Network Setup Troubleshooting Guide

Network Setup Troubleshooting
Step	Problem	Troubleshooting Steps
	Download of client profile fails	Check the CIDR IP range you entered was correct. Check with your network admin if required. Range will usually end in a 0, such as 10.0.0.0/24. Ensure you haven’t used the default setting 192.168.1.0/24 if it is not appropriate for your network. Ensure you haven’t used a specific single IP, for example the IP of your gateway or camera. Limit the range to /24 or less. Check your internet connection. Downloading the profile to a different device to eliminate local device settings or restrictions. Try repeating the setup. Select ‘Delete Network’ at the bottom left of the setup page and confirm by selecting ‘Destroy’ at the popup. Wait for the process to complete, then fill in the IP range again and select ‘Start another setup’. If this is a new project, try deleting the whole project and creating a new one, then start the Network setup on that. Contact DCM support
	Router or device to be used as client end does not support OpenVPN	The default VPN standard for DCM is OpenVPN, and the config file generated by the Network setup page is for that standard. Potentially a laptop or other MS windows machine can be set up to act as the OpenVPN client if it has access to the camera subnet. If no device is available that can support OpenVPN, it is possible to set up a VPN link using IPsec. This will require more information about the local network config and more time. Contact DCM support to set up an IPsec based connection.
	Cannot load client profile	DCM needs a device to act as a gateway for the secure VPN tunnel, usually a router that supports the OpenVPN standard. This step requires access to the gateway router as an admin. See the appendix for advanced troubleshooting tips for users with network admin rights and ability to change router settings.
	Cannot ping DCM systems from the local network	Check the CIDR IP range you entered was correct as above. An incorrect range will result in a bad configuration file. Copy the Source host name from the setup page (xxx-xxx-xxx-xxxx.vpn.crowdeagle.com.au Start a command prompt on a computer connected to the same network as the camera if possible, Run nslookup <hostname>. Ensure IP Address of the source host matches the IP address of the VPN server in the user interface. Ensure the server providing the result matches the expected gateway. Get your Network admin to check the Router configuration and OpenVPN status. See the appendix for advanced troubleshooting tips for users with network admin rights and ability to change router settings. Contact DCM support.
	Ping test to cameras known to be online fails with a “CS408” error popup. (Also visible using the browser console via F12)	Port 80 may not be open. Particularly likely on public or high security cameras that have custom config. Try changing the Host port in the deployment panel from 80 to the cameras RTSP port number – often 554. If this allows you to get an image, it should solve the issue if the camera is fixed. If the camera is a PTZ, note that DCM will likely not be able to control the camera movement if port 80 is closed. Set the device type in the deployment panel to “IP only” and use the camera as if fixed. Setting a home position using the native camera controls should assist.
	Can only ping DCM server intermittently or have packet loss reported.	Try pinging other external IPs. Check your network if results are also intermittent. DCM systems are primarily housed in Paris, Sydney and Oregon. Since only intermittent video samples are taken, some latency can be tolerated. Proceed with setup and Contact DCM support if you cannot complete it.
	Cannot ping local router/gateway from DCM VPN server	Check the gateway IP, ensure you can ping the gateway locally using a command prompt. Get your Network admin to check the Router configuration and OpenVPN status. See the appendix for advanced troubleshooting tips for users with network admin rights and ability to change router settings. Try pinging the camera /device beyond the gateway. If this succeeds, you may be able to proceed even if gateway ping fails.

Ping fails to the camera itself

If using an analogue camera, it must save its feed to an IP accessible location. Check you can ping this location.
Ensure you can ping the camera from your device on a command prompt. If not check your local LAN can access the cameras subnet.
Check that ping is not deliberately blocked on the camera or host network for security reasons. Cameras can work with DCM in this situation even though the test will not. If you believe this is the situation, proceed to the calibration page. If you can retrieve a camera image from the RTSP connection, the camera will work.
Ensure the camera can be accessed using its native software at the same IP you are verifying. Most IP cameras have a native User interface that will show a live view.
Using the Camera management system check there are no restrictions to access. Ports 80 and 443 should be set to allow access.
Use VLC player to connect to the same RTSP stream. From the menu use “Media > Open Network Stream”. At the prompt, input the same credentials used in DCM. If your internal systems can see the stream but VLC player cannot, external connections are likely blocked. Recheck credentials and firewall rules.
If VLC or other tools can connect to the camera but DCM cannot – check the camera password for reserved characters. Camera user passwords cannot contain the reserved characters ‘:’ or ‘@’ as they are used as delimiters. In general it is also advisable to avoid using #/\ or ? in usernames or passwords as some systems can also reserve these.
If all above are ok, but you still cant connecting to or retrieve an image from your cameras, and are connecting direct to a VMS system (as opposed to each camera directly), see item below.

Connecting to a VMS server to get camera feeds, (as opposed to each camera directly)

and can ping server, but cannot get a ping or image from any cameras.

If using the Milestone VMS system.

DCM uses ffmpeg to sample the video stream.
Milestone have actually logged the issue themselves and propose a fix that involves updating a registry key until they update it.

Specifically - disable the registry key as below. If this key is missing, add it with the value of 0 as below.

Path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Milestone\Milestone Open Network Bridge\
DWORD value: SHA256Auth
Value to disable SHA256: 0

If the registry DWORD key is missing, SHA256 will be enabled.

Important! Once you modify Windows Registry, restart ONB services through the ONB Tray Manager.

See the official bug report from Milestone.

Note that even though this issue is reported in 2021 and notes an imminent fix, it has still been observer as present in the latest version as of June 2023.
https://developer.milestonesys.com/s/article/changes-digest-authentication-RTSP-service-in-2021-R1-troubleshooting

If using a different VMS system, check that a similar issue with ffmpeg connections does not exist. DCM support can assist by providing connection logs. If the logs find the stream URL, but fail to connect to it with a “401 authorisation failure” or similar, the issue is likely to be double connection header related. Try temporarily disabling any SHA256 encryption, or swap to a different encryption method in the system settings, then reboot.