Skip to main content

Set up the Paxton Net2 door access integration

Connect your on-premises server to Flex so memberships, bookings, and day passes automatically grant and remove entry.

Written by Yasen Marinov

➤ Product: OfficeRnD Flex

➤ Who: Admins with access to Integration Hub

➤ Where: On the Admin Portal, under Integration Hub. Also on your Net2 server and on a Windows PC on your network

➤ Availability: Included on the Start, Grow, and Scale plans. The Essentials plan does not include door access integrations.

Without an integration, you add and remove each member in Paxton Net2 by hand. The Paxton Net2 integration connects Flex to your Net2 server. Flex then grants and removes Net2 access when memberships, bookings, and day passes start and end.

Your Net2 server runs inside your own network. Flex reaches the Net2 server through a tunnel: a secure connection to a connector program on a Windows PC in your network.

In this article:

  • Connect a Net2 server that runs only inside your own network

  • What to fix in Net2 before the first sync changes your users

  • Give access by billing plan, location, floor, room, or day pass

  • Not covered here: how Flex changes Net2 users after setup. How the Paxton Net2 integration manages door access →

Prerequisites

The Paxton Net2 integration needs work on 3 systems: Flex, the Net2 server, and a Windows PC. Before you start, ensure that you have the following items:

  • An admin role with access to Integration Hub.

  • A Paxton Net2 server on your network, with the Net2 services started.

  • Administrator access to the Net2 server. You change the Net2 configuration and add a license file on this server.

  • A Paxton API license file. Get the license file from Paxton or from your Paxton partner.

  • A Windows PC with a 64-bit (x64) version of Windows. The tunnel connector installs only on Windows x64.

  • Administrator rights on the Windows PC. The tunnel connector installs as a Windows service, and a Windows service needs administrator rights.

  • A network path from the Windows PC to the Net2 server. The Windows PC can be the Net2 server itself.

  • A door access model for your space. Define, prepare, and configure a door access model →

The Windows PC must stay on and connected to your network. Flex reaches Net2 only through the tunnel connector on this PC. When the PC is off, Flex cannot sync access changes to Net2.

Your Net2 edition changes what Flex can give each member. Net2 Lite keeps 1 access level or 1 set of doors for each Net2 user. Net2 Pro with advanced permissions turned off works the same way. To give 1 member several access levels, use Net2 Pro with advanced permissions turned on.

Prepare the Net2 server

Flex cannot connect until Net2 accepts requests from Flex. Do the work in this section on the Net2 server before you open Flex.

Turn on the Net2 Local API

Flex sends every request to the Net2 Local API. To turn on the Local API, do these steps:

  1. On the Net2 server, open the Net2 Server Configuration Utility.

  2. Open the Security tab.

  3. Select the LocalAPI checkbox.

  4. When Net2 asks to restart the Net2 services, confirm the restart. The Local API starts after the restart.

The Local API uses port 8443 by default. If your Net2 server uses a different port, write down the port number. You enter the port number when you create the tunnel.

Install the API license file

Net2 accepts requests from Flex only with a valid API license file. The license file name is also the Client ID you enter in Flex.

  1. Copy the license file to this folder on the Net2 server: C:\Program Files (x86)\Paxton Access\Access Control\ApiLicences

  2. Keep the original file name. Flex uses the file name as the Client ID. Net2 does not accept a Client ID from a renamed file.

  3. Restart the Net2 services. Net2 reads the license file when the Net2 services start.

  4. Write down the file name without the .lic extension. For example, if the file name is ABC123.lic, the Client ID is ABC123.

Create a Net2 account for Flex

Flex signs in to Net2 as a Net2 account. Create a separate account for Flex only. The account must meet these requirements:

  • The account name has the format FIRST_NAME LAST_NAME, for example OfficeRnD Sync. The account name must be unique in Net2.

  • The account must have the privileges for each change Flex makes. Flex finds, creates, and changes Net2 users. Flex also changes the door permissions of Net2 users.

  • The account can manage time zones. Flex must create the OfficeRnD 24/7 time zone. If the account cannot manage time zones, Flex gives no door permissions.

  • The account's Net2 user has access to every door, for example, through the All hours, all doors access level. Net2 shows Flex only the doors the account's Net2 user can open. Without access to every door, door group mappings give no doors.

  • The account's email address does not match an OfficeRnD member's email address. If the 2 email addresses match, Flex links that member to the operator's Net2 user. Flex then gives and removes the operator's door access.

Write down the account's username and password. Enter the username and password in Flex.

Net2 can ask the account for a multi-factor authentication code. If the account uses multi-factor authentication, keep access to the email inbox or the operator's authenticator app. Flex asks for the code when you connect the integration.

