If Sign In App cannot connect to your Paxton Net2 server, or a connection that was working has stopped, work through this article in order. Each check rules out a common cause before you move on to the next.
This article is for whoever manages the Net2 server, usually your IT team. You will need:
an administrator account on the Windows server that runs Paxton Net2
an admin login to Sign In App
the Paxton Local API licence file for Sign In Solutions. If you do not have it, ask your Account Manager.
For the standard setup steps, see On-Premise Access Control. For what the integration reads and changes in Net2, see Paxton Net2: what Sign In App reads, changes and stores.
How the connection works
Three things have to be in place. When the connection fails, it is almost always one of these.
Part | What it is |
Paxton Local API | Paxton's own web API on your Net2 server. It must be switched on, licensed and running. |
Tunnel | A small Windows service called SIS Connector that securely connects your Net2 server to Sign In App. It only makes outbound connections, so you do not need to open any inbound ports. |
Provider in Sign In App | The Paxton Net2 entry under Manage > On-Premise Access Control in Sign In App. |
Check 1. Your Net2 version and provider
Sign In App has two Paxton providers. Choose the one that matches your Net2 version.
Provider in Sign In App | Net2 versions |
Paxton Net2 (v6.7 SR3 and later) | v6.7 SR3 and later |
Paxton Net2 (v6.05 SR2 to v6.6) | v6.05 SR2 to v6.6 |
These versions are not supported:
Below v6.05 SR2. Upgrade Net2 to at least v6.05 SR2.
v6.7, v6.7 SR1 and v6.7 SR2. These builds do not have the temporary access feature the integration needs. Upgrade to v6.7 SR3 or later.
To find your exact Net2 version: open the Net2 software on the server and go to Help > About Net2. The Version line shows the full build number, for example 6.6.12017.4376. The service release matters, so check the full number, not just the major version.
Check 2. Your Net2 operator
An operator is any user who logs in to the Net2 software. The operator you use for the Sign In App connection must have System engineer or Supervisor rights. Any lower role, including custom roles with reduced rights, will not work.
We recommend a dedicated operator for the integration.
Check 3. The Local API and licence
The tunnel talks to Net2 through the Net2 Local API. The API has to be switched on, running and licensed. Do these steps on the Net2 server.
Check the licence file name. Your Account Manager can provide the licence file. Use it with exactly the name it had when you received it. If it was downloaded more than once, your browser may have added (1), (2) or similar to the end of the name, and Net2 will not recognise it. Remove the extra characters before you use it.
Net2 v6.7 SR3 and later
Switch on the Local API
Open the Net2 Configuration Utility. It is usually in the Start menu under Paxton.
Go to the Security tab.
Tick Enable Local API. Click Apply if it becomes available.
Click Launch Local API Config Utility.
Check the service and licence
In the Net2 Local API Configuration Utility, check that Local API Status shows Running. If it does not, click Start Service on the Service Controller tab.
Open the Licence Install tab. Activated licences should include the signinsolutions licence. If it is missing, click Browse, select the licence file, then click Import.
If you changed anything, click Apply. When Net2 asks to restart the server, click Yes.
Confirm the API is working
On the Net2 server, open a browser and go to https://localhost:8443/. You should see the Net2 Local Web API page. A "Not secure" warning in the address bar is expected and safe to ignore.
If the page does not load, check again that the Local API status is Running.
Net2 v6.05 SR2 to v6.6
These versions have no Local API Configuration Utility and nothing to switch on. You install the licence by copying the file into place and restarting the Net2 services.
Install the licence file
Open the ApiLicences folder in the Net2 install folder. By default this is
C:\Program Files (x86)\Paxton Access\Access Control\ApiLicences\. If the folder does not exist, create it.Copy the licence file into the folder.
Restart the Net2 services
Net2 only reads the licence when its services start.
Press the Windows key, type Services and open the Services app.
Find Net2 Client Service, Net2 Nginx Service and Net2 Service.
For each one in turn, right-click and choose Stop, wait for it to stop, then right-click and choose Start. Use Stop and Start, not Restart, which does not always pick up the licence.
Check that all three show Running, with startup type Automatic.
Confirm the API is working
On the Net2 server, open a browser and go to http://localhost:8080/. You should see the Net2 Local Web API page. On these versions the API uses HTTP on port 8080, not HTTPS on port 8443.
If the page does not load, check that the three Net2 services are running and that the licence file is in the ApiLicences folder.
Check 4. The tunnel service is running
On the Net2 server, open the Services app.
Find SIS Connector.
Check that the status is Running, with startup type Automatic.
If it is stopped, right-click it, choose Start, wait a few seconds, then try again in Sign In App.
If SIS Connector is not in the list, the tunnel was not installed properly. Follow Reinstall the tunnel below.
Check 5. Network access
If your Net2 server has open internet access, there is nothing to change. Move on.
If your network restricts outbound traffic, your IT team needs to allow the tunnel's connections. See Network requirements for your IT team below.
Reinstall the tunnel
If the checks above have not fixed the connection, remove the tunnel and set it up again.
1. Uninstall the tunnel
On the Net2 server, open the folder where you extracted
sis-connector.zip. It contains cloudflared, install, tunnel-token and uninstall. If you no longer have it, download the tunnel again from Sign In App and use the uninstall file from the new download.Right-click uninstall and choose Run as administrator. A window opens, removes the service, and closes on its own.
