IP-ACM Ethernet Door Module v2

Quick Start Guide

VERSION C0
PART NUMBER 8200-1466-01
SEPTEMBER 2018

Overview
The IP-ACM Ethernet Door Module v2 module provides connection and management of access control for two readers.
The maximum number of IP-ACM Ethernet Door Module v2 modules supported per iSTAR Ultra is 32, iSTAR Ultra SE
is 32, and iSTAR Ultra LT is 8 or 16, depending on the model.

The maximum number of readers can be accomplished as follows:

■ iSTAR Ultra or Ultra SE (in Ultra Mode): Up to 16 IP-ACMs with 2 readers per IP-ACM, 32 IP-ACMs with 1 reader
per IP-ACM, or any combination of these configurations.
■ iSTAR Ultra LT 16-reader board (0312-7188-02): Up to 8 IP-ACMs with 2 readers per IP-ACM, 16 IP-ACMs with
one reader per IP-ACM, or any combination of these configurations.

For the 8-reader iSTAR Ultra LT board (0312-7188-01), you can have up to 4 IP-ACMs with 2 readers per IP-ACM, 8 IP-ACMs with
NOTE one reader per IP-ACM, or any combination of these configurations.
The 16-reader iSTAR Ultra LT board has not been evaluated by UL.

The IP-ACM Ethernet Door Module v2 supports the following features:

■ 12VDC or 24VDC local power or Power over Ethernet (PoE or PoE+)
■ Two RJ45 ports:
• Port 1: Ethernet port, internally bound to MAC with the MAC address and used as the network connection port
for the board (10/100/1000)
• Port 2: Switch port, not a secondary port, used for iSTAR Ultra LT connection (10/100, no PoE)
■ Four supervised Inputs and two Outputs
■ Communication to readers through Wiegand or RS-485 ports
■ SSL network encryption from the unit to the GCM
■ IPv4 and IPv6 network protocols
■ 802.1X port-base authentication
■ HTTPS Web-based configuration
■ Offline mode for two readers that allows the last 1,000 previous card admits and/or a specific personnel group of no
more than 100

1
 Table 1:  Part numbers and descriptions of IP-ACM Ethernet Door Module v2 and enclosures

Part Number Description

IP-ACM2A-MB IP-ACM V2, 2 Reader, board only

IP-ACM2A-EM IP-ACM V2, 2 Reader in metal enclosure

IP-ACM2A-EP IP-ACM V2, 2 Reader in plastic enclosure

IP-ACM2-CAN IP-ACM metal enclosure without board

IP-ACM2-CAN-P IP-ACM plastic enclosure without board

IP-ACM2A-MB-5PK IP-ACM V2, 2 Reader, board only five pack box

Requirements and Specifications

The contents of this chapter explain the installation, power and wiring, grounding, and environmental requirements for
the IP-ACM v2.

Installation Requirements
Ensure the site is ready:
■ The module installation must be performed by a certified installer and must be installed within the same protected
premise as the controlling GCM.
■ For a UL-compliant installation, the power supply must be UL Listed to UL 294 and UL 603, low voltage Class 2
power limited with appropriate ratings.
Table 2:   UL 294 Levels

Feature Level

Destructive Attack 1

Line Security 4

Endurance 4

Standby Power 1

■ All interconnecting devices must be UL Listed, low voltage Class 2 power limited.
■ The site must be approved and all wiring must comply with UL requirements and other codes, as appropriate.
Installation shall be in accordance with the National Electric Code, ANSI/NFPA 70-1993.
■ In this installation, the enclosure is mounted directly to a wall or uni-strut using suitable user-supplied hardware.
■ The anchoring system must be capable of sustaining, a proof load four times that of the assembly. Refer to the
enclosure dimensions for information on the weight of enclosures. This weight does not include the cables.
■ The cables are protected by using metal or plastic conduit, or using flexible cable grip strain relief.
■ The module can be powered from either a 12VDC or 24VDC local source, PoE or PoE plus.
■ UL testing was conducted with a product powered from UL Listed model POE36U-1AT-R injector, manufactured
by PHIHONG.
■ Do not connect to a receptacle controlled by a switch.

2
 ■ It is recommended to setup a private dedicated network for the connection between IP-ACM v2 panels and iSTAR
Ultra panels for more secure connection options.

