ONVIF Camera Setup in VMS: Milestone, Genetec, Axis Camera Station and iVMS
Adding third-party ONVIF cameras to a VMS requires more than just knowing the IP address. NTP synchronisation, correct ONVIF profile selection, driver version, and port configuration each affect whether the camera streams reliably and whether motion events reach the recording server. This guide covers the exact steps for the four most widely deployed VMS platforms in commercial and smart building installations.
Prerequisites for all VMS platforms
These steps apply before adding any ONVIF camera to any VMS. Skipping them is the most common cause of failed camera additions and intermittent stream dropouts.
Assign static IP
ONVIF cameras must have static IPs on the surveillance VLAN. DHCP causes stream interruptions when leases expire. Use the camera web UI or SADP/Device Manager tool to assign a static IP, gateway and DNS before adding to VMS. Document the IP-to-camera mapping in the as-built drawing.
NTP time synchronisation
Mandatory. ONVIF WS-UsernameToken digest authentication requires the camera clock to be within 5 minutes of the VMS server clock. Configure the same NTP server (e.g. the VMS host or a local NTP server) on every camera. Verify in camera web UI: System → Date & Time → NTP. A 6-minute drift causes 'Invalid credentials' errors even with the correct password.
Set ONVIF credentials
Create a dedicated ONVIF user account on each camera (separate from the admin web UI account). Most VMS platforms require ONVIF credentials, not HTTP admin credentials. On Hikvision: System → User Management → Add User → Permission: Remote. On Axis: System → Access management → Add user → ONVIF media role.
Enable ONVIF service
Some cameras have ONVIF disabled by default or have a specific ONVIF port (default 80 or 8899 on Hikvision). Verify ONVIF is enabled in camera web UI. On Hikvision DS-2CD series: Network → Advanced Settings → Integration Protocol → Enable ONVIF, check port (default 80). On Dahua: Network → Integration → ONVIF.
Milestone XProtect
Milestone XProtect supports ONVIF via a dedicated ONVIF driver. The driver version determines which profile (S or T) and which features (H.265, metadata) are negotiated with the camera. Always download the latest ONVIF driver from Milestone Download Manager before adding ONVIF cameras.
Milestone XProtect — adding ONVIF camera
1. XProtect Management Client → Recording Servers → right-click recording server → Add Hardware 2. Add Hardware Wizard: → Select "Manually specify hardware" (not auto-detect for ONVIF) → Driver: ONVIF Conformant Device (NOT manufacturer-specific driver) → Address: http://192.168.1.64/onvif/device_service → Port: 80 (or camera's ONVIF port) → ONVIF username / password (NOT HTTP admin credentials) 3. Profile selection (appears after connection): → Select "ONVIF Profile T" if camera supports H.265 + metadata → Select "ONVIF Profile S" for basic H.264 streaming only → Profile T enables: H.265 streams, HTTPS, metadata events 4. Recording settings: → Default codec: H.265 (if Profile T selected) → Stream 1 (live): max resolution, 25fps, H.265 High → Stream 2 (record): 15fps, H.265 High, motion-triggered 5. Motion detection: → Use "ONVIF Motion" (camera-side analytics) not software motion → Reduces CPU load on recording server significantly → Enable in Camera Properties → Events → ONVIF Motion 6. Verify: right-click camera → Live → confirm stream + motion events
Milestone XProtect 2023 R1 and later include an updated ONVIF driver (version 15.x) that supports Media2 service for Profile T cameras. If cameras show as "Profile S only" despite Profile T certification, update the ONVIF driver package via Milestone Download Manager and re-add the hardware.
Genetec Security Center
Genetec Security Center uses WS-Discovery for ONVIF camera detection, which makes initial camera addition straightforward on properly configured networks. The unit addition wizard handles Profile negotiation automatically.
