) setup, sharing host is the recommended system to host in the cloud. |
| Import tool | The Import tool is supported and available, but it cannot be configured to run as a scheduled task through the Import from file action. |
| Intrusion Manager | The Intrusion Manager is an optional feature in the Genetec hosted environment. For a list of supported intrusion panels, see the Security Center SaaS Edition (Classic) ordering guide. |
| SMTP configuration | SMTP is configured by Genetec. |
| Security Center plugins | All plugins must be certified by Genetec before they can be deployed in a hosted system. If a specific plugin is required for your project, contact our sales representative. |
| Synergis units | The Portal and Hardware pages of the Synergis unit are not available in the Access control task. Connect to the Synergis unit's portal from the local network. |
| Features | Description |
|---|---|
| Threat levels | Do not use the Set minimum security clearance threat level action for time sensitive or life-critical scenarios. Instead, use a local input to trigger behavior changes with the Automation engine in Synergis™ Cloud Link. |
| Trigger output action | Triggering outputs using the Trigger output action is supported and available, for example, in event-to-actions or hot actions. However, the Trigger output action should not be used for time sensitive or life-critical scenarios. In those scenarios, I/O zones should be used to trigger outputs instead. |
¶ Security Center SaaS Edition (Classic) requirements
This section includes the following topics:
- "Presale checklist for Security Center SaaS Edition (Classic)" on page 8
- "Network requirements for Security Center SaaS Edition (Classic)" on page 9
- "Ports required by Security Center SaaS Edition (Classic)" on page 10
¶ Presale checklist for Security Center SaaS Edition (Classic)
Use this checklist to collect information about the customer's environment and to ensure that the customer environment meets Security Center SaaS Edition (Classic) requirements.
- Obtain a list of IP addressing schemes at their remote sites. Ensure that the Azure® cloud virtual network does not interfere with any of them.
- Check the internet service level agreement (SLA).
- Confirm the following:
- Number of simultaneous Security Desk users
- Number of simultaneous Genetec™ Web App users
- Number of simultaneous Security Center Web Client users
- Number of simultaneous Genetec™ Mobile users
- Any outstanding IT or security concerns that should be resolved before purchase.
- Check additional information for hosted Synergis™:
- Number of Synergis™ Cloud Link units
- Number of Cloud Link Roadrunner™ units
- Number of Axis Powered by Genetec units
- Number of access control system devices (readers, inputs, and outputs)
- Estimated number of cardholders and credentials to be handled.
- Check additional information for Federation™:
- Number of cameras from the remote sites (Federation)
- Video compression standards (H.264, H.265)
NOTE: The Web App can play H.265/HEVC streams without transcoding when the workstation and browser support this format.
The requirements are as follows:
- A workstation with hardware acceleration (NVIDIA GPU or Intel® Quick Sync Video on an 11th‑generation CPU or later).
- A current version of Google Chrome or Microsoft Edge with native H.265/HEVC support.
- ISP policies:
- Static or dynamic WAN
- DNS addresses (especially in Dynamic IP assignment)
- Number of remote systems
- Available upload bandwidth per site (see bandwidth considerations)
- Any required expansion resources on site (such as IP door controllers)
¶ Network requirements for Security Center SaaS Edition (Classic)
To successfully deploy Security Center SaaS Edition (Classic) in the cloud, network infrastructure must meet the required performance criteria, and network policy must adhere to the setup recommendations.
¶ General network requirements
Hosted services in Security Center SaaS Edition (Classic) have the following network requirements:
- Azure® connections: High-latency connections might negatively impact the availability of remote sites. A latency of 150 ms or less to the closest Azure® data center is mandatory. Use the Azure® Storage Latency Test to determine which Azure® data center is the best for hosting your servers.
- Internet service level: A service level of 99.9% guaranteed by the customer's Internet service provider (ISP) is highly suggested.
¶ Federation network requirements
Federation™ in Security Center SaaS Edition (Classic) has the following extra considerations and requirements:
- Bandwidth: The number of cameras that can be viewed simultaneously depends on several factors:
- Outbound bandwidth from the remote site
- Inbound bandwidth to the client workstation
- Quality of requested video streams
These bandwidth considerations do not apply if the client workstation is in the same network as the camera being viewed.
- Port forwarding: If you are not using reverse tunnels to connect the Federation host to your local systems, which is default, port forwarding from the WAN NAT device to the on-site servers is required. IMPORTANT: If port forwarding is required, make sure that the customer's IT department is aware before completing the purchase order. If neither opening the private network nor using reverse tunnels are acceptable options, contact your sales representative at Genetec Inc.
- Multi-streaming: Cameras at remote sites should support multiple streams. This ensures that a lower bandwidth stream can be used for outbound video streams from the remote sites.
- Video redirection: It is recommended to have the local Security Center system perform the video redirection. If the local site has a poor connection, such as a connection through a satellite, video redirection through the cloud might be acceptable with extra fees to cover overages. For more information on this architecture, contact your sales representative at Genetec Inc.
¶ Related Topics
What is reverse tunneling? on page 28
¶ Ports required by Security Center SaaS Edition (Classic)
To successfully deploy a hosted Security Center SaaS Edition (Classic) system, you must open specific network ports on-premises to allow communication with the Security Center system in the cloud.
¶ General ports
The following table lists the general network ports that are used in a standard Security Center SaaS Edition (Classic) setup. The administrator can choose to use different ports. For more information on port usage, ask your representative of Genetec Inc. for the latest Security Center Network Flow Diagrams.
| Computer | Inbound | Outbound | Port usage |
|---|---|---|---|
| Client workstations (Security Desk and Config |
TCP 5500 | Connection requests to the Directory in the cloud | |
| Tool) | TCP 443 | Genetec™ Update Service (GUS)1 | |
| Compatible browser | TCP 443 | Connection to web server |
1 Client workstations should not initiate updates unless notified by Genetec Cloud Operations.
¶ Federation ports
The following table lists the default network ports that are used in a standard Federation™ setup. The administrator can choose to use different ports. For more information on port usage, ask our representative for the latest Federation™ Port Diagrams.
| Computer | Inbound | Outbound | Port usage |
|---|---|---|---|
| Client workstations (Security Desk and Config Tool) |
TCP 554 | Connection to Media Routers in the cloud and on premises |
|
| TCP 560 | Connection to on-premises redirectors | ||
| TCP 960 | Connection to on-premises redirectors | ||
| Directory (on-premises) | TCP 55001 | Connection requests to Directory | |
| Media Router (on premises) |
TCP 5541 | Live and playback streams requests | |
| Redirector (on-premises) | TCP 5601 | Requests from client workstations and redirectors |
|
| TCP 9601 | Live and playback stream requests |
1 Not necessary if the Federation is set up through reverse tunneling.
¶ Synergis ports
The following table lists the default network ports that are used in a hosted Synergis™ setup. For more information on port usage, ask our representative for the latest Synergis™ Port Diagrams.
| TCP 443 Connection to the cloud Synergis™ Cloud Link The Synergis Cloud Link communicates with the Cloud Link Roadrunner™ following domains and URLs: Axis Powered by Genetec • .geneteccloud.com A1210 • .servicebus.windows.net Axis Powered by Genetec • *.blob.core.windows.net A1610 • global.azure-devices-provisioning.net • www.google.com NOTE: To disable communication with Google, see Disabling internet connectivity testing on access control units on page 21. UDP 123 Connection to a Network Time Protocol (NTP) server that links to a known time server. |
Access control unit | Inbound | Outbound | Port usage |
|---|---|---|---|---|
¶ Intrusion Manager ports
The following table lists the ports that are used in a hosted Intrusion Manager setup. The ports are managed by Genetec Inc. For more information on Intrusion Protocol port usage, see Ports used by the Genetec Intrusion Protocol extension.
| Computer | Inbound | Outbound | Port usage |
|---|---|---|---|
| Genetec Intrusion Bridge™ (on-premises) |
TCP 26241 | Connection to the Genetec™ Intrusion Protocol hub installed on the cloud Intrusion Manager |
1 Genetec™ Intrusion Bridge uses more ports on-premises to communicate with enrolled intrusion panels. The ports depend on the brand of panels used.
