AXIS D2123-VE Radar

4 m
(9.8 ft)

4 m
(9.8 ft)

5 m
(16.4 ft)

6 m
(19.7 ft)

6 m
(19.7 ft)

8 m
(26 ft)

7 m
(23 ft)

11 m
(36 ft)

8 m
(26 ft)

13 m
(42.7 ft)

9 m
(29.5 ft)

15 m
(49.2 ft)

10 m
(32.8.5 ft)

18 m
(59 ft)

Chrome^TM

Edge^TM

Firefox^®

Safari^®

Windows^®

macOS^®

Linux^®

Other operating systems

Show or hide the main menu.

Access the release notes.

Access the product help.

Change the language.

Set light theme or dark theme.

The user menu contains:

• Information about the user who is logged in.

• Change account : Log out from the current account and log in to a new account.

• Log out : Log out from the current account.

The context menu contains:

• Analytics data: Accept to share non-personal browser data.

• Feedback: Share any feedback to help us improve your user experience.

• Legal: View information about cookies and licenses.

• About: View device information, including AXIS OS version and serial number.

Upgrade AXIS OS: Upgrade the software on your device. Takes you to the Maintenance page where you can do the upgrade.

NTP settings: View and update the NTP settings. Takes you to the Time and location page where you can change the NTP settings.

Hardening guide: Link to AXIS OS Hardening guide where you can learn more about cybersecurity on Axis devices and best practices.

View details: View and update the list of connected clients. The list shows IP address, protocol, port, state, and PID/process of each connection.

Recordings: View ongoing and filtered recordings and their source. For more information, see Recordings

Shows the storage space where the recording is saved.

Power settings: View and update the power settings for the device. Takes you to the Power settings page where you can change the power settings.

Radar transmission: Use this to turn off the radar module completely.

Channel: If you have problems with multiple devices interfering with each other, select the same channel for up to four devices that are close to each other. For most installations, select Auto to let the devices automatically negotiate which channel to use.

Mounting height: Enter the mounting height for the product.

Number of neighboring radars: Select the number of neighboring radars that are mounted within the same coexistence zone. This will help to avoid interference.

• 0–3: Select this option if you mount one to four radars in the same coexistence zone.

• 4–5: Select this option if you mount five to six radars in the same coexistence zone.

• 6–11: Select this option if you mount seven to twelve radars in the same coexistence zone.

Detection sensitivity: Select how sensitive the radar should be. A higher value means that you get a longer detection range, but there is also a higher risk of false alarms. A lower sensitivity decreases the number of false alarms, but it may shorten the detection range.

Radar profile: Select a profile that suits your area of interest.

• Area monitoring: Track both large and small objects moving at lower speeds in open areas.

• • Ignore stationary rotating objects: Turn on to minimize false alarms from stationary objects with rotating movements, such as fans or turbines.

  • Ignore small objects: Turn on to minimize false alarms from small objects, such as cats or rabbits.

  • Ignore swaying objects: Turn on to minimize false alarms from swaying objects, such as trees, bushes, or flagpoles.

  • Ignore unknown objects: Turn on to minimize false alarms caused by objects that the radar can’t classify.

• Road monitoring: Track vehicles moving at higher speeds in urban zones and on suburban roads

• • Ignore stationary rotating objects: Turn on to minimize false alarms from stationary objects with rotating movements, such as fans or turbines.

  • Ignore swaying objects: Turn on to minimize false alarms from swaying objects, such as trees, bushes, or flagpoles.

  • Ignore unknown objects: Turn on to minimize false alarms caused by objects that the radar can’t classify.

Information legend: Turn on to show a legend containing the object types the radar can detect and track. Drag and drop to move the information legend.

Zone opacity: Select how opaque or transparent the coverage zone should be.

Grid opacity: Select how opaque or transparent the grid should be.

Color scheme: Select a theme for the radar visualization.

Rotation: Select the preferred orientation of the radar image.

Trail lifetime: Select how long the trail of a tracked object is visible in the radar view.

Icon style: Select the icon style of the tracked objects in the radar view. For plain triangles, select Triangle. For representative symbols, select Symbol. The icons will point in the direction the tracked objects are moving, regardless of style.

• Show information with icon: Select which information to display next to the icon of the tracked object:

• Object type: Show the object type that the radar has detected.

• Classification probability: Show how sure the radar is that the object classification is correct.

• Velocity: Show how fast the object is moving.

Resolution: Select the image resolution suitable for the surveillance scene. A higher resolution increases bandwidth and storage.

Frame rate: To avoid bandwidth problems on the network or reduce storage size, you can limit the frame rate to a fixed amount. If you leave the frame rate at zero, the frame rate is kept at the highest possible rate under the current conditions. A higher frame rate requires more bandwidth and storage capacity.

P-frames: A P-frame is a predicted image that shows only the changes in the image from the previous frame. Enter the desired number of P-frames. The higher the number, the less bandwidth is required. However, if there is network congestion, there could be a noticeable deterioration in the video quality.

Compression: Use the slider to adjust the image compression. High compression results in a lower bitrate and lower image quality. Low compression improves the image quality, but uses more bandwidth and storage when you record.

Signed video: Turn on to add the signed video feature to the video. Signed video protects the video from tampering by adding cryptographic signatures to the video.

• Average: Select to automatically adjust the bitrate over a longer time period and provide the best possible image quality based on the available storage.

• • Click to calculate the target bitrate based on available storage, retention time, and bitrate limit.

  • Target bitrate: Enter desired target bitrate.

  • Retention time: Enter the number of days to keep the recordings.

  • Storage: Shows the estimated storage that can be used for the stream.

  • Maximum bitrate: Turn on to set a bitrate limit.

  • Bitrate limit: Enter a bitrate limit that is higher than the target bitrate.

• Maximum: Select to set a maximum instant bitrate of the stream based on your network bandwidth.

• • Maximum: Enter the maximum bitrate.

• Variable: Select to allow the bitrate to vary based on the level of activity in the scene. More activity requires more bandwidth. We recommend this option for most situations.

Setup assistant: Click to open the setup assistant that guides you through the calibration step by step.

Reset calibration: Click to remove the current map image and radar position on the map.

Upload map: Select or drag and drop the map image you want to upload.

Download map: Click to download the map.

Rotate map: Use the slider to rotate the map image.

Distance: Add the distance between the two points you have added to the map.

Pan: Click on the buttons to pan the map image.

Zoom: Click on the buttons to zoom in or out on the map image.

Reset pan and zoom: Click to remove the pan and zoom settings.

Position: Click on the buttons to move the radar on the map.

Rotation: Click on the buttons to rotate the radar on the map.

An exclusion zone is an area in which moving objects are ignored. Use exclusion zones if there are areas inside a scenario that trigger a lot of unwanted alarms.

: Click to create a new exclusion zone.

To modify an exclusion zone, select it in the list.

Track passing objects: Turn on to track objects that pass through the exclusion zone. The passing objects keep their track IDs and are visible throughout the zone. Objects that appear from within the exclusion zone will not be tracked.

Zone shape presets: Select the initial shape of the exclusion zone.

• Cover everything: Select to set an exclusion zone that covers the entire radar coverage area.

• Reset to box: Select to place a rectangular exclusion zone in the middle of the coverage area.

• To modify the shape of the zone, drag and drop any of the points on the lines. To remove a point, right-click on it.

A scenario is a combination of triggering conditions, as well as scene and detection settings.

: Click to create a new scenario. You can create up to 20 scenarios.

• Triggering conditions: Select the condition that will trigger alarms.

• Movement in area: Select if you want the scenario to trigger on objects moving in an area.

• Line crossing: Select if you want to the scenario to trigger on objects crossing one, or two, lines.

• Scene: Define the area or lines in the scenario where moving objects will trigger alarms.

• For Movement in area, select one of the shape presets to modify the area.

• For Line crossing, drag and drop the line in the scene. To create more points on a line, click and drag anywhere on it. To remove a point, right-click on it.

• • Require crossing of two lines: Turn on if the object must pass two lines before the scenario triggers an alarm.

  • Change direction: Turn on if you want the scenario to trigger an alarm when objects cross the line in the other direction.

• Detection settings: Define the trigger criteria for the scenario.

• For Movement in area:

• • Ignore short-lived objects: Set the delay in seconds from when the radar detects the object to when the scenario triggers an alarm. This can help to reduce false alarms.