ELECTROSTATIC SENSITIVE DEVICES:

NOTE • Observe precautions for handling.
• Before handling any internal components, discharge static electricity by holding a grounding lug or non-painted surface for three
seconds.
• Wear a grounding wrist strap and stand on a grounded static mat.
• Reduce movement during installation to reduce static buildup.
• Confirm work area is safeguarded.
• Transport components to static-shielded containers.
• Verify that all components, materials, and the installer are reference to a common ground.
The outsides of the ESD bags are not ESD protected.

LIFE SAFETY REQUIREMENT: A fail-safe override mechanism must be installed at each card reader exit to allow people to leave
NOTE the secure area in case of electromechanical failure.

CAUTION: Changes to the that are not expressly approved by the party responsible for compliance could void your authority to
operate the equipment.

FOR BURGLAR ALARM INSTALLATIONS:

The is not provided with backup power. An external power supply must be provided with the following characteristics:
• UL 603 Listed.
• Minimum four hours of standby power after notification of loss of AC Power.
Tyco/Software House Advanced Power Supply (apS) used in conjunction with the will be sufficient in meeting the requirement of UL
1076.
When using an external power supply, the supply shall be Class 2 and compliant with EN/IEC 62368.
All Burglar Alarm and Intrusion Zone inputs must be supervised and have Triggers configured to Alarm upon Tamper.

Data processing equipment and office appliance and business equipment used as computer equipment shall comply with the
NOTE Standard for Information Technology Equipment - Safety - Part 1: General Requirements, UL 60950-1.
• The installation shall supply line transient protection complying with the Standard for Transient Voltage Surge Suppressors, UL
1449, with a maximum marked rating of 330 V.
• Communication circuits and network components connected to the telecommunications network shall be protected by secondary
protectors for communication circuits. These protectors shall comply with the Standard for Secondary Protectors For
Communication Circuits, UL 497A. These protectors shall be used only in the protected side of the telecommunications network.
• Equipment shall be installed in a temperature controlled environment. A temperature controlled environment is defined as one
that can be maintained between 55°F (13°C) to 95°F (35°C) by the HVAC system. Twenty-four hours of standby power shall be
provided for the HVAC system. The standby power system for the HVAC system may be supplied by an engine driven generator
alone and in those situations a standby battery is not required to be used.

Environmental requirements
This product is for indoor use only and not intended for outside wiring as covered by article 800 in the National Electrical
Code, NFPA 70.
Table 3:  Environmental requirements of the IP-ACM v2

Status Range

Ambient temperature rating 32° to 120° F (0 to 49°C)

3
 Table 3:  Environmental requirements of the IP-ACM v2 (con-
tinued)

Status Range

Maximum elevation 6600 ft (2000m)

Humidity 0 to 85% RH

Grounding requirements
The grounding requirements for IP-ACM Ethernet Door Module v2 installation are as follows:
■ Grounding needs to follow NEC codes or the applicable local code.
■ On the plastic enclosure, ensure that all shields of the IP-ACM v2 cables properly connect and terminate to the
earth ground at the point indicated on Figure 2 on Page 6.
■ Shielded wires should have the shields grounded to the chassis enclosure as close as possible to where the cables
are entering the enclosure.
■ When disconnecting the wiring, disconnect ground wires last, to provide maximum protection to the equipment and
personnel.

Disconnect all power sources before modifying the wiring.

Supervision wiring
The IP-ACM v2 supports configurable supervised input circuits. The default selection is the double 1K circuit, as seen
in Figure 1 on Page 4. For more information regarding other inputs available and details of configuration, refer to the I/8-
CSI User Guide.
Figure 1:  Supervised wiring

This method reports:

■ Short
■ Normal: 1K for Normally Open, 1K for Normally Closed
■ Alert: 500 ohms for Normally Open, and 2K for Normally Closed
■ Open: >30K
■ Line Fault: Any unexpected value usually due to wrong value or fault resistors

For more information regarding other inputs available and details of configuration, refer to the I/8-CSI User Guide.

Not all configurations can detect all states. For more information regarding states, refer to the I/8-CSI User Guide and the con-
NOTE figuration tables and images relevant to the configuration of your unit.