Check that it worked:
C:\Program Filesno longer contains a sis-connector folder.The Services app no longer lists SIS Connector.
If the folder or service is still there, run uninstall again using Run as administrator. If it is still there after that, restart the server and check again.
2. Remove the provider in Sign In App
The tunnel belongs to the provider, so to reinstall it you remove the provider and add it again.
Before you remove the provider: removing it also removes the credentials, access rules and connected sites you set up for it. You will need to add them again, and re-enter your Net2 operator username and password.
In Sign In App, go to Manage > On-Premise Access Control.
On the row for your Paxton provider, click Remove.
Click Remove again to confirm.
3. Set up the provider and tunnel again
Check the tunnel file name. The downloaded file must be named exactly sis-connector.zip. If it was downloaded more than once, your browser may have saved it as sis-connector (1).zip or similar, and the install will not work. Rename it back to sis-connector.zip before you extract it.
In Sign In App, go to Manage > On-Premise Access Control, click Add provider, and choose the provider that matches your Net2 version (see Check 1).
When prompted, download the tunnel (
sis-connector.zip). Copy it to the Net2 server and extract it.In the extracted folder, right-click install and choose Run as administrator.
A window opens and installs the SIS Connector service. You should see
[SC] CreateService SUCCESS, thenStarting sis-connector service.... The window closes on its own when it finishes.
Go back to Sign In App and click Next. If the tunnel is connected, Sign In App asks for your Net2 operator username and password. Enter them to finish the setup.
When the setup is complete, the provider shows as connected on the On-Premise Access Control page. You can then add your access rules and credentials again, as described in On-Premise Access Control.
If Sign In App does not move past Next, the tunnel is not reaching Sign In App. Go back to Check 4 and Check 5.
If you see an error after entering the username and password, the licence may not have been picked up. Restart the services from Check 3 again (the Local API service for v6.7 SR3 and later, or the three Net2 services for v6.05 SR2 to v6.6), then enter the username and password again.
Still not connecting?
Contact our support team and include:
your Sign In App account name
your exact Net2 version, from Help > About Net2
which checks in this article you have done, and what you saw
whether your network has open or restricted internet access
the tunnel log file.
To find the tunnel log: open C:\Program Files\sis-connector on the Net2 server and copy the cloudflared file whose type is Text Document (cloudflared.log). Do not send the cloudflared file whose type is Application. That is the tunnel program itself.
Network requirements for your IT team
The tunnel connects your Net2 server to Sign In App through a Cloudflare Tunnel. All tunnel traffic is outbound from the Net2 server. You do not need any inbound ports, port forwarding or NAT rules.
Outbound rules to allow
Allow outbound traffic from the Net2 server on port 7844, TCP and UDP, to these Cloudflare endpoints:
Hostname | IPv4 | IPv6 |
region1.v2.argotunnel.com | 198.41.192.7, 198.41.192.27, 198.41.192.37, 198.41.192.47, 198.41.192.57, 198.41.192.67, 198.41.192.77, 198.41.192.107, 198.41.192.167, 198.41.192.227 | 2606:4700:a0::1 to 2606:4700:a0::10 |
region2.v2.argotunnel.com | 198.41.200.13, 198.41.200.23, 198.41.200.33, 198.41.200.43, 198.41.200.53, 198.41.200.63, 198.41.200.73, 198.41.200.113, 198.41.200.193, 198.41.200.233 | 2606:4700:a8::1 to 2606:4700:a8::10 |
UDP carries the main connection (QUIC). TCP is the fallback (HTTP/2). Allow both.
If your firewall filters on SNI, also allow cftunnel.com, h2.cftunnel.com and quic.cftunnel.com on port 7844.
DNS
The Net2 server must be able to resolve region1.v2.argotunnel.com and region2.v2.argotunnel.com. If outbound DNS is restricted, set your firewall rules using the IP addresses above instead.
Not required
Automatic updates are switched off for the tunnel, so these Cloudflare update endpoints on port 443 can stay blocked: update.argotunnel.com, api.cloudflare.com and github.com.
Settings that stop the tunnel connecting
Setting | Effect and what to do |
TLS inspection on port 7844 | The tunnel checks Cloudflare's own certificate and rejects intercepted connections. Exclude the endpoints above from inspection. |
HTTP or SOCKS proxy | The tunnel does not connect through a proxy. It needs a direct route to the endpoints above. |
UDP blocked, TCP allowed | The tunnel still works over TCP, but takes longer to connect at first. |
Check the tunnel is connected
After the rules are in place, restart the SIS Connector service. Within a few seconds, the tunnel log at C:\Program Files\sis-connector\cloudflared.log should show four lines containing "Registered tunnel connection". That confirms the tunnel is connected.
Cloudflare publishes its current endpoints and IP ranges in Cloudflare Tunnel with firewall.
Quick reference
Item | Value |
Tunnel install folder |
|
Windows service | SIS Connector (service name |
Tunnel log |
|
Tunnel download |
|
Local API page |
|
Licence file | From your Account Manager. Shown as signinsolutions once imported. |
Tunnel outbound port | 7844, TCP and UDP |
Sign In App provider page | Manage > On-Premise Access Control |