  • Trigger on object type: Select the type of objects (human, vehicle, unknown) you want the scenario to trigger on.

  • Speed limit: Trigger on objects moving at speeds within a specific range.

  • • Invert: Select if you want to trigger on speeds above and below the set speed limit.

• For Line crossing:

• • Ignore short-lived objects: Set the delay in seconds from when the radar detects the object to when the scenario triggers an action. This can help to reduce false alarms. This option is not available for objects crossing two lines.

  • Max time between crossings: Set the max time between crossing the first line and the second line. This option is only available for objects crossing two lines.

  • Trigger on object type: Select the type of objects (human, vehicle, unknown) you want the scenario to trigger on.

  • Speed limit: Trigger on objects moving at speeds within a specific range.

  • • Invert: Select if you want to trigger on speeds above and below the set speed limit.

• Alarm settings: Define the criteria for the alarm.

• Minimum trigger duration: Set the minimum duration for the triggered alarm.

: Click to add an overlay. Select the type of overlay from the dropdown list:

• Text: Select to show a text that is integrated in the live view image and visible in all views, recordings and snapshots. You can enter your own text, and you can also include pre-configured modifiers to automatically show, for example, time, date, and frame rate.

• • : Click to add the date modifier %F to show yyyy-mm-dd.

  • : Click to add the time modifier %X to show hh:mm:ss (24-hour clock).

  • Modifiers: Click to select any of the modifiers shown in the list to add them to the text box. For example, %a shows the day of the week.

  • Size: Select the desired font size.

  • Appearance: Select the text color and background color, for example, white text on a black background (default).

  • : Select the position of the overlay in the image or click and drag the overlay to move it around in the live view.

• Image: Select to show a static image superimposed over the video stream. You can use .bmp, .png, .jpeg, or .svg files.

  To upload an image, click Manage images. Before you upload an image, you can choose to:

• • Scale with resolution: Select to automatically scale the overlay image to fit the video resolution.

  • Use transparency: Select and enter the RGB hexadecimal value for that color. Use the format RRGGBB. Examples of hexadecimal values: FFFFFF for white, 000000 for black, FF0000 for red, 6633FF for blue, and 669900 for green. Only for .bmp images.

• Scene annotation: Select to show a text overlay in the video stream that stays in the same position, even when the camera pans or tilts in another direction. You can choose to only show the overlay within certain zoom levels.

• • : Click to add the date modifier %F to show yyyy-mm-dd.

  • : Click to add the time modifier %X to show hh:mm:ss (24-hour clock).

  • Modifiers: Click to select any of the modifiers shown in the list to add them to the text box. For example, %a shows the day of the week.

  • Size: Select the desired font size.

  • Appearance: Select the text color and background color, for example, white text on a black background (default).

  • : Select the position of the overlay in the image or click and drag the overlay to move it around in the live view. The overlay is saved and remains in the pan and tilt coordinates of this position.

  • Annotation between zoom levels (%): Set the zoom levels which the overlay will be shown within.

  • Annotation symbol: Select a symbol that appears instead of the overlay when the camera is not within the set zoom levels.

• Streaming indicator: Select to show an animation superimposed over the video stream. The animation indicates that the video stream is live, even if the scene doesn’t contain any motion.

• • Appearance: Select the animation color and background color, for example, red animation on a transparent background (default).

  • Size: Select the desired font size.

  • : Select the position of the overlay in the image or click and drag the overlay to move it around in the live view.

• Widget: Linegraph: Show a graph chart that displays how a measured value changes over time.

• • Title: Enter a title for the widget.

  • Overlay modifier: Select an overlay modifier as data source. If you have created MQTT overlays, they will be located at the end of the list.

  • : Select the position of the overlay in the image or click and drag the overlay to move it around in the live view.

  • Size: Select the size of the overlay.

  • Visible on all channels: Turn off to show only on your currently selected channel. Turn on to show on all active channels.

  • Update interval: Choose the time between data updates.

  • Transparency: Set the transparency of the entire overlay.

  • Background transparency: Set the transparency only of the background of the overlay.

  • Points: Turn on to add a point to the graph line when data is updated.

  • X axis

  • • Label: Enter the text label for the x axis.

    • Time window: Enter how long time the data is visualized.

    • Time unit: Enter a time unit for the x axis.

  • Y axis

  • • Label: Enter the text label for the y axis.

    • Dynamic scale: Turn on for the scale to automatically adapt to the data values. Turn off to manually enter values for a fixed scale.

    • Min alarm threshold and Max alarm threshold: These values will add horizontal reference lines to the graph, making it easier to see when the data value becomes too high or too low.

• Widget: Meter: Show a bar chart that displays the most recently measured data value.

• • Title: Enter a title for the widget.

  • Overlay modifier: Select an overlay modifier as data source. If you have created MQTT overlays, they will be located at the end of the list.

  • : Select the position of the overlay in the image or click and drag the overlay to move it around in the live view.

  • Size: Select the size of the overlay.

  • Visible on all channels: Turn off to show only on your currently selected channel. Turn on to show on all active channels.

  • Update interval: Choose the time between data updates.

  • Transparency: Set the transparency of the entire overlay.

  • Background transparency: Set the transparency only of the background of the overlay.

  • Points: Turn on to add a point to the graph line when data is updated.

  • Y axis

  • • Label: Enter the text label for the y axis.

    • Dynamic scale: Turn on for the scale to automatically adapt to the data values. Turn off to manually enter values for a fixed scale.

    • Min alarm threshold and Max alarm threshold: These values will add horizontal reference lines to the bar chart, making it easier to see when the data value becomes too high or too low.

Use this page to test the patterns of the dynamic LED strip.

Pattern: Select the pattern you want to test.

Duration: Specify the duration of the test.

Test: Click to start the pattern you want to test.

Stop: Click to stop the test. If you leave the page when a pattern plays, it will stop automatically.

To activate a pattern for indication or deterrence purposes, go to System > Events and create a rule. For an example, see Activate a sweeping red light on the radar.

Producer: A data channel that uses Real-Time Streaming Protocol (RTSP) to send metadata.

Channel: The channel used to send metadata from a producer. Turn on to enable the metadata stream. Turn off for compatibility or resource management reasons.

Ongoing recordings: Show all ongoing recordings on the device.

Start a recording on the device.

Choose which storage device to save to.

Stop a recording on the device.

Triggered recordings will end when manually stopped or when the device is shut down.

Continuous recordings will continue until manually stopped. Even if the device is shut down, the recording will continue when the device starts up again.

Play the recording.

Stop playing the recording.

Show or hide information and options about the recording.

Set export range: If you only want to export part of the recording, enter a time span. Note that if you work in a different time zone than the location of the device, the time span is based on the device’s time zone.

Encrypt: Select to set a password for exported recordings. It will not be possible to open the exported file without the password.

Click to delete a recording.

Export: Export the whole or a part of the recording.

Click to filter the recordings.

From: Show recordings done after a certain point in time.

To: Show recordings up until a certain point in time.

Source: Show recordings based on source. The source refers to the sensor.

Event: Show recordings based on events.

Storage: Show recordings based on storage type.

Add app: Install a new app.

Find more apps: Find more apps to install. You will be taken to an overview page of Axis apps.

Allow unsigned apps: Turn on to allow installation of unsigned apps.

View the security updates in AXIS OS and ACAP apps.

Use the switch next to the app name to start or stop the app.

Open: Access the app’s settings. The available settings depend on the application. Some applications don’t have any settings.

The context menu can contain one or more of the following options:

• Open-source license: View information about open-source licenses used in the app.

• App log: View a log of the app events. The log is helpful when you contact support.

• Activate license with a key: If the app requires a license, you need to activate it. Use this option if your device doesn’t have internet access.

  If you don’t have a license key, go to axis.com/products/analytics. You need a license code and the Axis product serial number to generate a license key.

• Activate license automatically: If the app requires a license, you need to activate it. Use this option if your device has internet access. You need a license code to activate the license.

• Deactivate the license: Deactivate the license to replace it with another license, for example, when you change from a trial license to a full license. If you deactivate the license, you also remove it from the device.

• Settings: Configure the parameters.

• Delete: Delete the app permanently from the device. If you don’t deactivate the license first, it remains active.

Synchronization: Select an option for the device’s date and time synchronization.

• Automatic date and time (PTP): Synchronize using the precision time protocol.