¶ Stratocast ports
For more information on Stratocast™ port usage, see Firewall settings.
¶ Related Topics
What is reverse tunneling? on page 28
¶ Deploying hosted products in Security Center SaaS Edition (Classic)
¶ This section includes the following topics:
- "Deployment overview for Security Center SaaS Edition (Classic)" on page 13
- "Connecting to Security Center in the cloud for the first time" on page 15
- "Activating the Synergis Cloud Link cloud connection" on page 16
- "Adding access control units to a hosted Access Manager" on page 17
- "Configuring the NTP server for access control units" on page 18
- "Configuring access control units for peer-to-peer communication" on page 20
- "Disabling internet connectivity testing on access control units" on page 21
- "Connecting a Genetec Intrusion Protocol Bridge to a hosted Intrusion Manager role" on page 22
- "Setting up a Security Center Federation in a hosted system" on page 24
¶ Deployment overview for Security Center SaaS Edition (Classic)
Deploying hosted services in Security Center SaaS Edition (Classic) involves planning, ordering, connecting to the cloud, and configuration.
The following steps are required to deploy hosted services in Security Center SaaS Edition (Classic). These hosted services include the following:
- Federation™
- Synergis™
| Step | Description | Where to find more information | |||
|---|---|---|---|---|---|
| Understand the prerequisites and system requirements before ordering | |||||
| 1 | Read the deployment guide to learn about the available services, and to understand their requirements. |
|
|||
| 2 | Evaluate your customer's environment to ensure it meets Security Center SaaS Edition (Classic) requirements. | Presale checklist for Security Center SaaS Edition (Classic) on page 8 |
|||
| Orde | r Security Center SaaS Edition (Classic) | ||||
| 3 | Place your order for Security Center SaaS Edition (Classic) in the Channel Partner Portal or by contacting Genetec™ Inside Sales. | ||||
| 4 | Immediately after receipt of your order, we send you a welcome email, confirming your purchase order and providing a time line for the next steps. NOTE: An order that includes hardware might require more time. | ||||
| 5 | Within five business days, we deploy the new Security Center cloud instance and create the required roles. |
||||
| 6 | After deploying your cloud instance, we send the Channel Partner Technical Contact an activation email that provides the initial logon credentials and the system ID. This email includes important information about getting started. | ||||
| Conn | ect to your cloud instance and start the configuration | ||||
| 7 | Access the Security Center cloud instance using the credentials from your activation email. The first time you log on, you must connect using Config Tool or Security Desk and change your password. |
|
| Step | Description | Where to find more information |
|---|---|---|
| 8 | Add the Synergis™ Cloud Link to the cloud-hosted Access Manager. |
|
| 9 | Connect the Security Center Federation™ roles to remote systems. |
|
| 10 | Configure and connect the Genetec Intrusion Protocol Bridge to the cloud-hosted Intrusion Manager role. |
|
| 11 | Work with your customer to configure Security Center in the cloud for their needs. | Security Center Administrator Guide |
¶ Connecting to Security Center in the cloud for the first time
To log on to your Security Center in the cloud for the first time, you must connect with Config Tool or Security Desk using the credentials from your activation email.
¶ Before you begin
- Ensure that all requirements outlined in Network requirements for Security Center SaaS Edition (Classic) on page 9 have been met.
- Ensure that Security Desk, Config Tool, or both have been installed on a local workstation with internet access. For more information on installing the client software, refer to the Security Center Installation and Upgrade Guide.
- Ensure that you have received the activation email that includes your username, password, and the hostname of the Directory in the cloud.
¶ What you should know
Security Center SaaS Edition (Classic) supports connections from the following applications:
- Config Tool: To administer the system.
- Security Desk: To monitor the system and run reports from any regular operator workstation.
- Genetec™ Mobile: To monitor the system from a mobile device.
- Genetec™ Web App: To monitor the system and run reports from a web browser.
- Security Center Web Client: To monitor the system from a web browser.
¶ Procedure
- 1 Open Config Tool or Security Desk on a workstation with internet access.
- IMPORTANT: The first time you log on, you must connect using Config Tool or Security Desk to change your password. An initial connection with the Web Client is not supported.
- 2 In the Logon window, enter the Directory, Username, and Password you received in your activation email from Genetec Inc.
For example, look for the following lines in the email:
Username: si
Password: pAsSw0rD!
Directory: demo.gsc-cloud.com
3 Click Log on.
After establishing a connection, you are immediately forced to change your password.
- 4 In the Change password window, enter a new password for your user.
- 5 Click OK.
You are now connected and can get started using Security Center in the cloud.
¶ Activating the Synergis Cloud Link cloud connection
After activating the Synergis™ Cloud Link connection, you must establish a secure connection to the cloud from each Synergis Cloud Link unit that is enrolled in a hosted deployment.
¶ Before you begin
Your access control unit must be running the latest firmware version.
¶ What you should know
You can skip this procedure for the following access control units because cloud connection is pre-activated:
- Synergis Cloud Link
- Cloud Link Roadrunner™
- Axis Powered by Genetec
To activate the cloud connection, Cloud Agent must be installed and enabled on the legacy Synergis Cloud Link unit.
Cloud Agent is a separate software module that establishes a secure connection to the cloud.
- Depending on when you purchased your Synergis Cloud Link unit, Cloud Agent might come pre-installed on your unit. If so, you must enable Cloud Agent manually.
- If Cloud Agent did not come pre-installed on your unit, installing it automatically enables it on your unit.
¶ Procedure
- 1 Verify that Cloud Agent is installed on your Synergis Cloud Link unit.
- 2 If Cloud Agent is already installed, enable it on your Synergis Cloud Link unit:
- a) In a web browser, enter the following URL, where is the IP address of the Synergis Cloud Link unit:
- https:///CloudAgent
- b) Do one of the following, depending on the user interface:
- Log on using your Synergis Softwire credentials. On the Activation page, click Enable.
- On the Settings page, click Edit ( ), enter the Username and Password of the Synergis Cloud Link unit, select the Enabled checkbox, and then click Save.
- a) In a web browser, enter the following URL, where is the IP address of the Synergis Cloud Link unit:
- 3 If Cloud Agent is not already installed, download and install it:
- a) Open the GTAP Product Download page.
- b) From the Download Finder list, select Synergis™ Cloud Link Legacy.
- c) Download Cloud Agent.
- d) Install Cloud Agent on all Synergis Cloud Link units that will be enrolled in the hosted Synergis™ deployment.
- The installation is handled as a standard firmware update.
- 4 Add the units to a cloud-hosted Access Manager.
¶ Adding access control units to a hosted Access Manager
After you add a Cloud Agent-enabled access control unit to your Access Manager, the unit activates and can make secure connections to a Security Center SaaS Edition (Classic) hosted deployment.
¶ Before you begin
- Verify that the DNS and other networking settings of the unit are configured. For information on Synergis™ Cloud Link, see Configuring the network properties of the Synergis unit. For information on Cloud Link Roadrunner™, see Configuring the network properties of the Cloud Link Roadrunner unit. For information on Axis Powered by Genetec units, see the Axis network door controller user manual.