Genetec Security Center — ONVIF unit addition
1. Config Tool → Video → Archiver → Units → Add an IP unit 2. Discovery method: → Auto-discovery (WS-Discovery): cameras on same VLAN appear automatically → Manual: enter IP → Unit type: ONVIF → manufacturer: ONVIF Generic 3. Unit addition wizard: → Network credentials: ONVIF user/password (not HTTP admin) → Genetec negotiates Profile S/T/G/M automatically based on camera certs → For Profile T: H.265 codec option appears in camera properties 4. ONVIF-specific settings (Unit Properties → Extensions → ONVIF): → Event polling interval: 1000ms (default) → reduce to 500ms for faster alarms → Metadata streaming: enable if Profile M camera (analytics bounding boxes) → HTTPS transport: enable for Profile T cameras with HTTPS endpoint 5. Recording profile assignment: → Camera Properties → Recording → assign recording schedule → Codec: select H.265 (HEVC) for Profile T cameras → Retention: configure per project requirement 6. Verify: Config Tool → camera → Live → check stream Event monitor → trigger motion → verify alarm event appears
Axis Camera Station
Axis Camera Station provides native, deep integration with Axis cameras and uses ONVIF for third-party camera addition. Third-party ONVIF cameras have reduced feature sets compared to native Axis cameras — some Axis-specific features (AXIS Object Analytics, ARTPEC edge processing) require native driver.
Axis Camera Station 5.x — third-party ONVIF camera
1. ACS Client → Configuration → Cameras → Add Cameras 2. Search results: → Axis cameras appear with full model information (native AXIS driver) → Third-party ONVIF cameras appear as "ONVIF device" with IP only 3. For ONVIF third-party camera: → Select discovered device or click "Add manually" → Type: ONVIF → Address: camera IP → Port: 80 (default) or camera's ONVIF HTTP port → Credentials: ONVIF user/password 4. ONVIF profile selection: → ACS automatically queries GetProfiles and GetVideoSources → Select profile: Profile_1 (usually main stream, high res) → Secondary stream: Profile_2 (lower res for mobile/low-bandwidth view) 5. Recording configuration: → Schedule: 24/7 or motion-triggered → Motion detection: use ONVIF motion (camera-side) if available → Resolution: match camera's optimal H.265 resolution → Frame rate: 15fps for recording, 25fps for live view 6. Note: AXIS Object Analytics (perimeter detection, occupancy) is available ONLY on native Axis cameras, not ONVIF third-party. Use camera's own analytics and ONVIF motion event for non-Axis.
Hikvision iVMS-4200
Hikvision iVMS-4200 supports ONVIF for adding third-party non-Hikvision cameras. The ONVIF port override is frequently required — many cameras use non-standard ONVIF ports.
iVMS-4200 — adding ONVIF third-party camera
1. iVMS-4200 → Device Management → Add → IP/Domain 2. Device parameters: → Adding Mode: IP/Domain → IP Address: camera IP → Device Type: ONVIF (from dropdown — not "Encoding Device") → Port: 80 (or camera's ONVIF port — CHECK camera web UI) → User Name: ONVIF credentials → Password: ONVIF credentials Frequent issue: cameras default ONVIF to port 8899, not 80. Hanwha and Dahua often use port 8080. Always verify in camera UI. 3. ONVIF streaming URL format (for manual RTSP testing): rtsp://user:password@192.168.1.64:554/onvif/stream_0 rtsp://user:password@192.168.1.64:554/Streaming/Channels/101 (URL format is NOT standardised in ONVIF — query GetStreamUri) 4. Auto-detect: iVMS → Device Management → Auto Search → Device type filter: ONVIF → Cameras on LAN with WS-Discovery enabled appear automatically → Confirm each found device before adding 5. After adding: verify live view in iVMS main interface Preview → select camera → confirm stream resolution and codec
iVMS-4200 has limited ONVIF Profile T support in versions before 3.5. Update to the latest iVMS-4200 release before adding Profile T cameras — older versions force H.264 even when the camera supports H.265 via ONVIF.
H.265 and ONVIF Profile T
ONVIF Profile T is the mandatory profile for H.265 (HEVC) streams. Profile S devices are not required to support H.265. When specifying cameras for H.265 recording, always require Profile T certification in procurement documentation.