Prepare current Net2 users before the first sync

The Net2 server is ready, but the Net2 users that you added before the integration need work too. The first sync changes every Net2 user that Flex links to a member. If your Net2 server has no users yet, go to the next section.

Do these steps in Net2 before you sync:

  1. Enter each member's OfficeRnD email address in the Email field of the member's Net2 user. If the Email field is empty or different, Flex cannot find the Net2 user. Flex then creates a second Net2 user without a card. Flex does not grant the first Net2 user, with the card, access.

  2. Remove duplicate email addresses. If 2 Net2 users have the same email address, Flex skips the member.

  3. Give each member who also needs permanent access a second Net2 user, for example, staff or security. Use a different email address for the second Net2 user. When the membership ends, Flex removes the mapped access. Flex also expires the first Net2 user when the member has no access left. The second Net2 user keeps the permanent access.

  4. Review the access levels you assigned manually. On Net2 Lite, a member who has an access level gets no doors from Flex. Flex also treats a manual access level that matches a mapped access level as a Flex access level. Flex removes that access level when the member's access ends.

The first sync treats the permissions that you gave by hand in these ways:

  • If a member already has a mapped door, Flex takes over that door permission. The door keeps its current Net2 timezone while the member has access, for example, working hours. Flex removes the door permission when the member's access ends.

  • If a door permission is set to At no time, Flex does not change the door permission. Net2 uses At no time to block a door for a user.

  • Doors and access levels outside the member's mappings stay unchanged while the member has access from Flex.

  • Flex sets the expiry date of each linked Net2 user to about 10 years in the future.

Create and install the tunnel

Net2 now accepts requests, but Flex cannot reach your network yet. You create the tunnel in Flex first. Then you install the tunnel connector on the Windows PC.

Create the tunnel in Flex

The tunnel in Flex tells the tunnel connector where to find the Net2 Local API. To create the tunnel, do these steps:

  1. Go to Integration Hub > Tunnels.

  2. Click Create Tunnel and select Paxton.

  3. In Name, type a name for the tunnel, for example London Net2 server. You select the tunnel by this name when you connect the integration.

  4. In Host, keep localhost if the tunnel connector runs on the Net2 server. If the tunnel connector runs on a different PC, enter the hostname or the IP address of the Net2 server.

  5. In Port, keep 8443. Change the port only if the Net2 Local API uses a different port.

  6. Click Create.

Install the tunnel connector on the Windows PC

The tunnel exists in Flex, but nothing runs at your site yet. The install script installs the tunnel connector as a Windows service. The script also connects the service to this tunnel.

Important: The install script replaces a tunnel connector service that already runs on the Windows PC. If other software on the PC uses its own tunnel connector, install the Flex tunnel connector on a different PC. Otherwise, the other software loses its connection.

To install the tunnel connector, do these steps:

  1. Go to Integration Hub > Tunnels.

  2. Next to the tunnel, click Configure.

  3. Click Download Script. Flex downloads a PowerShell script file (.ps1).

  4. Copy the script file to the Windows PC.

  5. On the Windows PC, open Windows PowerShell with Run as administrator. The script needs administrator rights to install a Windows service.

  6. Run the script file in the PowerShell window.

  7. In Flex, go to Integration Hub > Tunnels.

  8. Ensure that the tunnel status is Connected. You cannot connect the integration to a tunnel without a running tunnel connector.

If the tunnel status is not Connected, ensure that the tunnel connector service runs in Windows Services. Also ensure that the Windows PC has an internet connection. The Connected status does not test the Net2 server. Flex tests the Net2 server when you connect the integration.

The script does these steps on the Windows PC:

  • Stops and removes the old tunnel connector service, if one exists.

  • Downloads and installs the latest tunnel connector.

  • Connects the tunnel connector service to this tunnel.

  • Starts the tunnel connector service.

You can run the same script again at any time. Run the script again to update or to repair the tunnel connector.

Connect Paxton Net2 to Flex

The tunnel is connected, but no integration uses the tunnel yet. Enter the Net2 sign-in details and select the tunnel in 1 dialog:

  1. Go to Integration Hub > All Integrations.

  2. Open the Access Control tab.

  3. Find Paxton Net2 and click Activate.

  4. In Client ID, enter the license file name without the .lic extension.

  5. In Username and Password, enter the sign-in details of the Net2 account for Flex.

  6. In Locations, select the locations that the integration applies to. Flex gives Net2 access only for these locations.

  7. In Tunnel, select your tunnel. The list shows only the tunnels that no other integration uses.

  8. Click Add.

If the Net2 account for Flex uses multi-factor authentication, Flex asks for a code before it saves the connection. If Net2 sends the code by email, select Email. If the account uses an authenticator app, select App. Enter the code to finish the connection.

