Teldat VisorALARM Plus2U Honeywell IP Communicator Tech Support Training

Teldat VisorALARM Plus2UHoneywell IP Communicator

Tech Support TrainingNick Martello

Martello ConsultingChesterfield, VA

100% Supervision

2© Martello Consulting, 2009

Part I: Introduction and Overview

• Model Review• Part Numbers• Ancillary parts• Theory of Operation


IP Communicator Review (Obsolete Models)

Picture ModelType of Alarm

Panel supported

Sold inIP

Supervision to the ARC

Customer IP server

supervision

U/D over the PSTN

U/D over TCP/IP

UL Certificates & Approvals

mIP-Plus US Burglar/Intrusion USA, Canada N/A N/A

UL1023UL1076UL1610

ULC C1023-1974ULC/ORD (C1076 -

M1986)CAN/ULC S304 - M88

mIP-Plus RW Burglar/Intrusion & Fire

Rest of the World (EMEA,

LATAM, ASIAPAC)

N/A N/A

IPDACT Fire USA, Canada N/A N/A UL864ULC Pending


Latest Models (IPDACT-2 and IPDACT-2UD)

Picture Model Type of Alarm Panel supported Sold in

IP Supervision to the ARC

Customer IP server

supervision

U/D over the PSTN

U/D over TCP/IP

mIP-UD US Burglar/Intrusion USA, Canada N/A N/A

mIP-UD RW Burglar/Intrusion & Fire

Rest of the World (EMEA,

LATAM, ASIAPAC)

IPDACT-2UD Fire USA, Canada N/A N/A


Honeywell Life System Part Numbers

IPDACT-2 Internet Communicator-Contact ID only. Requires compatible FL panel equipped with on-board or optional DACT. Requires 136mA aux non-reset able power from FACP without 2UD modem. Includes cable from panel primary Telco port to IPDACT. Photo shows 2UD model with modem plugged in.

IPDACT-2UD Internet Communicator-Contact ID only. Requires compatible FL panel equipped with on-board or optional DACT. Requires 155mA aux non-reset able power from FACP to support on board 2UD modem. Includes cable from panel primary Telco port to IPDACT.

2UD Modem option to turn IPDACT-2 into IPDACT-2UD

IPBRKT Bracket for mounting IPDACT inside MS-9200UDLS common enclosure or in optional HPP-300ULX power supply

IPSPLT Splitter for dual phone lines to IPDACT input cable.


Parts List

IPENC Optional cabinet for mounting IPDACT next to compatible Fire-Lite FACP. Use when connecting to older non common enclosure panels such as MS-9200UD or MS-9600. Includes IPBRKT mounting bracket already installed.

HP300ULX Optional UL listed Fire Aux power supply for mounting IPDACT next to compatible Fire Panel when additional power is required for IPDACT.

VisorALARM 2U PLUSPN: ALREH-220

UL Listed IP receiver for Teldat & Fire-Lite IP communicators


Additional Part numbers

NOTE: For purposes of this presentation, the Teldat mIP IP UL listed communicator models used in connection to Honeywell Life System fire panels are known as models IPDACT-2 and IPDACT-2UD respectively.


System Overview

90 second supervision


Theory of Operation

• The IP Communicators replace the telephone line with an Ethernet connection.

• No changes are made to the panel dialer setup.• The IP card simulates a standard PSTN analog line to the

panel.• During an event, the IP card senses off-hook status, counts

the digits of the dialed phone number then begins collecting Contact ID data.

• The IP card “frames” the Contact ID data using UDP packets with 512 bit AES encryption and forwards it to the receiver.

• The Receiver decrypts and un-packetizes the data and presents ASCII data to automation software in a preprogrammed format.

• The automation software or the receiver can provide the kiss-off signal to the panel.


Theory of Operation-UD

• The release of the 2UD models and firmware release 6.0 provides a modem feature to the IP communicator.

• This feature uses TCP/IP vs UDP to provide upload/download services to the panel from anywhere in the Internet.

• The card contains a V.32 bis modem capable of up to 14,4KB speeds-however most Honeywell Life System fire panels will only operate at a max of 2400 baud.

