Issue When attempting a login from a Security Expert client PC, it generates a "Network SSPI error" when using Windows Authentication and the machine name. Product Line Security Expert Server Environment Security Expert 4.3.285.21 Multiple PC Security Expert Installation using Windows Authentication Cause The Network SSPI error is generated at the Client PC Login because of how Security Expert implements RFC1034 which stipulates how machine names are used for DNS./p> Resolution 1. Place a period at the end of the Security Expert Server machine while logging into the client only Security Expert PC Example: Using "WIN-B0DOGEHESMN" as the server name will not work Using "WIN-B0DOGEHESMN." will work Notice this works because of the "." at the end Here is a graphical example of logging in with the correct server name by adding the "." 2. The other workaround would be to use the IP address of the server instead of the fully qualified domain name (FQDN). *Note* IT departments typically prefer the use of the FQDN name ... View more

Issue Webhelp and the Technical Reference Guide supply information for using the AS-P/B DHCP server option, however, a number of relevant questions have not been answered. Product Line EcoStruxture Building Operation Environment Building Operation Automation Server Premium (AS-P.62 hardware) Building Operation Automation Server Bundled (AS-B) Building Operation Multi-purpose Controller (MP-X) Building Operation Room Controller (RP-C) Cause There are typically a number of options to configure DHCP servers, but since the DHCP server included with the AS-P/B is very basic and NOT configurable, it's important to understand which options are and are not available. Resolution Webhelp has some helpful information about the DHCP Server Options. The AS-P/Bs built-in DHCP server assigns unrouted IP addresses within the range of addresses from 10.110.210.2 to 10.110.210.254. This was developed to allow for a quick configuration of a private MP-X/RP-C network. The AS-P/B DHCP server can be disabled and another DHCP server can be used. Here is a list of other questions and answers that may come up based on typical options in other DHCP servers: Can the scope of the IP range be configured? There is no way to configure or limit the range of the standard IP address range or to have multiple scopes. Can IP exceptions be configured? There is no configuration option to prevent the AS-P/B DHCP server from assigning a specific IP address. The AS-P/B DHCP server is unaware of static IP addresses, so if a switch or other device has a static IP set in the 10.110.210.2 to 10.110.210.254 range, you run the risk of having the AS-P/B DHCP server assign an IP address twice which can cause a number of issues. Can a Default gateway be configured? Not configurable Can a Subnet mask be configured? Not configurable Is IP6 supported? No Can lease types be configured? No Can multiple DHCP servers be installed on the private LAN? No Should MP-X/RP-C IP level devices only be hosted within the private AS-P/B network? Most site IT departments prefer that the BAS networks be isolated, however, if the network switch (Not the AS-P/B) is used for assigning DHCP IP addresses, it could hand out addresses to the AS-P/B and the MP-X/RP-C devices if they are on the same subnet. A managed (RSTP Enabled) switch can reside as a client to the AS-P/B. This is due to how the Private DHCP option is advertised. On-site IT departments may not want the switch on the customer's LAN so it is placed in the private AS-P/B network. Does the AS-P/B DHCP server assign addresses to 3rd party devices? Yes, if the 3rd party device supports this. This would be a configurable option in the device. ... View more

