Cradlepoint_cor_ibr900_manual Cradlepoint Cor Ibr900 Manual
User Manual: cradlepoint_cor_ibr900_manual
Open the PDF directly: View PDF 
.
Page Count: 111 [warning: Documents this large are best viewed by clicking the View PDF Link!]
- INTRODUCTION
- QUICK START
- ADMINISTRATION PAGES
- appendix A
- appendix B
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 1
User Manual / IBR900/IBR950 1/5/17
COR Series
Router
IBR900 / IBR950
User Manual
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 2
User Manual / IBR900/IBR950 1/5/17
TABLE OF CONTENTS
INTRODUCTION 4
WHAT’S IN THE BOX 4
KEY FEATURES 4
WAN 4
LAN 4
WIFI 4
MANAGEMENT 5
VPN AND ROUTING 5
SECURITY 5
CLOUD OPTIMIZED IP COMMUNICATIONS 6
SPECIFICATIONS 6
ACCESSORIES 8
BUSINESS-GRADE MODEM SPECIFICATIONS 8
HARDWARE 10
POWER/GPIO CONNECTOR 11
EXTENSIBILITY DOCK INSTALLATION INSTRUCTIONS 12
EXTENSIBILITY DOCK HARDWARE AND DIMENSIONS 13
LEDS 14
SUPPORT AND WARRANTY 14
QUICK START 15
BASIC SETUP 15
ACCESSING THE ADMINISTRATION PAGES 15
FIRST TIME SETUP WIZARD 16
USING ENTERPRISE CLOUD MANAGER 16
ADMINISTRATION PAGES 17
QUICK LINKS 17
DASHBOARD 17
CONNECTION MANAGER 18
WAN INTERFACE PROFILES & PRIORITY 18
STATUS 22
INTERNET 22
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 3
User Manual / IBR900/IBR950 1/5/17
LOCAL NETWORKS 27
CLIENT LIST 28
TUNNELS 28
FIREWALL 29
ROUTING 30
GPIO 30
ETHERNET 30
GPS 31
SYSTEM LOGS 31
NETWORKING 32
LOCAL NETWORKS 32
VLAN INTERFACES 43
TUNNELS 43
ROUTING 56
QOS 66
DNS SERVERS 69
WIFI AS WAN 72
WAN AFFINITY 73
CLIENT DATA USAGE 75
NHRP 75
SECURITY 77
IDENTITIES 77
ZONE FIREWALL 78
CLOUD-BASED SECURITY 83
WEB ACCESS FILTERING 84
CERTIFICATE MANAGEMENT 86
SYSTEM 89
ADMINISTRATION 89
ENTERPRISE CLOUD MANAGER 98
DEVICE ALERTS 98
SERIAL REDIRECTOR 100
GPIO CONFIGURATION 100
SNMP CONFIGURATION 101
SYSTEM CONTROL 103
DIAGNOSTICS 105
SETUP WIZARDS 106
APPENDIX A 109
EXTENSIBILITY DOCK 109
APPENDIX B 111
SAFETY, REGULATORY, AND WARRANTY GUIDE 111
ROUTER COMMUNICATION/DATA USAGE 111
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 4
User Manual / IBR900/IBR950 1/5/17
INTRODUCTION
WHAT’S IN THE BOX
KEY FEATURES
• Ruggedized router with integrated business-class 3G/4G modem; includes integrated mounting plate
• Quick Start Guide with warranty information
•
•
• 12 V / 2 A power supply w/ locking connector; DC GPIO/power cable available
• Extra SIM door screws (2)
NOTE: -NPS SKU comes with no antennas or power supply, and includes a 2-meter locking power and GPIO cable (direct
wire).
*-IBR900 only
WAN
• Dual-modem capable with optional COR Extensibility Dock
• LP6: LTE Advanced LTE/HSPA+ (SIM-based Auto-Carrier Selection for all North American and European carriers)
• WiFi as WAN¹, with WPA2 Enterprise Authentication for WiFi-as-WAN³
• Failover/Failback
• Load Balancing
• Advanced Modem Failure Check
• WAN Port Speed Control
•
• IP Passthrough
• Standby
LAN
• VLAN 802.1Q
• DHCP Server, Client, Relay
• DNS and DNS Proxy
• DynDNS
• UPnP
• DMZ
• Multicast/Multicast Proxy
• QoS (DSCP and Priority Queuing)
• MAC Address Filtering
WIFI1
• Dual-Band Dual-Concurrent
• 802.11 a/b/g/n/ac wave 2
• MU-MIMO and 256 QAM support
• Up to 128 connected devices (64 per radio – 2.4 GHz and 5 GHz)
• Multiple SSIDs: 2 per radio (4 total)
• WPA2 Enterprise (WiFi)
• Hotspot/Captive Portal
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 5
User Manual / IBR900/IBR950 1/5/17
• SSID-based Priority
•
MANAGEMENT
• Cradlepoint Enterprise Cloud Manager²
• Web UI, API, CLI
• Active GPS support on all models
• Data Usage Alerts (router and per client)
• Advanced Troubleshooting (support)
• Device Alerts
• SNMP
• SMS control
• Serial Redirector
• Auto APN Recovery
• Syslog
VPN AND ROUTING
•
• L2TP³
• GRE Tunnel
• OSPF/BGP/RIP³
•
• Per-Interface Routing
• Routing Rules
• Policy-based Routing
• NAT-less Routing
• Virtual Server/Port Forwarding
• NEMO/DMNR³
• IPv6
• VRRP³
• STP³
• NHRP³
• VTI Tunnel support
• OpenVPN support
• CP Secure VPN compatible
• Serial PAD Mode
SECURITY
• RADIUS and TACACS+ support*
• 802.1x authentication for Ethernet
• Zscaler integration³
•
• ALGs
• MAC Address Filtering
• Advanced Security Mode (local user management only)
• Per-Client Web Filtering
• IP Filtering
• Content Filtering (basic)
• Website Filtering
• Zone-Based Object Firewall with host address (IP or FQDN), port, and MAC address
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 6
User Manual / IBR900/IBR950 1/5/17
SPECIFICATIONS
WAN:
• Dual-modem capable with optional COR Extensibility Dock
• Integrated LP6 Category 6 LTE Advanced LTE modem (with DC-HSPA+ failover)
• Two LAN/WAN switchable 10/100/1000 Gigabit Ethernet ports – one default WAN (cable/DSL/T1/satellite/Metro
Ethernet)
• WiFi as WAN, Metro WiFi; 2×2 MIMO “N” 2.4 GHz or 5 GHz; 802.11 a/b/g/n/ac wave 2 (IBR900 only)
LAN:
• Dual-band dual-concurrent WiFi; 802.11 a/b/g/n/ac wave 2 (IBR900 only)
• Two LAN/WAN switchable 10/100/1000 Gigabit Ethernet ports – one default LAN
• Serial console support for out-of-band management of a connected device
PORTS:
• Power
• 2-wire GPIO
• Add more GPIO ports with optional 9-wire GPIO cable or COR Extensibility Dock (see Accessories section below)
• USB 2.0
• Two Ethernet LAN/WAN
• Two cellular antenna connectors (SMA)
• One active GPS antenna connector (SMA)
• Two WiFi antenna connectors (R-SMA)
• 15-pin dock port for COR Extensibiliity Dock or 9-wire GPIO cable
TEMPERATURE:
• -30 °C to 70 °C (-22 °F to 158 °F) operating
HUMIDITY (non-condensing):
• 5% to 95% operating
• 5% to 95% storage
POWER:
• DC input steady state voltage range: 9–33 VDC (requires inline fuse for vehicle installations)
• For 9–24 VDC installations, use a 3 A fuse
*-Native support for authentication. Authorization and accounting support through hotspot/captive portal services.
CLOUD OPTIMIZED IP COMMUNICATIONS
• Automated WAN Failover/Failback support
•
• Advanced VPN connectivity options to HQ
•
• MAC Address Filtering
• 802.1p/q for LAN QoS segmentation and treatment of VoIP on LAN
• Private Network support (wired and 4G WAN)
• Cloud-based management²
1 – WiFi-related functions are only supported on IBR900 models
2 – Enterprise Cloud Manager requires a subscription
3 – Requires an Extended Enterprise License
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 7
User Manual / IBR900/IBR950 1/5/17
• For > 24 VDC installations, use a 2.5 A fuse
• Reverse polarity and transient voltage protection per ISO 7637-2
• Ignition sensing (automatic ON and time-delay OFF)
• Power consumption:
• Idle: 4 W
• WiFi Tx/Rx: 9 W
• LTE Tx/Tx: 6.25 W
• 12 VDC / 2 A adapter recommended
WIFI POWER:
• 2.4 GHz: 18 dBm conducted
• 5 GHz VHT20: 17.5 dBm conducted
• 5 GHz VHT40: 17 dBm conducted
• 5 GHz VHT80: 16.5 dBm conducted
SIZE: 4.6 × 4.5 × 1.2 in (118 × 113.5 × 29.3 mm)
WEIGHT: 14 oz (400 g)
CERTIFICATIONS:
• FCC, CE, IC
• AS, NZS, SGP (IMDA)
•
• Safety: UL/CUL, CB Scheme, EN60950-1
• Shock/Vibration/Humidity: compliant with MIL STD 810G and SAEJ1455
• Ingress Protection: compliant with IP54 (includes protection from dust and splashing water)
• Materials: WEEE, RoHS, RoHS-2, California Prop 65
• Vehicle: E-Mark, compliant with ISO 7637-2
• Telecom: PTCRB/CTIA, GCF-CC
• Regulatory Models: S5A643A, S5A644A, S5A648A, S5A701A, S5A706A
GPS
• GPS Protocols: TAIP and NMEA 0183 V3.0
• Satellite channels: Maximum 40 channels, simultaneous tracking
• Concurrent standalone GPS, GLONASS, BeiDou and Galileo
• 1 Hz refresh rate
• Accuracy:
• < 2 m: 50%
• < 5 m: 90%
• Horizontal: < 2 m (50%); < 5 m (90%)
• Altitude: < 4 m (50%); < 8 m (90%)
• Velocity: < 0.2 m/s
• Acquisition (measured with signal strength: -135 dBm):
• Hot start: 1 second
• Warm start: 29 seconds
• Cold start: 32 seconds
• Sensitivity
• Tracking: -160 dBm (tracking sensitivity is the lowest GNSS signal level for which the device can still detect
an in-view satellite 50% of the time when in sequential tracking mode)
• Acquisition (standalone): -145 dBm (acquisition sensitivity is the lowest GNSS signal level for which the
device can still detect an in-view satellite 50% of the time)
• Operational limits: altitude <6000 m or velocity <100 m/s (either limit may be exceeded, but not both)
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 8
User Manual / IBR900/IBR950 1/5/17
BUSINESS-GRADE MODEM SPECIFICATIONS
COR IBR900/IBR950 LP6 models include an integrated LTE Advanced Category 6 4G LTE modem. The LP6 modems
support SIM-Based Auto-Carrier selection so there is only one model for all of North America. Simply insert the SIM
and wait for the router to automatically detect the SIM and establish a connection.