• A special virtual port program is used on the programming PC called UDPORT.exe. This program redirects modem signals from the programming software from the standard ports to a virtual Ethernet port.

• The software allows entry of the receiver’s IP address and TCP port to use along with username and password.


Theory of Operation UD-continued

• With standard remote programming via PSTN, the user enters a panel phone number to call.

• This same number is also used as a database entry in the subscriber field of the target IPDACT db record in the receiver.

• Since the VisorALARM “knows” how to poll the remote card, this subscriber field is used as a database lookup for which panel to call.

• The on-board modem on the IP card converts the digital encapsulated modem signals back to analog phone signals at the remote site.

• The panel then sees a “ring” and answers the call.


Standard Alarm Event Transmission Operation

Automation Software (1)

(1) Other Automation SW types: IBS, MICROKEY, MASterMind, BOLD, DICE

InternetDialercapture

Serial line

mIP-2/ IPDACT-2UD

VisorALARMAlarm Panel

Calling

Line picked up

Contact-ID Alarm IP Alarm Alarm in well-known format

Alarm KissoffAlarm ACKAlarm Kissoff

Call Disconnect

The alarm is never lost on the way: The Alarm is ACK’d only if the Automation Software has kissed it off


Part II: Network Concepts

• IP Address Formats• Subnetting• Determining a Network Address

- IP Calc• Private Networks and Subnets• The importance of defining the receiver as “classless”• Ping• Traceroute

- http://Network Tools.com• IP Transmission Concepts• NAPT (Network Address Port Translation)• Teldat Security Concepts (ARLY)

14© Martello Consulting, 2009 14

IP Address Concepts• IP address format: octet.octet.octet.octet•The IP address and mask defines the IP network

address and host network address •Example:

• In order for a device to reach any host in a remote (i.e. different) IP network, a default Gateway is required.

• It is the default gateway’s responsibility to transfer the IP traffic to the remote network.

192.198.1.200 /24Mask: “/24” = “255.255.255.0”

NetworkHost


IP Addresses and Subnets

• Sub netting works by applying the concept of extended network addresses to individual computer (and other network device) addresses.

• An extended network address includes both a network address and additional bits that represent the subnet number... (see below)

• Together, these two data elements support a two-level addressing scheme recognized by standard implementations of IP. The network address and subnet number, when combined with the host address, therefore support a three-level scheme


Understanding IP Addresses

For every additional bit set to '1' in the mask, another bit becomes available in the subnet number to index additional subnets. A two-bit subnet number can support up to four subnets, a three-bit number supports up to eight subnets, and so on.

Private Intranet


Private Networks and Subnets

• The governing bodies that administer Internet Protocol have reserved certain networks for internal uses.

• In general, intranets utilizing these networks gain more control over managing their IP configuration and Internet access.

• This sub-netting permits organizations to prohibit access to machines from certain other machines.

• The default subnet masks associated with these private networks are listed below.


Classless Routing

• Classless Inter-Domain Routing (CIDR) is a mechanism introduced to slow the growth of routing tables on routers across the internet, and to help prevent waste of IP addresses by allocating a subset (as opposed to whole chunks) of a Class A, B ,or C network to ISP's and organizations.

• It allows for address specified in CIDR notation, address aggregation and easier delegation of address blocks.

• It is important to include the term classless in the receiver’s config file just below the router entry.

• Failure to do so may cause routing problems and “lost” mIPS.

• See “Fine Tuning” the configuration later in this presentation.

http://en.wikipedia.org/wiki/CIDR_notation


Basic Useful IP Tests-PING

• The ping utility checks whether a host is alive and reachable or not. This is done by sending an ICMP Echo Request packet to the host, and waiting for an ICMP Echo Reply from the host. (See example below)


Basic Useful IP Tests-Traceroute

• Traceroute is a program that can show the route over the network between two systems, listing all the intermediate routers a connection must pass through to get to its destination.

• It can help determine why connections to a given server might be poor, and can often help determine where exactly the problem is.

• It can also show how systems are connected to each other, letting you see how an ISP connects to the Internet as well as how the target system is connected.

