Lenel•S2 develops various physical security solutions for large corporations, including access control, video surveillance, event monitoring, digital signage, live Internet-sourced, real-time data and information feeds, mobile applications, and cloud-based services.
How does this application work?
The Envoy + Netbox app streamlines the process of logging and assigning access cards to visitors. When a visitor signs in, Envoy automatically creates an entry for the visitor in your Netbox activity log. Netbox then assigns the visitor an access card with the appropriate expiration date and access level.
If you use Envoy’s block list feature, you can use the Envoy + Netbox app to kick off security measures when an unwanted visitor tries to sign in. When visitors match keywords on your block list, you can choose to trigger an event in Netbox. You can then configure specific actions, like turning on security cameras or alerting your security team.
Enabling the Envoy + Netbox application
PREREQUISITES
You’ll need to be an administrator on your Netbox account to complete this installation. Either become an administrator or ask your admin for help before completing these steps.
For the app to work and connect to your Netbox instance, please allowlist the following IP addresses for inbound and outbound communication
18.204.164.109
52.6.210.64
52.86.90.108
The on-premise Netbox instance must be routed to a public IP. Please see this article for possible network configurations.
Ensure that Port 443 and any chosen custom port to route traffic through are open to receive inbound traffic from the IPs listed above
You must be running Netbox version 5.6 or above
NETBOX CONFIGURATION
The API must be enabled on your Netbox. "System Setup" credentials are needed to authenticate the API requests and are required when using the Netbox endpoints.
Configuration -> Site Settings -> Network Controller -> Data Integration
"Limit session to single IP address" should be set to No.
Configuration > Site settings > Network Controller > Web Site
(Envoy Visitors Only) In order for events to show up in the activity log, there needs to be at least one action created for an event (e.g. Envoy visitor)
Configuration -> Alarms -> Events -> Actions
(Envoy Visitors Only) For the activity log, there should be at least one Network Node. The node does not need to be real
Configuration -> Site Settings -> Network Nodes -> Type: MicroNode
(Workplace Only) An ID number be filled out in every employee profile within Netbox. The way Netbox allows us to track badge activity is dependent on the ID field. There is also the option in Netbox to automatically assign ID numbers to all employees in the Network Controller section of Netbox.
Installing Netbox in Envoy
Go to Apps > All Apps.
Under Access Control, find LenelS2 Netbox.
Click Install.
Step 1: API
In the API step, paste or type your on-premise and public facing Netbox URL into the Hosted URL field.
On-premise NetBox must have an accessible public IP for Envoy to connect. Please see this article for possible network configurations.
Example: "https://136.28.33.47:4443/"
Note the PORT is appended to the end of the URL and the URL includes "https://"
Enter your administer credentials
If your Netbox is configured across multiple partitions, enable "Multi-partition Mode".
Select your Timezone.
Select your API Version
Step 2: Configuration Options
Select the partition you would like to use, then click Next Step.
Step 3: Workplace
Envoy Workplace is not currently available in the EU datacenter configuration of Envoy. Click Skip to continue.
Step 4: Visitors
Default access level for synced visitors
Choose which level is the default for any Envoy Visitor type.
Visitor types to Access Levels (OPTIONAL)
Select a visitor type to match to a specific Access Level
Setting an Envoy visitor type to "none — disallow" will prevent the visitor type from being recorded as a person record in Netbox.
Visitor Access Duration
Set the amount of time the Visitor has active credentials
Advance Access
Enabling this allows for invited visitors to have access 24 hours in advance of their visit.
Card Configuration
Choose whether to disable card generation, enabled for invited visitor only, or enable for walk-ins and for invited visitors
Add optional text to the QR code email
Minimum and Maximum card ranges are required to issue credentials in a digital QR code format.
These are card ranges are created and added to the user in Netbox. The QR code is generated from the card #. The ranges follow the format that the Netbox side has configured, such as Wiegand 26 bit which gives you a range of 0 to 65,535.
Options
Envoy requires a field to store our Visitor identifier. You can change the default of UDF1.
Choose which entries to sync to the S2 log
Choose preferred block list detection
Anytime a blocklist key word is detected
Only when the blocklist denies a visitor access.
None
Customization
Choose a field to store the Host's name
Option to add the prefix "envoy-" to any Envoy generated person ID within S2
Option to remove the user record upon sign out.
How Envoy Visitors entries look in Netbox
In the example below, the company Second Street Labs created an Netbox event called Envoy Block list Visitor Registered. They configured the application to sync all visitor entries. Additionally, they want to trigger the new event they created when a block list visitor is denied access.
Visitor Sophia Fitzroy signed in at 17:28. Her entry appears in the activity log as a record, but there are no additional triggered events.
Visitor Grey Ryer signed in at 18:12. His entry also appears in the activity log as a record, but, additionally, the Envoy Block list Visitor Registered event triggered since he was denied access.
How to view people created in Netbox through the sign-in event
In the example below, the visitor Sarah Smith has signed in with Envoy and is now accessible as a Person record.
Locate the visitor through Administration > People Search
How access cards are assigned to Envoy Visitors in Netbox
Assigning access cards to visitors currently requires a few easy steps. Once visitors are signed out, their card will be unassigned in Netbox. Please follow the instructions below to assign a card to your visitors:
Log in to your NetBox admin panel.
Select “People Search” under the “Administration” menu in the NetBox admin panel.
Search the “Find People” page using the first or last name fields based on the visitor’s information and click “Search”.
The new visitor can be selected by clicking the corresponding name in the “Name” column in the “People Search” results.
We recommend finding the visitor by both “Name” and “Modified” columns to ensure the most recent entry for this visitor is selected.
The “People Information” page for this visitor allows a card to be assigned. Click the “Read” button under “Read Credential”.
If the card profile has already been configured, then the identifier on the back of the card can simply be entered, instead of scanning the card.
After clicking “read”, scan the visitors unassigned card on a reader. This will assign the physical card to the Envoy visitor’s entry in Netbox.
Please refer to Netbox documentation if Card Formats have not yet been assigned.
Please refer to Netbox documentation if Access Levels have not yet been defined.