COR IBR900LP6-NA, COR IBR950LP6-NA, COR IBR900LP6-EU
• Technology: LTE Advanced, HSPA+
• Downlink Rates: LTE 300 Mbps, HSPA+ 42.2 Mbps
ACCESSORIES
EXTENSIBILITY
• COR Extensibility Dock (Part # 170700-000)
• 9-wire power & GPIO cable (Part #170680-000)
POWER
Vehicle options
• Vehicle locking power adapter for COR (Part # 170635-000)
• Two meter locking power and GPIO cable (direct wire) (Part # 170585-000) – included by default on IBR900LP6-NA-
NPS only
Power Supplies/Adapters
• North America COR IBR900/IBR950 power supply (Part # 170716-000)
• International power supply -- includes adapters for US, EU, UK, AU (Part # 170717-000)
• Barrel to 4-pin power adapter (Part # 170665-000)
ANTENNAS – 3G/4G Modem, WiFi, & GPS
• 700 MHz – 2700 MHz Wide Band Directional Antenna (Yagi/Log- Periodic) Part #: 170588-000
• 12” Mag-Mount Antenna with SMA Male Connector Part #: 170605-000
• 4” Mini Mag-Mount Antenna with SMA Male Connector Part #: 170606-000
• 2.4/5 GHz Dual-band Dual-concurrent WiFi Antenna Part #: 170628-000 (WiFi models only)
• Universal 3G/4G/LTE Modem Antenna Part #: 170649-000
• GPS Screw-Mount Antenna Part #: 170651-000
• GPS Mag-Mount Antenna Part #: 170652-000
• Multi-Band Omni-Directional Antenna Part #: 170668-000
• Indoor/Outdoor Panel Patch Part #: 170669-000
• Universal LTE/4G/3G / 2dBi/3dBi antenna with SMA connector for all AER, ARC, COR, and MC400 products (Part #
170704-001)
Vehicle Antennas
• 3-in-1 GPS & Modem Screw-Mount Part #: 170653-000
• 3-in-1 Adhesive-Mount Antenna Part #: 170653-001
• 5-in-1 GPS, Modem & WiFi Screw-mount Part #: 170654-000
•
001
See the Cradlepoint antenna accessories page for more information about antennas. Also see the Antenna Ordering
and Installation Guide, available as a PDF in the Resources section of antenna and router product pages.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 9
User Manual / IBR900/IBR950 1/5/17
• Uplink Rates: LTE 50 Mbps, HSPA+ 5.76 Mbps
• Frequency Bands:
• LTE Bands 1-5, 7, 8, 12, 13, 17, 20, 25, 26, 29, 30, 41
• Verizon: 2, 4, 5, 13 (XLTE support w/carrier aggregation)
• AT&T: 2, 4, 5, 12/17, 29, 30
• Sprint: 25, 26, 41 (LTE Plus Support)
• T-Mobile: 2, 4, 12 (T-Mobile Wideband LTE Support)
• Carrier Aggregation:
• 1+ 8
• 2+ 2/5/12 (17 w/MFBI)/13/29
• 3+ 7/20
• 4+ 4/5/12 (17 w/MFBI)/13/29
• 5+ 2/4/30
• 7+ 3/7/20
• 8+ 1
• 12 (17 w/MFBI) + 2/4/30
• 13+ 2/4
• 20+ 3/7
• 30+ 5/12 (17 w/MFBI)
• 41+ 41
• Fallback: WCDMA/DC-HSPA+ (42/5.76 Mbps): Bands 1, 2, 3, 4, 5, 8
• Power: LTE: 23 dBm ± 1; HSPA+: 23 dBm ± 1
• Antennas: )
• GPS: active GPS support
• SMS: SMS support
• Industry Standards & Certs: CE, FCC, GCF-CC, IC, PTCRB, AT&T, Sprint, Verizon
COR IBR900/IBR950LP5 models include an integrated LTE Advanced Category 6 4G LTE modem, and support Asia
automatically detect the SIM and establish a connection.
COR IBR900LP5-AP, COR IBR950LP5-AP
• Technology: FDD/TDD (Category 6) LTE Avanced, DC-HSPA+
• Downlink Rates: LTE 300 Mbps, DC-HSPA+ 42.2 Mbps
• Uplink Rates: LTE 50 Mbps, DC-HSPA+ 5.76 Mbps
• Frequency Bands:
• LTE Bands: 1, 3, 5, 7, 8, 11, 18, 19, 21, 28, 38, 39, 40, 41
• TD-SCDMA 39
• Carrier Aggregation:
• 1+ (8, 18, 19, 21)
• 3+ (5, 7, 19, 28)
• 7+ (5, 7, 28)
• 19+ 21
• 38+ 38
• 39+ 39
• 40+ 40
• 41+ 41
• Fallback: WCDMA/DC-HSPA+ (42/5.76 Mbps): Bands 1, 5, 6, 8, 9, 19
• Power: LTE: 23 dBm ± 1; DC-HSPA+: 23 dBm ± 1
• Antennas:)
• GPS: active GPS support
• SMS: SMS support
• Industry Standards & Certs: CE, GCF-CC, RC Australia, others pending
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 10
User Manual / IBR900/IBR950 1/5/17
Reset
Button
WiFi Antenna Connector*
(Reverse SMA)
USB 2.0
Port
10/100/1000 Ethernet
or WAN Default: WAN)
10/100/1000 Ethernet
WAN Default: LAN)
Power Port
WiFi Antenna Connector*
(Reverse SMA)
* - only on IBR900
Router to Dock Connector
HARDWARE
3G/4G Antenna
Connector (SMA)
3G/4G Antenna
Connector (SMA)
GPS Connector
(SMA)
LEDs
SIM slots
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 11
User Manual / IBR900/IBR950 1/5/17
POWER/GPIO CONNECTOR
This connector has four pin slots: power, ground, input, and output.
Connector pinout – view into router (rear view of cable connector):
Pin Denition Details Wire Color
1 Ground - Black
2Power 9-33 V DC Red
3 Input 3 V input high threshold (36 V tolerant) Orange
4 Output capable of sinking 250 mA Blue
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 12
User Manual / IBR900/IBR950 1/5/17
1. Remove modem door (C) from dock (A).
2. Insert activated SIM(s) into MC400 modem (B).
3. Slide MC400 modem (B) into modem dock (A).
4. Attach modem door (C) using M3 screws (D).
5. Remove dock port protective cover. With the
dock port of the router facing the dock, slide the
rails of the dock (A).
6. Fully seat the dock connectors and align the router/
dock holes.
7. Secure router to dock using four M5x8 screws
(F), then secure dock to mounting surface using
four mounting screws (G) (not supplied). For high-
vibration environments, Cradlepoint recommends
using thread locker.
EXTENSIBILITY DOCK INSTALLATION INSTRUCTIONS
NOTE: Do not place router antennas and
MC400 antennas immediately adjacent.
Cradlepoint recommends remotely attaching
one or both sets of antennas.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 13
User Manual / IBR900/IBR950 1/5/17
EXTENSIBILITY DOCK HARDWARE AND DIMENSIONS
Top view Bottom view
Rear view
Front view
GPIO Connector*
* - See Appendix A for Pinout information
10/100 Ethernet Ports
Dock to Router Connector
3G/4G Antenna
Connector (SMA)
3G/4G Antenna
Connector (SMA)
GPS Connector (SMA)
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 14
User Manual / IBR900/IBR950 1/5/17
CradleCare Support available in the US and Canada with technical support, software upgrades, and advanced hardware
exchange: 1-, 3-, and 5-year options.
Three-year limited hardware warranty available world-wide on IBR900/IBR950 series products when purchased from an
approved Cradlepoint Partner or Distributor — extend warranty to 5 years.
SUPPORT AND WARRANTY
LEDS
SIGNAL STRENGTH Blue LED bars indicate the active modem’s signal strength.
• 4 Solid Bars = Strongest signal.
• 1 Blinking Bar = Weakest signal. (A blinking bar indicates half of a bar.)
POWER
The Cradlepoint IBR900/IBR950 must be powered using an approved 9-33 VDC power
source.
• Green = Powered ON.
• No Light = Not receiving power. Check the power switch and the power source connection.
• Yellow = Attention. Open the administration pages and check the router status.
WiFi BROADCAST Indicates WiFi activity.
• Green = On and operating normally.
• Yellow = Attention.
GPS Indicates the status of GPS connection.
• Blue = GPS locked.
• Blinking Blue = Obtaining lock.
•
ADDITIONAL LED INDICATIONS
•
•
upgrade.
INTEGRATED MODEM
Indicates information about the integrated modem.
• Green = Modem has established active WAN connection.
• Blinking Green = Modem is connecting.
• Yellow = Modem not active.
• Blinking Yellow = Data connection error.
• Blinking Red = In process of resetting.
• No Light = Modem not connected.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 15
User Manual / IBR900/IBR950 1/5/17
QUICK START
BASIC SETUP
1. Insert an activated SIM
A wireless broadband data plan must be added to your Cradlepoint IBR900. Wireless broadband data plans are
available from wireless carriers such as Verizon, AT&T, Sprint, EE, and Vodafone. The SIM must be provisioned
with the carrier. Contact your carrier for details about selecting a data plan and about the process for
provisioning your SIM.
Once you have an activated SIM, insert it into the integrated modem. Insert the SIM card into the slot marked
SIM 1 (use the other slot, SIM 2, for a secondary/backup SIM).
To insert or remove SIM card:
1. Remove dual SIM cover.
2.
3. Replace dual SIM cover.
Note: Device will not power on without cover in place.
2. Attach the WiFi and modem antennas
Attach the three WiFi antennas (included) and two modem antennas to the connectors. Antennas are jointed,
which enables you to position them for optimal signal. To attach, hold the antenna straight and twist the base
of the antenna to connect, folding the joint if needed. NOTE: Ensure that the router antennas are not near metal
or other RF reflective surfaces.
3. Connect to power source
Wire power cable to 9-33 V power source. (AC power supply sold separately.)
ACCESSING THE ADMINISTRATION PAGES
Once you are connected, open the Cradlepoint IBR900’s GUI-based
1. Open a browser window and type “cp/” or “192.168.0.1” in the
address bar. Press ENTER/RETURN.
2. When prompted for your password, type the eight character
DEFAULT PASSWORD found on the product label.
NOTE: The product label shown is an example only: your DEFAULT
PASSWORD and SSID will be unique.
changes through Cradlepoint Enterprise Cloud Manager (ECM) without
logging into the local administration pages. Set up a group of routers
below for more
information about ECM.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 16
User Manual / IBR900/IBR950 1/5/17
FIRST TIME SETUP WIZARD
FIRST TIME SETUP WIZARD, which
the following:
• Administrator Password
• Time Zone
• WiFi Network Name
• Security Mode
• Access Point Name (APN) for SIM-based modems
• Modem Authentication
• Failure Check
If you are currently using the router’s WiFi network, you will need to reconnect your devices to the network
using the newly established wireless network name and password.
NOTE: To return to the First Time Setup Wizard after your initial login, select SYSTEM from the navigation bar,
expand Setup Wizard, and select First Time Setup.
USING ENTERPRISE CLOUD MANAGER
Rapidly deploy and dynamically manage networks at geographically distributed stores and branch locations with
Enterprise Cloud Manager, Cradlepoint’s next generation management and application platform. Enterprise Cloud
Manager (ECM) integrates cloud management with your Cradlepoint devices to improve productivity, increase
reliability, reduce costs, and enhance the intelligence of your network and business operations.
Click here to sign up for a free 30-day ECM trial.
Depending on your ordering process, your devices may have already been bulk-loaded into ECM. If so, simply
log in at cradlepointecm.com using your ECM credentials and begin managing your devices seamlessly from the
cloud.
If your device has not yet been loaded into your ECM account, you need to register. Log into the device
administration pages and select Enterprise Cloud Manager from the SYSTEM menu. Enter your ECM username
and password, and click on “Register”.
Once you have registered your device, go to cradlepointecm.com and log in using your ECM credentials.
