Soon, we will launch a new and updated customer portal, which is an important step toward providing our customers with one place to learn, interact, and get help.
Learn more.

# Installing OpticStudio with a Black USB Network Hardkey

This article is intended to help those with a black USB network licenses install the key server software, as well as configure client machines to locate and use the license.

If you have a multi-user network softkey or Red USB license (the key numbers are similar to L000001 rather than 5 digits) and need to set up the key server or configure OpticStudio to reach the server, refer to How to Install the Network License Version of OpticStudio

Single-user installation information

If you have a black USB single-user key, installation is discussed in Installing OpticStudio with a Black USB Single-User Hardkey
If you have any other single-user key type, refer to Installing OpticStudio for the First Time

CONTENTS:
Introduction

Installing Software and Configuring the Keyserver Installing or configuring OpticStudio on the Client Machine Client Troubleshooting
• You get prompted to enter a license code
• OpticStudio "Cannot Find Zemax Key" Error
Key Server Troubleshooting
Configuring OpticStudio when it is installed on the same machine as the USB network license.

Summary & Checklist

Alissa Wilczynski
09/26/2016
Installation and Troubleshooting
OpticStudio
License code
network hardkey
Zemax

## NOTE:  Before continuing this article, you should be certain that you have a black USB license.

If you are installing OpticStudio and need to connect to a server that uses a Red USB key or softkey network license instead (the key numbers are similar to L000001), refer to the following installation article: How to Install the Network License Version of OpticStudio

# Introduction

In the following pages, we describe setting up a black USB network key In order to install the network version, you must have a basic understanding of IP addresses and firewalls. Additionally and somewhat obviously, you must have a working network. Zemax LLC can not provide assistance with your network or firewalls. Before installing the software, there are a few concepts and terms to review. The network key is installed on a machine called the keyserver. This machine hosts the key and the software that makes the key visible over your local area network (LAN).

The keyserver machine provides network licensing services to all OpticStudio clients on the network. The keyserver can be any machine on the network. It does not need to run a server operating system, like Windows Server. It simply needs to run Windows 7 or Server 2008 or newer, and be visible on the network to all the machines that will want to use network licenses. Make sure that the machine is not configured to sleep automatically, so that the license key service will not be interrupted.

There is very little computational load placed on the keyserver machine by the keyserving software, but the machine should not be working at close to 100% CPU usage, otherwise it may fail to provide an adequate level of service to the clients. For this reason, if you do run OpticStudio on the keyserver machine, it should not be used for computationally intensive tasks like global optimization, physical optics propagation or non-sequential ray-tracing. See the section "Configuring OpticStudio when it is installed on the same machine as the USB network license

Client machines are the machines that will run OpticStudio and use the network license. The client machines must be able to ping the keyserver in order for network operation to work.  OpticStudio must be told where to 'look' to find the computer with the key via an XML configuration file.

### Important note: Multiple OpticStudio users are not supported on a single machine

The licensing is not designed to assign license seats to multiple users on a single machine. It assigns one license seat per machine. You may therefore run one OpticStudio user (or two instances of OpticStudio) on the server machine or any one client machine.

### Network ports and changing the port in use

The USB licenses can be seen through the network using ports 7001 and 7002 for communication by default. These port numbers were chosen because they are not normally used for any other purpose. If these ports are being used for some other purpose on your network, you can use other ports. Please see the readme as described further down this page -  Where do I find additional information about using or troubleshooting the key server?

# Installing Software and Configuring the Keyserver

Do not plug your hardware key in at this time. Also, if you have other Safenet/ Gemalto keys for any other software installed, we recommend you temporarily remove these keys during the installation. (They may be replaced once installation is complete).

​1. Be aware the install process requires administrator rights. You need to install the "Sentinel Protection Installer" on the keyserver machine. It is located in the "Resource Files" section of the OpticStudio Downloads page. To setup the Sentinel Protection Installer on your keyserver, follow the steps below.

2a. Open the Sentinel Protection Server installation file you downloaded from the "Required Software" section above. You will get this welcome screen.

2b. Click Next, and review the license agreement. Select the radio button to accept the terms, and click Next.

2c. The next screen will ask which setup type you would like to use. Usually you can simply select the "Complete" option, and click the Next button, and move to step 2d.

Fig 1 - Complete setup

If you want to install only the bare minimum to run the Zemax USB key server, select "Custom". Select only the "USB system driver" and "Sentinel Keys Server" options per Figure 2 below.

IMPORTANT: The  "Sentinel Security Runtime" is the Sentinel LDK runtime, used for Zemax Softkey licenses and other software. If you are not sure if you need this, be sure to install this component. .

Fig 2 - Custom setup.

2d. You will then see a screen that indicates the installer is ready to proceed. Click Install.