• Automatic date and time (manual NTS KE servers): Synchronize with the secure NTP key establishment servers connected to the DHCP server.

• • Manual NTS KE servers: Enter the IP address of one or two NTP servers. When you use two NTP servers, the device synchronizes and adapts its time based on input from both.

  • Trusted NTS KE CA certificates: Select the trusted CA certificates to use for secure NTS KE time synchronization, or leave at none.

  • Max NTP poll time: Select the maximum amount of time the device should wait before it polls the NTP server to get an updated time.

  • Min NTP poll time: Select the minimum amount of time the device should wait before it polls the NTP server to get an updated time.

• Automatic date and time (NTP servers using DHCP): Synchronize with the NTP servers connected to the DHCP server.

• • Fallback NTP servers: Enter the IP address of one or two fallback servers.

  • Max NTP poll time: Select the maximum amount of time the device should wait before it polls the NTP server to get an updated time.

  • Min NTP poll time: Select the minimum amount of time the device should wait before it polls the NTP server to get an updated time.

• Automatic date and time (manual NTP servers): Synchronize with NTP servers of your choice.

• • Manual NTP servers: Enter the IP address of one or two NTP servers. When you use two NTP servers, the device synchronizes and adapts its time based on input from both.

  • Max NTP poll time: Select the maximum amount of time the device should wait before it polls the NTP server to get an updated time.

  • Min NTP poll time: Select the minimum amount of time the device should wait before it polls the NTP server to get an updated time.

• Custom date and time: Manually set the date and time. Click Get from system to fetch the date and time settings once from your computer or mobile device.

Time zone: Select which time zone to use. Time will automatically adjust to daylight saving time and standard time.

• DHCP: Adopts the time zone of the DHCP server. The device must be connected to a DHCP server (v4 or v6) before you can select this option. If both versions are available, the device prefers IANA time zones over POSIX, and DHCPv4 over DHCPv6.

• • DHCPv4 uses Option 100 for POSIX time zones and Option 101 for IANA time zones.

  • DHCPv6 uses Option 41 for POSIX and Option 42 for IANA.

• Manual: Select a time zone from the drop-down list.

• Latitude: Positive values are north of the equator.

• Longitude: Positive values are east of the prime meridian.

• Heading: Enter the compass direction that the device is facing. 0 is due north.

• Label: Enter a descriptive name for your device.

• Save: Click to save your device location.

Metric (m, km/h): Select for distance measurement to be in meters and speed measurement to be in kilometers per hour.

U.S. customary (ft, mph): Select for distance measurement to be in feet and speed measurement to be in miles per hour.

Assign IPv4 automatically: Select IPv4 automatic IP (DHCP) to let the network assign your IP address, subnet mask, and router automatically, without manual configuration. We recommend using automatic IP assignment (DHCP) for most networks.

IP address: Enter a unique IP address for the device. Static IP addresses can be assigned at random within isolated networks, provided that each address is unique. To avoid conflicts, we recommend you contact your network administrator before you assign a static IP address.

Subnet mask: Enter the subnet mask to define what addresses are inside the local area network. Any address outside the local area network goes through the router.

Router: Enter the IP address of the default router (gateway) used to connect devices that are attached to different networks and network segments.

Fallback to static IP address if DHCP isn’t available: Select if you want to add a static IP address to use as fallback if DHCP is unavailable and can’t assign an IP address automatically.

Assign IPv6 automatically: Select to turn on IPv6 and to let the network router assign an IP address to the device automatically.

Assign hostname automatically: Select to let the network router assign a hostname to the device automatically.

Hostname: Enter the hostname manually to use as an alternative way of accessing the device. The server report and system log use the hostname. Allowed characters are A–Z, a–z, 0–9 and -.

Enable dynamic DNS updates:  Allow your device to automatically update its domain name server records whenever its IP address changes.

Register DNS name: Enter a unique domain name that points to your device's IP address. Allowed characters are A–Z, a–z, 0–9 and -.

TTL: Time to Live (TTL) sets how long a DNS record stays valid before it needs to be updated.

Assign DNS automatically: Select to let the DHCP server assign search domains and DNS server addresses to the device automatically. We recommend automatic DNS (DHCP) for most networks.

Search domains: When you use a hostname that is not fully qualified, click Add search domain and enter a domain in which to search for the hostname the device uses.

DNS servers: Click Add DNS server and enter the IP address of the DNS server. This provides the translation of hostnames to IP addresses on your network.

Allow access through: Select if a user is allowed to connect to the device through the HTTP, HTTPS, or both HTTP and HTTPS protocols.

HTTP port: Enter the HTTP port to use. The device allows port 80 or any port in the range 1024-65535. If you are logged in as an administrator, you can also enter any port in the range 1-1023. If you use a port in this range, you get a warning.

HTTPS port: Enter the HTTPS port to use. The device allows port 443 or any port in the range 1024-65535. If you are logged in as an administrator, you can also enter any port in the range 1-1023. If you use a port in this range, you get a warning.

Certificate: Select a certificate to enable HTTPS for the device.

Bonjour^®: Turn on to allow automatic discovery on the network.

Bonjour name: Enter a friendly name to be visible on the network. The default name is the device name and MAC address.

UPnP^®: Turn on to allow automatic discovery on the network.

UPnP name: Enter a friendly name to be visible on the network. The default name is the device name and MAC address.

WS-Discovery: Turn on to allow automatic discovery on the network.

LLDP and CDP: Turn on to allow automatic discovery on the network. Turning LLDP and CDP off can impact the PoE power negotiation. To resolve any issues with the PoE power negotiation, configure the PoE switch for hardware PoE power negotiation only.

Power and ethernet: Select this option to turn on network for the switch port.

Power only: Select this option to turn off network for the switch port. The port still provides power over ethernet.

Http proxy: Specify a global proxy host or IP address according to the allowed format.

Https proxy: Specify a global proxy host or IP address according to the allowed format.

• Allowed formats for http and https proxies:

• http(s)://host:port

• http(s)://user@host:port

• http(s)://user:pass@host:port

• No proxy: Use No proxy to bypass global proxies. Enter one of the options in the list, or enter several separated by a comma:

• Leave empty

• Specify an IP address

• Specify an IP address in CIDR format

• Specify a domain name, for example: www.<domain name>.com

• Specify all subdomains in a specific domain, for example .<domain name>.com

Allow O3C:

• One-click: This is the default option. To connect to O3C, press the control button on the device. Depending on the device model, either press and release or press and hold, until the status LED flashes. Register the device with the O3C service within 24 hours to enable Always and stay connected. If you don't register, the device will disconnect from O3C.

• Always: The device continuously attempts to connect to an O3C service over the internet. Once you register the device, it stays connected. Use this option if the control button is out of reach.

• No: Disconnects the O3C service.

Proxy settings: If needed, enter the proxy settings to connect to the proxy server.

Host: Enter the proxy server’s address.

Port: Enter the port number used for access.

Login and Password: If needed, enter username and password for the proxy server.

Authentication method:

• Basic: This method is the most compatible authentication scheme for HTTP. It’s less secure than the Digest method because it sends the username and password unencrypted to the server.

• Digest: This method is more secure because it always transfers the password encrypted across the network.

• Auto: This option lets the device select the authentication method depending on the supported methods. It prioritizes the Digest method over the Basic method.

Owner authentication key (OAK): Click Get key to fetch the owner authentication key. This is only possible if the device is connected to the internet without a firewall or proxy.

SNMP: Select the version of SNMP to use.

• v1 and v2c:

• • Read community: Enter the community name that has read-only access to all supported SNMP objects. The default value is public.

  • Write community: Enter the community name that has read or write access to all supported SNMP objects (except read-only objects). The default value is write.

  • Activate traps: Turn on to activate trap reporting. The device uses traps to send messages for important events or status changes to a management system. In the web interface, you can set up traps for SNMP v1 and v2c. Traps are automatically turned off if you change to SNMP v3 or turn off SNMP. If you use SNMP v3, you can set up traps through the SNMP v3 management application.

  • Trap address: Enter the IP address or host name of the management server.

  • Trap community: Enter the community to use when the device sends a trap message to the management system.

  • Traps:

  • • Cold start: Sends a trap message when the device starts.

    • Link up: Sends a trap message when a link changes from down to up.

    • Link down: Sends a trap message when a link changes from up to down.

    • Authentication failed: Sends a trap message when an authentication attempt fails.