For more information about how to use Cradlepoint Enterprise Cloud Manager, see the following:
• Getting Started
• ECM on the Knowledge Base
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 17
User Manual / IBR900/IBR950 1/5/17
ADMINISTRATION PAGES
Quick Links
Dashboard
Connection Manager
Status
Networking
Security
System
QUICK LINKS
DASHBOARD
The Dashboard is a centralized location for
basic information about the status of your
router. The areas include:
• Device Information
• Ethernet WAN*
• Modems*
• WWAN*
• Ethernet LAN*
• WiFi LAN*
*-To quickly edit settings for any of these
areas, click on the pencil icon ( ) in the top-
right of the desired dialog box.
You may return to the Dashboard at any time
by clicking on DASHBOARD from the left menu
or by clicking on the Cradlepoint logo at the
top-left of the screen.
Quick Links allows you to bookmark your most commonly-used settings. Simply click on the bookmark icon ( )
to add an item to your Quick Links menu. To remove an item from your Quick Links menu, select the item and
click on the remove bookmark icon ( ).
Quick Links Menu Add Quick Link Delete Quick Link
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 18
User Manual / IBR900/IBR950 1/5/17
CONNECTION MANAGER
The router can establish an uplink via Ethernet, WiFi as WAN, or 3G/4G modems (removable or external USB). If the
primary WAN connection fails, the router will automatically attempt to bring up a new link on another device: this
feature is called failover. If Load Balance is enabled, multiple WAN devices may establish a link concurrently.
This is a list of the available interfaces used to access the Internet. You can enable, stop, or start devices from this
section. Drag the priority icon ( ) up or down to set the interface the router uses by default and the order that it
allows failover.
WAN INTERFACE PROFILES & PRIORITY
Availability Key
Enable Load Balance
On Demand
WAN Verify Data Usage
FailbackStandby
STANDBY
Standby is used to decrease failover time from one WAN interface to another. When Standby is enabled for a WAN
Standby, the connection is already established and failover will take much less time.
Note that the current connected interface(s) is/are indicated by a green connection state. For interfaces on Standby,
the interface is indicated by a yellow connection state. If the interface is indicated in red, the interface is not currently
connected or in Standby.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 19
User Manual / IBR900/IBR950 1/5/17
LOAD BALANCE
To enable Load Balancing, select the check box for each desired
device. If this is enabled, the router will use multiple WAN
interfaces to increase the data transfer throughput by using any
connected WAN interface consecutively. Selecting Load Balance
will automatically start the WAN interface and add it to the pool
Balance for an active WAN interface may require the user to
restart any current browsing session.
From WAN Management, select the Load Balance Algorithm from
the following dropdown options:
• Round-Robin: Evenly distribute each session to the available WAN connections.
• Rate: Distribute load based on the current upload and download rates. A WAN device’s upload and download
bandwidth values can be set in CONNECTION MANAGER.
• Spillover
most available bandwidth. The estimated bandwidth rate is based on a combination of the upload and download
• Data Usage: This mode works in concert with the Client Data Usage feature.
cap in the data usage rule for each interface, rather than distributing sessions based solely on bandwidth. For proper
functioning you need to create data usage rules for each WAN device you will be load balancing. Make certain to select
the “Use with Load Balancing” checkbox in the data usage rule editor.
ON DEMAND
Typically, modem connections are not always on.
When the On Demand mode is selected a connection
to the Internet is made as needed. When On Demand
is not selected a connection to the Internet is always
maintained.
WAN VERIFY
If this is enabled, the router will check that the highest
priority active WAN interface can get to the Internet
even if the WAN connection is not actively being used.
If the interface goes down, the router will switch to
the next highest priority interface available. If this is
not selected, the router will still failover to the next
highest priority interface but only after the user has
attempted to get out to the Internet and failed.
Idle Check Interval: The amount of time between each
check. (Default: 30 seconds. Range: 10-3600 seconds.)
Monitor while connected
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 20
User Manual / IBR900/IBR950 1/5/17
FAILBACK
connection to its network.
Select the Failback Mode from the following
options:
• Usage
• Time
• Disabled
Usage Threshold: Fail back based on the amount
of data passed over time. This is a good setting
for when you have a dual-mode EVDO/WiMAX
modem and you are going in and out of WiMAX
coverage. If the router has failed over to EVDO it
will wait until you have low data usage before bringing down the EVDO connection to check if a WiMAX connection can
be made.
• High (Rate: 80 KB/s. Time Period: 30 seconds.)
• Normal (Rate: 20 KB/s. Time Period: 90 seconds.)
• Low (Rate: 10 KB/s. Time Period: 240 seconds.)
• Custom (Rate range: 1-100 KB/s. Time Period range: 10-300 seconds.)
Time: Fail back only after a set period of time. (Default: 90 seconds. Range: 10-300 seconds.) This is a good setting if
you have a primary wired WAN connection and only use a modem for failover when your wired connection goes down.
This ensures that the higher priority interface has remained online for a set period of time before it becomes active
(in case the connection is dropping in and out, for example).
Disabled: Deactivate failback mode.
Immediate Mode: Fail back immediately whenever a higher priority interface is plugged in or when there is a priority
change. Immediate failback returns you to the use of your preferred Internet source more quickly which may have
advantages such as reducing the cost of a failover data plan, but it may cause more interruptions in your network
than Usage or Time modes.
following dropdown options:
• Passive DNS (modem only): The router will take no action until data is detected that is destined for the WAN.
When this data is detected, the data will be sent and the router will check for received data for two seconds. If no
data is received the router behaves as described below under Active DNS.
• Active DNS (modem only): A DNS request will be sent to the DNS servers. If no data is received, the DNS request
server and the second two requests will be directed at the Secondary DNS server.) If still no data is received, the
device will be disconnected and failover will occur.
• Active Ping: A ping request will be sent to the Ping Target. If no data is received, the ping request will be retried
occur. When “Active Ping” is selected, the next line gives an estimate of data usage in this form: “Active Ping
could use as much as 9.3 MB of data per month.” This amount depends on the Idle Check Interval.
• O: Once the link is established the router takes no action to verify that it is still up.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 21
User Manual / IBR900/IBR950 1/5/17
DATA USAGE
Data UsageMonitor Monthly (or Weekly or Daily)
Usage to begin tracking this information. This data is not retained between router reboots.
For Monthly and Weekly you are able to specify the day to
start each cycle (e.g. the 1st or Tuesday, respectively).
Usage Cap: Enter a Cap amount in Megabytes. 1024
Megabyte is equal to 1 Gigabyte.
Use with Load Balancing: When checked, the Load
Balancing feature is allowed to use the thresholds and
metrics of this rule when making balance decisions. This
causes Load Balancing to spread the data usage between
interfaces according to the assigned usage rather than
these rules at a similar percentage utilization of data (e.g.
10%, 50%, 90%) as the cycle progresses, rather than quickly
using 100% of a fast 1GB capped interface while using only
a fraction of a slow 10GB capped interface, thus leaving
the rest of the cycle with only the slow interface. The Data
Shutdown on Cap: When checked, the WAN device will shutdown when the assigned usage is reached. A cycle reset or
a rule deletion will re-enable the device.
Alert on Cap: An email alert will be generated and sent when the assigned data cap is reached. NOTE: The SMTP mail
System > Device Alerts.
Custom Alerts:
usage cap.
Custom Alert Percentages: Example: “50,80,90,110” (values can exceed
100%) (Triggers alerts when 50, 80, 90, 110% of usage cap is used)
NOTE: To enable data usage, check Data Usage Enabled from WAN
Management.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 22
User Manual / IBR900/IBR950 1/5/17
STATUS
Internet
Local Networks
Client List
Tunnels
Firewall
Routing
Ethernet
GPS
System Logs
INTERNET
CONNECTIONS
Select your device to reveal
detailed information about the
following device properties:
• Summary
• Modem
• Cellular Network
• General Information
• Statistics
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 23
User Manual / IBR900/IBR950 1/5/17
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 24
User Manual / IBR900/IBR950 1/5/17
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 25
User Manual / IBR900/IBR950 1/5/17
CLIENT DATA USAGE
Displays the following client information:
• Name
• IP Address
• MAC Address
• Data Uploaded
• Data Downloaded
•
To reset information, click Reset Statistics.
STATISTICS
Statistics can be gathered at variable Sample Rate and Sample Size for the following areas:
• Wireless Device
• Data Usage
• Failover/Failback/Load Balance
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 26
User Manual / IBR900/IBR950 1/5/17
QOS
Displays packets and bytes transmitted and
received by your Quality of Service (QoS) queues.
NETWORKING
> QoS.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 27
User Manual / IBR900/IBR950 1/5/17
LOCAL NETWORKS
NETWORKING > Local
Networks.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 28
User Manual / IBR900/IBR950 1/5/17
CLIENT LIST
Displays information about
your Wireless, Wired, and
Hotspot Clients, and allows
you to Kick Wireless Clients,
block MAC addresses of both
Wireless and Wired Clients,
and Revoke Hotspot Clients.
TUNNELS
CP SECURE VPN
Displays status of your CP Secure
CP Secure VPN Tunnels, go to
NETWORKING > Tunnels > CP Secure
VPN.
IPSEC VPN
Displays status of your IPSec VPN
VPN Tunnels, go to NETWORKING >
Tunnels > IPSec VPN.
NETCLOUD ENGINE
Engine tunnels.
CP Secure VPN Tunnels, go to
NETWORKING > Tunnels > CP Secure
VPN.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 29
User Manual / IBR900/IBR950 1/5/17
OPEN VPN
GRE
NETWORKING > Tunnels
> OpenVPN.
NETWORKING > Tunnels > GRE.
FIREWALL
SECURITY
from the left navigation.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 30
User Manual / IBR900/IBR950 1/5/17
ROUTING
Displays information about your
System, protocol, BGP, OSPF, RIP,
these routes, go to NETWORKING >
Tunnels.
ETHERNET
Ethernet ports, go to NETWORKING > Local Networks >
Ethernet Ports.
GPIO
Displays information about your
SYSTEM > GPIO Conguration.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 31
User Manual / IBR900/IBR950 1/5/17
GPS
SYSTEM > Administration > GPS.
SYSTEM LOGS
SYSTEM > Administration > System
Logging.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 32
User Manual / IBR900/IBR950 1/5/17
NETWORKING
LOCAL NETWORKS
WIFI RADIO #1 (2.4GHZ)
Local Networks
VLAN Interfaces
Tunnels
Routing
QoS
DNS Servers
WiFi as WAN
WAN Anity
Client Data Usage
NHRP
WIFI RADIO #2 (5GHZ)
WiFi Name (SSID): When users browse for available
wireless networks, this is the name that they will
see. This name is referred to as the SSID (service set
recommends that you change this from the pre-
Hidden: This shows whether the router broadcasts its
attack a router that is not broadcasting its SSID, which
for friendly users to attach to a WiFi network with a
hidden SSID.
Isolate: Select this to isolate all wireless clients so they
cannot directly communicate with each other on the
wireless network.
To edit your wireless
network, select its name and
click Edit.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 33
User Manual / IBR900/IBR950 1/5/17
WMM
video streams are given higher priority than print jobs, since video streams need consistent throughput.
Enabled: Whether the network is available.
Security Mode: You have several options for selecting a security mode. The mode you choose depends on the
security features your wireless adapters support.
• WPA2 Personal
• WPA / WPA2 Personal
• WPA Personal
• WPA2 Enterprise
• WPA / WPA2 Enterprise
• WPA Enterprise
• WEP Auto
• Open
Select “Open” to create a hotspot: otherwise select the best security that your devices will support
(Cradlepoint recommends WPA2).