2e. If you're running a firewall, you will likely see the following message:

IMPORTANT: Be sure to select YES in order to allow the Windows Firewall to pass traffic from OpticStudio clients to the key server. If you are running any other firewall software, consult its documentation. Make ports 7001 and 7002 open to machines on your LAN.

2f. The installation will then proceed, and you'll see the following:

Which will be followed by the completion screen:

2g. Once installation is complete, plug your network key into a USB port on the keyserver machine. After a few seconds, the key should be detected, and the green LED on the key will illuminate. This is an important test: the green LED means not only that the key is getting power, but that the driver software is correctly configured and recognizes the key. If your key does not light up, see this knowledge base article for help.

## Setting a password on the key server

A password is required if you need to cancel a user's network seat that is in use, or want to keep end-users from seeing the key information on the server.

1. On the system where Sentinel Keys Server is installed, run the Password Generation utility (PwdGenUtility.exe) to generate the password. The utility is available at the following path:

• For Windows 32-bit: <OS drive>:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server
• For Windows 64-bit: <OS drive>:\Program Files(x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server.

2. Type an 8-16 character password that you can remember and click Ok. Make note of the password; it will be required when disconnecting users from the license key or viewing key information.

If you forget or otherwise need to clear the password, simply delete the sntlpass.dat file located in the same folder as PwdGenUtility.exe

3. Restart the Sentinel Keys Server to make the password change take effect. To do so, open Control Panel, then Administrative Tools, then Services. Right-click Sentinel Keys Server, and select "Restart".

## Viewing Key and User Information On The Server

1. Open Internet Explorer. Note you cannot use Microsoft Edge, Google Chrome, or Firefox (version 52 and later) as these browsers no longer support the Java Runtime required to use the key server.

2. Type the following into the addressbar:

http://127.0.0.1:7002

The address 127.0.0.1 is the "loopback" address, and means "use this machine". This address will therefore only work when run from the keyserver. You should see a screen like this:

3. You can click the "Keys Information" link on the right-hand side of the screen to see more about the key or keys.

If the "Keys Information" screen is blank or you get a Java error message, again be sure you are using Internet Explorer, or Firefox version lower than 52. If you still need help, go to the following section of this article: Sentinel Keys License Monitor "Keys Information" page is blank for information on configuring Java.

When you see the above screen you know that the keyserver is working correctly. The number under "Hard Limit" should correspond to the number of network licenses you have purchased. Licenses-In-Use is the current number of licenses being used, and is zero when the server software is first installed.

4. Click on the key number (normally number 1) to see more detailed information about who is using which keys.You must have full administrative privileges on the local machine in order to see this level of detail.

If you have not set a password on the key server, you will get the following page:

## Disconnecting users from the license

If you have set a password on the server, you will see the following page, which allows you to disconnect (cancel) a user from the license.

You can manually cancel access to the network seat from the server. To cancel a license in use, select the check box(es) for the license seats to be canceled. You can cancel up to 10 licenses at a time. Click "Cancel License Session". A dialog box will appear prompting you to provide the password you set on the server.

TIP: If you are not seeing all the users you expect, visit the "Key Server Troubleshooting" section below.

## How to I monitor or save a log of users accessing the license?

If you want to log information about key usage to a file, see the article Monitor and Log Usage of the Black USB Network License

## Where do I find additional information about using or troubleshooting the key server?

More information on features, advanced settings and troubleshooting, is provided in the README.PDF file located in the following folder on the server: C:\Program Files (x86)\SafeNet Sentinel\Sentinel Protection Installer\7.6.8\English\.

Important Note: Zemax uses a "Sentinel Hardware Key" not a Superpro or UltraPro key. Therefore, be sure to follow the documentaion in the PDF related to the "Sentinel Keys License Monitor" NOT the "Sentinel License Monitor"

# Installing or configuring OpticStudio on the Client Machine

## Verifying the client can reach the server

Before proceeding with the OpticStudio installation, it's a good idea to make sure the client machine can see the network key server. There are a few easy ways to test this. The easiest,way is to open a web browser and type the IP address or network name of the keyserver machine, followed by the port address.

TIP: If you do not know the key server's IP address, check with the person or group that manages the Zemax key server in your organization. Zemax does not know this information, as we do not host your license key.

In this test case, our keyserver is at 10.0.1.91 so we type:
http://10.0.1.91:7002

You should see the following page

If the web page loads successfully, congratulations! The client can reach the keyserver. Proceed to the next section of this article.

If you cannot load this web page at all (page not found or similar error), then the keyserver cannot be seen over the network by the client. Stop and resolve this problem before continuing.Typically, there are firewall settings preventing you from accessing the key server machine or the ports used. Consult the documentation for your firewall software to see how to manually open ports 7001 and 7002.  Also, if you are trying to use OpticStudio over a VPN. there may be VPN software or server settings to open the ports. You may need to talk to your IT or network department about this issue, as Zemax is not able to assist in troubleshooting your network.

