Cisco Physical Access Gateway User Guide, Release 1.4.1

Overview

---

This document provides information to install and configure the components located near each door of a Cisco Physical Access Control system.

This chapter includes the following information:

•System Overview

–The Cisco Physical Access Gateway

–Support for Multiple Cisco Physical Access Gateways

–Cisco Physical Access Manager

•Optional Expansion Modules

–CAN Bus Connections for Optional Modules

•Installation and Configuration Summary

•Door Device Wiring Requirements

•Power Options and Requirements

–Power Options

–Current Draw Requirements

–Installing Surge Suppressors on Output Device Connections

–Connect Reader Devices with Module Power Off

•Mounting a Gateway or Optional Module

System Overview

The Cisco Physical Access Control is a comprehensive solution of hardware and software components, connected through an IP network as shown in Figure 1-1.

Figure 1-1 Cisco Physical Access Control: System Overview

The Cisco Physical Access Gateway

A Cisco Physical Access Gateway is installed near each door to provide processing and control for the connected door hardware, such as card readers, locks, and other input and output devices. This architecture allows access control to be deployed incrementally, door by door, eliminating the central panel and simplifying system design, wiring, and planning.

The Gateway is required, and can control up to two doors. Each Gateway supports the following:

Table 1-1 Cisco Physical Access Gateway Features and Benefits

Feature	Benefit
250,000 cardholder cache and a 150,000 Transaction buffer	Door continues to function in case network connectivity is lost
Web server built in	Simplifies configuration and monitoring
All communication is128 Bit AES encrypted	Protects credentials, preserves security
Device pre-provisioning using network services	Simplifies deployment
Plug & Play support	Modules can be added or deleted without disrupting service

If additional connections are required, you can connect up to 15 optional modules using a three-wire Controller Area Network (CAN) bus. These modules can be added or removed without affecting the operation of the system or other modules. See the "Optional Expansion Modules" section for more descriptions of the available modules.

---

Note The modules are connected using the CAN1 interface. The CAN2 interface is not supported in this release.

---

Related Documentation

For installation and configuration instructions, see Chapter 2 "Installing and Configuring the Cisco Physical Access Gateway".

See the Cisco Physical Access Manager User Guide for advanced configuration and management of the access control components.

Support for Multiple Cisco Physical Access Gateways

A Cisco Physical Access Gateway is installed for each door, and connected to the IP network using an Ethernet connection, as shown in Figure 1-2. This network connection provides communication with the Cisco Physical Access Manager for advanced configuration, and management with the other Gateways in the system. If the network connection is lost, the Gateway continues to provide access control functionality for the connected door devices.

Figure 1-2 Multiple Cisco Physical Access Gateways

---

Note See the "Power Options and Requirements" section for more information on support for Power over Ethernet (PoE).

---

Cisco Physical Access Manager

The Cisco Physical Access Manager appliance (Cisco PAM) is a hardware and software solution that provides advanced configuration, monitoring, and report generation for the entire system. Each Cisco Physical Access Gateway is connected to the Cisco PAM appliance over an Ethernet-based IP network, as shown in Figure 1-2. A Java-based desktop application is installed on a PC connected to the network, and used to configure and monitor the system, as shown in Figure 1-3.

Figure 1-3 Configuring and Monitoring Using the Cisco Physical Access Manager

The Cisco PAM appliance includes the following main features:

•1 RU appliance

•Java thin client architecture

•Policy support: two-door, anti-passback

•Report generator (canned & custom)

•Badge design & enrollment

•Microsoft Active Directory integration

•Fine grained user rights

•Global I/O

•Device pre-provisioning

•Capacity & feature licenses

•IT data integration

•Warm standby high availability

•Audit trails

Related Documentation

For more information on the Cisco PAM appliance, including installation and configuration instructions, see the Cisco Physical Access Manager User Guide.

Optional Expansion Modules

Each Cisco Physical Access Control system includes at least one Cisco Physical Access Gateway to provide processing and connections for input and output devices such as card readers and locks. If additional connections are required, you can add optional modules to extend the functionality of the Gateway.

Module Features

Figure 1-4 shows the modules for a Cisco Physical Access Control system.