- Change the default logon password for the unit. For information on Synergis Cloud Link, see Changing the logon password for the Synergis appliance. For information on Roadrunner, see Changing the logon password for the Cloud Link Roadrunner appliance. For information about Axis Powered by Genetec units, see Preparing to enroll Axis Powered by Genetec units on the TechDoc Hub.
- Verify that the Cloud Agent is installed and enabled on the unit.
- Ensure that the access control unit has internet connectivity. The connectivity status is available on the unit Activation page. If your local network can only reach the internet through a proxy server, specify the proxy URL and optional username and password on the Proxy page.
- Ensure that your Config Tool workstation is on the same network as your access control unit.
¶ Procedure
¶ To add an access control unit to a hosted Access Manager:
- 1 From the Config Tool homepage, open the Access control task and click the Roles and units view.
- 2 Click Access control unit ( ).
- 3 In the Network endpoint area, enter the hostname or IP address of the unit, then click Validate. The system verifies the access control unit and displays the MAC address of the unit.
- 4 Enter the admin username and password. The default username is admin. Change the default password to enroll the unit.
- 5 Review the Creation summary window and click Create. Config Tool sends the information of the access control unit to the Access Manager, which forwards it to the SaaS gateway. When the unit is connected to the SaaS gateway, a confirmation message is displayed.
- 6 Click Close and then click Refresh ( ).
The newly added access control unit appears under the Access Manager that it was assigned to in the Roles and units view. The default entity name is the hostname of the access control unit. This unit now only responds to the commands issued by this Access Manager.
¶ To delete an access control unit from a hosted Access Manager:
- 1 In the Roles and units view, select the access control unit from the entity tree.
- 2 Click Delete ( ).
- 3 In the confirmation dialog box that opens, click Delete.
¶ After you finish
Associate the peripherals (readers, inputs, outputs, and so on) controlled by this unit to doors and zones defined in your system. For more information about deploying access control unit, see Deploying your access control system.
¶ Configuring the NTP server for access control units
Configuring the Network Time Protocol (NTP) settings synchronizes the time between the units that support NTP and the NTP server. Unlike on-premises systems that have a built-in protocol, which synchronizes access control units with their Access Manager, an NTP server must be configured for hosted systems to ensure that Cloud Agent can maintain a connection to the cloud.
¶ Configuring the NTP server on Synergis Cloud Link and Roadrunner units
Synergis™ Cloud Link and Cloud Link Roadrunner™ units enrolled in Security Center SaaS Edition (Classic) hosted deployments running on earlier firmware versions use the time.windows.com NTP server by default. If you have firewalls that block your unit from reaching that NTP server, you can configure a different server.
¶ What you should know
- Only one NTP server can be configured per unit.
- This procedure applies to appliances running the following firmware versions:
- Synergis™ Softwire 11.3 or earlier
- Synergis Cloud Link 2.0 or earlier
- Roadrunner 2.0 or earlier
- No NTP server is configured by default for appliances running the following firmware versions. Configure the NTP server in their respective portals:
- Synergis Softwire 11.4 or later
- Synergis Cloud Link 2.1 or later
- Roadrunner 2.1 or later
¶ Procedure
- 1 From a web browser, open the Cloud Agent Portal: https:///CloudAgent. Replace with the IP address of your unit.
- 2 From the homepage, click Clock.
- 3 In the Time Server (NTP) field, enter a different NTP server.
4 Click Save.
¶ Configuring the NTP server on Axis Powered by Genetec units
A Network Time Protocol (NTP) server offers greater time accuracy than the built-in protocol, which synchronizes the Axis Powered by Genetec units with their Access Manager.
¶ What you should know
Only one NTP server can be configured per Axis Powered by Genetec unit.
¶ Procedure
- 1 Log on to the Axis Powered by Genetec device. For more information, see "Get started" in Axis network door controller user manual.
- 2 Create a dedicated administrator user for the enrollment of the unit in Security Center.
- BEST PRACTICE: For better protection against malicious attacks, use a different administrator user than the default root account for communications with Security Center. Set a strong password that is different from the one for the root account.
- For more information, see "The device interface > System > Users" in the Axis network door controller user manual.
- 3 Configure the NTP server.
- IMPORTANT: Use the same NTP server as the one used for the Security Center servers and client workstations. This step is mandatory if the Axis Powered by Genetec unit is to be used on a cloud-hosted Security Center SaaS Edition (Classic) deployment. Leave the Time zone setting at UTC.
- For more information, see "The device interface > System > Date and time" in the Axis network door controller user manual.
¶ Configuring access control units for peer-to-peer communication
Configure the Fully Qualified Hostname in the Cloud Agent Portal for peer-to-peer communication to work between access control units managed by the same hosted Access Manager role.
¶ Before you begin
Enable the Activate peer-to-peer option on the hosted Access Manager role that your access control unit is enrolled under. For more information, see Configuring Access Manager roles on the TechDoc Hub.
¶ Procedure
- 1 From a web browser, open the Cloud Agent Portal: https:///CloudAgent. Replace with the IP address of your access control unit.
- 2 On the Activation page, enter the Fully Qualified Hostname for your unit. By default, this field contains the unit's hostname. The format for the Fully Qualified Hostname is ..
Example: SCL0CBF123456F2.genetec.com
- 3 Click Save.
- 4 Verify that your unit can communicate with its peers. For Synergis™ Cloud Link and Cloud Link Roadrunner™ units, do the following:
- a) Log on to one of your unit's peers.
- b) Click Maintenance > Peer-to-peer.
If you see your unit listed and online, peer-to-peer communication works correctly.
¶ Disabling internet connectivity testing on access control units
By default, Cloud Agent periodically tries to communicate with Google to test if the access control unit that it is installed on can connect to the internet. If you do not want your units to communicate with Google, you can disable internet connectivity testing from the Cloud Agent Portal.
¶ Procedure
- 1 From a web browser, open the Cloud Agent Portal: https:///CloudAgent. Replace with the IP address of your unit. You are automatically redirected to the Activation page of the portal.
- 2 Clear the Enable internet connectivity tests checkbox.
- 3 Click Save.
The Internet Connectivity field changes to Feature is not enabled.
¶ Connecting a Genetec Intrusion Protocol Bridge to a hosted Intrusion Manager role
To connect a remote Genetec™ Intrusion Protocol Bridge to the Intrusion Manager role, you must configure the Genetec Intrusion Protocol extension in the SaaS environment.
¶ Before you begin
An Intrusion Manager role must be created. The Genetec cloud operations team performs the Intrusion Manager role deployment and Genetec Intrusion Protocol installation.
¶ What you should know
- You can enroll the intrusion panel before or after connecting the Genetec™ Intrusion Bridge.
- To add cardholders, you must first connect the Genetec Intrusion Bridge.
- Custom certificates are not supported in Security Center SaaS Edition (Classic).
- Security Center SaaS Edition (Classic) supports intrusion panels in the following scenarios:
- Panels under the Genetec Intrusion Protocol extension
- Third-party panels federated from an on-premises system
- For the list of supported intrusion panels, see the Security Center SaaS Edition (Classic) ordering guide.
¶ Procedure
- 1 From the machine that runs Genetec Intrusion Bridge, verify that you can connect to TCP 2624 port.
- 2 In Config Tool, connect to your Security Center SaaS Edition (Classic) server and verify that the Intrusion detection task is visible.
- If the task is not visible, contact Genetec™ Technical Assistance Center (GTAC).