4
IP-ACM Ethernet Door Module v2 power and wiring requirements
Table 4 on Page 5 describes the power and wiring requirements for the IP-ACM v2.
Table 4:  Power and wiring requirements for the IP-ACM v2

Signal Power Requirements To AWG Shield Maximum Length

RS-485 Comm, RM & I/O modules 22 Yes 4000ft (1212m)

Data half duplex 2-
wire
NOTE: If using tthe TST-100
Touchscreen Terminal
reader, then the
maximum distance is
32ft (10m).

RS-485 Power 12Vdc 1 RM & I/O modules 22/18 Yes Maximum length depends on
application and AWG2

RJ45-Ethernet Level 3 Switch, Hub, or CAT-5E No 328ft. (100m)

Host or better

Request to Exit Switch Contact 22/18 No 2000ft. (606m)

(REX or RTE)

Door State Switch Contact

Monitor (DSM)

Supervised Input Input 22 Yes 2000ft. (606m)

(UL) Note3

Reader Data 12Vdc 4 Proximity/Wiegand 22 Yes 200ft. (60.96m)

(Direct Wiegand signaling read head 20 300ft. (91.4m)
Connection)
18 500ft. (152.4m)

Wet Relay 12 or 24Vdc (jumper 2000ft. (606m)

Contacts selectable), 0.5A (per lock) 5

Dry Relay 0 to 30Vdc , 5A max. NO, 2000ft. (606m)

Contacts 3A max. NC

Power over IEEE 802.3af (PoE) and 802at Switch Contact 24 Yes 328 ft. (100m)
Ethernet (PoE) (PoE Plus), 25.5W max. LLDP
supported for PoE Plus6

1It is important to note that the aggregate load of each pair of RS-485 and Wiegand connections together must not exceed 750mA. Each set of RS-485
and Wiegand can support 750mA.
2Check wire lengths to verify that voltage drops are acceptable. Calculations are based on a single RM-4 reader with keypad and LCD (250mA). Using
22AWG, distance = 600ft. (.0165 ohms/ft.). Using 18AWG, distance = 1500ft. (.0065 ohms/ft.).
3To comply with UL requirements, use shielded, minimum 22 AWG stranded, twisted pair cable for monitor points, DSMs, and REXs. Use Belden 9462 or
equivalent.
4It is important to note that the aggregate load of each pair of RS-485 and Wiegand connections together must not exceed 750mA. Each set of RS-485
and Wiegand can support 750mA. Maximum combined output limit for readers, locks, and board logic is 20W.
5Voltage depends on selection of power feed (L1 or L2). Maximum combined output limit for readers, locks, and board logic is 20W.
6Compliance with IEEE 802.3 (AT or AF) specifications was not verified as part of UL294/B.

5
 Signal Power Requirements To AWG Shield Maximum Length

Local Power 12 or 24Vdc 25.5W P1 18 No Maximum length depends on

max.1 application and AWG

Installation and Enclosures

The following sections describe features and installation procedures of the plastic and metal enclosures with the IP-
ACM Ethernet Door Module v2.

Plastic enclosure
Figure 2 on Page 6 and Table 5 on Page 6 describe the dimensions of the plastic enclosure. The plastic enclosure is not
acceptable for use in a plenum.
Figure 2:  Plastic enclosure mounting hole dimensions

Table 5:  Plastic enclosure dimensions

Plastic Enclosure Dimensions

Item Dimension

Weight 1.6lb (.72kg)

Height 7.2in (183mm)

Width 12.1in (307mm)

Depth 2.46in (62.4mm)

1Maximum combined output limit for readers and locks is 17W (+/- 10%).

6
Installing the plastic enclosure and IP-ACM Ethernet Door Module v2
To install the plastic enclosure, complete the following steps:
1. Remove the screws using the Software House security screwdriver (not included, part number: 132-183) and lift
the enclosure cover off of the plastic enclosure.
2. Secure the enclosure to the selected wall or support surface using the holes provided in the enclosure’s molded
base. Refer to Figure 2 on Page 6 for dimensions and hole pitch for mounting.

It is essential to use all five securing screws when mounting the plastic enclosure. Ensure that the mounting hole at 131.1 across and
NOTE 26.3 up is used as this is required for the "whole unit off the wall" anti-tamper feature to be operational.