• “Personal” security modes require passwords.
• “Enterprise” security modes are linked to a RADIUS server and require RADIUS authentication: IP, Port, and
Shared Key (Secondary IP and NAS ID optional).
• “WPA2” (Personal or Enterprise) forces AES as the WPA Cipher.
• “WPA/WPA2” and “WPA” (Personal or Enterprise) allow AES, TKIP/AES, and TKIP.
• “WEP Auto” requires a WEP Key.
• “Open” has no password or other security measures.
NOTE: If you don’t know whether you should choose Personal or Enterprise, assume Personal since you need to
know RADIUS authentication for Enterprise.
In order to protect your network from hackers and unauthorized users, Cradlepoint highly recommends WPA2/
AES for security if your attached devices can support it. WEP and WPA/TKIP are obsolete and have been
replaced by WPA/AES. Using those security settings will cause the WiFi to limit to 802.11g modes.
NOTE: If you select one of the security modes and are unable to connect to the router afterwards, you can use
When you select either WiFi Radio #1 (2.4GHz) or WiFi Radio #2 (5GHz) from Local Networks, you have several
WiFi Settings heading.
Channel Selection Method: This controls how a WiFi channel is selected.
• User Selection – Manually set the channel
• Random Selection – The router randomly sets the channel
• Smart Selection (Default) – Scans to determine the lowest interference WiFi channel
Channel Selection Schedule: When using the “Smart” channel selection, this controls whether the router will
periodically rescan for a better channel and change to it. Select from “Once,” “Daily,” “Weekly,” or “Monthly.”
Note that there may be a momentary WiFi disconnection while the channel changes.
Channel: (Shows if User Selection is selected.) The WiFi channel* corresponds to a frequency the router uses to
communicate with other devices. For 2.4 GHz, the range is 1 to 11, and 1, 6, and 11 do not overlap each other.
Select a channel from the dropdown list:
• 1 (2412 MHz)
• 2 (2417 MHz)
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 34
User Manual / IBR900/IBR950 1/5/17
• 3 (2422 MHz)
• 4 (2427 MHz)
• 5 (2432 MHz)
• 6 (2437 MHz)
• 7 (2442 MHz)
• 8 (2447 MHz)
• 9 (2452 MHz)
• 10 (2457 MHz)
• 11 (2462 MHz)
For 5.0 GHz, the ranges are 36 to 64 and 149 to 165.
• 36 (5180 MHz)
• 40 (5200 MHz)
• 44 (5220 MHz)
• 48 (5240 MHz)
• 149 (5745 MHz)
• 153 (5765 MHz)
• 157 (5785 MHz)
• 161 (5805 MHz)
• 165 (5825 MHz)
* - Channels listed above represent US/FCC settings. EU
users will see different settings.
Client Timeout: If the access point is not able to
communicate with the client it will disconnect it after this timeout (in seconds).
TX Power: Normally the wireless transmitter operates at 100% power. In some circumstances, however, there
RTS Threshold: When an excessive number of wireless packet collisions are occurring, wireless performance
can be improved by using the RTS/CTS (Request to Send/Clear to Send) handshake protocol. The wireless
transmitter will begin to send RTS frames (and wait for CTS) when data frame size in bytes is greater than the
RTS Threshold. This setting should remain at its default value.
Fragmentation Threshold: Wireless frames can be divided into smaller units (fragments) to improve
performance in the presence of RF interference and at the limits of RF coverage. Fragmentation will occur
when frame size in bytes is greater than the Fragmentation Threshold. This setting should remain at its default
value. Setting the Fragmentation value too low may result in poor performance.
DTIM: A DTIM is a countdown informing clients of the next window for listening to broadcast and multicast
sends the next DTIM with a DTIM Interval value. Wireless clients detect the beacons and awaken to receive the
broadcast and multicast messages. The default value is 1. Valid settings are between 1 and 255.
Beacon: Beacons are packets sent by a wireless router to synchronize wireless devices. Specify a Beacon
Period value between 20 and 1000 milliseconds.
Short Slot: Slot Time is the period wireless clients use in determining if the channel is free for transmission.
Enabling this value allows clients that can utilize a shorter time to do so. Disabling this option forces all
transmission collisions.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 35
User Manual / IBR900/IBR950 1/5/17
Wireless Mode: Select the WiFi clients with which the router will be compatible. Greater compatibility is a
802.11 a/b/g/n/ac.
2.4 GHz options 5 GHz options
• 802.11 b
• 802.11 b/g
• 802.11 a/b/g/n
• 802.11 b/g/n
• 802.11 n
• 802.11 a/b/g/n/ac
• 802.11 g/n/ac
• 802.11 n/ac
• 802.11 ac
• 802.11 n
• 802.11 g
• 802.11 b
Protection: In Auto mode the device will use protection to improve performance in mixed mode networks. Turn
Airtime Fairness: Airtime Fairness will attempt to balance air time between faster and slower wireless clients
to more fairly distribute bandwidth.
Channel Width: Selects whether the router uses a single 20 MHz channel to send/receive, or uses two adjacent
20 MHz channels to create a 40 MHz channel. Higher performance is possible with the 40 MHz channel.
Selecting Auto is generally best. Enabling WiFi as WAN will force 20 MHz only mode.
Extended Channel: When operating in 40 MHz mode the access point will use an extended channel either below
or above the current channel. Optimal selection will depend on the channels of other networks in the area.
MCS: 802.11n uses multiple Modulation Coding Schemes to enable higher throughput in various environments.
Since clients can dynamically change rates depending on environment, selecting Auto is generally best.
Short GI: Short GI is an optimization for shortening the interval between transmissions. May be incompatible
with older clients.
RADIUS Timeout: (Default: 3600 seconds) When using an Enterprise security mode clients will be forced to re-
authenticate with the RADIUS server at this interval in seconds. This allows administrators to revoke access so
when an attached client’s authentication expires, the client must re-authenticate.
RADIUS Retry: (Default: 60 seconds) When using an Enterprise security mode, if a RADIUS query fails to
receive a response from the server it will delay by this interval (in seconds) before attempting another query.
unreachable.
ETHERNET PORTS
circumstances, you have the ability to control: Mode (WAN or LAN) and Link Speed. Additional controls for WAN
ports are available in CONNECTION MANAGER.
Mode: WAN or LAN. By default there are two LAN (Local Area Network) ports and one WAN (Wide Area
Network) port.
• Internet (WAN) is used as a possible source of Internet for the router
• Local Network (LAN) is for connecting a computer or similar device directly to the router with an Ethernet
cable.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 36
User Manual / IBR900/IBR950 1/5/17
HOTSPOT SERVICES
Any of your networks can be enabled as a
hotspot. To enable a hotspot, you need to
select a network and set it as a hotspot in
NETWORKING > Hotspot Services.
NOTE: Although any network can be a hotspot,
the router allows only one hotspot.
Hotspot Mode: Choose from the following
dropdown options:
• Simple: Allows “Terms of Use” page and
timeout settings controlled within the
router
• RADIUS/UAM: Allows you to set up external
authentication servers
Local IP Network
Configure and set the IPv4 Routing Mode
to “Hotspot” for the LAN Group you want to use.
NOTE: Routing Mode is in the Primary LAN Editor under the IPv4 Settings tab. Select a network in
NETWORKING > Local IP Networks and click Edit to open the Primary LAN Editor.
Allow Service on 3G/4G Modems: Allows you to enable or disable hotspot access to the Internet over a modem.
This is often used if the router has a main wired link and a secondary modem for failover (typically with a more
the wired connection goes down.
Disable Service if Ethernet Threshold is met: This will block hotspot use of the WAN when the threshold is
met. This can be used if the router is being used as a backup failover connection to another router with a wired
connection. If that other router’s wired connection goes down and it starts using this router for its primary
connection, then disable hotspot use of the WAN connection. Set the limiting Rate (KB/s) and Time Period
(seconds).
Redirect HTTPS Requests: This allows initial requests to HTTPS websites to be redirected appropriately.
Hotspot/UAM Authentication Port
the port.
Simple Mode Settings
Display: This section allows you to choose if a “Terms of Use” page will be given to the user connecting to the
hotspot.
• Internal Terms of Use. Fill in your own terms of use.
Link Speed: Default setting is Auto. The Auto setting is preferred in most cases.
• Auto
• 10Mbps - Half Duplex
• 10Mbps - Full Duplex
• 100Mbps - Half Duplex
• 100Mbps - Full Duplex
• 1000Mbps - Full Duplex
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 37
User Manual / IBR900/IBR950 1/5/17
• External Terms of Use. Specify a URL that has the
Terms of Use page. Users will automatically be
directed to this page.
• No Terms of Use. Redirect Only.
Redirection on Successful Authentication: Depending
on your choice for the “Terms of Use” page, your have
further options for where the user will be directed.
After the user accepts the terms, you can either
let him/her continue to the URL they were trying to
URL once before continuing on.
• To the URL the user intended to visit
•
Redirect URL: If you have chosen to send users to an
the address.
Session Timeout: (Default: 60 minutes.) The amount
of time the user may use the router before being
forced to authenticate again.
Idle Timeout: (Default: 15 minutes.) If the user is idle for this amount of time, make them re-authenticate.
Bandwidth (upload): (Default: 512 Kbits/sec.) The data rate limit for users uploading data through the hotspot.
Bandwidth (download): (Default: 1024 Kbits/sec.) The data rate limit for users downloading data through the
hotspot.
Allowed Hosts/Domains Prior to Authentication
Adding hostnames to this list will allow access from your
network to any external domain or website prior to being
authenticated. For example, a hotel might allow access to
its own website prior to authentication.
Click Add to enter new hostnames you wish to allow.
Enter the hostname or domain name of the website you
wish to allow, e.g. www.company.com or company.com. To
allow all domain and sub-domain options, use a wildcard, e.g. *.company.com.
Click Update to save your additions.
Authorized MAC Addresses
Add the MAC addresses of trusted machines. This gives them automatic
access through the hotspot portal.
Click Add to enter new MAC Addresses you wish to allow.
Click Update to save your additions.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 38
User Manual / IBR900/IBR950 1/5/17
DHCP SERVER
addresses to the computers and other devices on each local area network (LAN). In this section you can view a
list of assigned IP addresses and reserve IP addresses for particular devices.
Active Leases: A list of devices that have
been provided DHCP leases. The DHCP server
automatically assigns these leases. This list
will not include any devices that have static
IP addresses on the network. Select a device
and click Reserve to add the device and its IP
address to the list of Reservations.
Reservations: This is a list of devices with
reserved IP addresses. This reservation is
almost the same as when a device has a static
IP address except that the device must still
request an IP address from the router. The
router will provide the device the same IP
address every time. DHCP reservations are
helpful for server computers on the local network that are hosting applications such as Web and FTP. Servers
on your network should either use a static IP address or a reservation.
While you have the option to manually input the information to reserve an IP address (Hostname, Hardware
Addr, IP Addr), it is much simpler to select a device under the Active Leases section and click “Reserve.” The
selected device’s information will automatically be added under Reservations.