- 3 Download and install the Genetec Intrusion Protocol extension on all workstations that interact with the extension.
NOTE: Install the Genetec Intrusion Bridge component on a server that can access the hosted Intrusion Manager role and the supported intrusion panel.
- 4 Configure the communications parameters of the Genetec Intrusion Protocol extension:
- a) From the Config Tool homepage, open the Intrusion detection task.
- b) Click the Extensions tab and click the GIP view.
- c) In the Unit enrollment section, click Add an item ( ) and select Genetec SaaS. For more information, see Configuring communications parameters of the Genetec™ Intrusion Protocol extension.
- d) In the Hub section, configure the settings as follows:
- Enable hub: Turn on this option.
- Hub port: Leave the default value, 2624.
- Connection acceptance: Select Manual to receive notifications for new connections.
- App key: Enter a key to be used as a password when connecting the Genetec Intrusion Bridge to the hub. When you change this value, you must deactivate and reactivate the Enable hub option for the change to take effect.
For more information, see Enabling a hub on the Genetec™ Intrusion Protocol extension.
- e) Click Apply.
- 5 Log on to the Genetec Intrusion Bridge web app.
- 6 (Optional) Update the admin password of your Genetec™ Intrusion Bridge web page.
- 7 (Optional) Reset the certificate thumbprint of a hub.
- 8 Connect the Genetec Intrusion Bridge to the hub that is enabled on the Genetec Intrusion Protocol extension.
- In the App key field on the Hubs page, enter the same key (password) that was created during the hub configuration.
- 9 (Optional) Define the priority of the hubs.
- 10 Enroll and configure intrusion panels to the Genetec Intrusion Bridge.
The intrusion detection unit appears in Security Center.
11 (Optional) Add cardholders to the intrusion panel.
¶ Setting up a Security Center Federation in a hosted system
To set up a Security Center Federation™ in a hosted system, you must connect the Security Center Federation™ role to the remote Security Center system and select events to federate.
¶ Before you begin
- If you are federating a Stratocast™ system, add a Federation™ user in Stratocast to generate the required credentials.
- To set up a Security Center Federation in a hosted system, it is recommended to deploy Security Center Federation™ using reverse tunneling instead of using the following procedure.
¶ What you should know
In a hosted system, all the Security Center Federation™ roles necessary to federate your remote systems are created in advance for you. You must then configure these roles to connect to your remote systems with the required options.
¶ Procedure
- 1 In Config Tool, log on to the hosted system.
- 2 Open the System task and click the Roles view.
- 3 In the entity tree, select the required Security Center Federation™ role and click the Properties tab.
- 4 Configure the following options:
- Allow untrusted connections: (Stratocast system only) Allow connections to Security Center servers using legacy authentication.
- Directory: Name of the main server for the remote Security Center system.
- Username and password: Credentials used by the Federation™ role to log on to the remote Security Center system. The rights and privileges of that user determine what your local users can see and do on the federated remote system.
- Resilient connection: Turn this option on for the Federation™ role to reconnect to the federated Security Center Directory server after a connection interruption. After a specified period of attempting to reconnect, the connection is considered lost and the role goes into a warning state.
- NOTE: Activating Resilient connection is highly recommended for remote systems that might have an unstable connection to the cloud.
- Reconnection timeout: Specify the number of seconds that the Federation™ role attempts to reconnect to the Directory before the connection is considered lost.
- Forward Directory reports: Turn this option on to view user activities (viewing cameras, activating the PTZ, and so on) and configuration changes performed at the federated site. This information is provided from the Activity trails and Audit trails reports on the Federation™ host, provided the Federation™ user has the privileges and access rights to view them. You can also view the federated units in the Hardware inventory task.
- IMPORTANT: Forward Directory reports are only supported with 5.8 systems and higher, including federations. If your federated system is 5.7 and lower, the Forward Directory reports option is grayed out and not available.
- Default live stream: The default video stream that is used for viewing live video from federated Security Center cameras. Remote is selected by default.
If your workstation does not require specific video stream settings for Federation™, you can use the default stream settings from Security Desk instead.
- Enable playback requests: Turn this option on for users to view playback video from federated Security Center cameras.
- Federate alarms: Turn this option on for users to receive alarms from the federated Security Center system.
- Federate custom icons: Turn this option on for federated entities to share custom icons with the Federation host. This means that entity icons in the Federation host appear identical to the federated system. It can take a few minutes to synchronize custom icons.
- Federated events: Select the events that you want to receive from the federated Security Center system. Events are necessary if you plan to monitor the federated entities in Security Desk, or to configure event-to-actions for the federated entities.
¶ 5 Click Apply.
The Security Center Federation™ role ( ) is configured.
The connection status should say Synchronizing entities, or Connected.
- 6 After the role successfully connects to the remote system, open the Area view task.
- 7 Expand the Security Center Federation™ role ( ) in the area view and verify all the federated entities were imported by the role.
The entity hierarchy corresponds to the area view on the federated remote system.
NOTE: It can take up to an hour after a new role is synchronized for video to work.
¶ Adding Federation users in Stratocast
To federate a Stratocast™ system in a hosted deployment of Security Center SaaS Edition (Classic), you must add a Federation™ user to your Stratocast system and use the credentials to configure the Federation role in Config Tool.
¶ Before you begin
Make sure that you have a client account in for the Federation user.
¶ Procedure
1 If your username is registered to multiple Stratocast accounts, select the account to add the Federation™ user.
- 2 Click Clients and then select an account from the Account name column. You can search for client accounts using the search box.
- 3 In the Federation users field of the Users section, click Edit details.
NOTE: If the Federation users field is not displayed, contact Stratocast support.
- 4 Click Add a Federation™ user, enter a brief description to identify the user by, and then click Create. The User state column changes from Creating to Active. The Federation user is added.
- 5 In the Federation™ users page, click the Username of the Federation user that you just added.
- 6 In the Connection details field, click Download and follow the onscreen instructions to open the text file or save it to your local drive.
- A text file that contains the Federation user's Security Center credentials is automatically generated.
¶ Example
Watch this video to learn more. Click the Captions icon (CC) to turn on video captions in one of the available languages.
¶ Federation through reverse tunneling
This section includes the following topics:
- "What is reverse tunneling?" on page 28
- "Deploying Security Center Federation using reverse tunneling" on page 30
- "Creating reverse tunnels on the Federation host" on page 31
- "Opening reverse tunnels between remote sites and the Federation host" on page 33
- "Connecting the Federation host to remote sites through reverse tunnels" on page 35
- "Resetting reverse tunnels" on page 37
¶ What is reverse tunneling?
Reverse tunneling is a method of securing communication between clients and servers that are behind a firewall. This technique enhances security and simplifies firewall management. When using a reverse tunnel, the server initiates a connection to the client. This tunnel connection is secured by a previously shared keyfile that contains an identity certificate. When established, the reverse tunnel allows bidirectional communication without opening inbound firewall ports.
¶ Context
In Security Center, reverse tunneling is primarily used to facilitate the configuration of Security Center SaaS Edition (Classic) where the Federation™ host is running in the cloud. Hosted systems can be challenging to set up from a networking point of view. This is because of the many inbound ports that customers must open on their firewalls to let the Federation host connect to their local Directory servers (the federated sites), exposing their systems to potential threats from the Internet.
With reverse tunneling, the federated sites initiate the connection with the Federation host. This means that only one outbound port needs to be open (TCP 5500 by default) at each local site, making the hosted solution easier for the customer to configure.
The following diagram shows the differences between the regular Federation (in blue) and Federation using reverse tunneling (in purple). In the context of Federation, the Federation host system is the client, initiating the connection with the server, which is the federated site.