• Easy to use Traceroute tools are available even for Vista.- Go to http://network-tools.com/

http://network-tools.com/


Traceroute Example


IP transmission basic concepts

IP Network

IP

Link

TCP/UDP

IP

Link

TCP/UDPPeer-to-peer

Host A

Def GW for host A

Host B

Def GW for host B


Teldat IP Basics -IPDACT Security

• Highest security level in the industry:- All IP traffic exchanged is encrypted with a 512-bit AES algorithm

(Grade AA for UL1610).- The configuration access is password protected.

• IPDACT installer & configuration passwords can be centrally managed.

• Any IPDACT parameter can be managed from the central station via individual IP address or group config pattern.

• Anti-device substitution protection based on non-writable IPDACT specific information.

• Anti-replay protection to avoid man-in-the-middle attacks- ‘sequential marked’ frames.


Teldat IP Basics -Supervision

• Firewall compatibility:- All communication begins at the IPDACT side so it becomes a trusted

host behind the customer’s firewall.- The IPDACT to VisorALARM communication only requires one UDP

port.• Low UDP bandwidth vs TCP/IP:

- Contact frame (once, when IPDACT boots up) 72 bytes Polling frames 24 bytes Alarm frames 56 bytes

• IP comm. supervision.• PSTN supervision.

- Supported by both IPDACT and Fire panels.- Alarm panel supervises in Fire scenarios.


Teldat IP Basics- Communication Highlights: ARLY

• ARLY is the protocol used between the mIP/IPDACT and the VisorALARM

• Three services run on ARLY

Internet

ARLY protocol

Alarm TransmissionAccount SupervisionUpload / Download

• Saves bandwidth in the ARC’s IP service- ARLY runs over UDP/IP Less bandwidth consuming than TCP/IP solutions

• Reliable communications:- ARLY adds robustness to UDP with packet sequencing and retransmissions- Backup VisorALARM serves mIP/IPDACT’s if the Main VisorALARM is down

• Firewall friendly- The Security Service just requires one open port in the ARC access Firewalls- No open ports required in the customer’s Firewall


The IP packet format & NAPT

IP SOURCE ADDRESS IP DESTINATION ADDRESS

UDP SOURCE PORT UDP DESTINATION PORTARLY PROTOCOL PAYLOAD

IP packet

Encapsulated UDP packet

The IP packet sent by the IPDACT has private source IP address and source UDP port When the IP packet traverses the customer access router, on its way to the Internet, the source IP address and UDP port is translated to public ones. When the IP packet traverses the customer access router, on its way to the IPDACT (opposite direction), inverse translation takes place: destination public IP address & port is translated to the private ones.

NAPT


Scenario 1: IPDACT and VisorALARM behind a NAPT router

• In a typical scenario, the IPDACT and VisorALARM default gateways are connected to the Internet.

• UDP frames transmitted to the Internet through these gateways are hence modified according to NAPT (Network Address Port Translation).

• The following diagram illustrates a network diagram for this scenario as well as the UDP frame header parameters in each network segment (subscriber network, the Internet and the ARC network):


IPDACT and VisorALARM behind a NAPT router



• As shown in the drawing, both routers need to do NAPT so the transmitted UDP frame travels along the Internet with the system public IP addresses (213.4.21.187 and 80.26.96.183 in the Figure). For the correct system operation, the subscriber’s network firewall should allow:- UDP traffic sent from the IPDACT (IP address: 192.168.1.2 in the

example) to the ARC public IP address (80.26.96.183 in the example).



• On transmission, the subscriber’s default gateway sets a NAPT conversion entry in its cache memory, so the received UDP traffic from the Internet can be forwarded back to the IPDACT.- UDP traffic received from the ARC (80.26.96.183). The subscriber’s

default gateway will forward this traffic to the IPDACT (192.168.1.2) according to its cached NAPT entry.



• In analogy, the ARC network firewall should allow:- UDP traffic received from the Internet to its serving port (port 80 in the

example). Traffic to this port should be triggered to the VisorALARM (IP address: 172.24.4.1, serving port 80).

