Will My Biometric Device Work With NepalHRM?
You have a fingerprint or face machine and need to know if it works with NepalHRM, how it connects, and what to check when punches go missing.
Works with ZKTeco, Hikvision and Sintech (Realand) devices. Older ZKTeco machines that cannot push connect through the NepalHRM edge agent on your office network. Find your make and connection mode in the table below. A device that pushes needs its server settings exactly right and nothing else in the office; the edge agent needs a computer on the same network that stays on. Most missing punches come down to a server setting typed wrong, an office internet address that changed, or a device user ID that is not mapped to an employee.
Find your device and how it connects
Support is by make and connection mode, not by model: what matters is whether the machine's firmware can push, can only send plain HTTP, or can do neither.
| Device and mode | How punches arrive | What to check |
|---|---|---|
| ZKTeco · ADMS push | How punches arriveThe machine pushes each punch over HTTPS to an address made for that one device, with its own token in it. No office computer is involved and no port is opened on your router. | What to checkIn NepalHRM, press Generate setup URL on the device; the token is shown once. On the machine, enter Server Address and Server Port in the Cloud Server settings exactly as shown. The port is 443, because NepalHRM does not answer plain HTTP. An address too long for the field is not saved and the machine reports no error. With a wrong token, punches are answered but not recorded, and push does not send them again. |
| ZKTeco · relay mode | How punches arriveFor a machine that can only send plain HTTP. It pushes to the NepalHRM relay, which signs each request and passes it on, and NepalHRM accepts it only from your office's public IP. | What to checkOn the device in NepalHRM, tick Device only supports plain HTTP (use relay) and add the office's public IP under Office public IPs (search “what is my IP” from the office, not the address on the machine's screen). On the machine, Server Address is the relay host only: no https://, no path, no port. If your internet provider changes the office IP, pushes are refused and the machine keeps its punches until you update it. |
| ZKTeco · edge agent | How punches arriveFor an older machine that cannot push. The NepalHRM edge agent runs on a Windows, macOS or Linux computer on the same network, reads the machine (port 4370 by default), stores every punch on that computer and uploads them in signed batches. | What to checkCreate the agent under Edge Agents and download it; its secret key is shown once. In the agent's settings, list the machine's IP address and serial number. The serial must match the device in NepalHRM, and only one agent may read each machine. Install it as a background service and stop the computer sleeping. Last seen and Punches today on the Edge Agents tab show it working. |
| Hikvision · push | How punches arriveThe terminal posts each access event over HTTPS as it happens, to a path made for that device. It is provisioned in Push Setup in two steps, a company key and then the device's own push token, each shown once. | What to checkDevice push must be ON for your company in Push Setup. On the terminal, open Network → Advanced → HTTP Listening and fill Host / IP, Port, Protocol and URL as four separate fields; the URL field holds 128 characters. Then press Verify from server. On first connection a terminal may send its stored history; anything more than 7 days old stays in the raw log, outside attendance. |
| Sintech (Realand) · cloud push | How punches arriveThe terminal sends a short network message for each punch to the NepalHRM listener, which acknowledges it once it is safely queued. The terminal is matched by its MAC address and accepted only from your office's public IP. NepalHRM support switches cloud push on for it. | What to checkOn the terminal, under Menu → Network: Real Time Push on, Server set to the NepalHRM push address, Port 5055. The MAC address recorded in NepalHRM must match the terminal's. If the office IP changes, the device card shows the new address with an Allow button; the terminal keeps its punches, and they arrive within a minute of allowing it. |
Every mode lands in the same punch log, and every punch reaches an employee the same way: through the device user ID on the machine, mapped once to an employee in NepalHRM.
What the message on your screen means
These are the strings NepalHRM shows, word for word. Find yours and read across.
Device push is off for this company, so every push will be rejected no matter how the terminal is configured. Turn it on before provisioning.
- What it means
- The company-wide switch for Hikvision push is off, so NepalHRM refuses every Hikvision push, however well the terminal is set up.
- What to do
- In Push Setup, press Turn on, then Verify from server.
None set. Every push is refused until the office’s public IP is added in the device’s settings.
- What it means
- The device is in relay mode with no office IP recorded, so the relay refuses everything it sends.
- What to do
- Add the office's public IP under Office public IPs on the device, then reboot the machine.
This device is connecting from a new internet address, 203.0.113.7, so its punches are not being accepted. It keeps them and delivers them once the address is allowed.
- What it means
- A Sintech terminal is sending from a public IP that is not on its allowed list, usually because the office's internet provider changed it. The terminal is holding its punches.
- What to do
- If your office's internet address really did change, press Allow 203.0.113.7. The held punches arrive within a minute.
Sync stuck
- What it means
- The edge agent's sync pointer for a machine is set in the future, usually because the machine's clock ran ahead, so every punch it reads is skipped. Only Backfill still works.
- What to do
- Correct the machine's clock, press Reset sync pointer on the agent, then Backfill the missing days.
Not a service
- What it means
- The edge agent was started in a window instead of being installed as a background service, so it stops when the window closes, the user signs out or the computer restarts, and attendance stops with it.
- What to do
- Run the setup again on that computer and answer y when it asks about installing the service.
Work through these in order
Cheapest first. Each step says what you should see if it worked, so you can stop as soon as it does.