NVR / VMS server GPU decoding
- ·H.265 software decoding is ~2× more CPU-intensive than H.264 at same resolution
- ·4K H.265 requires hardware decode: NVIDIA GTX 1650+ or Intel UHD 630+ with NVDEC/Quick Sync
- ·Milestone and Genetec support GPU-accelerated H.265 decode from their 2022 releases
- ·Check VMS spec sheet for max H.265 4K streams per server without GPU
H.265 Main Profile vs Main10
- ·H.265 Main Profile (8-bit): standard — supported by all Profile T cameras and VMS
- ·H.265 Main10 (10-bit): higher dynamic range — limited VMS support, not required for surveillance
- ·Always specify H.265 Main Profile in camera stream config for maximum VMS compatibility
- ·H.265 High Efficiency: non-standard extension — avoid for ONVIF interoperability
Bandwidth planning
Use these figures for network switch port sizing, NVR storage planning, and uplink capacity calculations. Values assume constant bitrate (CBR) at medium scene complexity (indoor corridor, moderate motion). Outdoor scenes with vegetation add 20–40%.
| Resolution | FPS | H.264 bitrate | H.265 bitrate | H.265 saving |
|---|---|---|---|---|
| 2MP (1080p) | 15 | 2–4 Mbit/s | 1–2 Mbit/s | ~50% |
| 2MP (1080p) | 25 | 3–6 Mbit/s | 1.5–3 Mbit/s | ~50% |
| 4MP (2560×1440) | 15 | 4–8 Mbit/s | 2–4 Mbit/s | ~50% |
| 4MP (2560×1440) | 25 | 6–12 Mbit/s | 3–6 Mbit/s | ~50% |
| 8MP (4K / 3840×2160) | 15 | 12–20 Mbit/s | 6–10 Mbit/s | ~50% |
| 8MP (4K / 3840×2160) | 25 | 20–32 Mbit/s | 10–16 Mbit/s | ~50% |
Storage formula: GB/day = (bitrate Mbit/s × 3600 × recording_hours) / 8 / 1000. Example: 8MP H.265 at 10 Mbit/s × 24h = 108 GB/day per camera. For 30-day retention with 16 cameras: 16 × 108 × 30 = 51.8 TB — plan for RAID-6 NVR with ~65 TB usable.
Common failure modes
ONVIF port blocked by camera firewall
Some cameras run a host-based firewall that restricts ONVIF HTTP access to specific source IP ranges. Symptoms: VMS auto-discovery fails, manual IP addition returns 'connection refused' on port 80/8899. Fix: camera web UI → Security → Firewall → allow VMS server IP, or disable host firewall. Verify with: curl -v http://camera-ip/onvif/device_service from VMS host.
NTP sync off → digest auth failure
Camera clock drift > 5 minutes causes WS-UsernameToken digest timestamps to be rejected. VMS shows 'Invalid credentials' even with correct username/password. Fix: camera web UI → System → Date/Time → NTP sync → set same NTP server as VMS. Restart ONVIF service on camera after NTP sync. Verify: camera web UI should show current UTC time within 60s of actual time.
Wrong ONVIF path — 404 on device service
ONVIF does not mandate a fixed URL path for the device service. Most cameras use /onvif/device_service but some use /onvif/deviceio_service, /OnvifService, or a non-standard path. Fix: check camera documentation for the ONVIF device service URL. Use WS-Discovery (onvif-device-test) to obtain the XAddr — the camera advertises its actual service URL in the ProbeMatch response.
H.265 stream connects but VMS shows 'unsupported codec'
VMS server lacks H.265 software decode capability or the ONVIF driver version does not request H.265 via Media2 service. Fix: verify VMS version supports H.265 (check release notes). Update ONVIF driver to latest version. In camera ONVIF settings, confirm H.265 stream is configured as the primary codec — some cameras default to H.264 on the ONVIF profile even when H.265 is available.
Need ONVIF cameras commissioned into your VMS on-site?
We handle ONVIF camera commissioning in Milestone XProtect, Genetec and Axis Camera Station — including NTP sync, Profile T H.265 configuration, KNX event integration and recorded stream verification.
Request a quote →