3. Remove the IP-ACM v2 from the packaging and place in a safe location using ESD proper procedures while
handling equipment.
4. Secure the IP-ACM v2 to the right of the enclosure.
5. Fit and connect all customer cables. Refer to the power and wiring requirements for more information.
6. Secure the cover with two tamper-proof screws using the Software House security screwdriver.

Metal enclosure
Figure 3 on Page 8 and Table 6 on Page 7 describe the dimensions of the metal enclosure. The metal enclosure is
approved for use in a plenum.

Mounting hardware is not included with the metal enclosure. Hardware used for mounting should be able to support four
times the weight of the enclosure not including cabling.
Table 6:  Metal enclosure dimensions

Metal Enclosure Dimensions

Item Dimension

Weight ~2.6lb (~1.2kg)

Height 8.25in (209.6mm)

Width 7.34in (186.5mm)

Depth 3.46in (87.8mm)

7
 Figure 3:  Metal enclosure mounting holes

Installing the metal enclosure and the IP-ACM Ethernet Door Module v2
To install the module and metal enclosure, complete the following steps:
1. Open the door of the metal enclosure.
2. Secure the enclosure to selected wall or support surface using holes provided in the enclosure’s base. Refer to
Figure 3 on Page 8 for dimensions and hole pitch for mounting.
3. Remove the IP-ACM v2 from the packaging and place in a safe location using ESD proper procedures while
handling equipment.
4. Secure the IP-ACM v2 to the enclosure.
5. Fit and connect all cables. Refer to the power and wiring requirements for more information.
6. Close and secure the metal enclosure cover.

8
IP-ACM v2 Ethernet Door Module features
Figure 4 on Page 9 shows the switches, jumpers, ports, and connectors of the IP-ACM Ethernet Door Module v2.
Figure 4:  IP-ACM Ethernet Door Module v2

Switches and jumpers

Refer to Figure 4 on Page 9 for the locations of the switches and jumpers on the IP-ACM v2.

SW1

Table 7 on Page 9 describes the positions of switch SW1.

Table 7:  Switch SW1 descriptions

Position Description

SW1-1 OFF: Normal Operation

ON: Standalone Operation
Refer to the Initial Configuration section for details.

SW1-2, SW1-3, and SW1-4 Not used. Must be in the OFF position.

9
SW2 used for factory reset

Position D of rotary switch SW2 is used for factory reset. All other positions of the rotary switch are not used in this
release.

Factory reset

1. Switch the position of the rotary switch SW2 to position D.

2. Press and release SW3 Reset button.
3. Wait until LEDs DS4 and DS8 flash. Factory reset is successful if DS4 and DS8 flash in a sequence of two flashes
in quick succession then pause and repeat continuously. If there are more than two quick flashes in the sequence,
the factory reset has failed.
4. Switch rotary switch SW2 to position 0.
5. Press and release SW3 Reset button.

Ports and connectors

Refer to Figure 4 on Page 9 for ports and connectors on the IP-ACM v2.

J5

The second RJ45 port (J5) is mainly for communication to the iSTAR Ultra LT when mounted in the same enclosure. If
this use case is being implemented, two IP addresses are needed: one for the IP-ACM and another for the iSTAR Ultra
LT.

Specific requirements for the second RJ45 port are:

■ Full duplex wiring
■ 10/100 speed (GIgabit Ethernet not provided)
■ Power over Ethernet (PoE) not provided on this port

P1

This port supports local power of 12VDC or 24VDC, 25.5W max. However, the maximum combined output limit for
readers and locks is 17W (+/-10 %). See Table 4 on Page 5 for more information regarding power and wiring
requirements.

P3 and P4

Figure 5 on Page 11 illustrates the wiring for a Wiegand reader on the IP-ACM v2.

10
 Figure 5:  Wiegand wiring for the IP-ACM v2

P5 and P6

You can wire these RS-485 ports either full or half duplex depending on the reader you are using. Refer to Figure 6 on
Page 11 for reference on wiring these RS-485 ports.
Figure 6:  Full duplex and half duplex wiring

l Wiring for the RS-485 ports are straight-through. Ensure that pin 1 of the RS-485 port on the IP-ACM v2
NOTE
connects to pin 1 of the RS-485 port on the corresponding reader.
l Full duplex has not been evaluated by UL.

