This article explains how to configure a keyserver and client machine for use with an OpticsViewer network license. Also included is a FAQ and some troubleshooting tips.
Authored By Matthew Sutton
This article explains how to configure a keyserver and OpticsViewer client machine for use with a network license. If you are going to configure an Opticstudio or Lensmechanix license server, see this article instead.
If your network license is already installed on your server, and you need information on configuring server settings, see the article "How do I monitor and control usage of the OpticsViewer network license?"
Zemax network licenses make it easy to receive support renewal updates as they only have to be applied on the server machine. With network licenses, seats can be shared among a team without using transfer codes or trying to keep track of physical USB dongles for each user. The softkey has no physical unit -- the license itself is attached to the keyserver computer through software.
Before installing the software, there are some simple concepts you must understand. The network key is installed on a machine called the keyserver. This machine hosts the license key and the software that makes the license available over your local area network (LAN). The keyserver can be any Windows machine on the network. It can be installed on Windows 7 Service Pack 1, 8.1, or 10 or any Windows Server 2008 R2 SP1 or newer Server operating system up to 2019. Note that "Core" versions of Windows Server are not supported. There is also no native Linux support for the license software. The server requires 300MB drive space free for the software and only requires the same minimum RAM the OS requires to install. The keyserver needs to be visible on the network to all the machines that will want to use network licenses via "ping".
We recommend the keyserver machine be kept in a secure room and backed up regularly. See the Zemax Licensing Policies for details on safeguarding the license from loss and the license replacement policy. Note that OpticsViewer licenses are a Subscription product.
Client machines are the machines that will run OpticsViewer and use the network license. The client machines must be able to ping the keyserver in order for the license on the server to be seen.
For softkeys, Zemax uses the Gemalto (formerly Safenet) Sentinel LDK license technology and communicates on port 1947 on your network. .
Note that you cannot run multiple users of OpticsViewer on any single machine or multiple users accessing OpticsViewer on the license server via Citrix / Windows Terminal Services . It's designed as a client-server setup with one user per client machine as pictured below. You can run one user of OpticsViewer on the server if you wish.
The first step to configuring your network license is to properly configure the keyserver machine that will host the license. Doing this requires three steps: installing software and activating the license, checking the Windows firewall, and configuring the keyserver settings. The following sections describe these steps in detail. Note that in order to properly configure the keyserver, you must be logged in as an administrator on the key server machine.
You will need internet access for installation and activation. To install and activate your license, follow these steps:
1. Navigate to the OpticsViewer Downloads page. Download the Zemax License Manager (ZLM) installer. This application will allow you to view, activate or transfer the license as well as update your license when renewed. This installer package includes everything you needed.
2. Launch the ZLM installer file you downloaded. You may accept the default options or choose a different installation folder.
- Activate your Softkey license: First note that softkey licenses may only be activated once. If you have a softkey license and your server is connected to the internet, start by opening the Windows Start menu...Zemax License Manager...Zemax License Manager.
- Select New License, and enter the License Number and Activation Code. If your software requires registration, two fields will automatically be displayed to enter your MyZemax email address and password. If you get this prompt, ensure you have created your account at MyZemax.com. An invite should have been sent at the same time as the activation email, if you did not already have an account.
- You will receive a confirmation message that your software has successfully activated.
- Verify your license is installed and working. After activation, you will be taken to the License Information section of the ZLM. Verify that the Product, Support expiration, and Seats: Total match your activation email or purchase order.
- After completing activation and verifying your information, we recommend reading the Zemax Licensing Policy. It provides details on how softkey licenses are locked to the machine, tips to avoid losing it, backing it up, and our policy on lost keys.
The next step in the installation and configuration process is to check the Windows firewall. Normally the installation process opens the Windows firewall for you automatically. This section will tell you how to verify that it is configured properly.
- Open the Windows Firewall settings by clicking the Windows Start button and searching, "Firewall."
- Select the Windows Firewall app.
- Select "Allow an app or feature through Windows Firewall."
- Check the list of applications. If “License Manager” or "Sentinel License Manager" is already on the list, then you may move to the next section of this article: Configure keyserver settings and security, below. If not, follow these steps to allow access:
- Click "Allow another app." If "Allow another app" is greyed out, select Change settings to enable it.
- Click Browse and open the C:\Windows\system32 folder.
- Select the hasplms.exe file from the list and click Open.
- The Zemax License Manager will appear on the Add an app window. Click Add to add the License Manager to list of exceptions.
- The check boxes next to License Manager specify which type of network includes this exception. You may check any (or all) the boxes for Domain, Public networks, and Private networks. For security reasons, Public is not selected by default. If you are not sure which you need, select all of the checkboxes. Tip: If the computer is not joined to a domain, the Domain option will not show up.
- Ensure port 1947 is not blocked on your network firewall both for UDP and TCP, and that you can "ping" the IP address of the key server machine from other machines. Consult with your IT department if you are not sure.
The final step in configuring the keyserver machine is to configure its settings and security. Click on Launch Sentinel Admin Control Center (ACC). This is located inthe Troubleshoot tab in Zemax License Manager. You can also get to the Admin Control Center by opening a web browser and navigating to http://localhost:1947.