Flex tests the connection through the tunnel before Flex saves the integration. If the test fails, Flex shows an error. Flex does not save a failed integration. After the test passes, Paxton Net2 is displayed under Integration Hub > Active Integrations.

Choose which members Flex syncs

The integration is connected, but Flex doesn't yet know which members to sync to Net2. You choose the members in the integration's configuration dialog.

  1. Go to Integration Hub > Active Integrations > Paxton Net2.

  2. Next to the account, click Configure.

  3. Under User Credential Provisioning, turn on sync for Active Member. Flex then syncs members with an active membership.

  4. To give Net2 access to drop-in members, turn on sync for Drop-in.

  5. Click Apply to save the configuration.

Flex does not issue PINs or other credentials through Net2. Give each member a card or fob in Net2.

Map Flex entities to Net2 access

Flex now syncs members, but members get no access yet. A member gets access only when a Flex entity points to a Net2 access level, door, or door group.

Each mapping type gives access for a different reason. The following table shows when each mapping type gives a member access.

Mapping type

The member gets access when

For example

Locations

The member has a membership for a desk in the location, or a booking in the location

The London location gives access to the building entrance

Floors

The member has a membership for a desk on the floor

Floor 2 gives access to the Floor 2 doors

Plans

The member has an active membership with the mapped billing plan

A hot desk plan gives access to the main entrance

Bookable Resources

The member has a booking for the mapped meeting room

The Elephant meeting room gives access to its door during the booking

Assignable Resources

The member has a membership for the mapped private office or dedicated desk

Office 204 gives access to the Office 204 door

Day Passes

The member has a valid day pass. Access ends when the member has no valid day passes left.

A day pass gives access to the coworking floor entrance

If no member is assigned to a membership, Flex gives access to all company members.

Important: On Net2 Lite, map each member to 1 access level only, or to doors and door groups only. Net2 Lite keeps 1 access level or 1 set of doors for each Net2 user. A member with more mappings gets only 1 access level or 1 set of doors. Net2 Pro with advanced permissions turned off works the same way.

To map a Flex entity to Net2 access, do these steps:

  1. Go to Integration Hub > Active Integrations > Paxton Net2.

  2. Click the account to open its mappings.

  3. Open the tab for the mapping type. For example, open the Plans tab.

  4. Click Assign Access Group. The Assign Access Group dialog opens.

  5. In OfficeRnD, select the Flex entity.

  6. In Paxton Net2, select 1 or more Net2 items. The list shows the Net2 items under Access levels, Doors, and Door groups.

  7. Click Map to save the mapping. Flex applies the mapping at the next sync.

To change a mapping, click the edit icon on its row. To remove a mapping, click the delete icon on its row.

If you change the doors in a Net2 door group, members who already have the door group do not get the change. Flex reads the doors in a door group only when it assigns the door group to a member.

Sync and check member access

Your mappings are saved, but members who already have memberships and bookings do not have access yet. A sync applies the mappings to these members.

  1. Go to Integration Hub > Active Integrations > Paxton Net2.

  2. Click Sync.

  3. Wait for the sync to finish. Flex shows the sync result on the Paxton Net2 page.

After the first sync, Flex also syncs automatically. To confirm that the sync worked, examine 1 member in Flex and in Net2:

  1. In Flex, go to Operations > Members and open the member's profile.

  2. Next to Door Access, click Show Details. Flex shows the member's Net2 items.

  3. In Net2, find the Net2 user with the same email address.

  4. Ensure that the Net2 user has the same access levels and doors.

If the access levels and doors do not match, run the sync again. Then examine the sync result on the Paxton Net2 page.

Give new Net2 users a card or fob

The sync gives members access, but a Net2 user that Flex creates has no card or fob. A member cannot open a door until the member's Net2 user has a card or fob. In Net2, assign a card or fob to each new Net2 user.

Best practices

These practices reduce the number of Net2 users that a setup error can affect:

  • If you go live for the first time, map 1 test plan and sync 1 test member first. Examine the result in Net2 before you map the rest. A mapping error then affects only 1 test member.

  • If you give access to cleaners, contractors, or other non-members, give them Net2 users with email addresses that no member uses. Flex changes only the Net2 users that Flex links to members.

  • If you run more than 1 Net2 server, create a separate tunnel and a separate integration for each Net2 server. Each tunnel serves 1 integration.

Related articles

The following articles explain the door access concepts that the Paxton Net2 integration uses:

Did this answer your question?

Related Articles