- UDP traffic sent from the VisorALARM to the Internet


Teldat IP Basics -IPDACT Security

• Highest security level in the industry:- All IP traffic exchanged is encrypted with a 512-bit AES algorithm

(Grade AA for UL1610).- The configuration access is password protected.

• IPDACT installer & configuration passwords can be centrally managed.

• Any IPDACT parameter can be managed from the central station via individual IP address or group config pattern.

• Anti-device substitution protection based on non-writable IPDACT specific information.

• Anti-replay protection to avoid man-in-the-middle attacks- ‘sequential marked’ frames.


Teldat IP Basics -Supervision

• Firewall compatibility:- All communication begins at the IPDACT side so it becomes a trusted

host behind the customer’s firewall.- The IPDACT to VisorALARM communication only requires one UDP

port.• Low UDP bandwidth vs TCP/IP:

- Contact frame (once, when IPDACT boots up) 72 bytes Polling frames 24 bytes Alarm frames 56 bytes

• IP comm. supervision.• PSTN supervision.

- Supported by both IPDACT and Fire panels.- Alarm panel supervises in Fire scenarios.


Part III: Servicing Receiver Customers

• Recommended Tools• IPDACT programming• Reducing Customer Frustration• Initial Bench Receiver Settings


Recommended Tools For Tech Support Site

• TeraTerm-Pro Shareware but better terminal program than HyperTerminal which does not come with Vista or Windows 7.- Used for programming:

IPDACT via Telnet or serial connection VisorALARM Plus via Telnet or serial connection

• IPDACT Windows Programming Tool- Used for programming IPDACT in field

Actually a Windows application front end for Telnet• VisorALARM Manager-A Windows application for Telnet• FTP client (Available on Vista/Windows 7)

- Used for upgrading receivers• RFU: Rabbit Field Utility

- Used for upgrading IPDACT firmware from a PC• Ping-Used to determine access to an IP address


Basic IP-Card Programming Requirements

• IPDACT default access password (factory default is 24680). This is NOT the install password

• “Installator” password, required to execute the register command. (Called “Installator” password to separate from default access password)

• If STATIC IP is to be used such as in an enterprise or corporation: Obtain IP address, subnet mask and Internet gateway for IPDACT from enterprise IT manager.

• Default IP is 192.168.0 100 with subnet of 255.255.255.0 (Card ships defaulted to DHCP)

• IPDACT account number or client number• IP addresses of the Primary and Secondary VisorALARM

central station receivers• UDP Port number to use


IPDACT Windows Installer Tool

Automatically finds IPDACT



Automatically finds IPDACT


Eliminate Setup Frustration

• Central Station Operators should contact tech support before opening the box!

• Obtain or download programming tools including TeraTerm Pro.

• Downloads:- Download the latest version of VisorALARM Manager.- After determining firmware version decide if receiver needs firmware

upgrade before continuing. This can be accomplished via the monitor program inside VM or via simple

serial terminal connection and turning it on.


Eliminate Setup Frustration for New Customers

• If possible, set up receiver on bench before mounting in rack• Connect via serial cable to set basic parameters such as:

- IP address- Gateway- Port numbers

• After preliminary settings, system can be rack mounted and accessed via Telnet from the programmer’s desk.

• This process will eliminate a lot of frustration!


Tera-Term Pro setup

• Using the supplied DB9M to DB9F serial cable connect to receiver first via serial port.

• Set Tera-Term window to 40 lines –this allows more of the config to be seen without scrolling


A new session of Tera-Term is defaulted to COM 1

• Connect first via the DB9 serial port on the back of the receiver –setup is standard 9600, 8, n, 1


Initial Settings

• Upon connection, hit enter to start the session• Enter manager for User:• Enter 24680 for password and the following should appear:


Changing IP address of the receiver

• Determine existing IP address (should be 192.168.0.200)• At the * prompt, enter p 4 (p-space-4) and the following

screen should appear:



• At the Config> prompt, type “show all” and the following screen will scroll to the bottom of the config file: (exit) Note the IP address below:



• At the Config> prompt, Enter the following commands, protocol ip

• The receiver will respond with the following prompt:• IP config>



• Type the following text to change the IP address

• IP Config>address Ethernet 0/0 XXX.XXX.XXX.XXX (spc) 255.255.0.0 or what ever the mask to be used.