• v3: SNMP v3 is a more secure version, which provides encryption and secure passwords. To use SNMP v3, we recommend you to activate HTTPS, as the password is then sent through HTTPS. This also prevents unauthorized parties’ access to unencrypted SNMP v1 and v2c traps. If you use SNMP v3, you can set up traps through the SNMP v3 management application.

• • Privacy: Select what encryption to use for protecting your SNMP data.

  • Password for the account “initial”: Enter the SNMP password for the account named “initial”. Although the password can be sent without activating HTTPS, we don’t recommend it. The SNMP v3 password can only be set once, and preferably only when HTTPS is enabled. Once the password is set, the password field is no longer displayed. To set the password again, you must reset the device to factory default settings.

Certificates are used to authenticate devices on a network. The device supports two types of certificates:

• Client/server certificates

  A client/server certificate validates the device’s identity, and can be self-signed or issued by a Certificate Authority (CA). A self-signed certificate offers limited protection and can be used before a CA-issued certificate has been obtained.

• CA certificates

  You can use a CA certificate to authenticate a peer certificate, for example to validate the identity of an authentication server when the device connects to a network protected by IEEE 802.1X. The device has several pre-installed CA certificates.

These formats are supported:

• Certificate formats: .PEM, .CER, and .PFX

• Private key formats: PKCS#1 and PKCS#12

Add certificate : Click to add a certificate. A step-by-step guide opens up.

• More: Show more fields to fill in or select.

• Secure keystore: Select to use Trusted Execution Environment (SoC TEE), Secure element or Trusted Platform Module 2.0 to securely store the private key. For more information on which secure keystore to select, go to help.axis.com/axis-os#cryptographic-support.

• Key type: Select the default or a different encryption algorithm from the drop-down list to protect the certificate.

The context menu contains:

• Certificate information: View an installed certificate’s properties.

• Delete certificate: Delete the certificate.

• Create certificate signing request: Create a certificate signing request to send to a registration authority to apply for a digital identity certificate.

Secure keystore:

• Trusted Execution Environment (SoC TEE): Select to use SoC TEE for secure keystore.

• Secure element (CC EAL6+, FIPS 140-3 Level 3): Select to use secure element for secure keystore.

• Trusted Platform Module 2.0 (CC EAL4+, FIPS 140-2 Level 2): Select to use TPM 2.0 for secure keystore.

Active: Select which cryptographic policy to apply to the device:

• Default — OpenSSL: Balanced security and performance for general use.

• FIPS — Policy to comply with FIPS 140–2: Encryption compliant with FIPS 140-2 for regulated industries.

IEEE 802.1x

IEEE 802.1x is an IEEE standard for port-based network admission control providing secure authentication of wired and wireless network devices. IEEE 802.1x is based on EAP (Extensible Authentication Protocol).

To access a network protected by IEEE 802.1x, network devices must authenticate themselves. The authentication is performed by an authentication server, typically a RADIUS server (for example, FreeRADIUS and Microsoft Internet Authentication Server).

IEEE 802.1AE MACsec

IEEE 802.1AE MACsec is an IEEE standard for media access control (MAC) security that defines connectionless data confidentiality and integrity for media access independent protocols.

Certificates

When configured without a CA certificate, server certificate validation is disabled and the device tries to authenticate itself regardless of what network it is connected to.

When using a certificate, in Axis' implementation, the device and the authentication server authenticate themselves with digital certificates using EAP-TLS (Extensible Authentication Protocol - Transport Layer Security).

To allow the device to access a network protected through certificates, you must install a signed client certificate on the device.

Authentication method: Select an EAP type used for authentication.

Client certificate: Select a client certificate to use IEEE 802.1x. The authentication server uses the certificate to validate the client’s identity.

CA certificates: Select CA certificates to validate the authentication server’s identity. When no certificate is selected, the device tries to authenticate itself regardless of what network it is connected to.

EAP identity: Enter the user identity associated with the client certificate.

EAPOL version: Select the EAPOL version that is used in the network switch.

Use IEEE 802.1x: Select to use the IEEE 802.1x protocol.

These settings are only available if you use IEEE 802.1x PEAP-MSCHAPv2 as the authentication method:

• Password: Enter the password for your user identity.

• Peap version: Select the Peap version that is used in the network switch.

• Label: Select 1 to use client EAP encryption; select 2 to use client PEAP encryption. Select the Label that the network switch uses when using Peap version 1.

These settings are only available if you use IEEE 802.1ae MACsec (Static CAK/Pre-Shared Key) as the authentication method:

• Key agreement connectivity association key name: Enter the connectivity association name (CKN). It must be 2 to 64 (divisible by 2) hexadecimal characters. The CKN must be manually configured in the connectivity association and must match on both ends of the link to initially enable MACsec.

• Key agreement connectivity association key: Enter the connectivity association key (CAK). It should be either 32 or 64 hexadecimal characters long. The CAK must be manually configured in the connectivity association and must match on both ends of the link to initially enable MACsec.

Blocking: Turn on to block brute-force attacks. A brute-force attack uses trial-and-error to guess login info or encryption keys.

Blocking period: Enter the number of seconds to block a brute-force attack.

Blocking conditions: Enter the number of authentication failures allowed per second before the block starts. You can set the number of failures allowed both on page level and device level.

Firewall: Turn on to activate the firewall.

• Default Policy: Select how you want the firewall to handle connection requests not covered by rules.

• ACCEPT: Allows all connections to the device. This option is set by default.

• DROP: Blocks all connections to the device.

To make exceptions to the default policy, you can create rules that allows or blocks connections to the device from specific addresses, protocols, and ports.

+ New rule: Click to create a rule.

• Rule type:

• FILTER: Select to either allow or block connections from devices that match the criteria defined in the rule.

• • Policy: Select Accept or Drop for the firewall rule.

  • IP range: Select to specify a range of addresses to allow or block. Use IPv4/IPv6 in Start and End.

  • IP address: Enter an address that you want to allow or block. Use IPv4/IPv6 or CIDR format.

  • Protocol: Select a network protocol (TCP, UDP, or Both) to allow or block. If you select a protocol, you must also specify a port.

  • MAC: Enter the MAC address of a device that you want to allow or block.

  • Port range: Select to specify the range of ports to allow or block. Add them in Start and End.

  • Port: Enter a port number that you want to allow or block. Port numbers must be between 1 and 65535.

  • Traffic type: Select a traffic type that you want to allow or block.

  • • UNICAST: Traffic from a single sender to a single recipient.

    • BROADCAST: Traffic from a single sender to all devices on the network.

    • MULTICAST: Traffic from one or more senders to one or more recipient.

• LIMIT: Select to accept connections from devices that match the criteria defined in the rule but apply limits to reduce excessive traffic.

• • IP range: Select to specify a range of addresses to allow or block. Use IPv4/IPv6 in Start and End.

  • IP address: Enter an address that you want to allow or block. Use IPv4/IPv6 or CIDR format.

  • Protocol: Select a network protocol (TCP, UDP, or Both) to allow or block. If you select a protocol, you must also specify a port.

  • MAC: Enter the MAC address of a device that you want to allow or block.

  • Port range: Select to specify the range of ports to allow or block. Add them in Start and End.

  • Port: Enter a port number that you want to allow or block. Port numbers must be between 1 and 65535.

  • Unit: Select the type of connections to allow or block.

  • Period: Select the time period related to Amount.

  • Amount: Set the maximum number of times a device is allowed to connect within the set Period. The maximum amount is 65535.

  • Burst: Enter the number of connections allowed to exceed the set Amount once during the set Period. Once the number has been reached, only the set amount during the set period is allowed.

  • Traffic type: Select a traffic type that you want to allow or block.

  • • UNICAST: Traffic from a single sender to a single recipient.

    • BROADCAST: Traffic from a single sender to all devices on the network.

    • MULTICAST: Traffic from one or more senders to one or more recipient.

Test rules: Click to test the rules that you have defined.

• Test time in seconds: Set a time limit for testing the rules.

• Roll back: Click to roll back the firewall to its previous state, before you have tested the rules.

• Apply rules: Click to activate the rules without testing. We don't recommend that you do this.

To install test software or other custom software from Axis on the device, you need a custom signed AXIS OS certificate. The certificate verifies that the software is approved by both the device owner and Axis. The software can only run on a specific device which is identified by its unique serial number and chip ID. Only Axis can create custom signed AXIS OS certificates, since Axis holds the key to sign them.