LOCAL IP NETWORKS
Local IP Networks displays the following information for
each network:
• Network Name, IP address/Netmask, and Enabled/
Disabled (along the top bar)
• Multicast Proxy (Enabled/Disabled)
• DHCP Server (Enabled/Disabled)
• DHCP Relay (Enabled/Disabled)
• Schedule (Enabled/Disabled – See the Schedule tab in
the Local Network Editor)
• VRRP Failover State (Disabled, Backup, or Master)
• IPv4 Routing Mode (NAT, Standard, IP Passthrough,
Hotspot, Disabled)
• IPv6 Addressing Mode (SLAAC Only, SLAAC with
DHCP, Disable SLAAC and DHCP)
• Access Control (Admin Access, UPnP Gateway, LAN Isolation)
• Attached Interfaces (Ethernet ports, WiFi, VLAN)
Click AddRemove to delete a network, or select an existing network and click Edit
General Settings
Enabled:
work with certain types of modems.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 39
User Manual / IBR900/IBR950 1/5/17
Name: The “name” property primarily helps to identify
this network during other administration tasks.
Hostname: The hostname is the DNS name associated
with the router’s local area network IP address.
IPv4 Settings
IP Address: This is the address used by the router for
local area network communication. Changes to this
parameter may require a restart to computers on this
network.
Netmask: The netmask controls how many IP addresses
can be used in this network. The default value is usually
acceptable for most situations.
IPv4 Routing Mode: Each network can use a unique
routing mode to connect to the Internet. The default of
• NAT: Network Address Translation hides private IP addresses behind the router’s IP address.
• Standard: Without NAT exposes the subnet addresses which requires them to be externally routable.
• IP Passthrough: IP Passthrough passes the IP address given by the modem WAN through the router.
Hotspot, VPN, and GRE must be disabled. Any Wireless interfaces must be removed from this network in
order to enable IP Passthrough.
• Hotspot: Provide Hotspot Services on this Network, requiring Terms of Service or RADIUS/UAM
authentication before WAN access will occur on both Wireless and Wired LAN connections.
IPv6 Settings
IPv6 Address Source: The Address source has three settings. The default of Delegated is desirable in most
• Delegated: The address is provided by a router connected to this router’s WAN.
• Static: The address is provided by the router admin.
• None: No use of an IPv6 WAN address, IPv6 is disabled on the WAN.
IPv6 Address: An IPv6 Address is a unique numerical label for a computer or device using the Internet Protocol
(IP). IPv6 addresses are typically in the format composed of 8 sets of 4 hexadecimal numbers. Leading zeros
can be ignored and the longest set of continuous zeros can be replaced with ::. For example, the IPv6 address
of 0001:0000:0234:5678:0000:0000:9abc:0def can be expressed as 1:0:234:5678::9abc:def.
Interfaces
Select the network interfaces which will
be attached to this network by either
dragging desired interface or clicking left
or right arrows to move them between
Available Interfaces and Selected
Interfaces.
Access Control
UPnP Gateway: Select the UPnP
(Universal Plug and Play) option if you
want to enable the UPnP Gateway service
for computers on this network.
Admin Access: When enabled users may access these admin pages from this network.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 40
User Manual / IBR900/IBR950 1/5/17
IPv4 DHCP
DHCP Server
• Enable DHCP Server: When the DHCP server is
enabled, users of your network will be able to
automatically connect to the Internet without
that you leave this enabled. Advanced
NETWORKING > Local Networks > DHCP
Server.
• Range Start: The starting IP address in the
DHCP Server range is the beginning of the
reserved pool of IP addresses which will be
given to any DHCP enabled computers on your
• Range End: The ending IP address in the DHCP Server range is the end of the reserved pool of IP
addresses which will be given to any DHCP enabled computers on your network. The default value is
• Lease Time:
new DHCP lease. Smaller values are better suited to busy environments.
• Custom Options: Send optional extra options to DHCP clients of this network. This can be used to, for
example, set the boot TFTP server of a network for disk-less clients.
DHCP Relay
• Enable DHCP Relay: DHCP Relay communicates with a DHCP server and acts as a proxy for DHCP
broadcast messages that must be routed to remote segments. This is accomplished by converting
broadcast DHCP messages to unicast messages to communicate between clients and servers.
Multicast Proxy
Multicast Proxy:
Quick Leave Mode: Disable quick leave mode if it’s vital that the daemon should act exactly as a real multicast
client on the upstream interface. However, disabling this function increases the risk of bandwidth saturation.
Altnet:
legal multicast sources.
IPv6 Addressing
Address Configuration Mode:
DHCP Range Start: The DHCP Range Start is the beginning of the range that will be used for IPV6 DHCP
addresses. The IPv6 range will always start at 1.
DHCP Range End: The ending IP address in the DHCP Server range is the end of the reserved pool of IP addresses
which will be given to any DHCP enabled computers on your network.
IPv6 DHCP Lease Time:
lease.
Schedule
Enable Schedule Service: Enable the interface scheduler. A schedule allows an interface to be enabled or disabled
VRRP
Enable VRRP: Enable or disable VRRP.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 41
User Manual / IBR900/IBR950 1/5/17
Virtual Router IP: IP Address of the Virtual Router.
Virtual Router ID:
Router Priority: Failover priority of this router. The highest
priority router will take ownership of the Virtual IP.
WAN Fault Priority: This optional value sets the failover priority
of this router when no WAN connection is available. If the value
matches the normal router priority, WAN connection state
will not be considered. If the value is empty (the default), the
router will always give up the Virtual IP and let a new master
take over when no WAN connection is available.
Advertisement Interval: Sets the amount of time (in seconds)
between sending VRRP advertisements.
Initial Value Router State: This controls the initial failover state
Authentication: VRRP Authentication Method. Note that VRRP
Authentication has been deprecated as of RFC 3768.
Password: VRRP Group Password.
Provide Virtual IP in DHCP leases: Select this to automatically set the DHCP default gateway address and DNS
server address to the Virtual IP in DHCP leases provided on this network.
STP
Enable STP: Enable Spanning Tree Protocol loop detection.
Bridge Priority: Set the priority of the bridge. When determining the root bridge of the spanning tree topology,
be the root bridge, then set it to a value less than the default of 32768. A valid priority value is between 0 and
65535.
Wired 802.1X
Enable 802.1X: Require IEEE 802.1X Authorization.
Reauthentication Period: EAP reauthentication period in
seconds.
Auth Server IP Address: IP address of the connected RADIUS
server.
Auth Server MAC Address: Hardware address of the
connected RADIUS server’s interface. NOTE: If you don’t
know the MAC address for the RADIUS server, enter
00:00:00:00:00:00, and the service will try to find the MAC
address from the given IP address.
Port
Password
Acct Server IP Address: IP address of the connected RADIUS
server.
Acct Server MAC Address: This is the Hardware address
of the connected RADIUS server’s interface. NOTE: If you
don’t know the MAC address for the RADIUS server, enter
00:00:00:00:00:00, and the service will try to find the MAC
address from the given IP address.
Port
Password
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 42
User Manual / IBR900/IBR950 1/5/17
connected to your router.
Filter Conguration
The MAC Filter allows you to create a list of devices that have either exclusive access (whitelist) or no access
(blacklist) to your local network.
Enabled: Click to allow MAC Filter options.
Whitelist: Select either “Whitelist” or “Blacklist” from
a dropdown menu. In “Whitelist” mode, the router
will restrict LAN access to all computers except those
contained in the “MAC Filter List” panel. In “Blacklist”
mode, listed devices are completely blocked from local
network access.
MAC Filter List (Whitelist or Blacklist)
Add devices to either your whitelist or blacklist simply
by inputting each device’s MAC address.
NOTE: Use caution when using the MAC Filter to avoid
accidentally blocking yourself from accessing the
router.
MAC Logging Conguration
Enable MAC Logging: Enabling MAC Logging will cause the router to log MAC addresses that are connected to
the router. MAC addresses that you do not want to have logged (addresses that you expect to be connected)
should be added to the “Ignored MAC Addresses” list.
has a MAC address that the router doesn’t recognize. Go to SYSTEM >
Device Alerts to set up these email alerts.
Ignored MAC Addresses
This is the list of MAC addresses that will not produce an alert or a log
entry when they are connected to the router. These should be MAC
addresses that you expect to be connected to the router. To add MAC
addresses to this list, simply select devices shown in the MAC Address
Log and click “Ignore.” You can also add addresses manually.
MAC Address Log
This shows the last 64 MAC addresses that have connected to the router, as well as which interface was used
to show the most recent log entries.
Double-clicking on entries from this list will add them to the Ignored MAC Addresses list.
MAC FILTER & LOGGING
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 43
User Manual / IBR900/IBR950 1/5/17
TUNNELS
CP SECURE VPN
private data network that minimizes both cost and complexity. Unlike traditional
bulky head-end concentrator hardware solutions, CP Secure VPN allows IT managers
to secure their expanding Edge Networks using architectures that scale quickly and
are easy to maintain. For more information, visit cradlepoint.com.
Click AddEdit to make changes to an
existing tunnel.
Add/Edit Tunnel – General
Name
Activation Username: Account username.
Activation Password: Account password.
VLAN INTERFACES
A virtual local area network, or VLAN, functions as
any other physical LAN, but it enables computers
and other devices to be grouped together even
if they are not physically attached to the same
network switch.
To enable a VLAN, select a VID (virtual LAN ID) and
a group of Ethernet ports through which users
can access the VLAN. Then go back up to the Local
Network Editor to attach your new VLAN to a
network. To use a VLAN, the VID must be shared
with another router or similar device so that
multiple physical networks have access to the one
virtual network.
Click Add to create a new VLAN interface. To edit
an interface, select the check box next to the
desired interface.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 44
User Manual / IBR900/IBR950 1/5/17
Remote Gateway: US and European gateways associated with
activation username and password.
Port: Remote Secure port.
Certificate Name
SECURITY/Certicate Management.
Tunnel Enabled: Enabled or Disabled.
NOTE: CP Secure VPN requires an ECM Prime subscription. For
more information, visit cradlepoint.com.
IPSEC VPN
VPN (virtual private network) tunnels
are used to establish a secure
connection to a remote network over
a public network. For example, VPN
tunnels can be used across the Internet
networks to function as one network.
The two networks set up a secure connection across the (normally) unsecure Internet by assigning VPN
encryption protocols.
Cradlepoint VPN tunnels use IPsec (Internet Protocol security) to authenticate and encrypt packets exchanged
across the tunnels. To set up a VPN tunnel with a Cradlepoint router on one end, there must be another device
(usually a router) that also supports IPsec on the other end.
IKE (Internet Key Exchange) is the security protocol in IPsec. IKE has two phases, phase 1 and phase 2. The
The VPN tunnel status page allows you to view the state of the VPN tunnels. If a tunnel fails to connect to the
remote site, check the System Logs for more information. You may double click on a cell to directly edit that
information.
Click AddEdit to
make changes to an existing tunnel.
Add/Edit Tunnel – General
Tunnel Name: Give the tunnel a name that uniquely
Anonymous Mode: Select to allow remote connections
from any IP address.
Responder Mode: When enabled, the router will not
initiate negotiation with peers.
Local Identity
remote host during phase 1 negotiation. If left blank it
will default to the IP address of the WAN connection.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 45
User Manual / IBR900/IBR950 1/5/17
being used, a single word (instead of an address) can be used if a DynDNS connection is not being used.
Remote Identity
IP address of the WAN connection. If NAT-T is being used, a single word (instead of an address) can be used if a
DynDNS connection is not being used.
Authentication Mode: Select from Pre-Shared Key and Certificate. Pre-Shared Key is used when there is a
single key common to both ends of the VPN. Certificate
private key that can be uploaded to the router. Select Enable Certificate Support in the Global VPN Settings
Pre-Shared Key: Create a password or key. The routers on both sides of the tunnel must use this same key.