This will open your web browser to the following page. If this page does not open, see "How to troubleshoot OpticsViewer softkey license issues"
Click Sentinel Keys to see your installed Zemax license(s). Licenses can be identified by the Key ID field, which is also present in the Zemax License Manager. Note that Gemalto/SafeNet does provide licenses for other software, so you may also see non-Zemax licenses on this page. You can identify Zemax licenses using the Vendor field; Zemax's Vendor number is 114811.
After identifying your license, you should be done with the basic server setup. If you have troubles with any of this process, you may contact Zemax support for additional assistance. For client configuration, proceed to the next section for client configuration.
If you would like to further specify your server settings and security, select Configuration. You will see six tabs used to configure it. By default, licenses are available to anyone within your network. There is also no password or other blocks on changing settings in the Admin Control Center from other computers. You may configure security settings, log license usage, restrict users / computers from the license, and configure license Check Out (also known as Detachable Licenses) so client machines can use the software offline. For full details and instructions, refer to "How do I monitor and control usage of the network license?"
Now that your server is configured, move to the next section Adding End-users in zemax
This section is not required to use the software. However, for OpticsViewer users to donwload the software or post questions to the OpticsViewer support forum , they need a Zemax account. To get them an account, the License Administrator needs to add them as an end user of the OpticsViewer license. The License Administrator is normally the same person who was emailed the OpticsViewer activation code. See this article for detailed information on adding end-users.
- Ensure that you are logged in as an administrator on the machine.
Download the latest copy of OpticsViewer from the OpticsViewer downloads page and follow the instructions in "Installing OpticsViewer for the first time"
- Once installed, open Zemax License Manager from Start...Zemax OpticsViewer...Zemax License Manager or Start...OpticsViewer...Zemax License Manager. Open the "View License" tab so see if it finds the network license automatically. If you do not see any licenses, skip to What to do if the license is not found automatically. In most cases, OpticsViewer will automatically bind to the available license.
If the key was not found automatically, follow the configuration steps below to help specify the network server where the license is hosted.
- Obtain the license server machine name. Note that Zemax support does not know your server name as we do not host your license. One easy method to get the server name is to check with a colleague that is using the same license. You can get the server name from the Zemax License Manager application on their machine. It will be listed in the "Location" column next to "hosted on" .
If this is at an educational institution for an optics class, check with the class instructor. If this is at a business, contact the Zemax License Administrator as listed in your Zemax account profile or your IT department to obtain the server information.
Example of the license server name from a machine:
- Open the Zemax License manager and select Launch Sentinel Admin Control Center (ACC). This is located at the top of the Zemax License Manager (Classic) or in the Troubleshoot tab (ZLM V2). You can also get to the Admin Control Center by opening a web browser and navigating to http://localhost:1947. If the Sentinel ACC gives an error message when opening, see "How to troubleshoot OpticsViewer softkey license issues."
- Open Configuration...Access to Remote License Managers. Make sure Allow access to Remote Licenses is checked. We recommend you also select Aggressive Search for Remote Licenses. In the Remote License Search Parameters box, input the machine name of the network license server you would like to access. We recommend using the fully qualified domain name such as servername.company.com rather than just the machine name itself. It is not necessary to include http:// or a port number in the machine name.
- Click Submit when done entering the server information.
- Check under Options...Sentinel Keys to see if the network license has become visible. Note that there may be a delay of ~60 seconds before the key information is refreshed with the new settings. If you see it, close the Admin Control Center and re-open OpticsViewer. You are done! If the key remains unfound, continue to Step 5.
- If the license key is still not found after entering the server information, try these options:
- Restart the machine. That will ensure the licensing process has refreshed the settings.
- Try using the IP address of the server rather than the machine name in the Remote License Search Parameters.
- If you are logging in to a company network remotely via a VPN connection, your IT department may need to configure the VPN server to pass through traffic to the license server's IP address (Port 1947). Zemax cannot help you configure your company firewalls.
- We also recommend verifying that your security software is not blocking access to the license software. Check your security software's logs to see if either the HASP_RT.EXE in the OpticsViewer installation folder, or HASPLMS.exe in C:\windows\system32 has been blocked. Instructions for Mcafee Enterprise is covered in the Frequently Asked Questions section at the bottom of this page.
If you still cannot get OpticsViewer to locate the license, feel free to contact Zemax support for help.
If you are a network administrator and would like to easily configure multiple client machines to use the same keyserver settings, see "Automate client computer configuration for OpticsViewer network licenses" for more details.
OpticsViewer will automatically use a network license seat as long as it is connected to the network. If you need to leave the network you can check a seat out for use offline, assuming your server administrator has enabled this option. Note that using the license check out feature dedicates the license seat to your machine for 1 or more days (14 days is the default unless changed by the license server administrator). Therefore it's not recommended to use this feature unless you really need it. This will maximize the availability of license seats for others.
Follow these steps:
- Close OpticsViewer to ensure the license seat is not in use.
- Launch the Zemax License Manager (ZLM). For OpticsViewer licenses, you can find the Zemax License Manager in Start...All Programs...Zemax OpticsViewer.