Tip: If you want to see more specific license information, click the "Keys Information" link. If the "Keys Information" screen is blank or you get a Java error message, this is covered below in the  "Sentinel Keys License Monitor "Keys Information" page is blank.

## Installing the OpticStudio Application

If you already have OpticStudio or Zemax installed on your client machine, proceed to the next section "Configuring OpticStudio to find the key server". If not, download OpticStudio from our downloads page and install it. Detailed instructions are given in the Installing OpticStudio for the First Time article. Note that all versions of OpticStudio as well as legacy Zemax releases as old as version 11 can use a Black USB network license!

## Configuring OpticStudio to find the key server

You must tell OpticStudio where to find the keyserver machine, by editing a configuration file that ships with OpticStudio called SNTLCONFIG.XML.BAK.

TIP: If you do not know the key server's IP address, check with the person or group that manages the Zemax key server in your organization. Zemax does not know this information, as we do not host your license key.

1. Locate the SNTLCONFIG.XML.BAK file.

• If you have installed OpticStudio 15 and later, it is located in the Documents\Zemax\Configs folder.
• If you have installed OpticStudio 14, or Zemax 13 or earlier, the file is located in the Zemax / OpticStudio installation location, typically C:\Program Files\Zemax OpticStudio.

2. Make a copy of the sntlconfig.xml.bak file. Then rename the file to sntlconfig.xml. If you cannot see .BAK to rename it, then you likely need to configure Windows to display file extensions
3. Open sntlconfig.xml in a text editor.such as Windows Notepad. I usually open Notepad first from the Windows Start menu, then drag the sntlconfig.xml into the open Notepad window.

The file should look like the following example:

4. The "ContactServer" address should be replaced with the IP address of the keyserver machine. In the example, it is 10.0.0.1, but you will use the IP address or computer name of your keyserver machine. If you have multiple keyserver machines, you can specify the order in which to access them by ordering the IP addresses. The top address is first.

5. Try launching OpticStudio. If it locates the license server you specified in the above file, it should launch successfully, and you are done! If not, check the Client Troubleshooting section below.

# Client Troubleshooting:

## You get prompted to enter a license code

The first time you run OpticStudio, you may be prompted for a license code, like so:

If you see this dialog box, your copy of OpticStudio is correctly installed, and the network USB key has been found. You just need a license code to allow OPticStudio to run with your key.  To get a license code, take a screenshot of this dialog box (e.g. using Alt-Print_Screen or the Windows Snipping Tool). Paste it into an email to support@zemax.com. One of our global tech support staff will send a license code right away. Please do not call tech support for a license code. License codes are complex multi-character strings and cannot be reliably given over the phone. Emailing the screenshot of the dialog box to us is the quickest, most error-free way of getting your license code.

## "Cannot Find Zemax Key" Error

If you are able to access the Sentinel Key page through your browser, but when opening OpticStudio, you get a splash screen that does not go away or receive a "Cannot Find Key" error, re-check the SNTLCONFIG.XML file to be sure it has the correct server IP address and port in the "Configuring OpticStudio to find the key server" section.

We have also seen problems when a customer has multiple SNTLCONFIG.XML files.

OpticStudio Version 15 and newer: Make sure there is a SNTLCONFIG.XML file ONLY in \Documents\zemax\config, and none in C:\program files\zemax opticstudio.
OpticStudio Version 14 and earlier: Make sure there is a SNTLCONFIG.XML file ONLY in c:\program files\zemax opticstudio.

# Key server troubleshooting:

## Cannot reach the Sentinel Keys License Monitor page on the keyserver

Reinstall the Sentinel Protection Server and follow the above instructions carefully. Be sure to use the "Complete" rather than "Custom" option when installing. Watch for any error messages. If you are still unable to make it work, contact Zemax Support. Once it is done, verify the "Sentinel Keys Server" is listed in Windows Services.

## Fewer license seats are available than expected, or users who no longer have OpticStudio open are listed on the Keys Information page.

Normally this means the Sentinel Keys service is malfunctioning, and needs to be refreshed.

1. Unplug the Zemax USB key,
2. Restart the Sentinel Key Server process. To do so, open Control Panel, then Administrative Tools, then Services. Right-click Sentinel Keys Server, and select "Restart".

## Sentinel Keys License Monitor "Keys Information" page is blank

If you get a blank page (with no other warning message first) like the below example:

1 - Check the version of the Sentinel Keys License Monitor by opening the admin page at http://localhost:7002.