P15 Tamper

NC (Normally Closed) when the enclosure is secure.

11
Inputs
Refer to Figure 4 on Page 9 for the four supervised inputs, P11 to P14, of the IP-ACM v2. Use standard Software
House 1K dual EOL configuration. Further configurations may be selected through the IP-ACM v2 editor in C•CURE
9000.

Initial Configuration
The IP-ACM v2 requires:
■ iSTAR Ultra/Ultra SE/Ultra LT firmware version 6.5.4 or higher
■ C•CURE 9000 version 2.60SP1 and higher

Initial configuration of the IP-ACM Ethernet Door Module v2 can be performed in two modes:
■ Normal Operation mode
■ Standalone configuration mode

Use Normal operation mode when using DHCP network addressing, and use Standalone configuration mode when
configuring a static IP address for the IP-ACM v2.

The IP-ACM Ethernet port (J1) defaults to using DHCP.

NOTE The MAC Address of the IP-ACM Ethernet Door Module v2 is located on the module, enclosure, or shipping carton.

Software House strongly recommends that you use a Static IP address when configuring iSTAR controllers.

The following limitation applies to iSTAR controllers with member connected controllers and iSTAR Ultra controllers
with connected IP-ACMs that use DHCP IP address assignments:
■ If DHCP is used, the lease may expire and assign a new IP address to the iSTAR controller. If this happens, all
members and IP-ACMs are not able to connect to the iSTAR controller with the new IP address. You need to
reassign the IP address:
1. Update the iSTAR controller IP address in the ICU.
2. Update the IP address in the IP-ACM Configure/Status web page.
3. Update the IP address in the iSTAR Controller Editor (members).

When you initially configure the IP-ACM v2 using the iSTAR Configuration Utility (ICU), you can only use one IP address of the Ultra
NOTE GCM board for configuration. The GCM board has two Ethernet connections, so if the GCM switches to a different IP address from
the initial configuration, communication from the IP-ACM v2 to the GCM board is lost.

Normal operation mode 

To configure the IP-ACM v2 in Normal Operation mode, complete the following steps:
1. Ensure the SW1-1 is OFF.
2. Apply power using the PoE (J1) or the local power port.
3. Push the SW3 reset switch.
4. Connect the IP-ACM v2 board to the Ethernet port directly on a DHCP network and run the iSTAR Configuration
Utility (ICU), version 6.5.4 or later, on the same subnet using an Ethernet cable. Ensure you have previously
configured the iSTAR Ultra controller in order to obtain the iSTAR IP address for the IP-ACM configuration.
5. To discover the IP-ACM, click the IP-ACM icon in the ICU. A list of IP-ACM modules appear.

12
 6. Right-click the IP-ACM, identified by its IP address or MAC Address, you want to configure and select Configure
IP-ACM.

• There is limited access to the IP-ACM v2 Configuration/Status Web Page on a system with Windows 8 or Windows 10 operating
NOTE system using Internet Explorer 11 or Edge browser on IPv4 and IPv6.
• Internet Explorer 9 does not display content correctly for the IP-ACM v2 web page.
• If using Internet Explorer and you receive a Certificate Error indicating "There is a problem with this website's security certificate”,
click Continue to this website (not recommended).
• If using Goggle Chrome and you receive an error indicating “Your connection is not private”, click ADVANCED and then click
Proceed to x.x.x.x (unsafe).

7. Enter the password: iSTAR, and click Login. The IP-ACM Configuration/Status web page appears.
8. In the Configuration section, enter the iSTAR IP address assigned to the iSTAR Ultra controller.

Ensure you click Logout on the IP-ACM Configuration/Status Web Page instead of exiting the browser through the X in the
NOTE upper-right corner so you can access this web page when you want to. If you close IP-ACM Configuration/Status Web Page from the
X in the upper-right corner and then re-open a new web page to the same URL, a message appears stating that the IP-ACM session
is currently locked by the IP Address of the machine where you closed the web page. The locked session times out after being idle for
five minutes. You can then try accessing the URL again.

9. Click Save.

• Saved changes do not take effect until the board is rebooted.