Install: Click to install the certificate. You need to install the certificate before you install the software.

The context menu contains:

• Delete certificate: Delete the certificate.

Add account: Click to add a new account. You can add up to 100 accounts.

Account: Enter a unique account name.

New password: Enter a password for the account. Passwords must be 1 to 64 characters long. Only ASCII printable characters (code 32 to 126) are allowed in the password, for example, letters, numbers, punctuation, and some symbols.

Repeat password: Enter the same password again.

Privileges:

• Administrator: Has full access to all settings. Administrators can also add, update, and remove other accounts.

• Operator: Has access to all settings except:

• • All System settings.

• Viewer: Doesn’t have access to change any settings.

The context menu contains:

Update account: Edit the account properties.

Delete account: Delete the account. You can’t delete the root account.

Allow anonymous viewing: Turn on to allow anyone access the device as a viewer without logging in with an account.

Allow anonymous PTZ operating: Turn on to allow anonymous users to pan, tilt, and zoom the image.

Add SSH account: Click to add a new SSH account.

• Enable SSH: Turn on to use SSH service.

Account: Enter a unique account name.

New password: Enter a password for the account. Passwords must be 1 to 64 characters long. Only ASCII printable characters (code 32 to 126) are allowed in the password, for example, letters, numbers, punctuation, and some symbols.

Repeat password: Enter the same password again.

Comment: Enter a comment (optional).

The context menu contains:

Update SSH account: Edit the account properties.

Delete SSH account: Delete the account. You can’t delete the root account.

Add virtual host: Click to add a new virtual host.

Enabled: Select to use this virtual host.

Server name: Enter the name of the server. Only use numbers 0-9, letters A-Z, and hyphen (-).

Port: Enter the port the server is connected to.

Type: Select the type of authentication to use. Select between Basic, Digest, Open ID, and Client Credential Grant.

HTTPS: Select to use HTTPS.

The context menu contains:

• Update virtual host

• Delete virtual host

Admin claim: Enter a value for the admin role.

Verification URI: Enter the web link for the API endpoint authentication.

Operator claim: Enter a value for the operator role.

Require claim: Enter the data that should be in the token.

Viewer claim: Enter the value for the viewer role.

Save: Click to save the values.

Client ID: Enter the OpenID username.

Outgoing Proxy: Enter the proxy address for the OpenID connection to use a proxy server.

Admin claim: Enter a value for the admin role.

Provider URL: Enter the web link for the API endpoint authentication. Format should be https://[insert URL]/.well-known/openid-configuration

Operator claim: Enter a value for the operator role.

Require claim: Enter the data that should be in the token.

Viewer claim: Enter the value for the viewer role.

Remote user: Enter a value to identify remote users. This assists to display the current user in the device’s web interface.

Scopes: Optional scopes that could be part of the token.

Client secret: Enter the OpenID password

Save: Click to save the OpenID values.

Enable OpenID: Turn on to close current connection and allow device authentication from the provider URL.

Add a rule: Create a rule.

Name: Enter a name for the rule.

Wait between actions: Enter the minimum time (hh:mm:ss) that must pass between rule activations. It is useful if the rule is activated by, for example, day-night mode conditions, to avoid that small light changes during sunrise and sunset activate the rule repeatedly.

Condition: Select a condition from the list. A condition must be met for the device to perform an action. If multiple conditions are defined, all of them must be met to trigger the action. For information about specific conditions, see Get started with rules for events.

Use this condition as a trigger: Select to make this first condition function only as a starting trigger. It means that once the rule is activated, it remains active for as long as all the other conditions are met, no matter the state of the first condition. If you don’t select this option, the rule will simply be active whenever all the conditions are met.

Invert this condition: Select if you want the condition to be the opposite of your selection.

Add a condition: Click to add an additional condition.

Action: Select an action from the list and enter its required information. For information about specific actions, see Get started with rules for events.

Your product may have some of the following pre-configured rules:

Front-facing LED Activation: LiveStream: When the microphone is turned on and a live stream is received, then the front-facing LED on the audio device will turn green.

Front-facing LED Activation: Recording : When the microphone is turned on and a recording is ongoing, then the front-facing LED on the audio device will turn green.

Front-facing LED Activation: SIP : When the microphone is turned on and a SIP call is active, then the front-facing LED on the audio device will turn green. You must enable SIP on the audio device before it can trigger this event.

Pre-announcement tone: Play tone on incoming call: When a SIP call is made to the audio device, then the device plays a pre-defined audio clip. You must enable SIP for the audio device. For the SIP caller to hear a ring tone while the audio device plays the audio clip, you must configure the SIP account for the device to not answer the call automatically.

Pre-announcement tone: Answer call after incoming call-tone: When the audio clip has ended, the incoming SIP-call is answered. You must enable SIP for the audio device.

Loud ringer : When a SIP call is made to the audio device, a pre-defined audio clip is played as long as the rule is active. You must enable SIP for the audio device.

Add a recipient: Click to add a recipient.

Name: Enter a name for the recipient.

Type: Select from the list:

• FTP

• • Host: Enter the server's IP address or hostname. If you enter a hostname, make sure that a DNS server is specified under System > Network > IPv4 and IPv6.

  • Port: Enter the port number used by the FTP server. The default is 21.

  • Folder: Enter the path to the directory where you want to store files. If this directory doesn’t already exist on the FTP server, you will get an error message when uploading files.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

  • Use temporary file name: Select to upload files with temporary, automatically generated filenames. The files get renamed to the desired names when the upload completes. If the upload is aborted/interrupted, you don’t get any corrupt files. However, you probably still get the temporary files. This way you know that all files that have the desired name are correct.

  • Use passive FTP: Under normal circumstances, the product simply requests the target FTP server to open the data connection. The device actively initiates both the FTP control and data connections to the target server. This is normally needed if there is a firewall between the device and the target FTP server.

• HTTP

• • URL: Enter the network address to the HTTP server and the script that will handle the request. For example, http://192.168.254.10/cgi-bin/notify.cgi.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

  • Proxy: Turn on and enter the required information if a proxy server must be passed to connect to the HTTP server.

• HTTPS

• • URL: Enter the network address to the HTTPS server and the script that will handle the request. For example, https://192.168.254.10/cgi-bin/notify.cgi.

  • Validate server certificate: Select to validate the certificate that was created by HTTPS server.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

  • Proxy: Turn on and enter the required information if a proxy server must be passed to connect to the HTTPS server.

• Network storage

  You can add network storage such as NAS (network-attached storage) and use it as a recipient to store files. The files are stored in the Matroska (MKV) file format.

• • Host: Enter the IP address or hostname for the network storage.

  • Share: Enter the name of the share on the host.

  • Folder: Enter the path to the directory where you want to store files.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

• SFTP

• • Host: Enter the server's IP address or hostname. If you enter a hostname, make sure that a DNS server is specified under System > Network > IPv4 and IPv6.

  • Port: Enter the port number used by the SFTP server. The default is 22.

  • Folder: Enter the path to the directory where you want to store files. If this directory doesn’t already exist on the SFTP server, you will get an error message when uploading files.

  • Username: Enter the username for the login.

  • Password: Enter the password for the login.

  • SSH host public key type (MD5): Enter the fingerprint of the remote host’s public key (a 32-digit hexadecimal string). The SFTP client supports SFTP servers using SSH-2 with RSA, DSA, ECDSA, and ED25519 host key types. RSA is the preferred method during negotiation, followed by ECDSA, ED25519, and DSA. Make sure to enter the right MD5 host key that is used by your SFTP server. While the Axis device supports both MD5 and SHA-256 hash keys, we recommend using SHA-256 due to stronger security over MD5. For more information on how to configure an SFTP server with an Axis device, go to the AXIS OS Portal.

  • SSH host public key type (SHA256): Enter the fingerprint of the remote host’s public key (a 43-digit Base64 encoded string). The SFTP client supports SFTP servers using SSH-2 with RSA, DSA, ECDSA, and ED25519 host key types. RSA is the preferred method during negotiation, followed by ECDSA, ED25519, and DSA. Make sure to enter the right MD5 host key that is used by your SFTP server. While the Axis device supports both MD5 and SHA-256 hash keys, we recommend using SHA-256 due to stronger security over MD5. For more information on how to configure an SFTP server with an Axis device, go to the AXIS OS Portal.