• Keep in mind the mask works in conjunction with the network numbers to limit the number of machines that can exist on the network or to divide subnets to prevent machines from accessing other machines.

• Once this is complete, the user can connect with VisorALARM Manager. This will make the setup go much faster and cause less frustration.

• To exit from IPCONFIG, type exit to return to Config>• Save the configuration by type sa (save)• Respond to “save configuration? –type y (yes)• Then type <CtrL>P to exit to the * prompt• Type re for restart to start the receiver with the changed IP address.


Part IV VisorALARM Manager

• Logging In• Set Global Parameters• The Monitor Program

- Determining Firmware Rev and Bios Rev- Determining mIP on-line/off line-status

• Adjusting User-Defined Contact ID Codes• Viewing Registered Accounts• Setting up Configuration Patterns


VisorALARM Manager Initial Setup

• VisorALARM Manager is actually a Visual Basic front end to Telnet.

• If the actual IP address is not entered correctly, the session will not start.

• Enter does not work-click on OK with the mouse.


VisorALARM Manager Initial Setup

• Enter Username and Password (defaults are manager, 24680)

• Click OK


Successful Retrieval

Global TabRetrieve Config Start Monitor


Global Parameters

Set all IP addresses for receiver, router/gateway, and NTP host

Set IP address of unit on network used to supervise the network (IP address to monitor) This should be a machine that is on 24/7.

Set parameters of automation software emulation

Set User Name and password

Set TCP upload/download parameters


Monitor Program

To open the monitor program, click the icon with the lightning bolt in the upper right hand corner of VA Manager

The first tab shows license and version numbers as well as a virtual representation of receiver front panel LED condition.

The second tab will show all registered remote IP communicators including IP address, software version number and status, (alive, contacted, loss reported.)


Monitor Program


mIP Status Screen


User-Defined Contact ID Codes

Change to 311Battery Fault


User-Defined Codes

Here you can change some contact ID codes that report to automation

Note that the alarm reported from input number 1 on the mIP/IPDACT communicator should be changed to 311 “battery missing/trouble”• This is used to monitor aux power supplies when connecting to a non-UL

listed fire panel.

Note that some codes do not restore.


Registered Accounts

Req. for UD


Registered Accounts

This screen shows all registered accounts

Accounts can be deleted from the system on this screen

For upload/download, the central station operator must fill in the subscriber telephone number provided by the installer/dealer.

Other parameters can be changed and updated or pushed out to the remote communicator.


Config Patterns


Config Patters

Here you control the registration process of remote communicators

When an installer registers a remote card to the receiver, the receiver overwrites the flash memory of the remote communicator with information from the assigned pattern

The pattern ID is the key database index to a set of remote communicators but it is also the public side of the encryption key.

• Note that most central station pick one general configuration pattern. However, if a customer uses a maintenance receiver (such as a county school system) to receive trouble alarms, then it is critical that a separate configuration pattern be used for that specific customer.

• Download the document called Understanding Configuration Patterns from www.martelloconsulting.com for more understanding.

http://www.martelloconsulting.com/


Part V-Fine Tuning via CONFIG

• All commands administered via VisorALARM manager plus additional configurations can be administered via direct command line interface (CLI)

• Requires use of a terminal program such as TeraTerm.Pro or Hyperterminal. Hyperterminal no longer ships with Vista or Windows 7. TeraTerm works on both operating systems and is shareware.

• TeraTerm Pro can be used initially via the serial port to set up the basic IP address. Note that early versions of VisorALARM Manger GUI will not permit removal of default address.

• Once setup, the user can connect remotely via Telnet over IP.


VisorALARM console terminal access

• Authenticated access.- The console is a command line interface (CLI) text mode.- The console structure is always the same (local and remote).

• PC Serial Port to VisorALARM connection:- Standard DB9 cable from the PC COM to the VisorALARM AUX port.- TeraTerm serial port (COM):- Speed: 9600 bps.- Data bits: 8.- Parity: None.- Stop bits: 1.- Flow control: None.

COM

Computer

To prevent electric shock,do not remove cover.CAUTION!

