3 - Planning and Preparation
ExpressCard 2000| Instant Issuance Card Personalization System | User Installation and Operation Manual
Page 15
2)
The physical cable path from the EC2000 to its connection destination should be appropriately
secured against unauthorized access.
3)
Firewalls should be configured to allow bidirectional communication from the EC2000 via Secure
Sockets Layer (SSL) on port 443. No other open ports are required. Standard destination servers are:
a)
https://authorization.magensa.net
b)
https://qwickcardsjs.com
for EC2000 devices to be used with QwickCards.com.
4)
If the network primarily uses static IP addresses, an appropriate IP address should be allocated and
ready for use by the EC2000.
5)
If the network provides local DNS lookups, MagTek advises creating an entry for the EC2000’s IP
address using the name
EC-serial-number
(see section
). This will
prevent users from seeing errors when using a web browser to connect to the EC2000 via https.
6)
If using a proxy server, proxy information should be available prior to setting up the EC2000.
7)
A system administrator should select and configure a secure workstation from which users can create
card processing transactions for the EC2000:
a)
If users will process cards using local card personalization software, the EC2000 and the card
personalization workstation must be on the same LAN, or must have an alternate way to connect
directly by IP address, such as a VPN. In any case, the PC and the EC2000 must be able to
communicate via port 443 SSL.
b)
If users will process cards via QwickCards.com, the workstation must be equipped with a
working web browser and an Internet connection, and be able to communicate via SSL.
8)
A system administrator should select and configure a secure workstation from which administrators
can perform updates to the EC2000. At the administrator’s discretion, it may share a workstation
with the card personalization software, with some additional requirements:
a)
The workstation must have a working web browser.
b)
The workstation must have bidirectional access to port 443 SSL.
c)
The workstation must have secure provisions for obtaining files, either via the network (such as
SFTP or e-mail with an Internet gateway) or via removable media, such as USB drives.
d)
The workstation must be within the same LAN as the EC2000, or must provide some alternate
means of connecting directly to the EC2000 directly by IP address, such as a secure VPN to the
EC2000’s LAN or an Ethernet crossover cable.
e)
For convenience, if local DNS is not available, the workstation can be set up with an entry in its
hosts
file that binds the EC2000’s IP address to a text name of the form
EC-serial_number
(see
section
). For more information on the Windows hosts file, see
the Microsoft Knowledgebase article located at
http://support.microsoft.com/kb/972034
3.3
Configuration Planning
EC2000 features can be customized based on customer application needs. Before installing the EC2000,
it is beneficial to determine how features will be configured. Configurable features include:
Card design.
There is a wide variety of techniques to optimize card designs for instant issuance.
MagTek can advise your designers on techniques that make best use of the EC2000’s capabilities.
Device passwords.
Determine which passwords will be held by which users, and what the passwords
will be. See section
6.6 About Passwords and Asterisks
, and section
Touchscreen top access door unlock.
By default, the EC2000 requires a user to open the top access
door with one of the two included keys. The device can be configured to allow users to open the top
access door using the touchscreen. See section