When using reverse tunneling, you must create two new roles to reverse the communication order: Reverse Tunnel Server role and Reverse Tunnel role. Reverse tunneling works as follows:
-
- The Reverse Tunnel Server role generates a keyfile, which includes an identity certificate, network connectivity information, and a one-time use token.
-
- The Reverse Tunnel role uses the keyfile to open the reverse tunnel.
-
- The Federation™ role connects to the federated site through the reverse tunnel.
¶ Limitations and requirements
• Reverse tunneling only supports TCP: The network segment used for tunneling between the remote site and the Federation host must support Unicast TCP. After the video reaches the cloud, the Best available transport protocol can be used. If the system detects that the client workstation that requests the video is on the same site where the video originates, the video stream will not go through the cloud.
• Video streams must go through a redirector before and after the tunnel: The tunneling mechanism is only implemented at the level of video redirectors. The tunneling concept is transparent to the Security Desk application. For this reason, the Network view must be configured in such a way that the Media Router never instructs the Security Desk application to connect directly to a remote site.
¶ Related Topics
Deploying Security Center Federation using reverse tunneling on page 30
¶ Deploying Security Center Federation using reverse tunneling
To deploy Security Center Federation™ using reverse tunneling, you must first create a reverse tunnel on the Federation host for each remote site you want to federate. Then open the reverse tunnel from the remote site before you federate it.
¶ Before you begin
Prepare or gather the following information:
- Names of all remote sites to federate and the version of Security Center they are running.
- Credentials to log on to these remote systems as a Federation client and as an administrator. The credentials must have the Add roles privilege.
- Storage that can be accessed from the Config Tool workstation used to log on to different Security Center systems: either the Federation host or one of the remote sites. This storage, which may be a USB key or network drive, is used to save the tunnel keyfiles that will be generated for the reverse tunnels that you create for the remote systems you want to federate.
- The Reverse Tunnel Server role must be able to resolve the cloud server hostname using its configured DNS.
¶ What you should know
- If possible, work from a workstation that can access both the Federation host and the remote site.
- You create reverse tunnels on the Federation host through the Reverse Tunnel Server role. This role only exists on hosted Security Center systems.
¶ Procedure
- 1 Create reverse tunnels for each remote site on the Federation host.
- 2 Open the reverse tunnel between remote sites and the Federation host.
- 3 Connect the Federation host to remote sites through the reverse tunnel.
¶ Related Topics
What is reverse tunneling? on page 28
¶ Creating reverse tunnels on the Federation host
To open a reverse tunnel between a remote site and the Federation™ host, you must first create a reverse tunnel for the remote site on the Federation host.
¶ Procedure
- 1 In Config Tool, log on to the Federation host system.
- 2 Open the System task and click Roles > Reverse Tunnel Server > Properties.
- 3 At the bottom of the page, click Add an item ( ).
- 4 In the Name field, enter the name of the remote site you want to federate and click Add. You can choose any name but it must uniquely identify the remote site. A reverse tunnel is created for that site with the status Not registered.
The Encryption status depends on the encryption mode configured for you on the Reverse Tunnel Server, based on the customer information you provided:
- Enabled: Video in transit from the remote site to the Federation host is encrypted. This is the default setting. If the remote site does not support encryption, connection is blocked.
- Disabled: Video is not encrypted in transit. This option is set up for you if the video from your remote sites is already encrypted by other means, thus making the encryption on the TLS channel redundant. NOTE: When the video is encrypted by the on-premises Archiver role, Web Client and Genetec™ Mobile cannot view it.
- 5 Get the keyfile by doing one of the following:
- If your workstation can access the remote site, click Copy keyfile to clipboard ( ).
- If your workstation cannot access the remote site, click Save keyfile to disk ( ), and specify the file location.
A file named .keyfile is saved to the folder that you select.
6 Click Apply.
¶ After you finish
Open the tunnel that you created from the remote site using the tunnel keyfile.
¶ Opening reverse tunnels between remote sites and the Federation host
To establish a reverse tunnel connection between a remote site and the Federation™ host, you must open the tunnel from the remote site.
¶ Before you begin
To create a Reverse Tunnel role, generate a keyfile from the Federation host system. For security reasons, you can use a keyfile only once.
¶ What you should know
If the remote site is running a version of Security Center earlier than version 5.8.1.0, the reverse tunnel connection is rejected by default.
¶ Procedure
- 1 In Config Tool, log on to the remote Security Center system.
- 2 Open the System task, and click the Roles view.
- 3 Click Add an entity > Reverse Tunnel.
- 4 In the Specific info page, enter the keyfile. Do one of the following:
- In the Tunnel keyfile field, paste the content of the keyfile from the clipboard if previously copied.
- Click Select file ( ), browse the keyfile for your site, and click Open.
The tunnel site name and the time it was created are displayed.
5 Confirm that you have the correct name and click Next. If you used the wrong keyfile, click Clear ( ) and try again.
- 6 (Optional) Enter the role name and description.
- The default role name is Reverse Tunnel.
- If multiple hosts federate this site, choose a different name for each host.
- 7 Click Next > Create > Close.
- The Reverse Tunnel role is created. It takes a few seconds for the role to connect to the Reverse Tunnel Server role on the Federation host.
- 8 (Optional) Click the Properties tab and select an Encryption option. The option is available only if the remote site runs on Security Center 5.8.1.0 or later.
- Encrypt: Encrypt video in transit from the remote site to the Federation host. This is the default option.
- Prefer encryption: Encrypt the video in transit if both the remote site and the Federation host support TLS. Use this option if you are not certain of the capabilities of the Federation host.
- Do not encrypt: Do not encrypt the video in transit. Use this option if the remote site is already encrypting the video through other means, which makes encryption on the TLS channel redundant. NOTE: When the video is encrypted by the on-premises Archiver role, Web Client and Genetec™ Mobile cannot view it.
- 9 (Optional) Turn on the Create agents on role servers option.
- By default, all servers that host the Directory, Media Router, and Redirector roles require internet access for reverse tunneling. This option transfers the role agents to the servers listed on the Resources page.
- On systems with restricted internet access, this option allows you to select which servers can redirect the outbound network traffic. In this scenario, these are the only servers that require outbound internet access for reverse tunneling.
- 10 (Optional) Click the Resources tab and configure failover for the Reverse Tunnel role.
- For more information, see "Setting up role failover" in the Security Center Administrator Guide.
- NOTE: When the Create agents on role servers option is enabled, the servers listed here are used as proxies for all outbound traffic. When option is disabled, a typical role failover occurs.
¶ After you finish
-
- Log on to the Federation host using Config Tool and confirm that the status of the remote site is Online.
¶ Connecting the Federation host to remote sites through reverse tunnels
To connect the Federation™ host to a remote site using reverse tunneling, you must follow a specific pattern for the Directory name while configuring the Security Center Federation™ role.
¶ Before you begin
Open a reverse tunnel on a remote site.
¶ What you should know
In a hosted system, all the Security Center Federation™ roles necessary to federate your remote systems are created in advance for you. You must then configure these roles to connect to your remote systems with the required options.
¶ Procedure
- 1 In Config Tool, log on to the hosted system.
- 2 Open the System task and click the Roles view.
- 3 In the entity tree, select the required Security Center Federation™ role and click the Properties tab.
- 4 In the Directory field, enter the name of the reverse tunnel to be used. The format of the reverse tunnel name is: directory..tunnel.genetec.com, where is the name used to identify the remote site on the Reverse Tunnel Server role.