Mode: Select from Tunnel, Transport or V TI-Tunnel. Tunnel Mode
Transport Mode is
used for end-to-end communications (for example, for communications between a client and a server). VTI
Tunnel
Initiation Mode: Always On or On Demand. Always On is used if you want the tunnel to initiate the tunnel
connection whenever the WAN becomes available. Select On Demand if you want the tunnel to initiate a
Tunnel Enabled: Enabled or Disabled.
Add/Edit Tunnel – Local Gateway
IP Version: Select IPv4 or IPv6.
WAN Binding: WAN Binding is an optional parameter
An example use case is when there is a router with both
a primary and failover WAN device and the tunnel should
only be used when the system has failed over to the
backup connection.
Make a selection for “When,” “Condition,” and “Value” to
create a WAN Binding. The condition will be in the form
of these examples:
When Condition Value
Port Is USB Port 1
Type Is not WiMax
• When:
• Port – Select by the physical port on the router that you are plugging the modem into (e.g., “USB
Port 2”).
• Manufacturer – Select by the modem manufacturer (e.g., “Cradlepoint Inc.”).
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 46
User Manual / IBR900/IBR950 1/5/17
• Model
• Type – Select by type of Internet source (Ethernet, LTE, Modem, Wireless as WAN, WiMAX).
• Serial Number – Select a 3G or LTE modem by the serial number.
• MAC Address – Select a WiMAX modem by MAC Address.
• Unique ID – Select by ID. This is generated by the router and displayed when the device is connected
to the router.
• Condition: Select “is,” “is not,” “starts with,” “contains,” or “ends with” to create your condition’s
statement.
• Value: If the correct values are available, select from the dropdown list. You may need to manually input
the value.
Invert Binding: Advanced option that inverts the meaning of WAN Binding to only establish this tunnel when
NOT connected.
Add/Edit Tunnel – Local Networks
IP Version: Select IPv4 or IPv6.
The Network Address and the Netmask
VPN tunnel.
NOTE
Optionally: A Port
Add/Edit Tunnel – Remote Gateway
Gateway: This value can be any of the following: an
name in the form of “host.domain.com” (DNS names
are case-insensitive, so only lower case letters are
allowed). It is recommended that you use a dynamic
DNS hostname instead of the static IP address – by
using the dynamic DNS hostname, updates of the
remote WAN IP are compensated for while connecting
to a VPN tunnel.
Add/Edit Tunnel – Remote Networks
The Network Address and the Netmask
remote network address range that local devices will
have access to via the VPN tunnel.
NOTE: the remote network IP address MUST be
Optionally: A Port
Add/Edit Tunnel – IKE Phase 1
To set up a tunnel with a remote site, you need to match your tunnel’s IKE negotiation parameters with
the remote site. By selecting several encryption, hash, and DH group options, you improve your chances
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 47
User Manual / IBR900/IBR950 1/5/17
for a successful tunnel negotiation. For greatest
compatibility, select all options; for greatest security,
select only the most secure options that your devices
support.
Exchange Mode: The IKE protocol has two modes
of negotiating phase 1 – Main (also called Identity
Protection) and Aggressive.
• In Main mode, IKE separates the key information
from the identities, allowing for the identities
of peers to be secure at the expense of extra
packet exchanges.
• In Aggressive mode, IKE tries to combine as much
information into fewer packets while maintaining
security. Aggressive mode is slightly faster but
less secure.
Because it has better security, Main mode is recommended for most users.
Key Lifetime: The lifetime of the generated keys of phase 1 of the IPsec negotiation from IKE. After the time
has expired, IKE will renegotiate a new set of phase 1 keys.
Encryption, Hash, and DH Groups
Each IKE exchange uses one encryption algorithm, one hash function, and one DH group to make a secure
exchange.
Encryption: Used to encrypt messages sent and received by IPsec.
• AES 128
• AES 256
• DES
• 3DES
Hash: Used to compare, authenticate, and validate that data across the VPN arrives in its intended form and to
derive keys used by IPSec.
• MD5
• SHA1
• SHA2 256
• SHA2 384
• SHA2 512
Note that some Encryption/Hash combinations (e.g., 3DES with SHA2 384/512) are computationally expensive,
impacting WAN performance. AES is as strong an encryption and performs much better than 3DES.
DH Groups
numbers associated with key generation. The strength of the key generated is partially determined by the
strength of the DH Group. Group 5, for instance, has greater strength than Group 2.
• Group 1: 768-bit key
• Group 2: 1024-bit key
• Group 5: 1536-bit key
In IKE Phase 1 you can only select one DH group if you are using Aggressive exchange mode.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 48
User Manual / IBR900/IBR950 1/5/17
By default, all the algorithms (encryption, hash, and DH groups) supported by the device are checked, which
means they are allowed for any given exchange. Deselect these options to limit which algorithms will be
accepted. Be sure to check that the router (or similar device) at the other end of the tunnel has matching
algorithms.
The algorithms are listed in order by priority. You can reorder this priority list by clicking and dragging
algorithms up or down. Any selected algorithm may be used for IKE exchange, but the algorithms on the top of
the list are more likely to be used more often.
Add/Edit Tunnel – IKE Phase 2
Perfect Forward Secrecy (PFS): Enabling this feature will require IKE to generate a new set of keys in phase
2 rather than using the same key generated in phase 1. Additionally, with this option enabled the new keys
security.
Key Lifetime: The lifetime of the generated keys of phase 2 of the IPsec negotiation from IKE. After the time
has expired, IKE will renegotiate a new set of phase 2 keys.
Phase 2 has the same selection of Encryption and DH Groups as phase 1, but you are restricted to only one
DH Group. Phase 2 and phase 1 selections do not have to match. For the Hash selection an added value of
truncation, but RFC4868 requires 128-bit. A VPN to newer Cisco or Juniper devices will typically require 128-bit.
Add/Edit Tunnel – Dead Peer Detection
Dead Peer Detection (DPD)
will detect when one end of the IPsec session loses
connection while a policy is in use.
Connection Idle Time
will allow an IPsec session to be idle before beginning
to send Dead Peer Detection (DPD) packets to the
peer machine. (Default: 30 seconds. Range: 10 – 3600
seconds.)
Request Frequency allows you to adjust the delay
between these DPD packets. (Default: 15 seconds.
Range: 2 – 30 seconds.)
Maximum Requests: Specify how many requests to
send at the selected time interval before the tunnel
is considered dead. (Default: 5. Range: 2 – 10.)
Failback Retry Period: If you have VPN tunnel failover/failback enabled (see below), set the time period
between each check on the primary network after failover. (Default: 10 seconds. Range: 5 – 60 seconds.)
Failover Tunnel and Failback Tunnel: Use these settings to create two tunnels – one as the primary tunnel and
1. Create two tunnels: one for primary and one for backup. Make sure that both tunnels have the same
Remote Network and that both have Dead Peer Detection enabled.
2. Choose one to be the primary tunnel. Open the editor for this tunnel and make sure Tunnel Enabled is
selected. Then go to the Dead Peer Detection page. Under Failover Tunnel select the other tunnel you
have created.
3. Open the editor for the failover tunnel. Make sure Tunnel Enabled is not selected. On the Dead Peer
Detection page, set the Failback Tunnel to your primary tunnel.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 49
User Manual / IBR900/IBR950 1/5/17
Global VPN Settings
Enable VPN Service: Enabling VPN Service will
router.
Certificate Name
IKE / ISAKMP Port: Internet Key Exchange
/ Internet Security Association and Key
Management Protocol port. (Default: 500. This
is a standard VPN port that usually does not
need to be changed.)
IKE / ISAKMP NAT-T Port: Internet Key Exchange
/ Internet Security Association and Key
Management Protocol network address translation traversal port. (Default: 4500. This is a standard VPN NAT-T
port that usually does not need to be changed.)
NAT-T KeepAlive Interval: Number of seconds between sending NAT-T packets to keep the tunnel alive if no
all cases.)
Tunnel Connect Retry: Number of seconds between connection attempts. (Default: 30 seconds. Range: 10-255
OpenVPN is an open source software application that implements virtual private network (VPN) techniques
access facilities.
NOTE: OpenVPN requires a feature license not included with ECM Prime. Go to SYSTEM > Administration >
Feature Licenses to enable this feature.
Once you have a valid feature license, click Add to
create a new OpenVPN tunnel. Click Edit to make
changes to an existing tunnel.
Add/Edit Tunnel – General
• Tunnel Name – Enter a name to uniquely
identify this tunnel
• Tunnel Mode – Select which mode this tunnel
endpoint is required to be. Choose from the
following:
• Client
• Server
• Device Type - Select between Routed (TUN)
or Bridged (TAP) virtual device.
• Routed creates an interface that can
be used in the Zone Firewall and is fully
routable.
OPEN VPN
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 50
User Manual / IBR900/IBR950 1/5/17
• Bridged creates a network interface that can be assigned to a LAN under the Local Networks
• Local Endpoint - Enter the IP Address of the LNS (tunnel server) peer
• Local Netmask – Enter the Netmask of the LNS (tunnel server) peer
• Remote Endpoint – Enter the IP Address of the LNS (tunnel server) peer
• Remote Netmask – Enter the Netmask of the LNS (tunnel server) peer
• Support IPv6 Tunnels
input an IPv6 Tunnel Address and Tunnel Prefix Length for IPv6
• Tunnel Protocol – Choose UDP or TCP
• Port – Specify the port if desired
• Ping – (Displays if the Configuration Mode is Advanced) If no packets have been sent in the amount of
time entered, a ping is sent to the remote endpoint
• Ping Restart – (Displays if the Configuration Mode is Advanced) If no pings have been received in the
amount of time entered, OpenVPN restarts the tunnel
• Tunnel Enabled – Click to enable/disable this tunnel
Add/Edit Tunnel – Security
• Cipher – Encrypt packets with the selected algorithm.
of being fast, very secure, and allowing key sizes of up
where keys are changed infrequently. OpenVPN supports
the CBC, CFB, and OFB cipher modes, however CBC is
recommended and CFB and OFB should be considered
advanced modes.
• Auth Algorithm – Authenticate packets with HMAC using
message digest algorithm alg. (The default is SHA1).
HMAC is a commonly used message authentication
algorithm (MAC) that uses a data string, a secure hash
algorithm, and a key, to produce a digital signature.
• Verify peer certicate
was signed with RFC3280 TLS rules set in key usage and
in-the-middle attacks.
• TLS-Authentication – In client/server mode: adds an additional layer of HMAC authentication on top of the
tls control channel to protect against DoS attacks. In point-to-point mode: encrypts the communication
using a static key. These keys must match on each endpoint.
Add/Edit Tunnel – Remote Servers
Create a list of remote server connections to connect to. OpenVPN will try to connect to each host in the list. If
a disconnect occurs from a given server, the next server will be tried in a round-robin fashion.
• Host – IP address of the remote server
• Port – Specify the port if desired
• Protocol – Select UDP or TCP
Add/Edit Tunnel – Routes
Add or remove the routes that will be used to direct packets through the tunnel.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 51
User Manual / IBR900/IBR950 1/5/17
Generic Routing Encapsulation (GRE) tunnels can be used to create a connection between two private
networks. Most Cradlepoint routers are enabled for both GRE and VPN tunnels. GRE tunnels are simpler to
• Local Network and Remote Network addresses for the “Glue Network,” the network that is created by
the administrator that serves as the “glue” between the networks of the tunnel. Each address must be a
the tunnel.
• Remote Gateway, the public facing WAN IP address that the local gateway is going to connect to.
• Routes
tunnel.
Optionally, you might also want to enable the tunnel Keep Alive feature to monitor the status of a tunnel and
more accurately determine if the tunnel is alive or not.