- Click Check Out. If you receive any error messages during the check out, or if Check Out it is grayed out see "Resolving network license issues on client machines ."
- If the check out was successful, an additional entry in the ZLM will appear with the following information. It will also be made your default license. The date by "Checked Out Until" is the date and time the license seat will expire and automatically stop working. The length of time is set by your network license administrator on the server.
- Once the license seat is checked out, the client machine may be disconnected from the network. To return a license seat before it expires, simply press Check In. Note that your computer needs to be online and be able to see the same license number from which the seat was checked out.
Press OK, and you are done!
For more details on the ZLM controls and information, you may also refer to the OpticsViewer Help in The Help Tab...Information Group...License Manager.
Can I have multiple users run OpticsViewer on the license key server machine?
OpticsViewer network licenses are designed using a client-server model. The key server is intended host the license itself, and the licensing assigns 1 seat per machine. The key server can run a copy of OpticsViewer for one user if you wish.
Do I have to worry about losing my softkey on the key server in case of hardware failure, theft, or a reinstall of Windows?
Yes. We recommend reading the Zemax Licensing Policies. It gives details on how softkey licenses are locked to the machine, tips to avoid losing it, backing it up, and our policy on lost keys.
How do I configure multiple client machines with the server address, so users don't have to enter it themselves?
Normally, client machines will find the key server without entering the server name into the settings as long as they are on the same subnet. However, if you want to preconfigure the clients with a specific server name, or other settings, please see this article for details.
In the Zemax License Manager, there are fewer than the total number of available seats I expect to see. Why?
First, check on the server machine for licenses that have been checked out (detached) as well as open sessions. For instructions, read this link: "How do I monitor and control usage of the OpticsViewer network license?" If the total number of seats is still not what you expect, this means that the server has not properly released a session after OpticsViewer was closed. To resolve this, you can restart the Sentinel LDK License Manager service.
Client machines will not find the license server, or hang on the OpticsViewer "splash screen" indefinitely. What can I do?
First, make sure that the firewall exception on the server is configured in step 5 of the server setup instructions above. Once you are sure of that, check the client machine has specified the name of the server in the What to do if the license is not found automatically section. If that is done, then your security software may be blocking access to the license software. We have seen both Trend Micro and McAfee block this. If you use Trend Micro, check its scan logs to see if either the HASP_RT.EXE in the OpticsViewer installation folder (normally C:\program files\Zemax OpticsViewer), or HASPLMS.exe in C:\windows\system32 has been blocked. If you use McAfee Enterprise, it's HIPS (Host Intrusion Prevention System) feature can block this. You can temporarily turn off HIPS to see if this is the case. On the client machine, perform the following steps:
Right-click the McAfee icon in the system tray (by the time displayed at the bottom right). The Mcafee icon is normally a red shield with an M in the center. Navigate the menu to the Disable option.Select Disable HIPS protection. If this works, your IT department can whitelist the hasp_rt.exe process to fix it permanently. This file is located in c:\program files\Zemax OpticsViewer.
This section provides a recommended procedure to move to a new server with minimal downtime and configuration. Note that if client machines have a checked out license seat at the time the license is moved to the new server, it will not affect them, as the checked-out licenses simply time out automatically.
- Install the Zemax License Manager software on the new server following the process at the beginning of this article.
- Copy the HASPLM.INI file from the current server to the new one. This file contains all the server settings from the Admin Control Center (user rules, detachable license settings, password, etc., as descrbied in "How do I monitor and control usage of the OpticsViewer network license?"). It is located in C:\Program Files (x86)\Common Files\Aladdin Shared\HASP.
- Transfer the license from the old server to the new one.
- Test the license server is working with an OpticsViewer client machine. If you need to test the new license server before moving the license over, you may email firstname.lastname@example.org. They can provide you a 2 week temporary network license you can use. Note that you must have an active support agreement to receive a trial license. If moving a softkey license, test the transfer process between servers with the trial license to make sure it works and get used to the process. After you are done with the trial license testing you will want to remove it from the server to prevent users from accidentally using it after it expires. The easiest way to remove the trial license is to just transfer it away and discard the generated transfer code.
- Let the users of OpticsViewer know they may need to modify the settings on their client machines with the new server IP address or machine name. You can provide the new server information and a link to the instructions in this article under "What To Do If the License Is Not Found Automatically." Alternatively you can provide them with a modified HASPLM.INI file with the new server information per the following article: "Automate client computer configuration for OpticsViewer network licenses."
This is useful if it's not practical to restart the entire client or server computer, and can be used to fix the following issues:
- The license server or clients are not able to see the softkey license in the Zemax License Manager
- You change a setting on the keyserver and it doesn't take effect even after submitting changes
- A license seat fails to check out on the client even though the "detachable license" feature is enabled on the server.
- Releases sessions showing on the server that are no longer actually in use. Note that this does not release checked out licenses.
You may either open the Start menu, and search for services.msc, or open Control Panel...System and Security...Administrative Tools...Services and right-click on Sentinel LDK License Manager and select Restart.