Issue Contemporary Controls Skorpion Switch configuration settings for using RSTP with MPX controllers Product Line EcoStruxure Building Operation Environment Contemporary Controls EISK8M-100T Skorpion Switch Building Operation Automation Server Premium Building Operation Multi-purpose Controller Building Operation Multi-purpose VAV   Cause Contemporary Controls Skorpion switches have several caveats to consider before using them in a site design. Specific Skorpion switch configuration settings are needed in order for the RSTP protocol to work with MPX controllers.    Resolution   Two caveats to consider before using these switches:  Contemporary Controls (CC) Support has indicated that these switches have a limitation to 39 devices (MPXs) per switch. Other vendor's switches do not have this limitation and allow 39 devices per RSTP loop. Multiple Skorpion switches may be used and daisy-chained to allow for greater than 39 devices. The 39 total number includes the switch itself, so effectively, 38 MPXs. A static IP address of the switch should not be in the same IP range (10.110.210.x) if the AS-P is being used as a DHCP server. Configuring the switch this way may cause the AS-P to assign a duplicate IP address to 1 of the MPXs in that range. The DHCP server in the AS-P is a very basic DHCP server to allow for quick IP assignments in a private network. There aren't any configuration options for designated exceptions in the AS-P. (Note: This may be a security concern for sites that do not want a switch on their main network. Setting the Skorpion switch to DHCP enable can allow the ASP to assign a non-static IP to the switch and not interfere with MPXs. There are several Skorpion switch configuration options available to use with AS-Ps and MPX controllers. The following information is to assist with one of the Skorpion switch RSTP configurations and is not meant to be a comprehensive guide.   Configuration items to consider:   EISK8m-100T switch documentation https://www.ccontrols.com/ctrlink/eiskm.php To initially set up the switch, the NIC on the PC will be set to 192.168.92.x, the default switch IP address is 192.168.92.68 If placing the switch(s) on the same subnet as the IP controllers is required by the site's IT to keep them separate from their network, then set the switch to use DHCP so the ASP can assign an available address to the switch.   3. RSTP Enabled Redundancy State: STP/RSTP STP: Enable Version: RSTP   4. Bridge Priority:  The bridge priority can be left at its default (32768) If using 1 or 2 switches with separate rings. If an RSTP ring spans more than 1 ring, unique priorities should be set using the cccontrols documentation Using multiple Skorpion switches limits the entire ring to 38 controllers for this vendor's switches!   Root ID: This uneditable field will show "Self" when it's the root switch or s single switch Root ID: the mac address will show the root switch In a multiple switch network, one of the switches is designated as a root switch based on priority and other factors.   The snapshot below shows the settings to enable RSTP (highlighted). It also shows the root ID (mac id) in a multiple switch configuration. If there is only 1 switch, it will indicate 'Self' ... View more

Issue SSC or EP1501 is bouncing offline and online Product Line Access Expert Environment Access Expert Controller Cause Not configuring the DNS suffix or misconfiguring the DNS IP or DNS suffix, may cause Access Expert to lose connection to the controller. Resolution Add in the DNS IP and DNS suffix for a local DNS server DNS resolution issues can happen when using a site’s internal DNS. It is recommended to use Google's DNS of 8.8.8.8 to resolve any names to our hosted servers. Per the documentation https://support.feenics.com/hc/en-us/articles/360019852374-Mercury-Controllers See the “Configuring a Controller for IP Client” section Note: You will need your Feenics login credentials. If the 2 options above do not correct the issue, increase the retry interval to 20 seconds. (5 is the default) If needed, as a test, configure a controller with the Host IP field as connect.feenics.com This will reach the V3 US stack ... View more

Issue How can the IP address of an MPX controller that is configured for DHCP be determined when there is no attached display Product Line EcoStruxure Building Operation Environment Building Operation Multi-purpose Controller Cause It is necessary to know the IP address of an MPX that does not have a display for troubleshooting and commissioning multiple MPXs,  Resolution ... View more