Click AddEdit to make changes to an existing tunnel.
Add/Edit Tunnel – General
Tunnel Name: Give the tunnel a name that
Tunnel Key: Enables an ID key for a GRE tunnel,
(Multipoint GRE).
Local Network: This is the local side of the
“Glue Network,” a network created by the
administrator to form the tunnel. The user
creates the IP address inputted here. It must be
it is gluing together. Choose any private IP
address from the following three ranges that
doesn’t match either network:
• 10.0.0.0 - 10.255.255.255
• 172.16.0.0 - 172.31.255.255
• 192.168.0.0 - 192.168.255.255
Remote Network: This is the remote side of
the “Glue Network.” Again, the user must create an IP address that is distinct from the IP addresses of the
networks that are being glued together.
GRE
• Network Address
• Netmask
Generate Client Conguration
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 52
User Manual / IBR900/IBR950 1/5/17
Subnet Mask
with this mask. 255.255.255.0 is a logical choice for most users.
Remote Gateway: This is the public facing, WAN-side IP address of the network to which the local gateway is
going to connect.
TTL: Set the Time to Live (TTL), or hop limit, for the GRE tunnel.
MTU: Set the maximum transmission unit (MTU) for the GRE tunnel.
WAN BindingONLY operate when
both a primary and failover WAN device and the tunnel should only be used when the system has failed over to
the backup connection.
Make a selection for “When,” “Condition,” and “Value” to create a WAN Binding. The condition will be in the
form of these examples:
When Condition Value
Port Is USB Port 1
Type Is not WiMax
• When:
• Port – Select by the physical port on the router into which you are plugging the modem (e.g., “USB
Port 2”).
• Manufacturer – Select by the modem manufacturer (e.g., “Cradlepoint Inc.”)
• Model
• Type – Select by type of Internet source (Ethernet, LTE, Modem, Wireless as WAN, WiMAX)
• Serial Number – Select a 3G or LTE modem by the serial number
• MAC Address – Select a WiMAX modem by MAC Address
• Unique ID – Select by ID. This is generated by the router and displayed when the device is connected
to the router.
• Condition: Select “is,” “is not,” “starts with,” “contains,” or “ends with” to create your condition’s
statement.
• Value: If the correct values are available, select from the dropdown list. You may need to manually input
the value.
Invert WAN Binding: Advanced option that inverts the meaning of WAN Binding to only establish this tunnel
NOT connected.
Tunnel Enabled: Select to activate the tunnel.
Add/Edit Tunnel – Routes
allowed through the tunnel.
Click Add Route
remote network:
• Network Address – This is the network address that is the destination of the route. This should be set to
the network address at the remote side of the tunnel.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 53
User Manual / IBR900/IBR950 1/5/17
NEMO
session continuity for every node in a mobile network as the network moves.
NOTE: NEMO requires a feature license not included with ECM Prime. Go to SYSTEM > Administration > Feature
Licenses to enable this feature.
NEMO requires a service provider, e.g. Verizon Wireless Private Network with DMNR (Dynamic Mobile Network
Once you have a NEMO service provider and a valid feature license, add networks to the Networks Routed by
NEMOAdd. In the popup window, input:
• Network Address - This is the network address that is the destination of the route. This should be set to
the network address at the remote side of the tunnel.
• Netmask
local network you want associated with the NEMO settings.
• Netmask
You can set the tunnel to connect to a range of IP addresses or to a single IP address. For example, you could
input 192.168.0.0 and 255.255.255.0 to connect your tunnel to all the addresses of the remote network in
the 192.168.0.x range. Alternatively, you could select a single address by inputting that address along with a
Netmask of 255.255.255.255.
Add/Edit Tunnel – Keep Alive
GRE keep-alive packets can be enabled to be sent
through the tunnel in order to monitor the status of the
tunnel and more accurately determine if the tunnel is
alive or not.
GRE keep-alive packets may be sent from both sides of a
tunnel, or from just one side.
Enabled: Select to enable GRE Keep Alive to continually
send keep-alive packets to the remote peer.
Rate: Choose the length of time in seconds for each
check (Default: 10 seconds. Range: 2 – 3600 seconds).
Retry: Select the number of attempts before the GRE
tunnel is considered down or up (Default: 3. Range: 1 –
255).
Failover Tunnel and Failback Tunnel: Use these settings
failback, complete the following steps:
1. Create two tunnels: one for primary and one for backup. Make sure both tunnels have Keep Alive enabled.
2. Choose one to be the primary tunnel. Open the editor for this tunnel and make sure Tunnel Enabled is
selected. Then go to the Keep Alive page. Under Failover Tunnel select the other tunnel you have created.
3. Open the editor for the failover tunnel. Make sure Tunnel Enabled is not selected. On the Keep Alive page,
set the Failback Tunnel to your primary tunnel.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 54
User Manual / IBR900/IBR950 1/5/17
Network Mobility (NEMO) Settings
Enbable: Enable NEMO.
WAN: Select the WAN(s) to use for the NEMO
connection. An expression such as “Unique ID is (any)”
will allow NEMO to operate on any WAN, whereas
“Type is LTE” will limit NEMO operation to the WAN(s)
provided by any connected LTE device(s).
With WAN: Register the NEMO connection simultaneous
If not checked, will only register the NEMO connection
when needed.
Home IP Address and Home Netmask – These may be
provided by your NEMO service provider. The IP address is a placeholder, “dummy” address; any IP address can
be used (1.2.3.4 is common).
Home Agent IP Address, Home Agent Password, and Home Agent SPI
NEMO service provider.
Renew Registration – The NEMO network regularly re-registers with the home agent (e.g., every 30 seconds).
Specify the number of seconds between each check-in.
MTU – Override the maximum transmission unit (MTU) of the NEMO tunnel. The TCP MSS (maximum segment
size) is automatically derived from the MTU. Leave blank to rely on Path MTU Discovery.
Layer 2 Tunneling Protocol (L2TP) tunnels can be used to create a connection between two private networks.
NOTE: L2TP Tunnels require a feature license not included with ECM Prime. Go to SYSTEM > Administration >
Feature Licenses to enable this feature.
Once you have a valid feature license, click
**Add** to create a new L2TP tunnel. Click **Edit**
to make changes to an existing tunnel.
Add/Edit Tunnel – General
• Tunnel Name – Enter a name to uniquely
identify this tunnel
• LNS address – Enter the IP Address of the
LNS (tunnel server) peer
• MTU – Set the maximum transmission unit
(MTU) for the L2TP tunnel
• MRU – Set the maximum receive unit (MRU)
to request from the tunnel peer. The MRU is
very similar to the MTU: MTU is for packets
sent and MRU is for packets received
• Tunnel Enabled – Click to enable/disable this
tunnel. Default: Enabled.
L2TP
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 55
User Manual / IBR900/IBR950 1/5/17
Authentication
More authentication options and overrides are available in the next section.
• Username
• Password – Shared secret (or password) used to authenticate the associated Local and Remote names.
Redial
• Enabled – When this is selected, the tunnel will attempt to reconnect if disconnected.
Add/Edit Tunnel – Authentication
• Remote Name
by and to the remote system as its identity,
sometimes a username or hostname. Leave
blank to match any.
• Local Name
and to the remote system as the local system
identity; sometimes a username or hostname.
Leave blank to match any.
• Secret – Shared secret (or password) used to
authenticate the associated Local and Remote
names.
Overrides
Override Authentication methods/parameters.
With methods set to Allow the two ends of
the tunnel can negotiate a common scheme.
Sometimes this negotiation fails, or the
implementation on one end is incompatible with
the other. To solve those authentication issues,
enable the overrides as needed.
• Authentication
• CHAP – Choose from Allowed, Refused, or Required.
• PAP – Choose from Allowed, Refused, or Required.
• Name – Override names used to authenticate the router. Leave empty to use the default.
Add/Edit Tunnel – Routes
remove routes to be used to funnel packets through the tunnel.
• Network Address – This is the network address that is the destination of the route. This should be set to
the network address at the remote side of the tunnel.
• Netmask
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 56
User Manual / IBR900/IBR950 1/5/17
ROUTING
STATIC AND POLICY ROUTING
It cannot be edited or removed. Typical destination-based static routes should
be added to the Main route table.
Policy routing allows for the addition of routes which are only evaluated when
policy. Evaluation occurs in the order in which the route policies are listed and
continues until a route is matched. The order of evaluation can be changed via
drag/drop. A route policy (including Main) will be overridden by polices that
precede it in the list.
To avoid unexpected routing problems, newly created route policies are placed
Route Policies:
next policy in the list.
Main Route Policy: A special route policy that maps to the Main route table. It cannot be edited or removed.
Click Add to create a new route policy. Click Edit to edit an existing route policy.
Match on
• IP Version: Select IPv4 or IPv6. Depending on
• Source IP/Network Address: Select the source IP
network upon which this policy will match. Leave
blank to match on any.
• Destination IP/Network Address: Select the
destination IP network upon which this policy
will match. Leave blank to match on any.
• Incoming Device: Select the incoming device
upon which this policy will match. Leave blank to
match on any.
‘lo’ is a special device that matches all local
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 57
User Manual / IBR900/IBR950 1/5/17
higher priority than the more general local source.
Reference
Table: Select the route table to use for routing when this policy is matched. Only user-created route tables may
be selected (Main is reserved for the Main policy).
Route Tables: Static route tables to be used in policy route lookups.
not available for use in dynamic routing protocols.
Main Route Table: A special route table that contains the main system
routes. It cannot be removed and cannot be referenced by a user-
routing protocols.
Click Add to open the Route Table Editor. Click Add to create a new
route table or Edit to edit an existing route table.
• Destination IP/Network Address: Enter the network address in the
following forms:
• IPv4: 1.2.3.4/32
• IPv6: 0123:4567::CDEF/128
The optional gateway must match the IP version
entered here.
• Gateway: Enter the gateway in the following
forms:
• IPv4: 1.2.3.4/32
• IPv6: 0123:4567::CDEF/128
The form must match the ip network address.
If Gateway is blank, a device interface must be
selected. Both Gateway and Device may also be
• Device: Select the device interface. Selecting null0 will install a black hole route. If Device is blank, a
• Metric:
• Allow Network Access: Some static routes will need an IP Filter Rule added to allow packets to route
checking this box.
ROUTE FILTERS
Common route lters
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 58
User Manual / IBR900/IBR950 1/5/17
appear in the grid. A match will apply the action (permit or
Access List:
Prefix List: Works the same as an access list with the
or equal to the ‘le’ value, or greater than or equal to the ‘ge’
list acts as an access list.
Route Map: Provides a richer set of match conditions for
to be applied to a route via set actions.
• Description: Displayed to help identify the route map.
• Permit: Checking Permit will carry out the Set Actions
if the Match Conditions are met, and permit the
route. Clearing Permit will deny the route if the Match
Conditions are met.
• Match Conditions:
match.
• Set Actions: A set of actions that are triggered by a
match.
Certain match conditions and set actions are protocol-
incompatible protocol will cause errors during operation that
prevent the routing protocol from starting.
• OSPF-specific: metric-type.
• BGP-specific: as-path, weight, comm-list, local-preference,
community, ext community.
usually expressed as two 16-bit values separated by a colon
(e.g. 18838:722). A received or well-known community can be
community list allows naming and refering to it by name.
Note certain well-known communities can be used by name
no-advertise (never advertise these
routes), no-export (don’t advertise beyond confederation
boundary), local-AS (don’t advertise to external peers),
internet (advertise to everyone), and none (used to clear any
community associated with a route).