NOTE • When you initially configure the IP-ACM v2 using the iSTAR Configuration Utility (ICU), you can only use one IP address of the
Ultra GCM board for configuration. The GCM board has two Ethernet connections, so if the GCM switches to a different IP
address from the initial configuration, communication from the IP-ACM v2 to the GCM board is lost.

Standalone configuration mode

To configure the IP-ACM v2 in Standalone mode, complete the following steps:
1. If there is no DHCP network, or the installer prefers configuring the IP-ACM v2 before putting it on the network,
switch SW1-1 to ON.
2. Apply power using the PoE (J1) or the local power port.
3. Perform a factory reset (refer to Factory reset on Page 10) while SW1-1 is in the ON position.
4. The IP-ACM starts with a static IP address of: 192.168.1.111. Connect a laptop or PC, statically configured in the
192.168.1.0/24 subnet, directly to the IP-ACM v2 with an Ethernet cable.
5. Open a web browser and enter the IP address: https://192.168.1.111.

• There is limited access to the IP-ACM v2 Configuration/Status web page on a system with Windows 8 or Windows 10 operating
NOTE system using Internet Explorer 11 or Edge browser on IPv4 and IPv6.
• Internet Explorer 9 does not display content correctly for the IP-ACM v2 web page.
• If using Internet Explorer and you receive a Certificate Error indicating "There is a problem with this website's security certificate”,
click Continue to this website (not recommended).
• If using Goggle Chrome and you receive an error indicating “Your connection is not private”, click ADVANCED and then click
Proceed to x.x.x.x (unsafe).

6. Enter the password: iSTAR, and then click Login.

7. Make edits that you require to the following fields on the IP-ACM web page: IP-Type, Alloc Type, IP-ACM Addr,
IP-ACM NetMask, IP-ACM Gateway, IP-ACM DNS, and iSTAR IP Addr.
8. Click Save.

13
 Ensure you click Logout on the IP-ACM Configuration/Status Web Page instead of exiting the browser through the X in the upper-
NOTE right corner so you can access this web page when you want to. If you close IP-ACM Configuration/Status Web Page from the X in the
upper-right corner and then re-open a new web page to the same URL, a message appears stating that the IP-ACM session is
currently locked by the IP Address of the machine where you closed the web page. The locked session times out after being idle for
five minutes. You can then try accessing the URL again.

9. Switch SW1-1 to OFF.

10. Reboot the IP-ACM v2 before putting the module back on the network.

• Saved changes do not take effect until the board is rebooted.

NOTE • When you initially configure the IP-ACM v2 using the iSTAR Configuration Utility (ICU), you can only use one IP address of the
Ultra GCM board for configuration. The GCM board has two Ethernet connections, so if the GCM switches to a different IP
address from the initial configuration, communication from the IP-ACM v2 to the GCM board is lost.

802.1X port-based authentication configuration

802.1X is a port-based authentication. Credentials, such as user name/password or digital certificate, are forwarded to
the authenticator. The authenticator then forwards the credentials to the authentication server for verification. If the
authentication server determines the credentials are valid, access resources located on the protected side of the
network are allowed.
■ 802.1X is supported on IP-ACM v2.
■ 802.1X is disabled by default.
■ EAP-TLS authentication and EAP-PEAP authentication with MSCHAPv2, MD5, or GTC are supported.
■ Factory reset clears the 802.1X configuration and sets 802.1X back to disabled.

Prerequisites
■ An Internet browser with JavaScript and cookies enabled.
■ An iSTAR controller that contains IP-ACM v2 firmware version 04.01.00.30093, or greater.
■ A configured network switch with 802.1X capability.
• Port control enabled:
— Set the ports to be authorized to avoid authentication.
— Set the ports to auto to automatically detect port status for authentication.
■ A Radius Server running on the network.
■ You need to know the location of the following files generated by the Radius Server configuration:
• User Certificate
• CA Certificate
• Private Key
• Authentication password

Upgrading the IP-ACM v2 Firmware

Upgrading the IP-ACM v2 Firmware to version 04.01.00.30093 or Higher

1. Power on the IP-ACM v2. Ensure the Ethernet cable is plugged into a port that does not require authentication.
2. Configure the IP-ACM v2 to connect to the controller.

