Back to Package Rooms posts
Package Rooms

One Week Before Install: Locker Network Requirements for IT Teams

One Week Before Install: Locker Network Requirements for IT Teams Parcel lockers require reliable IP connectivity, outbound TLS to vendor hosts, NTP, and placement on an isolated VLAN or SSID with restricted egress. Before a single unit get

Published

Technician verifying package locker network connectivity

Parcel lockers require reliable IP connectivity, outbound TLS to vendor hosts, NTP, and placement on an isolated VLAN or SSID with restricted egress. Before a single unit gets bolted to a wall, IT needs stable IP assignment, DHCP or static addressing decided in advance, and firewall rules that allow specific vendor traffic while blocking everything else. Treat every locker as a high-exposure IoT device sitting in a public hallway, not as a trusted internal endpoint, and require the vendor to hand over a network diagram and host/port list before staging begins.

TL;DR:

  • Parcel lockers require static or reserved DHCP addressing, reliable DNS resolution, and NTP synchronization to ensure consistent operation.
  • Outbound TLS traffic over port 443 to vendor hostnames must be allowlisted, with minimal additional ports for remote support, based on vendor-provided matrices.
  • Lockers should be placed on isolated VLANs or SSIDs following zone-based security standards, not trusted internal networks, to prevent lateral movement in case of compromise.
  • Power over Ethernet switch capacity must be confirmed for PoE wattage and port count before installation, with diagrams and specs verified in advance.
  • Network testing should include full connectivity, DNS, NTP, PoE load, and firmware update verification performed on-site before declaring deployment ready.
Postal Solutions
Plan Your Locker Installation With Confidence
Postal Solutions sells and installs Luxer One package room and locker systems for apartment communities across more than 40% of U.S. states.
Explore locker solutions

Table of Contents

Locker Network Requirements: IP Addressing, DNS, and Time Sync

Most vendors default to DHCP because it simplifies onboarding across dozens of properties with different subnet layouts. Reserve a fixed lease for each locker gateway anyway. A kiosk that renews into a new IP mid-cycle can lose its session with the management platform and drop offline until someone notices residents complaining.

Set a few defaults before the installer arrives:

  • Use DHCP with address reservations tied to the device’s MAC address, not floating leases.
  • Set lease times long enough to survive a weekend power blip, typically 24 hours or longer for fixed kiosk hardware.
  • Confirm DNS resolves every vendor hostname, and route locker VLANs through a resolver that will not intercept or rewrite those lookups.
  • Disable SSL inspection for vendor domains. Breaking the TLS handshake to inspect it is one of the most common day-one failures vendor support teams report, according to networking guidance from Bretford’s kiosk deployment documentation.
  • Confirm NTP reachability. Authentication tokens and TLS certificate validation both depend on accurate system time, so a locker with clock drift can fail to authenticate even when connectivity looks fine.

Latency matters less than most IT teams expect, but it is not irrelevant. Keep round-trip latency to the vendor’s cloud endpoint under roughly 150 milliseconds where possible, and use standard Ethernet MTU (1500 bytes) unless the vendor documentation specifies otherwise.

Required Outbound Ports and Firewall Rules for Locker Connectivity

Nearly every locker platform runs on outbound TLS over port 443. Vendor support documentation for platforms like Pitney Bowes explicitly instructs IT teams to allow outbound HTTPS traffic to a published list of hostnames rather than opening broad port ranges, and to expect a handful of additional ports for remote-support and diagnostic tools. Some vendors also publish separate hostname lists for locker-specific hardware, distinct from shipping or mailing software, so confirm you have the correct matrix for the exact model being installed.

Build the firewall policy in this order:

  1. Request the vendor’s full host and port matrix in writing before staging, not after installation day.
  2. Allowlist exact hostnames where the vendor supports it; fall back to wildcard domains only when the vendor requires it for cloud load balancing.
  3. Open the minimum port set (typically 443, plus any documented remote-support ports) and leave everything else denied by default.
  4. Test connectivity from the locker’s actual VLAN, not from a laptop on the corporate network, before calling the deployment ready.
  5. Once traffic is confirmed working, close any temporary ports opened for testing.

Remote-support tools like TeamViewer or LogMeIn should run through a vendor-managed tunnel or a time-boxed exception, never a permanently open inbound port.

Pro Tip: Run your allowlist test a full week before go-live, not the day before. Vendor cloud endpoints occasionally rotate IP ranges behind their hostnames, and a test done too close to installation day won’t catch a DNS caching issue that surfaces after the truck leaves.

VLAN Segmentation and Device Onboarding Standards

A parcel locker sitting in a lobby is physically accessible to anyone who walks by, which is exactly why NIST’s IoT onboarding guidance recommends treating these devices as high-exposure endpoints rather than trusted internal hardware. Isolating locker traffic on its own VLAN or SSID keeps a compromised or misbehaving kiosk from reaching property management servers, resident Wi-Fi, or building access control systems.

Segmentation guidance from NIST’s broader work on zone-based security architecture applies directly here: define the locker network as its own security zone, map exactly which flows need to cross into other zones, and deny everything else by default. In practice, that means:

  • A dedicated VLAN or SSID exclusively for locker gateways, never shared with guest Wi-Fi or office systems.
  • Trusted network-layer onboarding using device-specific credentials issued at manufacture, not shared passwords typed in during install.
  • A static IP or DHCP reservation on the gateway with the minimum outbound ports open.
  • Signed firmware updates delivered over an encrypted channel, with tamper-evidence you can verify during commissioning.

One useful benchmark for procurement conversations: bid specifications for institutional locker deployments, including one published by the University of Massachusetts Lowell, require encrypted user-to-server and server-to-locker communication plus multi-subnet operation as baseline conditions of the contract, not optional add-ons.