  • Use temporary file name: Select to upload files with temporary, automatically generated filenames. The files get renamed to the desired names when the upload completes. If the upload is aborted or interrupted, you don’t get any corrupt files. However, you probably still get the temporary files. This way, you know that all files that have the desired name are correct.

• SIP or VMS:

  SIP: Select to make a SIP call.

  VMS: Select to make a VMS call.

• • From SIP account: Select from the list.

  • To SIP address: Enter the SIP address.

  • Test: Click to test that your call settings works.

• Email

• • Send email to: Enter the email address to send emails to. To enter multiple addresses, use commas to separate them.

  • Send email from: Enter the email address of the sending server.

  • Username: Enter the username for the mail server. Leave this field empty if the mail server does not require authentication.

  • Password: Enter the password for the mail server. Leave this field empty if the mail server does not require authentication.

  • Email server (SMTP): Enter the name of the SMTP server, for example, smtp.gmail.com, smtp.mail.yahoo.com.

  • Port: Enter the port number for the SMTP server, using values in the range 0-65535. The default value is 587.

  • Encryption: To use encryption, select either SSL or TLS.

  • Validate server certificate: If you use encryption, select to validate the identity of the device. The certificate can be self-signed or issued by a Certificate Authority (CA).

  • POP authentication: Turn on to enter the name of the POP server, for example, pop.gmail.com.

  • Note

    Some email providers have security filters that prevent users from receiving or viewing large amount of attachments, from receiving scheduled emails and similar. Check the email provider's security policy to avoid your email account being locked or missing out on your expected emails.

• TCP

• • Host: Enter the server's IP address or hostname. If you enter a hostname, make sure that a DNS server is specified under System > Network > IPv4 and IPv6.

  • Port: Enter the port number used to access the server.

Test: Click to test the setup.

The context menu contains:

View recipient: Click to view all the recipient details.

Copy recipient: Click to copy a recipient. When you copy, you can make changes to the new recipient.

Delete recipient: Click to delete the recipient permanently.

Schedules and pulses can be used as conditions in rules. The list shows all the schedules and pulses currently configured in the product, along with information about their configuration.

Add schedule: Click to create a schedule or pulse.

You can use the manual trigger to manually trigger a rule. The manual trigger can, for example, be used to validate actions during product installation and configuration.

MQTT (Message Queuing Telemetry Transport) is a standard messaging protocol for the Internet of Things (IoT). It was designed for simplified IoT integration and is used in a wide variety of industries to connect remote devices with a small code footprint and minimal network bandwidth. The MQTT client in Axis device software can simplify integration of data and events produced in the device to systems which are not video management software (VMS).

Set up the device as an MQTT client. MQTT communication is based on two entities, the clients and the broker. The clients can send and receive messages. The broker is responsible for routing messages between clients.

You can learn more about MQTT in AXIS OS Knowledge base.

ALPN is a TLS/SSL extension that allows for the selection of an application protocol during the handshake phase of the connection between the client and server. This is used to enable MQTT traffic over the same port that is used for other protocols, such as HTTP. In some cases, there might not be a dedicated port open for MQTT communication. A solution in such cases is to use ALPN to negotiate the use of MQTT as the application protocol on a standard port, allowed by the firewalls.

Connect: Turn on or off the MQTT client.

Status: Shows the current status of the MQTT client.

Broker

Host: Enter the hostname or IP address of the MQTT server.

Protocol: Select which protocol to use.

Port: Enter the port number.

• 1883 is the default value for MQTT over TCP

• 8883 is the default value for MQTT over SSL

• 80 is the default value for MQTT over WebSocket

• 443 is the default value for MQTT over WebSocket Secure

ALPN protocol: Enter the ALPN protocol name provided by your MQTT broker provider. This is only applicable with MQTT over SSL and MQTT over WebSocket Secure.

Username: Enter the username that the client will use to access the server.

Password: Enter a password for the username.

Client ID: Enter a client ID. The client identifier is sent to the server when the client connects to it.

Clean session: Controls the behavior at connection and disconnection time. When selected, the state information is discarded at connect and disconnect.

HTTP proxy: A URL with a maximum length of 255 bytes. You can leave the field empty if you don't want to use an HTTP proxy.

HTTPS proxy: A URL with a maximum length of 255 bytes. You can leave the field empty if you don't want to use an HTTPS proxy.

Keep alive interval: Enables the client to detect when the server is no longer available without having to wait for the long TCP/IP timeout.

Timeout: The time interval in seconds to allow a connect to complete. Default value: 60

Device topic prefix: Used in the default values for the topic in the connect message and LWT message on the MQTT client tab, and in the publication conditions on the MQTT publication tab.

Reconnect automatically: Specifies whether the client should reconnect automatically after a disconnect.

Connect message

Specifies if a message should be sent out when a connection is established.

Send message: Turn on to send messages.

Use default: Turn off to enter your own default message.

Topic: Enter the topic for the default message.

Payload: Enter the content for the default message.

Retain: Select to keep the state of client on this Topic

QoS: Change the QoS layer for the packet flow.

Last Will and Testament message

The Last Will Testament (LWT) lets a client provide a testament along with its credentials when connecting to the broker. If the client disconnects ungracefully at some point later (maybe because his power source died), it can let the broker deliver a message to other clients. This LWT message has the same form as an ordinary message and gets routed via the same mechanics.

Send message: Turn on to send messages.

Use default: Turn off to enter your own default message.

Topic: Enter the topic for the default message.

Payload: Enter the content for the default message.

Retain: Select to keep the state of client on this Topic

QoS: Change the QoS layer for the packet flow.

Use default topic prefix: Select to use the default topic prefix, that is defined in the device topic prefix in the MQTT client tab.

Include condition: Select to include the topic that describes the condition in the MQTT topic.

Include namespaces: Select to include ONVIF topic namespaces in the MQTT topic.

Include serial number: Select to include the device’s serial number in the MQTT payload.

Add condition: Click to add a condition.

Retain: Defines which MQTT messages are sent as retained.

• None: Send all messages as non-retained.

• Property: Send only stateful messages as retained.

• All: Send both stateful and stateless messages as retained.

QoS: Select the desired level for the MQTT publication.

Add subscription: Click to add a new MQTT subscription.

Subscription filter: Enter the MQTT topic that you want to subscribe to.

Use device topic prefix: Add the subscription filter as prefix to the MQTT topic.

Subscription type:

• Stateless: Select to convert MQTT messages into a stateless message.

• Stateful: Select to convert MQTT messages into a condition. The payload is used as the state.

QoS: Select the desired level for the MQTT subscription.

Add overlay modifier: Click to add a new overlay modifier.

Topic filter: Add the MQTT topic that contains the data you want to show in the overlay.

Data field: Specify the key for the message payload that you want to show in the overlay, assuming the message is in JSON format.

• Modifier: Use the resulting modifier when you create the overlay.

• Modifiers that start with #XMP show all of the data received from the topic.

• Modifiers that start with #XMD show the data specified in the data field.

Network storage: Turn on to use network storage.

Add network storage: Click to add a network share where you can save recordings.

• Address: Enter the IP address or host name of the host server, typically a NAS (network-attached storage). We recommend you to configure the host to use a fixed IP address (not DHCP since a dynamic IP address can change) or that you use DNS. Windows SMB/CIFS names are not supported.

• Network share: Enter the name of the shared location on the host server. Several Axis devices can use the same network share since each device gets its own folder.

• User: If the server requires a login, enter the username. To log in to a specific domain server, type DOMAIN\username.

• Password: If the server requires a login, enter the password.

• SMB version: Select the SMB storage protocol version to connect to the NAS. If you select Auto, the device tries to negotiate one of the secure versions SMB: 3.02, 3.0, or 2.1. Select 1.0 or 2.0 to connect to older NAS that don’t support higher versions. You can read more about SMB support in Axis devices here.

• Add share without testing: Select to add the network share even if an error is discovered during the connection test. The error can be, for example, that you didn’t enter a password even though the server requires one.

Remove network storage: Click to unmount, unbind, and remove the connection to the network share. This removes all settings for the network share.

Unbind: Click to unbind and disconnect the network share.
Bind: Click to bind and connect the network share.

Unmount: Click to unmount the network share.
Mount: Click to mount the network share.

Write protect: Turn on to stop writing to the network share and protect recordings from being removed. You can’t format a write-protected network share.

Retention time: Select how long to keep recordings, to limit the amount of old recordings, or to comply with regulations regarding data storage. If the network storage becomes full, old recordings are removed before the selected time period passes.