14
 3. Connect to the IP-ACM Status/Control web page:
a. Enter the IP address.
b. Enter the IP-ACM v2 password and click Login.

The default case-sensitive login password is iSTAR.

NOTE

4. Wait for the IP-ACM v2 to download the new firmware and Reboot.
5. The IP-ACM v2 can now be configured for 802.1X.

Configuration

To configure the IP-ACM v2 to use 802.1X authentication:

1. Ensure that the Ethernet cable is plugged into a port that does not require authentication.
2. Connect to the IP-ACM v2 Status/Control web page. You must prefix the IP address with HTTPS://. The ICU
automatically adds the IP address prefix.
3. Click in the radio button to select the authentication type, PEAP or TLS. The fields change depending on the
authentication type selected.
• Disabled: 802.1X is disabled.
• TLS requires Identity, Private Key Password, CA, Client Cert, and Private Key.
• PEAP requires Anon Identity, Identity, Password, and CA.
• Anon Identity can be any string you want.
4. Fill in the required fields with the appropriate values.
a. The sum of the sizes of all files uploaded must be less than 10K. The web page does not accept any configuration
where the sum of the file sizes is greater than 10K.
b. The suggested file type for certificates is: .pem.
c. The suggested file type for private keys is: .key.
5. Click Upload to upload the 802.1X configuration settings.
6. Click Reboot at the top of the page.
7. Move the Ethernet cable of the IP-ACM v2 to the port that requires authentication.
a. If the cable is not moved, the IP-ACM v2 retains network access even when it's configured for 802.1X.
b. Once plugged into the required port, the IP-ACM v2 attempts to authenticate.
8. Check the radius server to ensure that the IP-ACM v2 is authenticated.
a. If authentication fails due to an invalid configuration, move the Ethernet cable back to a non-authenticated port
and re-configure the 802.1X settings that confirm to the radius server.
b. A factory reset disables 802.1X and removes all configuration information.
9. The IP-ACM v2 firmware version can be verified by accessing the IP-ACM Status/Control page by entering the IP
address of the IP-ACM into a browser address bar.

15
Offline configuration
In Offline Mode, there is a limited level of access and control if communication is interrupted between the IP-ACM v2
and the iSTAR. The offline functionality of the IP-ACM v2 allows up to the last 1,000 previous card admits and/or a
specific personnel group of no more than 1,000. Offline Access stores a set of credentials in non-volatile memory on the
IP- ACM v2. Clearances are not downloaded to the IP-ACM v2 and are not stored.

Refer to the C•CURE Hardware Configuration Guide for more information regarding IP-ACM Offline Mode
Configuration. Offline mode is configured in C•CURE 9000 in the iSTAR Controller Editor dialog box in the IP-ACMs
tab.

Card + PIN access is not supported in Offline Mode. Card-only access with no PIN is supported.

Offline Mode is not supported on OSDP readers connected to the IP-ACM v2.
NOTE

Predefined credentials
Predefined credentials are downloaded from the iSTAR controller in the form of raw data (Static Card Data). When the
IP-ACM v2 is offline, access is granted when the predefined credentials, from the Static Card Data stored on the IP-
ACM v2, are presented to the readers.

The following restrictions apply to stored predefined credentials in offline mode:

■ Personnel groups configured for Offline Mode must all share the same card format and facility code.
■ Card formats supported are:
• Wiegand 26
• Wiegand 37
• Two-parity bit style formats
• 32-bit serial number type formats
■ The Offline Mode Personnel Group can only be configured or edited in C•CURE. Offline Mode Personnel Group
changes are sent to the IP-ACM immediately including deleting credentials, if necessary, if the iSTAR controller
and the IP-ACM are online. Any change in the Personnel Group deletes and recreates the IP-ACM static records.

Credentials last granted access

In Offline Mode, the IP-ACM v2 board admits cards that are among the last xxx previous admitted cards in addition to a
pre-defined personnel group.
■ A total of 1000 credentials (not personnel) for both previous admitted credentials and credentials in the personnel
group.
■ Maximum 100 personnel in the personnel group.
■ If you set the Personnel system variable Maximum Cards Per Person, then that value must be taken into
consideration.

Example:

If you set the Maximum Cards Per Person value to 3, then only 1000 - 100 x 3 = 700 is allowed in the Admit the last
admitted cards field for configuration.

