How do I configure a firewall so that Digital Sentry server can connect to Sarix IP cameras?

Issue

Digital Sentry server can not connect to Sarix IP cameras when a firewall is used to separate the server’s network from the IP Cameras’ network.

Product Line

Pelco Cameras, Pelco Video Management

Environment

  • Digital Sentry Server ver. 7.2.30 and later
  • Sarix IP cameras ver. 1.7.xx
  • H.264 compression

Cause

The correct TCP and UDP ports have not been opened in the firewall for the video stream to flow from the camera to Digital Sentry server.

Resolution

There are various ways to configure Digital Sentry server to connect to Sarix IP cameras that will influence which network ports and camera functions will be utilized. The following are a few guidelines: 
  1. For best performance, it is not recommended to install the Digital Sentry server and IP cameras in separate networks using firewalls.
  2. For video stream only, the RTSP Tunneling feature may be used. This feature uses only TCP ports 80 and 554 to establish the video stream from the camera. The camera simply replies to the connection request using the same TCP source port from the server, therefore the firewall automatically allows the video stream back through to the server. This feature does not work with in-camera motion detection, in-camera analytics, or audio.
  3. To support all of Sarix features, the following ports are used:
  • Outbound from server to camera:
    • TCP ports 80 and 554
    • UDP ports 6700-6900
  • Inbound from camera for live video, motion detection, and analytics:
    • TCP 1025-65535
    • UDP 1025-65535
    • These are the ephemeral ports used by Microsoft Windows operating systems.  To further narrow down the number of ports used, please consult Microsoft’s documentation for a specific list of ephemeral ports used by the version of operating system deployed on your server.  Microsoft Windows 7 Ultimate that runs on the DS SRV uses ports 49152 through 65535.
  • Inbound from camera for audio:
    • UDP port specified in IP camera setup within DS Admin or DS Quicksetup Wizard when audio is enabled.
    • These ports work in pairs, so the port specified and that port +1 must be opened.