100-240 V~;1-0.5 A 47-63 Hz

~AC INPUT

WAN 1 AUX.

SLOT 1


VisorALARM console remote terminal access

• Telnet connection to the VisorALARM IP address:• Firewall compatibility:

- The telnet is a TCP connection to the VisorALARM port 23.- We can set a different port.

IP1

IP

telnet


VisorALARM console terminal layout

Serial Num.

Firmware release

Main Process (P 1)


Monitoring

Console processes

*P 4Configuration

Config >

Cntrl-P*P 2

Event Visualizatio

n

Cntrl-P

*P 3Cn

trl-P

Console access

Main process

*

*config

*monitor

*event


Main process commands (P 1)

*RESTARTAre you sure to restart the system(Yes/No)? YRestarting. Please wait .......................................APP DATA DUMP......................................Running applicationFlash configuration readInitializing

*TELNET 192.168.0.100Trying to connect...(Press Control S to come back to local router)

Telnet connection closed.*TELNETTelnet destination [192.168.0.100]?Telnet source [192.6.2.176]?Telnet port [23]?Trying to connect...(Press Control S to come back to local router)

*LOGOUTDo you wish to end connection (Yes/No)?

*?MONITORCONFIGRUNNING-CONFIGFLUSHINTERCEPTLOADLOGOUTPROCESSRESTARTSTATUSTELNETVRF-TELNET

*LOAD ?ACTIVATEDEACTIVATEIMMEDIATERACTIVATERDEACTIVATE

Interactive help command


Configuration process (P 4)

• Where all the VisorALARM configuration commands are present.

• Hierarchic tree structure: Configuration sub-processes.• In order to activate a new configuration:

- Execute the required configuration commands.- Exit the configuration sub process ([subprocess] config>exit)- Save the configuration (Config>save-yes).- Quit P 4 (Ctrl+P) and restart the VisorALARM (* restart)


Useful console configuration commands (I)

• Add a new user/password with different console passwords- Config> user <name> password <pwd>- Config> user <name> access-level <acc_level>

• To erase an existing user/password insert a no before the command- Config>no user<name> password >pwd>

• To show the entire configuration:- Config>Show Config

• To delete the entire configuration- Config>no configuration

• To delete a single item- Config>no <item> as in Config>no mip 1234


Useful console configuration commands (I)

• To configure IP address- Config>protocol IP (To exit type quit)

• ARLY configuration access- p 4- List devices returns the following:


Useful console configuration commands (II)

• To access the ARLY directly:


A complete VisorALARM configuration (III)

• The VisorALARM configuration process is divided into the following groups:

1. Serial connection with the automation software (in the ARLY interface)

2. IP configuration (in protocol IP)3. Alarm reception interface (in the ARLY interface)4. Receiver protocol type

1. Receiver ID & line ID5. Connectivity parameters (in the ARLY interface)

1. UDP port2. External reference IP address



6. Backup receiver information (in the ARLY interface)7. User configurable events (in the ARLY interface)

1. IPDACT patterns (in the ARLY interface)8. Advanced configuration:

1. NTP configuration for the clock synchronization in backup scenarios.

2. SEPI serial interface configuration for the serial printer.9. TVRP configuration for local redundancy scenarios.10.Trace and event activation (in the event configuration sub-process).



• As a rule, the easiest way to configure a VisorALARM receiver is using Teldat’s customized “configuration scripts”.

• To configure the VisorALARM with a script:- Connect to the console via Telnet or Serial connection.- Type “p 4” and hit ENTER to log into the “Config>” prompt.- Select all the configuration script content and save it using notepad as a

basic txt file.- Edit the saved text file with any new information.- From your saved file and paste it in the “Config>” prompt.- Save the configuration and restart the VisorALARM.- In the new bootup, the configuration is activated.- NOTE: newer formatted mIPS require the line does not wrap prior to

pasting back into the config.


VisorALARM configuration script template (III)

Teldat VisorALARM Plus2U Honeywell IP Communicator Tech Support Training

Documents

Transcript of Teldat VisorALARM Plus2U Honeywell IP Communicator Tech Support Training