Figure 1-4 Cisco Physical Access Gateway and the Optional Modules

Gateway	Cisco Reader Module	Cisco Input Module	Cisco Output Module
•Mandatory module. •Connects up to two doors using the 10 pin Wiegand reader port, which can be configured as two five-pin ports. •Connects up to 15 optional expansion modules using a three-wire CAN bus.1 •Power-over-Ethernet (POE) or 12 through 24V DC •Two Ethernet ports •Three output ports: Form C contacts rated at 5A 30VDC •Three supervised input ports2 •Tamper & Power Fail inputs (can be configured as additional unsupervised inputs) •One RS-485 serial port (not supported in this release).	•Requires connection to an Access Gateway using a three-wire CAN bus. •Connects up to two doors using the 10 pin Wiegand reader port, which can be configured as two 5 pin ports. •Power: 12 through 24V DC •Three output ports: Form C contacts rated at 5A 30VDC •Three supervised input ports •Tamper & Power Fail inputs (can be configured as additional unsupervised inputs) •One RS-485 serial port (not supported in this release).	•Requires connection to an Access Gateway using a three-wire CAN bus. •10 supervised input ports •Example inputs are: Push button switches, Glass Break sensors, or any contact closure input. circuit •Power: 12 through 24V DC •Tamper & Power Fail inputs (can be configured as additional unsupervised ports)	•Requires connection to an Access Gateway using a three-wire CAN bus. •8 output ports: Form C contacts rated at 5A 30VDC •Example outputs are: lights, LEDs, or any contact closure output circuit. •Power: 12 through 24V DC •Tamper & Power Fail inputs (can be configured as additional unsupervised ports)

1 The modules are connected using the CAN1 interface. The CAN2 interface is not supported in this release. 2 A supervised input supports four states: normal, alarm, open and short. An unsupervised input only indicates normal or alarm.

CAN Bus Connections for Optional Modules

The optional modules are connected to a Cisco Physical Access Gateway using a CAN bus connection, as shown in Figure 1-5.

Figure 1-5 CAN Bus Wiring

The CAN bus must adhere to the following rules:

•The maximum length for the CAN bus is 1320 feet (400 Metres).

•The last device in a CAN bus must be terminated by setting the CAN terminator switch to ON.

–The CAN terminator switch in included on the Reader, Input and Output modules only (the Gateway is always the first device in the CAN bus).

–Set the terminator switch to OFF for all other modules in the CAN bus.

–For the location of the CAN terminator on each device, see the physical port description for that device.

•The Gateway and Reader modules are connected using the CAN1 interface. The CAN2 interface is not supported in this release.

Related Documentation

See the following chapters for instructions to install the modules and related equipment:

•Chapter 2 "Installing and Configuring the Cisco Physical Access Gateway"

•Chapter 3 "Connecting a Cisco Reader Module"

•Chapter 4 "Connecting a Cisco Input Module"

•Chapter 5 "Connecting a Cisco Output Module"

Installation and Configuration Summary

The following steps are an example of the main installation and configuration tasks for a Cisco Physical Access Control system. The exact procedure and order of installation for your system may vary.

---

Step 1 Unpack and mount the Cisco Physical Access Gateway.

Step 2 Unpack and mount optional reader, input or output modules, if necessary.

Step 3 Connect door readers, input and output devices to the Cisco Physical Access Gateway or optional modules.

Step 4 Connect power to the Cisco Physical Access Gateway and any optional modules.

Step 5 Connect an Ethernet cable from a PC to the ETH1 interface on the Gateway module.

---

Note To enter the Gateway initial configuration, be sure to connect your PC to the ETH1 port. The ETH0 port is used for network communication.

---

Step 6 Open a web browser on your PC and enter https://192.168.1.42. This URL opens the web-based configuration page.

---

Note Be sure to include the s in https://. This connects your browser to the secure URL.

---

Step 7 Enter the default username and password:

default username: gwadmin

default password: gwadmin

Step 8 Enter and save the Network settings in the Initial Setup window. See the "Configuring and Managing the Gateway Using a Direct Connection" section. Wait until the Gateway resets and the web browser displays the screen Network Settings Applied.

Step 9 Verify the connections to the optional modules, door readers and other input and output devices.

Step 10 Connect an Ethernet cable from the Gateway ETH0 port to the IP network, and verify IP network connectivity.

Step 11 Perform additional configuration, verification, and monitoring tasks as described in the Cisco Physical Access Manager User Guide.

---

Door Device Wiring Requirements

The wires used for an access control door depend on the devices installed at the door. Before installing the wiring for an access control system, do the following:

•Determine the number and type of door devices used at each door (as shown in Figure 1-6).

•Determine the number and type of wires used for each device, based on the descriptions in Table 1-2.

•Determine the length of the wires based on the distance between the device and the access control Gateway, or optional module (such as a Reader, Output or Input module).

Figure 1-6 Air Return Using Ceiling Space or Using Ductwork

Table 1-2 describes the wires used for typical input and output door devices. Refer to the device documentation for more information and to verify the following requirements.