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Security Expert Installation steps for separate SQL, SX application Server, and Client for use with Windows Authentication and Active Directory Product Line Security Expert Environment Microsoft SQL Server Microsoft Windows10 Security Expert Server and Client  Cause Access Denied error appears when attempting to log into Security Expert with Windows Authentication with a multiple PC Security Expert Installation Resolution Important considerations when connecting Security Expert to an external SQL Server: Machines should be on the same network and Domain. When you install Security Expert, reference the SQL database in this form:  Machine Name\SQL Instance Name The Windows user account doing the installation must have admin rights on both machines. The windows login you're using to install on the Security Expert machine has to have admin privileges to alter the SQL Database on the remote machine. The easiest way to do this is to use the same account to set up all machines. Different accounts can be used, but the accounts have to have privileges added to the SQL Database manually. (Not covered in this document)   Assumptions: Active Directory server has a domain user that can be used to install the applications on all machines. Licenses cover all machines Security Expert users are set up to use Windows Authentication (snapshots at the end of the document) If the SQL server ever had Security Expert Installed on it, uninstall Security Expert and reboot. If the Security Expert application server had SQL on it, uninstall SQL, reboot and reinstall Security Expert without local SQL. If the Client PC had Server components installed, uninstall Security Expert, reboot and install the client only.   Perform the SQL Server Installation onto a separate Server per the Security Expert Installation Instructions Security Expert Application Server/Client installation (No SQL) If this box is selected, the install may fail because the service has not been installed yet. With this option selected, the install will finish and then the service can be configured later. 3. Change the database server to NOT be localhost\SecurityExpert Use machinenameofSQLServer\SecurityExpert (Ex. SECEXPERTVM\SecurityExpert) 4. Select Windows Authentication Complete the installation.   5. Open Windows Services on the Security Expert Application Server (Run> services.msc) Right-click on Security Expert Data Service> Properties Select the Log On tab Deselect Login As Local System Account Select This account and then click browse to search for the domain admin user   Start the service. Security Expert Data Service, Security Expert Event Service, and Security Expert Update should all start   Client only setup - Ensure the Server option is deselected In the following dialog select Custom   7. Select the drop-down next to Server> then select “This feature will not be available” Complete the installation   A successful login with the domain admin account using Windows Authentication from the Security Expert machine and also the client PC should work.   From the Client PC – Security Expert application server = 10.169.90.170 From the Security Expert Server/Client SecurityExpertSV.exe.config (Server) – This file did not have to be changed    SecurityExpert.exe.config (Client) - This file did not have to be changed   Note: There may be circumstances where these files do need to be configured. See LL https://community.exchange.se.com/t5/Knowledge-Base/Security-Expert-Error-Server-Has-Rejected-Client-Credentials/ta-p/698   Domain Tab example set up in Security Expert for Active Directory Windows Authentication   Operator Example setup in Security Expert for Windows Authentication   Global Support Lab Testing SX Application Server (Windows10 1803) SQL Server – Server 2012 R2 with SQL 2016 SP1 (VM) SX Client – Window 8.1 Pro ... View more

Issue WebClient Pre-Installation Requirements for Server 2016 are not included in the 2.03 webClient installation guide Product Line Andover Continuum Environment Windows Server 2016 Continuum webClient Server 2.03 Cause The Pre-Installation requirement steps provided in the webClient planning and installation guide do not show all the steps needed to install webClient successfully Resolution This material is intended as a supplement to the webClient Planning and Installation Guide   Installing IIS on Windows Server 2016 For Windows Server 2016, install IIS on the designated web.Client application server (LAN systems) or the standalone CyberStation/web.Client workstation (standalone system). 1. Start the Server Manager by clicking on the Administrative Tools menu. 2. In the Server Manager, click Add Roles and Features. 3. In the Add Roles and Features Wizard, Before You Begin tab, click Next. 4. In Installation Type, select Role-based or feature-based installation. 5. Click Next and then select a server or virtual hard disk on which to install roles and features. 6. In Server Selection, click Select a server from the server pool. 7. Click Next and select one or more roles to install on the selected server. 8. In Select Server Roles, please select the items from the following snapshots carefully Note: In previous Windows Server instructions from the webClient pre-installation guide, a reference was made to select Application Server. This option is selected and installed by default in Windows Server 2016. No selection for Application Server is offered.   Once these Pre-Installation steps have been performed the webClient Server is ready for Chapter 4 - Installing web.client on the IIS PC (Found in the webClient planning and installation guide.pdf) ... View more