If it is 1.3.6:

Make sure "Javascript"  is enabled in the browser's security settings. We recommend Chrome, Internet Explorer, or Edge to view the admin page for this version. If you still cannot get the page to work, contact the Zemax Support team.

If it is 1.3.5 or lower, this is normally because it either requires the Java Runtime to be installed, Java is disabled, or you are using an incompatible browser. The easiest way to fix this is to upgrade to the latest Sentinel Protection Server software linked at the beginning of this article, which uses javascript instead. Otherwise:

• Ensure that your browser supports Java. Internet Explorer is recommended as it is available on All Windows versions. Microsoft Edge, Google Chrome and Firefox (52 and later) no longer support Java. Switch to a supported web browser and try loading the key info page again.
• If you have already installed Java, make sure it is Java 7 update 45 or newer. Java 8 has also been verified to work. If you do not have Java Runtime installed, you can get the latest version of Java from the Oracle download page
If all of the above fail to make the keys info page work, Move to the next section to configure Java's settings

## Sentinel Keys License Monitor "Keys Information" page gives an error message

If you get an error on the page, or a warning message like below:

First, open the "Java" icon in your Windows Control Panel. On the General page click "About" to see the Java version that is installed.

Once you have the version, you can modify the security settings.  If you are running something older than Java 7 update 45, install the latest version of Java from the Oracle download page

Be sure to perform all 4 of the below steps.
1. Click on the Security tab and reduce the security level to medium (Java 7) or High (Java 8).
2. Ensure "Enable Java Content in the browser" is checked (only an option in Java 8).
3. Add the keyserver to the "Exception Site List". In the Java Control Panel, Click "Edit Site List", click "Add".

If you are currently on the keyserver computer, type http://localhost:7002 into the Location field.
If you are currently on a client computer, substitude the server IP address for Localhost. Using our example server from the beginning of this article, type http://10.0.1.91:7002 into the Location field.

4. Click Ok, and "Continue" on the security warning. See the procedure below (From Java 8, very similar to Java 7)

Java 7 setting
If you have Java 7 rather than 8 , you should also change one other setting. Go to the Windows Control Panel and double-click on the Java icon. Select the "Advanced" tab, and expand the "Java Plug-in" section. Uncheck the "Enable the next-generation Java Plug-in" option.  Click OK, then close and reopen your web browser. You should now be able to see the Sentinel License Monitor information.

## Retesting the Sentinel License Key Monitor

After changing all the above settings, close your web browser. Open it and go to the keyserver address again. You may be prompted with a security warning asking if you want to run the application.
Click "I accept" radio box, then Run, and you should be able to view the SKLM.

If you are still unable to load the Sentinel Key Monitor, contact Zemax support for further help.

## Configuring OpticStudio when it is installed on the same machine as the USB network license.

The process is the same as configuring a client machine, except you have to use either localhost or 127.0.0.1 for the contact server address.

1. Locate the SNTLCONFIG.XML.BAK file.

• If you have installed OpticStudio 15 and later, it is located in the Documents\Zemax\Configs folder.
• If you have installed OpticStudio 14, or Zemax 13 or earlier, the file is located in the Zemax / OpticStudio installation location, typically C:\Program Files\Zemax OpticStudio.

2. Make a backup copy of the sntlconfig.xml.bak file. Then rename the file to sntlconfig.xml.
TIP: If you cannot see the .BAK extension to rename it, then you likely need to configure Windows to display file extensions

3. Open sntlconfig.xml in a text editor such as Windows Notepad. I usually open Notepad first from the Windows Start menu, then drag the sntlconfig.xml into the open Notepad window.

4. Under the <ContactServer> section, add localhost and /or  127.0.0.1 to the list. The file should look similar to the following example:

That is it! Verify OpticStudio launches.

# Summary and Checklist

Installing the network version is farily simple, despite the length of the instructions! Here is a summary of the steps to take.
1. Write down the IP address of the machine that will act as the keyserver.
2. On the keyserver machine, install the Sentinel Protection Installer. Then plug the network key into a spare USB port. After a few seconds Windows will recognize the key, and its green LED will illuminate.
3. Point a web browser to http://127.0.0.1:7002 and open "keys information" to check that the correct number of network licenses are shown.
4. Move to a client machine, and point a web browser to http://{IP address of keyserver}:7002 and check that the key can be seen from the client machine. Install OpticStudio. Edit the sntlconfig.xml file to point to the IP address of the keyserver. Save the file in the Documents\Zemax\Configs for OpticStudio 15 or higher, OR in the same folder as the OpticStudio.exe file in older releases. OpticStudio should now launch normally.
5. If Zemax OpticStudio does not see the key, configure any firewall software on the client machine to allow OpticStudio.exe to access the network and run through the troubleshooting steps above.
6. If you cannot view the Sentinel Keys license monitor, follow the steps to add a security exception for the Java runtime