Table 1-2 Wires Used for Typical Door Devices 

Function	# of Wires	Typical Wire Gauge	Type	Use
Request to Exit	2	22	Input	Used to exit the door. This may be replaced by an egress crash bar if the exit is not alarmed.
Door position switch	2	22	Input	Used to determine if door is open or closed. This device can cause a door forced open alarm after a time out. This devise is usually supervised.
Reader	6 per reader	22	Wiegand	A reader device includes the following: •2 Wiegand data wires •1 LED •1 beeper •2 power (12VDC) wires (500 feet maximum length)
Electric strike or magnetic lock	2	18	Output	Opens the locking device. Include a reverse bias diode or other surge suppressor to protect against reverse current. See the "Installing Surge Suppressors on Output Device Connections" section for more information.
Alarm bypass	2	22	Output	Optionally used to turn off the alarm contact at the door while the strike is energized.
Bell or call	2	22	Input	Optional call button that creates an event to notify a CPAM user that a person is trying to get in the door.

Understanding Supervised and Unsupervised Input Devices

Door input devices can be supervised or unsupervised

•Unsupervised input devices have two states: active or inactive.

•Supervised input devices have four states: active, inactive, short, and open.

Unsupervised inputs have limited functionality. If a wire is cut or shorted between the input module and a normally open device. The server cannot determine the change and the device would remains in inactive state even when the switch is closed.

To make the input device supervised, use two 1K resistors in the circuit (Figure 1-7).

•In the inactive state, the circuit measures 2000 ohms.

•In the active state, the circuit measures 1000 ohms.

•In the short state the circuit measures 0 ohms

•In the open state the circuit measures infinite ohms.

Once the input device is supervised, CPAM can determine if a wire is cut or shorted.

---

Note You must also configure the device as supervised in CPAM. See the Cisco Physical Access Manager User Guide for more information.

---

Figure 1-7 Example of a Supervised Door Sensor

Power Options and Requirements

This section includes the following information:

•Power Options

•Current Draw Requirements

•Installing Surge Suppressors on Output Device Connections

•Connect Reader Devices with Module Power Off

Power Options

Table 1-3 summarizes the power options for each module. The Cisco Physical Access Gateway supports Power over Ethernet (PoE) and DC power. All other modules support DC power only.

•The DC power connections on each module are Voltage In (VIN) and Ground (GND).

•For information on configuring PoE, see the documentation for your network switch. Your switch must support PoE and be properly configured to use this feature with the Cisco Physical Access Gateway.

Table 1-3 Power Options for the Cisco Physical Access Control Modules

Module	Power over Ethernet (PoE)	12 through 24V DC
Cisco Physical Access Gateway	Supported	Supported
Cisco Reader Module	Not Supported	Supported
Cisco Input Module	Not Supported	Supported
Cisco Output Module	Not Supported	Supported

Current Draw Requirements

Each Cisco Physical Access Control module requires a minimum amount of available power, as described in Table 1-4. The current draw requirements listed in Table 1-4 account for inefficiencies in power supplies and are to be used for power budgeting. The requirements do not represent actual power usage.

Table 1-4 Current Draw Requirements for the Cisco Physical Access Control Modules

Module	Current Draw Requirement	Notes
Cisco Physical Access Gateway	1.5A	1.5A is required for the Gateway module only. Add an additional 1A if a reader or lock is attached to the module.
Cisco Reader Module	1A	1A is required for the Reader module only. Add an additional 1A if a reader or lock is attached to the module.
Cisco Input Module	1A	N/A
Cisco Output Module	1A	N/A

Installing Surge Suppressors on Output Device Connections

Install a surge suppressor between all output devices and the Gateway, Reader, or Output modules to protect the devices from power surges. Use one of the following methods:

•If the base on a lock device receives power from an external power source, install an isolation relay between the output device and the Gateway, Reader, or Output module.

•Install a MOV (Metal Oxide Varistor) surge protection product, such as the Ditek DTK-ESS Electric Switch Suppressor kit from Diversified Technology Group. An example installation is shown in Figure 1-8. You can also use a diode 4N4001 for surge suppression.

Figure 1-8 Sample Surge Suppressor Installation

Connect Reader Devices with Module Power Off

Disconnect power from the Gateway or Reader module before connecting reader devices to the modules. Connecting a reader device when the modules are powered can cause the Gateway or Reader module to malfunction.

Mounting a Gateway or Optional Module

Each Cisco Physical Access Gateway and optional module includes two mounting brackets and four screws to mount the Gateway to the wall.

Wall Mounting a Gateway or Optional Module

Figure 1-9 shows the three options for attaching the included wall-mount brackets to a module.

Figure 1-9 Three Options for Installing Wall Mount Brackets

1	Option 1: Bottom end mounting	4	Mounting Brackets (included)
2	Option 2: Bottom side mounting	5	Screws
3	Option 3: Side mounting

Wall Mount Installation Kit Contents

Each module includes a wall mount installation kit that contains the following:

Table 1-5 Wall Mount Installation Kit Contents 

Hardware Item	Quantity
Wall Mount brackets	2
Screws	8