Power, Cabling, and Switch Requirements for Locker Hardware

Technician checking locker power and network cabling

Locker gateways typically run on Power over Ethernet, which eliminates a separate electrical run but adds a planning step most facility teams miss: switch PoE budget. A property adding six locker banks to an existing switch stack needs someone to confirm total PoE wattage available, not just port count.

Plan around these physical requirements:

  • Confirm PoE class and wattage draw per unit against your switch’s total PoE budget before ordering hardware.
  • Run Cat6 where distance allows; Cat5e works for shorter runs but has tighter distance limits for reliable PoE delivery.
  • Keep uplink bandwidth generous. A single kiosk uses very little sustained bandwidth, but bursty firmware updates and camera feeds on smart units can spike briefly.
  • Mount and lock gateway hardware out of resident reach, especially for outdoor package room installations exposed to weather and foot traffic.
  • Require a vendor-supplied network diagram showing every interface, port, and connection point end to end before signing off on the install.

Monitoring, Testing, and Firmware Update Procedures

Commissioning a locker network isn’t done when the unit powers on. It’s done when you’ve verified the full communication path under real conditions.

  1. Run ping and HTTPS connectivity tests directly from the locker’s VLAN to every required vendor hostname.
  2. Confirm NTP sync completes and the system clock stays within an acceptable drift window.
  3. Verify PoE delivery under load, not just at idle, since power draw can spike during firmware updates or peak carrier drop-off windows.
  4. Export connectivity, authentication, and firmware-change logs to your SIEM or the vendor’s monitoring portal, whichever your security team requires.
  5. Request signed firmware releases and test the update process in a staging environment before pushing it fleet-wide.

Favor vendor-managed reverse tunnels for remote troubleshooting over any permanently open inbound access. It keeps the support path auditable without leaving a standing door open into your network.

Compliance Checklist for Locker Procurement and Sizing

Compliance Checklist for Locker Procurement and Sizing — overview diagram

Build your procurement scorecard around documentation, not promises. Require every vendor bid to include: hostnames and ports in writing, a full network diagram, PoE specifications, VLAN and multi-subnet support, encryption standards for data in transit, and confirmed logging or SIEM export capability.

Sizing matters too. For new or remodeled apartment buildings, the U.S. Postal Service requires a minimum ratio of one parcel locker for every five mail compartments, a rule worth knowing before finalizing how many units your network needs to support. Larger deployments mean more concurrent connections, higher power draw, and more reason to confirm switch capacity early rather than mid-install.

  • Written host/port matrix from the vendor, not a verbal assurance.
  • Documented onboarding procedure and firmware signing evidence.
  • Example firewall rule set the vendor has deployed successfully elsewhere.

What Postal Solutions Sees Go Wrong on Install Day

Most failures we encounter trace back to three things: SSL inspection silently breaking vendor TLS, a missing DHCP reservation causing a kiosk to drop offline overnight, or a switch that simply doesn’t have the PoE budget the install crew assumed. Run an allowlist test before the truck arrives, put IT and the vendor on the same staging call, and screenshot every configuration step. It saves a second site visit almost every time.

— Postal Solutions

Postal Solutions Helps You Get the Network Right Before Install Day

Getting locker network requirements right on paper is one thing. Getting them verified on-site, with a working system that residents can actually use on day one, is another. Postal Solutions reviews vendor specifications, builds pre-install network checklists, coordinates directly with vendor support teams, and runs staging verification before your Luxer One® locker solutions go live. Every commissioning includes the network diagram, configuration screenshots, and test sign-off documentation your IT team needs on file, not just a vendor’s word that it works.

If your property is planning a new locker deployment or troubleshooting an existing one that keeps dropping offline, start with a mail management specification review and get the network right before the hardware ships.

Where to Verify Locker Network Specifications

Vendor support pages remain the authoritative source for exact hostnames, ports, and firmware requirements, since these details change as platforms update their cloud infrastructure. Pair that with NIST’s segmentation guidance for internal security policy, and building bid packages like the University of Massachusetts Lowell’s smart locker specification for procurement language you can adapt. Collect the vendor’s host/port matrix and network diagram before you finalize any purchase order.

Sources

FAQ

What network settings does a parcel locker system require?

A parcel locker needs stable IP addressing (DHCP with reservations or static), outbound TLS on port 443 to vendor hostnames, working NTP for time sync, and placement on an isolated VLAN or SSID. Vendors typically publish the exact host and port list you need for firewall allowlisting.

Are there rules or regulations for employee and package lockers?

Workplace locker rules vary by employer policy and local ordinance, and there is no single federal network standard specific to employee lockers. For multifamily parcel lockers, the closest regulatory benchmark is the USPS requirement of one locker per five mail compartments for new or remodeled apartment buildings.

How does a smart locker system actually work on the network?

A smart locker gateway maintains a persistent outbound connection to the vendor’s cloud platform over TLS, authenticating carriers and residents through that connection rather than hosting logic locally. The network’s job is simply to keep that connection alive and secure, which is why isolation and reliable DNS and NTP matter so much.

What counts as a parcel locker under USPS guidance?

USPS defines parcel lockers as secured compartments distinct from standard mail compartments, sized for package delivery where a carrier cannot fit an item into a resident’s mailbox. The USPS ratio guidance applies specifically to new or remodeled apartment housing.

Does Postal Solutions handle network setup for locker installations?

Postal Solutions sells and installs Luxer One® locker solutions and reviews network specifications as part of the installation process, coordinating with vendor support teams during staging. Pricing details for services and installations are available on the company’s website.