Find your row in the table
Read the make on the machine and work out what it can do: push over HTTPS, send plain HTTP only, or neither. That decides the connection mode and which of the checks below apply.
You know which settings the machine needs and where NepalHRM shows them.
Trust the device card, not the device screen
A machine can show connected on its own screen whether or not anything reaches NepalHRM. Reboot it, then look at last contact and last punch on its card in NepalHRM.
A fresh last contact means the machine is reaching NepalHRM.
Re-enter the server settings field by field
Copy each value NepalHRM shows into its own field on the machine, and never paste a full URL into a host field. A ZKTeco or Hikvision address too long for its field is not saved and the machine reports no error; NepalHRM shows the length against the limit.
After a reboot, last contact on the device card updates.
Check the office's public IP
Relay mode and Sintech cloud push accept punches only from the office IPs listed on the device. When an internet provider changes the address, the relay refuses pushes and a Sintech device card shows the new address with an Allow button. Either way the machine keeps its punches.
The held punches arrive once the IP is updated or allowed.
Edge agent: check the computer it runs on
On the Edge Agents tab, read Last seen and Punches today. An old Last seen means the computer is off, asleep, or the service stopped. Only one agent may read each machine, so remove any older copy left on another computer.
Last seen is current and Punches today rises as staff punch.
Map every device user ID to an employee
Each machine keeps its own user IDs. Map each one to an employee by hand, by auto-matching on name, or in bulk. Punches recorded before the mapping are attached once it is made.
The employee's punches appear in their attendance.
Recover a gap the right way
Only the edge agent reads history back: Backfill pulls a date range, as far back as the machine's memory still holds (when it fills, the oldest records are overwritten). A ZKTeco machine on push re-sends what it could not deliver, and a Sintech terminal re-sends anything not acknowledged; a Hikvision terminal on push does not re-send an event that failed. A punch that falls in an attendance month already finalized stays in the raw log until the month is unlocked and backfilled.
The missing days rebuild from the backfilled punches.
Duplicate punches after a backfill: find where the copies come from
Backfilling dates that already arrived does not double them, because a repeated punch is dropped. If you do see two copies, open the punch log for one employee and day. Copies from two device names mean the same machine is registered twice, so retire the stale record. Copies from one device at shifted times mean the time correction on that device changed between the first delivery and the backfill, so send support the device and the dates before recomputing.
Each real punch appears once.
What the system does
- Makes accepted
- ZKTeco, Hikvision, Sintech (Realand)by connection mode, not by model
- Push devices need
- no office computerand no port opened on your router
- Edge agent
- stores every punch before uploadan outage delays punches, it does not lose them
- Live delivery window
- 24 hours ahead to 7 days lateoutside it a punch stays in the raw log
- A repeated punch
- is droppedmatched on device, user ID, time and type
- Hikvision URL field
- 128 characterstoo long saves nothing, silently
Still stuck? Send us this
Include all of it in the first message and the first reply back is usually a fix rather than a question.
- The make, and which mode it uses: ADMS push, relay mode, edge agent or cloud push.
- The serial number, or for a Sintech terminal its MAC address.
- A photo of the machine's server or network settings screen.
- The last contact time on the device card, or Last seen and the agent version for an edge agent.
- One employee, their device user ID and a date where a punch is missing or doubled.
Asked most often
Works with ZKTeco, Hikvision and Sintech (Realand) devices. Older ZKTeco machines that cannot push connect through the NepalHRM edge agent on your office network. The table on this page shows how each one connects and what to set on the machine.
Yes. Sintech (Realand) terminals connect by cloud push: each punch goes to the NepalHRM listener, matched by the terminal's MAC address and accepted only from your office's public IP. NepalHRM support switches cloud push on for the terminal, and on the terminal you set Real Time Push on, the NepalHRM server and port 5055.
No. Support is by make and connection mode, because what decides it is what the machine's firmware can do: push over HTTPS, send plain HTTP only, or neither. If you are not sure which yours does, send support a photo of its server or network settings screen.
Behind the edge agent, every punch is stored on the office computer and uploaded when the connection returns. A ZKTeco machine on push or relay keeps the punches it could not send and delivers them on reconnect, and a Sintech terminal re-sends anything not acknowledged. A Hikvision terminal on push does not re-send an event that failed, so check its last contact after an outage.
Not because of the backfill itself: a punch with the same device, user ID, time and type is dropped. Two copies mean the same machine is registered as two devices, or the time correction on that device changed between the first delivery and the backfill. The punch log for one employee and day tells you which.
Not for a device that pushes: it connects out to NepalHRM, and NepalHRM never connects in. The edge agent also only connects out. The agent does need to reach the machine on your local network.
Screens, labels and limits change between releases. If something here does not match what you see, tell us and we will correct the page.
Related guides
- Biometric Device Not Syncing PunchesThe device status reads offline, or it reads online but no attendance appears against your employees.
- Attendance Is Missing or WrongA day is marked absent when the person was at work, or the in and out times do not match reality.
Support you can actually reach. From Kathmandu.
Email, phone and WhatsApp, answered in English and Nepali by people who know the product. Most questions are closed on the first reply.
- No minimum commitment
- Nepal IRD compliant
- Free onboarding
- Cancel anytime