For example, if the remote site is named VM30462, enter directory.VM30462.tunnel.genetec.com. The string is not case-sensitive.
- 5 Configure the rest of the Federation role settings:
- Username and password: Credentials used by the Federation™ role to log on to the remote Security Center system. The rights and privileges of that user determine what your local users can see and do on the federated remote system.
- Resilient connection: Turn this option on for the Federation™ role to reconnect to the federated Security Center Directory server after a connection interruption. After a specified period of attempting to reconnect, the connection is considered lost and the role goes into a warning state.
NOTE: Activating Resilient connection is highly recommended for remote systems that might have an unstable connection to the cloud.
- Reconnection timeout: Specify the number of seconds that the Federation™ role attempts to reconnect to the Directory before the connection is considered lost.
- Forward Directory reports: Turn this option on to view user activities (viewing cameras, activating the PTZ, and so on) and configuration changes performed at the federated site. This information is provided from the Activity trails and Audit trails reports on the Federation™ host, provided the Federation™ user has the privileges and access rights to view them. You can also view the federated units in the Hardware inventory task.
IMPORTANT: Forward Directory reports are only supported with 5.8 systems and higher, including federations. If your federated system is 5.7 and lower, the Forward Directory reports option is grayed out and not available.
• Default live stream: The default video stream that is used for viewing live video from federated Security Center cameras. Remote is selected by default.
If your workstation does not require specific video stream settings for Federation™, you can use the default stream settings from Security Desk instead.
- Enable playback requests: Turn this option on for users to view playback video from federated Security Center cameras.
- Federate alarms: Turn this option on for users to receive alarms from the federated Security Center system.
- Federate custom icons: Turn this option on for federated entities to share custom icons with the Federation host. This means that entity icons in the Federation host appear identical to the federated system. It can take a few minutes to synchronize custom icons.
- Federated events: Select the events that you want to receive from the federated Security Center system. Events are necessary if you plan to monitor the federated entities in Security Desk, or to configure event-to-actions for the federated entities.
¶ 6 Click Apply.
The Security Center Federation™ role ( ) is configured.
The connection status should say Synchronizing entities, or Connected.
- 7 After the role successfully connects to the remote system, open the Area view task.
- 8 Expand the Security Center Federation™ role ( ) in the area view and verify all the federated entities were imported by the role.
The entity hierarchy corresponds to the area view on the federated remote system.
NOTE: It can take up to an hour after a new role is synchronized for video to work.
¶ Resetting reverse tunnels
When the reverse tunnel is open, the two parties are authenticated through the certificates exchanged during the site enrollment. If the certificate of either party is modified while disconnected, you must reset the tunnel by generating and applying a new keyfile to the tunnel.
¶ What you should know
For security reasons, a reverse tunnel keyfile can only be used once. The tunnel keyfile only needs to establish the first connection from the remote site to the host.
NOTE: If the certificate of the host system is replaced while the remote systems are connected, the new host certificate is propagated to all remote systems, and no re-enrollment is necessary.
¶ Procedure
- 1 Generate a new keyfile on the Federation™ host:
- a) In Config Tool, log on to the Federation host.
- b) Open the System task and click Roles > Reverse Tunnel Server > Properties.
- c) Select the site that corresponds to the broken tunnel and click Force re-enrollment of this site ( ).
- d) click OK > Apply.
- The status of the site reverts to Not registered.
- e) At the bottom of the window, get the keyfile:
- If you are using the same workstation to connect to both the Federation host and the remote site, click Copy keyfile to clipboard ( ).
- If the workstation you use to log on to the Federation host is different than the workstation used to log on to the federated systems, click Save keyfile to disk ( ), and specify the file location.
A file named .keyfile is saved to the folder that you select.
- 2 Apply the new keyfile to the remote site:
- a) In Config Tool, log on to the remote site.
- b) Open the System task and click Roles > Reverse Tunnel > Properties.
- c) (Optional) Select an Encryption option. The option is available only if the remote site runs on Security Center 5.8.1.0 or later.
- d) (Optional) Turn on the Create agents on role servers option.
- e) Enter the keyfile by doing one of the following:
- In the Tunnel keyfile field, paste the content of the keyfile from the clipboard if previously copied.
- Click Select file ( ) and browse to the keyfile corresponding to your site and click Open.
f) Click Apply. The Connection status changes to Connected.
¶ After you finish
Log on to the Federation host using Config Tool and confirm that the status of the remote site is Online.
¶ Related Topics
Creating reverse tunnels on the Federation host on page 31 Opening reverse tunnels between remote sites and the Federation host on page 33
¶ Sipelia SaaS
This section includes the following topics:
- "About Sipelia SaaS" on page 40
- "Configuring your Sipelia plugin in Security Center SaaS Edition (Classic)" on page 41
- "Configuring your Sipelia Mobile plugin in Security Center SaaS Edition (Classic)" on page 42
- "Adding a VoIP device in Sipelia SaaS" on page 43
- "Establishing a call in Sipelia SaaS" on page 44
¶ About Sipelia SaaS
Sipelia™ as a service is a cloud-based service. It provides an alternative way to deploy and maintain Sipelia™. Sipelia SaaS functions the same as our on-premises solution but requires some basic configuration to get your system set up and ready to register your VoIP device.
¶ Supported VoIP devices
See the Supported Device List to verify which devices are supported using Sipelia™ SaaS.
If your device is not listed as Cloud Compliant, you can contact Sipelia_commercial@genetec.com for a certification request. To comply with our solution, a VoIP device must at least support SIP/SIPS, TLS, SRTP, and STUN. Although we recommend using certificates issued by an authority, you can disable the certificate validation and use a self-signed certificate.
¶ Ports
To communicate with our server, some inbound ports might need to be opened where the intercom is located. Make sure that SIP and RTP (Inbound) are allowed for the ports that are used by the VoIP device.
¶ Features and Limitations
For all features and limitations of Sipelia™ SaaS, see the Sipelia™ User Guide.
¶ Configuring your Sipelia plugin in Security Center SaaS Edition (Classic)
You must configure some specific settings in Config Tool before adding and registering a VoIP device to Sipelia™ as a service.
¶ Procedure
- 1 Open Config Tool and log on using your credentials.
- 2 In Tasks > Plugins > Sipelia, select the General tab.
- 3 Set the options as follows and click Apply:
- SIP port: 25060 • Session transfer: 8202 • Enable TCP: Set to ON
- TCP port: 25060
- Enable authentication on incoming calls: Set to ON
- Enable TLS: Set to ON • SIP secure port: 25061
- Validate remote certificate: Set to OFF if you want to use self-signed certificates
- 4 Click the Server tab and define the extension ranges as required for your system.
NOTE: Use a strong password when creating your extension ranges.
5 Enable the recording option in the Recording tab, to record calls made in Sipelia. If recording is enabled, set the Recording folder path to D:\SipArchives.
¶ Configuring your Sipelia Mobile plugin in Security Center SaaS Edition (Classic)
To allow users to access a Sipelia™ Mobile Integration in Security Center SaaS Edition (Classic), you must first configure settings in Config Tool.
¶ Procedure
¶ To configure your Sipelia Mobile plugin:
- 1 From the Config Tool homepage, open the Plugins task.
- 2 Click Add an entity ( ) and select Plugin.
- 3 On the Specific info page, select a server to host the plugin role. If no expansion server is present, this option is not available.
- 4 Select Sipelia™ Mobile as the plugin type and click Next.
- 5 On the Basic information page, enter a name and description for the role.
- 6 If there is a Partition field, select the partition that the role belongs to. Partitions determine which Security Center users have access to this entity. Only users who have been granted access to the partition can see this role.