16
Door configuration
In Offline Mode, all components of the door must come from the same IP-ACM v2 board.
NOTE Door configuration in Offline Mode does not support RS-485 wiring for readers.

In Offline Mode, you must configure the readers, inputs, and outputs on the IP-ACM v2 as detailed below:
■ A reader configured on Wiegand Port 1 as the entry reader.
■ A reader configured on Wiegand Port 2 as the exit reader.
■ An input configured on Input 1 as the DSM (Door State Monitor).
■ An input configured on Input 2 as the REX (Request to Exit).
■ An output configured on Output 1 as the Door lock.

• Door configurations not complying with the above restrictions may result in unexpected operation between online and offline
NOTE modes. However, any of the above readers, inputs, or outputs may be omitted from the door. See the following note about not
using these reader, inputs, or outputs for other purposes.
• If the readers in the list aboveand inputs/outputs are configured for a different purpose in C•CURE, the Offline Mode door
controller uses them for the door control function listed above, even if they are not configured for the door in C•CURE.

The door operation parameters are fixed when the IP-ACM v2 goes into offline mode and cannot be changed. The door
parameters revert to their configured settings when the IP-ACM v2 goes back online.

Offline fixed parameters:

■ Shunt time: 10 seconds
■ Unlock time: 5 seconds
■ Relock delay time: ½ second
■ Debounce time: ½ second
■ Unlock on RTE: Enabled
■ Shunt on RTE: Enabled
■ DSM shunted full shunt time: Disabled
■ Delay Relock full shunt time: Disabled

Readers and accessory modules

The following readers and accessory modules are UL supported: 
■ Wiegand Signaling Readers:
• SWH-4000, SWH-4100, SWH-4200
• SWH-5100
• HID 5365 Series
• HID RP40 multiCLASS
• HID RPK40 multiCLASS
• HID RP15 multiCLASS
■ RS-485 RM Bus:
• RM1 series (SWH)

17
 • RM2 series (SWH)
• RM3 series (SWH)
• RM2L series (SWH), RM2L-PI, RM2L-4000, RM2L-NH
• SWH-TST series (SWH): SWH-TST-100, SWH-TST-100-V
■ Accessory modules:
• One I/8 or I/8-CSI per port
• One R/8 per port
• RM-4, RM-4E, RM-DCM-2

18
Canadian Radio Emissions Requirements

The digital apparatus does not exceed the Class A limits for radio noise emissions from digital apparatus set out in the Radio Interference
Regulations of the Canadian Department of Communications.

Le present appareil numerique n’emet pas de bruits radioelectriques depassant les limites applicables aux appareils numeriques de la class A
prescrites dans le Reglement sur le brouillage radioelectrique edicte par le ministere des Communications du Canada.

FCC Digital Device Limitations

Radio and Television Interference

This equipment has been tested and found to comply with the limits for a digital device, pursuant to Part 15 of the FCC rules. These limits are
designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This
equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may
cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which
case the user will be required to correct the interference at his own expense.

Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any
interference received, including interference that may cause undesired operation.

In order to maintain compliance with FCC regulations, shielded cables must be used with this equipment. Operation with non-approved equipment
or unshielded cables is likely to result in interference to radio and television reception.

Caution: Changes or modifications not expressly approved by the manufacturer could void the user’s authority to operate this
equipment.

C•CURE and Software House are registered trademarks of Tyco Security Products.

The trademarks, logos, and service marks displayed on this document are registered in the United States [or other countries]. Any misuse of the
trademarks is strictly prohibited and Tyco Security Products will aggressively enforce its intellectual property rights to the fullest extent of the law,
including pursuit of criminal prosecution wherever necessary. All trademarks not owned by Tyco Security Products are the property of their
respective owners, and are used with permission or allowed under applicable laws.

Products offerings and specifications are subject to change without notice. Actual products may vary from photos. Not all products include all
features. Availability varies by region; contact your regional sales manager.

This manual is proprietary information of Software House. Unauthorized reproduction of any portion of this manual is prohibited. The material in this
manual is for information purposes only. It is subject to change without notice. Software House assumes no responsibility for incorrect information
this manual may contain.

© 2018 Tyco Security Products. All rights reserved.

19