Manage

Security and Compliance

Edited

Pleneo IT deployment and security guide

Network requirements, ports, and security model for deploying Pleneo in an enterprise environment.


Network architecture

RoomHub has two independent, isolated Ethernet interfaces (no bridging between them):

  • LAN 1 (control network): management, configuration, and integration. Can also carry device communication

  • LAN 2 (audio and video network): real-time media and communication with audio and video devices in segmented networks

Device control can run on LAN 1 or LAN 2, depending on how devices are connected. Multicast is required on the audio and video network for real-time audio.

Management access (LAN 1)

Service

Protocol

Port

Direction

Encryption

Web interface

TCP

443

Inbound

TLS 1.2+

RoomHub uses a self-signed certificate by default; browsers show a warning on first access. Validate and accept it during setup.

Device communication

Purpose

Protocol

Port(s)

Direction

Encryption

Device control and monitoring

TCP

19150–19152

Outbound

None (local network)

Device heartbeat / discovery

UDP

19153

Inbound

None

Secure device control

TCP

443

Outbound

TLS 1.2+

Legacy device control

TCP

45

Outbound

None

Vendor-specific control

TCP

2202

Outbound

None

Camera control (VISCA over IP)

UDP

52381

Outbound

None

Camera discovery / session init

UDP

45

Inbound

None

Real-time audio (multicast)

UDP

Dynamic

Bidirectional

None

Unencrypted control traffic runs on the local network only.

Firewall configuration

Source

Destination

Port(s)

Protocol

Direction

Purpose

Admin workstation

RoomHub (LAN 1)

443

TCP

Inbound

Secure management access

Devices

RoomHub

19153

UDP

Inbound

Device heartbeat/discovery

PTZ cameras

RoomHub

45

UDP

Inbound

Camera session initiation

RoomHub

Devices

See device communication

TCP/UDP

Outbound

Device communication

Network requirements

Category

Requirement

Management access

HTTPS (TCP 443)

Device communication

LAN 1 and/or LAN 2

Multicast

Required for real-time audio

VLANs

Strongly recommended

LAN 2 is required when using a segmented media network or a dedicated audio and video VLAN.

Security

  • Authentication: single local admin account. Set the password directly on first-time setup; no default or shared password. Enforced policy: 12+ characters with upper, lower, numeric, and special characters

  • Network access control: IEEE 802.1X on LAN 1 (EAP-TLS certificate-based authentication)

  • Encryption: all management interfaces require HTTPS (TLS 1.2+); no plaintext management interfaces

  • Segmentation: LAN 1 for control, LAN 2 for media; separate VLANs recommended

  • Communication model: RoomHub initiates communication outbound; inbound is limited to the UDP discovery ports above (19153, 45). No general-purpose inbound control interfaces

Deployment checklist

  • Restrict LAN 1 management access to authorised subnets

  • Separate control and media networks using VLANs

  • Allow only the required ports between segments

  • Limit inbound UDP to ports 19153 and 45

  • Monitor with your standard IT security tools

Compliance

Pleneo's security and compliance program aligns with recognised international standards, including SOC 2 Type 2, ISO/IEC 27001 for information security, and ISO/IEC 42001 for AI management.

On this page

Reference logos reflect clients of the Pleneo Group, including those served by Pleneo, Xilica or other group brands.

© 2026 Pleneo Holdings Pte Ltd