- 7 Click Next > Create > Close.
- 8 Grant mobile rights to users:
- a) From the Config Tool homepage, open the User management task.
- b) Select the user that you want to grant rights to use Sipelia Mobile and click the VoIP tab.
- c) Turn on Mobile enabled.
¶ Adding a VoIP device in Sipelia SaaS
You must add a device to Sipelia™ using Config Tool to complete the setup for registering the device.
¶ Procedure
¶ To add a VoIP device in Sipelia:
- 1 In Tasks > Plugins > Sipelia, click the General tab.
- 2 Click Add Intercom.
- 3 Enter an Intercom name.
- 4 Associate an extension and password to the intercom. NOTE: You need this password for configuration on the device's web page.
¶ To configure a VoIP device to register to Sipelia:
- 1 Log on the device's web page and select the SIP configuration section. NOTE: Settings can vary depending on the manufacturer. For assistance, contact Genetec™ Technical Assistance Center (GTAC).
- 2 Set the Server IP of the Sipelia server.
- 3 Set the Username the same that you assigned to the intercom earlier.
- 4 Set the Password the same that you assigned to the intercom earlier.
¶ Establishing a call in Sipelia SaaS
Once your device is registered, you can test it by establishing a call in Sipelia™ using Security Desk.
¶ What you should know
Before establishing a call, ensure that the user is assigned an extension. For more information, see the Sipelia™ User Guide.
¶ Procedure
¶ To assign a user extension:
- 1 In Config Tool, open the User Management task.
- 2 Click the VoIP tab and select your user and assign an extension.
¶ To call a VoIP device:
- 1 Open Security Desk and log on with your credentials.
- 2 Select Options > Sipelia and in the Audio and video section, select your Webcam, Microphone, and Speaker.
- This allows you to make or receive calls directly from Security Desk.
- If your device is properly registered, you should see a green dot next to the device icon.
- 3 After you are set up, there are two ways to make calls:
- Click the green phone icon at the top right of your screen to open the Address Book or double-click the contact to start a call from Security Desk to the device.
- You can also make a call from the device to Security Desk by dialing your user extension (at the top right inside the Address Book) from the VoIP device and you will receive the call in the Security Desk application.
¶ Glossary
is a cloud-based video monitoring system that makes the adoption of network video security solutions easy. With , you can connect to your business wherever you go. Using the Microsoft Windows Azure cloudcomputing platform, eliminates the need for on-site servers. As a result, installation time is reduced and you can begin monitoring your premises quickly.
¶ access control unit
An access control unit is a device that manages physical access, such as a Synergis™ Cloud Link appliance or an Axis Powered by Genetec door controller, and communicates directly with an Access Manager. Access control units operate autonomously when disconnected from the Access Manager.
¶ Access Manager
The Access Manager role manages and monitors access control units on the system.
¶ Active Directory Federation Services
Active Directory Federation Services (ADFS) is a component of the Microsoft® Windows® operating system that issues and transforms claims, and implements federated identity.
¶ Archiver
The Archiver role is responsible for the discovery, status polling, and control of video units. The Archiver also manages the video archive and performs motion detection if it is not done on the unit itself.
¶ AutoVu™
The AutoVu™ automatic license plate recognition (ALPR) system automates license plate reading and identification, making it easier for law enforcement and for municipal and commercial organizations to locate vehicles of interest and enforce parking restrictions. Designed for both fixed and mobile installations, the AutoVu™ system is ideal for a variety of applications and entities, including law enforcement, municipal, and commercial organizations.
¶ certificate
Designates one of the following: (1) digital certificate; (2) SDK certificate.
¶ client user
User level that is assigned by either the integrator administrator, integrator user, or the client administrator. You can only add a maximum of nine client users per client account, not including the client administrator, and they can each be assigned unique usernames or the same username.
¶ cloud platform
A cloud platform provides remote computing and storage services through centralized data centers that are accessible via the Internet.
¶ Config Tool
Config Tool is the Security Center administrative application used to manage all Security Center users and to configure all Security Center entities such as areas, cameras, doors, schedules, cardholders, patrol vehicles, ALPR units, and hardware devices.
¶ Directory
The Directory role identifies a Security Center system. It manages all entity configurations and system-wide settings. Only a single instance of this role is permitted on your system. The server hosting the Directory role is called the main server, and must be set up first. All other servers you add in Security Center are called expansion servers, and must connect to the main server to be part of the same system.
¶ expansion server
An expansion server is any server machine in a Security Center system that does not host the Directory role. The purpose of the expansion server is to add to the processing power of the system.
¶ failover
Failover is a backup operational mode in which a role (system function) is automatically transferred from its primary server to a secondary server that is on standby. This transfer between servers occurs only if the primary server becomes unavailable, either through failure or through scheduled downtime.
¶ Federation™
Federation™ joins multiple, independent Genetec™ security systems into a single virtual system. With this feature, users on a central system, called the Federation host, can view and control entities that belong to remote systems.
¶ Federation™ host
The Federation™ host is the Security Center or Security Center SaaS system that runs Federation™ roles. Users on the Federation™ host can view entities that belong to federated systems and control the entities directly from their system.
¶ Genetec™ Intrusion Bridge
The Genetec™ Intrusion Bridge is the component of the Genetec™ Intrusion Protocol that communicates with intrusion alarm panels and relays their information to Security Center.
¶ Genetec™ Intrusion Hub
The Genetec™ Intrusion Hub is a component of the Genetec™ Intrusion Protocol that enables the connection between the Intrusion Manager and the Genetec™ Intrusion Bridge.
¶ Genetec™ Intrusion Protocol
The Genetec™ Intrusion Protocol integrates specific third-party intrusion panels with Security Center, either on-premise or hosted. You can then monitor and investigate intrusion events in Security Desk.
¶ Genetec™ Mobile
Official name of the map-based Security Center mobile application for Android and iOS devices.
¶ Genetec™ Server
Genetec™ Server is the Windows service that is at the core of Security Center architecture, and that must be installed on every computer that is part of the Security Center's pool of servers. Every such server is a generic computing resource capable of taking on any role (set of functions) you assign to it.
¶ Genetec™ Update Service
The Genetec™ Update Service (GUS) is automatically installed with most Genetec™ products and enables you to update products when a new release becomes available.
¶ Genetec™ Web App
Genetec™ Web App is a web application that gives users access to Security Center from any computer with a supported web browser. Users can monitor system entities, investigate alarms and events, respond to incidents, generate reports, and more.
¶ Global Cardholder Synchronizer
The Global Cardholder Synchronizer (GCS) role ensures the two-way synchronization of shared cardholders and their related entities between the local system (sharing guest) where it resides and the central system (sharing host).
¶ Health Monitor
The Health Monitor role monitors system entities such as servers, roles, units, and client applications for health issues.
¶ Intrusion Manager
The Intrusion Manager role monitors and controls intrusion detection units. It listens to the events reported by the units, provides live reports to Security Center, and logs the events in a database for future reporting.
¶ Map Manager
The Map Manager centrally manages all mapping resources in your system, including imported map files, external map providers, and KML objects. It also acts as the map server for client applications and as the record provider for system entities placed on georeferenced maps.
¶ Media Router
The Media Router is the central role that handles all audio and video stream requests in Security Center or Security Center SaaS. It establishes streaming sessions between the stream source, such as a camera or an Archiver role, and the client applications that request the sessions. The location and transmission capabilities of each party determine the routing decisions.
¶ Mobile Admin
(Obsolete as of SC 5.8 GA) Mobile Admin is a web-based administration tool used to configure the Mobile Server.