Tools

• Test connection: Test the connection to the network share.

• Format: Format the network share, for example, when you need to quickly erase all data. CIFS is the available file system option.

• Use tool: Click to activate the selected tool.

Unmount: Click to safely remove the SD card.

Write protect: Turn on to stop writing to the SD card and protect recordings from being removed. You can’t format a write-protected SD card.

Autoformat: Turn on to automatically format a newly inserted SD card. It formats the file system into ext4.

Ignore: Turn on to stop storing recordings on the SD card. When you ignore the SD card, the device no longer recognizes that the card exists. The setting is only available to administrators.

Retention time: Select how long to keep recordings to limit the amount of old recordings or comply with data storage regulations. When the SD card is full, it deletes old recordings before their retention time has passed.

Tools

• Check: Check for errors on the SD card.

• Repair: Repair errors in the file system.

• Format: Format the SD card to change the file system and erase all data. You can only format the SD card to the ext4 file system. You need a third-party ext4 driver or application to access the file system from Windows®.

• Encrypt: Use this tool to format the SD card and enable encryption. This erases all data stored on the SD card. Any new data you store on the SD card will be encrypted.

• Decrypt: Use this tool to format the SD card without encryption. This erases all data stored on the SD card. Any new data you store on the SD card will not be encrypted.

• Change password: Change the password required to encrypt the SD card.

• Use tool: Click to activate the selected tool.

Wear trigger: Set a value for the SD card wear level at which you want to trigger an action. The wear level ranges from 0–200%. A new SD card that has never been used has a wear level of 0%. A wear level of 100% indicates that the SD card is close to its expected lifetime. When the wear-level reaches 200%, there is a high risk of the SD card malfunctioning. We recommend setting the wear trigger between 80–90%. This gives you time to download any recordings as well as replace the SD card in time before it potentially wears out. The wear trigger allows you to set up an event and get a notification when the wear level reaches your set value.

• Hard drive

• Free: The amount of free disk space.

• Status: If the disk is mounted or not.

• File system: The file system used by the disk.

• Encrypted: If the disk is encrypted or not.

• Temperature: The current temperature of the hardware.

• Overall heath test: The result after checking the health of the disk.

• Tools

• Check: Check the storage device for errors and tries to repair it automatically.

• Repair: Repair the storage device. Active recordings will pause during the repair. Repairing a storage device may result in lost data.

• Format: Erase all recordings and format the storage device. Choose a file system.

• Encrypt: Encrypt stored data.

• Decrypt: Decrypt stored data. The system will erase all files on the storage device.

• Change password: Change the password for the disk encryption. Changing the password doesn't disrupt ongoing recordings.

• Use tool: Click to run the selected tool

Unmount: Click before you disconnect the device from the system. This will stop all ongoing recordings.

Write protect: Turn on to protect the storage device from being overwritten.

Autoformat: The disk will automatically format using the ext4 file system.

• RAID

• Free: The amount of free disk space.

• Status: If the disk is mounted or not.

• File system: The file system that is used by the disk.

• Encrypted: If the disk is encrypted or not.

• Temperature: The current temperature of the hardware.

• Overall heath test: The result after checking the health of the disk.

• RAID level: The RAID level used for the storage. Supported RAID levels are 0, 1, 5, 6, 10.

• RAID status: The RAID status of the storage. Possible values are Online, Degraded, Syncing, and Failed. The syncing process may take several hours.

• Tools
• Note

  When you run the following tools, make sure to wait until the operation is done before closing the page.

• Check: Check the storage device for errors and tries to repair it automatically.

• Repair: Repair the storage device. Active recordings will pause during the repair. Repairing a storage device may result in lost data.

• Format: Erase all recordings and format the storage device. Choose a file system.

• Encrypt: Encrypt data that is stored. All files on the storage device will be erased.

• Decrypt: Decrypt data that is stored. All files on the storage device will be erased.

• Change password: Change the password for the disk encryption. Changing the password doesn't disrupt ongoing recordings.

• Change RAID level: Erase all recordings and change the RAID level for the storage.

• Use tool: Click to run the selected tool.

Hard drive status: Click to view the hard drive status, capacity, and serial number.

Write protect: Turn on write protection to protect the storage device from being overwritten.

Add stream profile: Click to create a new stream profile.

Preview: A preview of the video stream with the stream profile settings you select. The preview updates when you change the settings on the page. If your device has different view areas, you can change the view area in the drop-down in the bottom left corner of the image.

Name: Add a name for your profile.

Description: Add a description of your profile.

Video codec: Select the video codec that should apply for the profile.

Resolution: See for a description of this setting.

Frame rate: See for a description of this setting.

Compression: See for a description of this setting.

Zipstream: See for a description of this setting.

Optimize for storage: See for a description of this setting.

Dynamic FPS: See for a description of this setting.

Dynamic GOP: See for a description of this setting.

Mirror: See for a description of this setting.

GOP length: See for a description of this setting.

Bitrate control: See for a description of this setting.

Include overlays: Select what type of overlays to include. See Overlays for information about how to add overlays.

Include audio: See for a description of this setting.

Add accounts: Click to add a new ONVIF account.

Account: Enter a unique account name.

New password: Enter a password for the account. Passwords must be 1 to 64 characters long. Only ASCII printable characters (code 32 to 126) are allowed in the password, for example, letters, numbers, punctuation, and some symbols.

Repeat password: Enter the same password again.

Privileges:

• Administrator: Has full access to all settings. Administrators can also add, update, and remove other accounts.

• Operator: Has access to all settings except:

• • All System settings.

  • Adding apps.

• Media account: Allows access to the video stream only.

The context menu contains:

Update account: Edit the account properties.

Delete account: Delete the account. You can’t delete the root account.

Add media profile: Click to add a new ONVIF media profile.

Profile name: Add a name for the media profile.

Video source: Select the video source for your configuration.

• Select configuration: Select a user-defined configuration from the list. The configurations in the drop-down list correspond to the device's video channels, including multiviews, view areas and virtual channels.

Video encoder: Select the video encoding format for your configuration.

• Select configuration: Select a user-defined configuration from the list and adjust the encoding settings. The configurations in the drop-down list act as identifiers/names of the video encoder configuration. Select user 0 to 15 to apply your own settings, or select one of the default users if you want to use predefined settings for a specific encoding format.

Audio source: Select the audio input source for your configuration.

• Select configuration: Select a user-defined configuration from the list and adjust the audio settings. The configurations in the drop-down list correspond to the device's audio inputs. If the device has one audio input, it's user0. If the device has several audio inputs, there will be additional users in the list.

Audio encoder: Select the audio encoding format for your configuration.

• Select configuration: Select a user-defined configuration from the list and adjust the audio encoding settings. The configurations in the drop-down list act as identifiers/names of the audio encoder configuration.

Audio decoder: Select the audio decoding format for your configuration.

• Select configuration: Select a user-defined configuration from the list and adjust the settings. The configurations in the drop-down list act as identifiers/names of the configuration.

Audio output: Select the audio output format for your configuration.

• Select configuration: Select a user-defined configuration from the list and adjust the settings. The configurations in the drop-down list act as identifiers/names of the configuration.

Metadata: Select the metadata to include in your configuration.

• Select configuration: Select a user-defined configuration from the list and adjust the metadata settings. The configurations in the drop-down list act as identifiers/names of the metadata configuration.

PTZ: Select the PTZ settings for your configuration.

• Select configuration: Select a user-defined configuration from the list and adjust the PTZ settings. The configurations in the drop-down list correspond to the device's video channels with PTZ support.

Create: Click to save your settings and create the profile.

Cancel: Click to cancel the configuration and clear all settings.

profile_x: Click on the profile name to open and edit the preconfigured profile.

Shock detector: Turn on to generate an alarm if the device is hit by an object or if it is tampered with.

Sensitivity level: Move the slider to adjust the sensitivity level at which the device should generate an alarm. A low value means that the device only generates an alarm if the hit is powerful. A high value means that the device generates an alarm even with mild tampering.

Shows power status information. Information varies depending on the product.

Delayed shutdown: Turn on if you want to set a delay time before the power turns off.

Delay time: Set a delay time between 1 and 60 minutes.

Power saving mode: Turn on to put the device into power saving mode. When you turn on power saving mode, the IR illumination range reduces.