¶ Mobile Server
The Mobile Server role provides Security Center access on mobile devices.
¶ network
The network entity is used to capture the characteristics of the networks used by your system so that proper stream routing decisions can be made.
¶ network view
The network view is a browser view that illustrates your network environment by showing each server under the network they belong to.
¶ Omnicast™
Security Center Omnicast™ is the IP video management system (VMS) that provides organizations of all sizes the ability to deploy a surveillance system adapted to their needs. Supporting a wide range of IP cameras, it addresses the growing demand for HD video and analytics, all the while protecting individual privacy.
¶ redirector
A redirector is a server assigned to host a redirector agent created by the Media Router role.
¶ redirector agent
A redirector agent is an agent created by the Media Router role to redirect data streams from one IP endpoint to another.
¶ Report Manager
The Report Manager role automates report emailing and printing based on schedules.
¶ reverse tunnel
A reverse tunnel is a private communication channel open between a server inside a secured LAN and a client outside. In the Security Center implementation, certificate authentication is used to protect against manipulator-in-the-middle attacks.
¶ Reverse Tunnel
The Reverse Tunnel role is used on the federated system to connect to the Federation™ host residing in the cloud. The connection is established using a keyfile generated from the cloud system. The keyfile can only be used once to ensure maximum security.
¶ reverse tunneling
Reverse tunneling is a method of securing communication between clients and servers that are behind a firewall. This technique enhances security and simplifies firewall management. When using a reverse tunnel, the server initiates a connection to the client. This tunnel connection is secured by a previously shared keyfile that contains an identity certificate. When established, the reverse tunnel allows bidirectional communication without opening inbound firewall ports.
¶ Reverse Tunnel Server
The Reverse Tunnel Server role is used on the Federation™ host to manage reverse tunnels. Reverse tunnels are created using this role, but must be opened from the federated sites using the Reverse Tunnel roles.
¶ role
A role is a software component that performs a specific job within Security Center or Security Center SaaS.
¶ Security Center
Security Center is a truly unified platform that blends IP video surveillance, access control, automatic license plate recognition, intrusion detection, and communications within one intuitive and modular solution. By taking advantage of a unified approach to security, your organization becomes more efficient, makes better decisions, and responds to situations and threats with greater confidence.
¶ Security Center Federation™
The Security Center Federation™ role connects the local system to an independent remote Security Center system. After connecting to the remote system, your local system acts as the Federation™ host and you can view federated entities and events locally.
¶ Security Center Mobile
(Obsolete) See Mobile Server and Genetec™ Mobile.
¶ Security Center SaaS Edition (Classic)
The Security Center SaaS Edition (Classic) is Security Center offered by subscription. Subscription-based ownership simplifies the transition to cloud services and provides an alternative way to purchase, deploy, and maintain the Genetec™ Security Center unified platform.
¶ Security Desk
Security Desk is the unified user interface of Security Center. It provides consistent operator flow across all of the Security Center main systems, Omnicast™, Synergis™, and AutoVu™. The unique task-based design of Security Desk lets operators efficiently control and monitor multiple security and public safety applications.
¶ server
In Security Center, a server entity represents a computer on which the Genetec™ Server service is installed.
¶ Server Admin
Server Admin is the web application running on every server machine in Security Center that you use to configure the Genetec™ Server settings. You use this same application to configure the Directory role on the main server.
¶ sharing guest
A sharing guest is a Security Center system that has been given the rights to view and modify entities owned by another Security Center system, called the sharing host. Sharing is done by placing the entities in a global partition.
¶ sharing host
A sharing host is a Security Center system that gives the right to other Security Center systems to view and modify its entities by putting them up for sharing in a global partition.
¶ Sipelia™ as a service
Sipelia™ as a service is a cloud-based service. It provides an alternative way to deploy and maintain Sipelia™. Sipelia™ as a service functions the same as our on-premises solution but requires some basic configuration to get your system set up and ready to register your VoIP device.
¶ Synergis™
Security Center Synergis™ is the IP access control system (ACS) that heightens your organization's physical security and increases your readiness to respond to threats. Synergis™ supports an ever-growing portfolio of third-party door control hardware and electronic locks. Using Synergis™, you can leverage your existing investment in network and security equipment.
¶ Synergis™ Cloud Link
The Synergis™ Cloud Link is an intelligent, PoE-enabled access control appliance that supports various thirdparty interface modules over IP and RS-485.
¶ video archive
A video archive is a collection of video, audio, and metadata streams managed by an Archiver or Auxiliary Archiver role. These collections are catalogued in the archive database that includes camera events linked to the recordings.
¶ video watermarking
Video watermarking adds visible text to live, playback, and exported video processed by Security Center. This text includes identifying information that is intended to deter unauthorized users from leaking video recordings.
(Obsolete) Beginning in Security Center 5.9.0.0, video watermarking no longer refers to the use of digital signatures for tampering protection. Tampering protection is now called digital signature.
¶ Web Client
Security Center Web Client is a web application that gives users remote access to Security Center so that they can monitor videos, investigate events related to various system entities, search for and investigate alarms, and manage cardholders, visitors, and credentials. Users can log on to Web Client from any computer that has a supported web browser installed.
¶ Web Server
The Web Server role is used to configure the Genetec™ Web App and the Web Client, two web applications that give users remote access to Security Center. Each role created defines a unique web address (URL) that users enter in their web browser to log on to the Genetec™ Web App or Web Client and access information from Security Center.
¶ Where to find product information
You can find our product documentation in the following locations:
- Genetec™ TechDoc Hub: The latest documentation is available on the TechDoc Hub. Can't find what you are looking for? Contact documentation@genetec.com.
- Installation package: The Installation Guide and Release Notes are available in the Documentation folder of the installation package. These documents also have a direct download link to the latest version of the document.
- Help: Security Center client and web-based applications include help, which explains how the product works and provide instructions on how to use the product features. To access the help, click Help, press F1, or tap the ? (question mark) in the different client applications.
¶ Technical support
Genetec™ Technical Assistance Center (GTAC) is committed to providing its worldwide clientele with the best technical support services available. As a customer of Genetec Inc., you have access to TechDoc Hub, where you can find information and search for answers to your product questions.
- Genetec TechDoc Hub: Find articles, manuals, and videos that answer your questions or help you solve technical issues.
- Before contacting GTAC or opening a support case, it is recommended to search TechDoc Hub for potential fixes, workarounds, or known issues.
- To access the TechDoc Hub, log on to Genetec Portal and click TechDoc Hub. Can't find what you're looking for? Contact documentation@genetec.com.
- Genetec Technical Assistance Center (GTAC): Contacting GTAC is described in the Genetec Advantage Description.
¶ Technical training
In a professional classroom environment or from the convenience of your own office, our qualified trainers can guide you through system design, installation, operation, and troubleshooting. Technical training services are offered for all products and for customers with a varied level of technical experience, and can be customized to meet your specific needs and objectives. For more information, go to https:// www.genetec.com/support/training/training-calendar.
¶ Licensing
- For license activations or resets, contact GTAC at https://portal.genetec.com/support.
- For issues with license content or part numbers, or concerns about an order, contact Genetec Customer Service at customerservice@genetec.com, or call 1-866-684-8006 (option #3).
- If you require a demo license or have questions regarding pricing, contact Genetec Sales at sales@genetec.com, or call 1-866-684-8006 (option #2).
¶ Hardware product issues and defects
Contact GTAC athttps://portal.genetec.com/support to address any issue regarding Genetec appliances or any hardware purchased through Genetec Inc.