Set power configuration: Change the power configuration by selecting a different PoE class option. Click Save and restart to save the change.

Dynamic power mode: Turn on to reduce power consumption when the device is inactive.

Power warning overlay: Turn on to show a power warning overlay when the device doesn’t have enough power.

I/O port power: Turn on to supply 12 V power to external devices connected to the I/O ports. Leave off to prioritize internal functions, such as IR, heating, and cooling. As a result, devices and sensors that require 12 V power will stop working properly.

Shows the current power usage, average power usage, maximum power usage, and power consumption over time.

The context menu contains:

• Export: Click to export the chart data.

Add: Add a device to pair with.

Discover devices: Click to find devices on the network. When the network has been scanned a list of available devices is shown.

To pair a device from the list, click .

Select pairing type: Select from the drop-down list.

Speaker pairing: Select to pair a network speaker.

Microphone pairing: Select to pair a microphone.

Address: Enter host name or IP address to the network speaker.

Username: Enter username.

Password: Enter password for the user.

Close: Click to clear all fields.

Connect: Click to establish connection to the device to pair with.

To pair a device from the list, click .

Select pairing type: Select from the drop-down list.

Address: Enter host name or IP address of the PTZ camera.

Username: Enter the username of the PTZ camera.

Password: Enter the password for the PTZ camera.

Close: Click to clear all fields.

Connect: Click to establish connection to the PTZ camera.

Configure radar autotracking: Click to open and configure autotracking. You can also go to Radar > Radar PTZ autotracking to configure.

To pair a device from the list, click .

Select pairing type: Select from the drop-down list.

Address: Enter host name or IP address to the device.

Username: Enter username.

Password: Enter password.

Certificate name: Enter certificate name.

Close: Click to clear all fields.

Connect: Click to establish connection to the device to pair with.

Reports

• View the device server report: View information about the product status in a pop-up window. The Access Log is automatically included in the Server Report.

• Download the device server report: It creates a .zip file that contains a complete server report text file in UTF–8 format, as well as a snapshot of the current live view image. Always include the server report .zip file when you contact support.

• Download the crash report: Download an archive with detailed information about the server's status. The crash report contains information that is in the server report as well as detailed debug information. This report might contain sensitive information such as network traces. It can take several minutes to generate the report.

Logs

• View the system log: Click to show information about system events such as device startup, warnings, and critical messages.

• View the access log: Click to show all failed attempts to access the device, for example, when a wrong login password is used.

• View the audit log: Click to show information about user and system activities, for example, successful or failed authentications and configurations.

Server: Click to add a new server.

Host: Enter the hostname or IP address of the server.

Format: Select which syslog message format to use.

• Axis

• RFC 3164

• RFC 5424

Protocol: Select the protocol to use:

• UDP (Default port is 514)

• TCP (Default port is 601)

• TLS (Default port is 6514)

Port: Edit the port number to use a different port.

Severity: Select which messages to send when triggered.

Type: Select the type of logs you want to send.

Test server setup: Send a test message to all servers before you save the settings.

CA certificate set: See the current settings or add a certificate.

Plain config is for advanced users with experience of Axis device configuration. Most parameters can be set and edited from this page.

Restart: Restart the device. This does not affect any of the current settings. Running applications restart automatically.

Restore: Return most settings to the factory default values. Afterwards you must reconfigure the device and apps, reinstall any apps that didn’t come preinstalled, and recreate any events and presets.

Factory default: Return all settings to the factory default values. Afterwards you must reset the IP address to make the device accessible.

AXIS OS upgrade: Upgrade to a new AXIS OS version. New releases can contain improved functionality, bug fixes, and completely new features. We recommend you to always use the latest AXIS OS release. To download the latest release, go to axis.com/support.

• When you upgrade, you can choose between three options:

• Standard upgrade: Upgrade to the new AXIS OS version.

• Factory default: Upgrade and return all settings to the factory default values. When you choose this option, you can’t revert to the previous AXIS OS version after the upgrade.

• Automatic rollback: Upgrade and confirm the upgrade within the set time. If you don’t confirm, the device reverts to the previous AXIS OS version.

AXIS OS rollback: Revert to the previously installed AXIS OS version.

Reset PTR: Reset PTR if for some reason the Pan, Tilt, or Roll settings aren’t working as expected. The PTR motors are always calibrated in a new camera. But calibration can be lost, for example, if the camera loses power or if the motors are moved by hand. When you reset PTR, the camera is re-calibrated and returns to its factory default position.

Calibration: Click Calibrate to recalibrate the pan, tilt, and roll motors to their default positions.

Ping: To check if the device can reach a specific address, enter the hostname or IP address of the host you want to ping and click Start.

Port check: To verify connectivity from the device to a specific IP address and TCP/UDP port, enter the hostname or IP address and port number you want to check and click Start.

Network trace

A network trace file can help you troubleshoot problems by recording activity on the network.

Trace time: Select the duration of the trace in seconds or minutes and click Download.

Steady green for normal operation.

Steady during startup. Flashes during device software upgrade or reset to factory default.

AXIS OS upgrade failed

If the upgrade fails, the device reloads the previous version. The most common reason is that the wrong AXIS OS file has been uploaded. Check that the name of the AXIS OS file corresponds to your device and try again.

Problems after AXIS OS upgrade

If you experience problems after the upgrade, roll back to the previously installed version from the Maintenance page.

Can’t set the IP address

• If the IP address intended for the device and the IP address of the computer used to access the device are located on different subnets, you can’t set the IP address. Contact your network administrator to obtain an IP address.

• The IP address could be in use by another device. To check:

• 1. Disconnect the Axis device from the network.

  2. In a Command/DOS window, type ping and the IP address of the device.

  3. If you receive: Reply from <IP address>: bytes=32; time=10... this means that the IP address might already be in use by another device on the network. Obtain a new IP address from the network administrator and reinstall the device.

  4. If you receive: Request timed out, this means that the IP address is available for use with the Axis device. Check all cabling and reinstall the device.

• There could be a possible IP address conflict with another device on the same subnet. The static IP address in the Axis device is used before the DHCP server sets a dynamic address. This means that if the same default static IP address is also used by another device, there could be problems accessing the device.

Can’t log in when accessing the device from a browser

When HTTPS is enabled, make sure that you use the correct protocol (HTTP or HTTPS) when you try to log in. You might need to manually type http or https in the browser’s address field.

If you’ve lost the password for the root account, you must reset the device to the factory default settings. For instructions, see Reset to factory default settings.

The IP address has been changed by DHCP

IP addresses obtained from a DHCP server are dynamic and could change. If the IP address has been changed, use AXIS IP Utility or AXIS Device Manager to locate the device on the network. Identify the device using its model or serial number, or by the DNS name (if the name has been configured).

If required, you can assign a static IP address manually. For instructions, go to axis.com/support.

Certificate error when using IEEE 802.1X

For authentication to work properly, the date and time settings in the Axis device must be synchronized with an NTP server. Go to System > Date and time.

The browser isn’t supported

For a list of recommended browsers, see Browser support.

Can’t access the device externally

To access the device externally, we recommend you to use one of the following applications for Windows^®:

• AXIS Camera Station Edge: free of charge, ideal for small systems with basic surveillance needs.

• AXIS Camera Station Pro: 90-day trial version free of charge, ideal for small to mid-size systems.

For instructions and download, go to axis.com/vms.

Can’t connect over port 8883 with MQTT over SSL

The firewall blocks traffic that uses port 8883 since it’s regarded insecure.

In some cases the server/broker might not provide a specific port for MQTT communication. It might still be possible to use MQTT over a port normally used for HTTP/HTTPS traffic.

• If the server/broker supports WebSocket/WebSocket Secure (WS/WSS), typically on port 443, use this protocol instead. Check with the server/broker provider to see if WS/WSS is supported and which port and basepath to use.

• If the server/broker supports ALPN, the use of MQTT can be negotiated over an open port, such as 443. Check with your server/broker provider to see if ALPN is supported and which ALPN protocol and port to use.

Image degradation or image loss

• Check the devices server report for the number of times you have lost the link to the sensor unit.

• Check that the connector cable between the sensor unit and the main unit is tight.

• Change to a new sensor unit cable.

The device shuts down

• Disconnect and reconnect power to the device.

• Check if Delayed shutdown is turned on. If it’s on, the main unit turns off according to the set delay time. You have 300 seconds to turn off Delayed shutdown before the device turns itself off again.