BGP route lters
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 59
User Manual / IBR900/IBR950 1/5/17
found, the route is denied.
Access List:
Community List:
is a label which is attached to routes learned from that community. Then
that community or label can be used to select which policy(s) should be
applied to those routes.
The latest version of BGP (Border Gateway Protocol) is version 4. BGP-4 is one of the Exterior Gateway
Protocols and de facto standard of Inter Domain routing protocol. BGP-4 is described in RFC1771, A Border
Gateway Protocol 4 (BGP-4). BGP is a distance vector
routing protocol, and the AS-Path framework provides
distance vector metric and loop detection to BGP
RFC1930.
BGP Editor
• Enabled: Click to enable/disable the policy. (Default:
enabled).
• Name: Unique name of the policy.
• Router-ID: This sets the router-ID of the BGP
process. The router-ID may be an IP address of the
router, but need not be – it can be any arbitrary 32-
BGP
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 60
User Manual / IBR900/IBR950 1/5/17
bit number. However it *MUST* be unique within the entire BGP domain to the BGP speaker: bad things will
• Cluster ID:
• ASN: The AS (Autonomous System) number is one of the essential elements of BGP.
• View Name: Specify a view to exchange BGP routing information without adding to the kernel routing
table.
• Distance:
• Maximum Paths: Maximum Paths can be set greater than 1 to allow multipath routing. This setting limits
• Multipath Relax:
• Timers Keepalive/Hold: Keepalive interval is the time between keepalive messages sent to peers. Hold
time is the timeout after the last keepalive message until the peer is declared dead. The Keepalive interval
must be set in order to set the Hold time. All times are in seconds from 1 to 65535. Set to 0 or empty to
disable (default).
Networks Associated with ASN or IPv6 Networks
Associated with ASN
you need an AS number. An AS number is an
uses the AS number for detecting whether the BGP
connection is internal one or external one. Use the
IPv4 address and netmask or IPv6 address with a
CIDR notation
range.
Neighbor Options or IPv6 Neighbor Options: Creates
address.
• Peer Group: Optionally specify a peer group
for this neighbor. You can Bind to an existing
peer group or Define a new one. A neighbor
will inherit the properties from the peer group
neighbor will override inherited properties.
• IP Address: The IP address of the neighbor. Not
• Port: Specify port.
• Remote ASN: Enter the ASN of the remote AS.
The AS (Autonomous System) number is one of
the essential elements of BGP. BGP is a distance
vector routing protocol, and the AS-Path
framework provides distance vector metric and
loop detection to BGP. RFC1930.
• Weight: Assign a weight to a neighbor
connection.
• Maximum Prex: Specify the maximum number
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 61
User Manual / IBR900/IBR950 1/5/17
• Password: Enable message digest5 (MD5) authentication on a TCP connection between BGP peers. The
same password must be used on both peers.
• Update Source: Specify the IPv4 source address or interface name to use for the BGP session to this
neighbor.
• Default Originate: Allow the local router to send the default route (0.0.0.0) to a neighbor for use as a
• Don’t Send Community:
the BGP neighbor.
• eBGP Multihop: Accept and attempt BGP connections to external peers residing on networks that are not
directly connected. Mutually exclusive with TTL Security. Optionally specify Time To Live from 1 to 255
hops.
• TTL Security: Specify the number of hops to reach eBGP neighbors. Mutually exclusive with eBGP Multihop.
• Next Hop Self:
learned via eBGP. Select All to also apply this setting to routes learned via iBGP.
• Local AS Number:
received AS_PATH when receiving routing updates from the peer, and prepended to the outgoing AS_PATH
when transmitting local routes to the peer. Check No Prepend to not prepend the local AS Number to either
the received or outgoing AS_PATH. Check Replace AS to prepend the local AS Number to just the outgoing
AS_PATH.
• Distribute-list In/Out: Specify a distribute-list for the peer in either or both directions. Lists are chosen
• Filter-list In/Out:
BGP tab.
• Prex-list In/Out: Filter this neighbor’s incoming and/or outgoing advertisements according to the
tab.
• Route Map In/Out: Apply a route map to incoming and/or outgoing routes. Maps are chosen from the
• Route Reector Client:
client.
• Capability Negotiation:Strict to completely
match capabilities. Select Disable to suppress sending a negotiation message to peers that are not
Override to ignore the remote peer’s capability value and use the local
value instead.
• Soft Reconguration:
• Advertisement Interval:
• Timers Keepalive/Hold: Keepalive interval is the time between keepalive messages sent to peers. Hold
time is the timeout after the last keepalive message until the peer is declared dead. The Keepalive interval
must be set in order to set the Hold time. All times are in seconds from 1 to 65535. Set to 0 or empty to
disable (default).
Redistribute Routes
• Type: The type is the source of the route. Select from: Main, Connected, Static, RIP, and OSPF.
• Metric: Numerical priority of the route.
• Route Map
applied to routes.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 62
User Manual / IBR900/IBR950 1/5/17
OSPF
OSPF (Open Shortest Path First) version 2 is a routing protocol described in RFC2328, OSPF Version 2. OSPF
is an IGP (Interior Gateway Protocol). Compared with RIP, OSPF can provide more scalable network support
and faster convergence times. OSPF is widely used in large networks such as ISP (Internet Service Provider)
backbone and enterprise networks. Click Add to add an OSPF router.
General
• Enable: Enable and disable the routing protocol
policy.
• Router ID
unique ID which must be a dotted quad (like an IP
address). This ID MUST be unique within the entire
OSPF domain - errors will happen if multiple OSPF
• ABR Type: The OSPF standard does not allow
an ABR to consider routes through connected
non-backbone areas. Relaxed (default) relaxes
this restriction and will consider routes through
non-backbone areas if the backbone area is down.
Standard respects the OSPF standard regardless
if the backbone area is down. Shortcut will always
route through the best path even if it does not go through the backbone area. When this is set, shortcut
can be enabled/disabled on a per area basis.
• Flags: RFC 1583 Compatibility uses the predecessor standard RFC 1583 path preference algorithm. This
typically is NOT set. Opaque capability enables forwarding Opaque LSA extensions described in RFC 5250.
• Max Metric:
router is unreachable.
• Passive Interface Default:
send link-state advertisements.
• Refresh Timer: Sets the OSPF LSA refresh timer. Default is 10 seconds.
• Reference Bandwith (Mb/s): Sets the reference bandwidth for cost calculations. Link cost will
automatically scale in reference to this bandwidth unless explicitly overridden. The default is 100 Mb/s
equal to cost of 1. Note: this setting MUST be consistent across routers in the OSPF domain.
• SPF Timers:
values allows you to manage CPU usage when calculating SPF. Delay sets the initial delay. SPF calculations
will always be performed at least this many milliseconds apart. Consecutive SPF calculations will always
be separated by at least the Hold Time up to the Max Hold Time increasing by Max Hold Time for each
consecutive calculation.
Interfaces
• Device: Select device interface.
• Options: Set interface options. Passive means no Hellos will be transmitted out this interface. MTU Ignore
disables MTU mismatch detection.
• Network Type: Set the network type for this interface.
• Authentication: Set OSPF interface authentication. Key sets the OSPF authentication key to a simple
password. After setting authentication key, all OSPF packets are authenticated. The authentication key
has a maximum length of eight characters if using plain text authentication and sixteen characters if using
message-digest authentication. Key ID enables message-digest authentication. Leave this blank to enable
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 63
User Manual / IBR900/IBR950 1/5/17
part of the protocol and must be consistent across
routers on a link.
• Cost: OSPF metric for this interface.
• Transmit Delay: Link state transmit delay.
• Priority: The router with the highest priority
will be more eligible to become Designated
Router. Setting this to 0 disables this router from
participating in DR elections.
• Intervals: Set hello intervals. Hello sets the
number of seconds for the Hello Interval timer
value. Setting this value, Hello packets will be
sent every timer value seconds. This value must
be the same for all routers in the area. The default
value is 10 seconds. Dead sets the number of seconds for the Router Dead Interval timer value used for
Wait Timer and Inactivity Timer. This value must be the same for all routers attached an area. The default
value is 40 seconds. Retransmit sets the number of seconds between retransmitting lost link state
advertisements.
• Sub-second Hellos: Enable sub-second Hellos and set the number of Hellos per second. When set, Dead
Interval is set to one second.
Areas
• Area:
may be a 32-bit unsigned integer or a dotted quad
(like an IP address).
• Default Cost: Set the cost of default-summary
LSAs announced to stubby areas.
• Options: Set options for this area. Stub indicates
that this area is a stub and no area router will
propagate routes external to OSPF and AS-
External LSAs (Type-5s) or ASBR-Summary LSAs
(Type-4) will be propagated into the area. Only
Network-Summary (Type-3) and default-route summary advertisements will be propagated. Not-So-Stubby
indicates this area is Not-So-Stubby or NSSA. This is similar to a stubby area except external routes are
LSAs with the NSSA Translate option set. No Summary Prevents ABR from injecting inter-area summaries
• NSSA Type 7-to-5 Translation: Method of translating Type-7 LSAs to Type-5 when propagating external
routes. Via Election indicates this router is an NSSA Border Router but other border routers exist in the
topology. It will perform Type-7 to Type-5 translation unless another border router has Always set or is set
to Via Election and has a higher router-id. Always indicates this is an NSSA Border Router and must always
perform Type-7 tp Type-5 LSA translations. Never indicates that this router must never perform Type-7 to
Type-5 LSA translations.
• Shortcut: Enable or disable shortcuts through non-backbone areas. Default will shortcut only if the
backbone link is down. Requires that ABR Type be set to Shortcut.
• Access-List Filter: Filter Type-3 summary LSAs to/from area using access lists. This is only applicable on
ABR.
• Prex-List Filter:
ABR.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 64
User Manual / IBR900/IBR950 1/5/17
Redistribute
• Default Originate: Enable
broadcasting default route. Always
will cause the default route
(0.0.0.0/0) to be broadcast even if
it is not in the routing table. Metric
route. Metric Type is the OSPF metric
type (default Type-2). Route Map
• Default Metric: Specify the default metric for routes redistributed to OSPF. This can be overridden under
the Redistribute
• Default Distance: Sets the default administrative distance for intra-area, inter-area and external routes.
Distances. The default is 110.
• Distances: Specify administrative distances for intra-area, inter-area, or external routes. This overrides
the value set in Default Distance.
RIP
RIP (Routing Information Protocol) is a widely deployed interior gateway protocol. RIP is a distance-vector
protocol based on the Bellman-Ford algorithms. As a distance-vector protocol, RIP sends updates from
one router to its neighbors periodically, allowing the convergence to a known topology. In each update, the
distance to any given network will be broadcast to its neighboring router. The router supports RIP version 2 as
described in RFC2453 and RIP version 1 as described in RFC1058.
RIP Editor
• Name: Unique name of the policy.
• Metric: RIP metric is a value for distance for the
network. Usually RIP increments the metric when
the network information is received. The metric
for redistributed routes is set to 1.
• Protocol Version
either version 1 or version 2 packets. The default
is to send RIPv2 while accepting both RIPv1
and RIPv2 (and replying with packets of the
appropriate version for REQUESTS / triggered
updates).
• Password: RIPv2 allows packets to be
authenticated via either an insecure plain text
password, included with the packet, or a more
secure MD5 based HMAC (keyed-Hashing for Message AuthentiCation). RIPv1 cannot be authenticated at
• Plain text password: Select to use a plain text password instead of an MD5 HMAC. WARNING: A plain text
password is insecure.
• Enabled: Click to enable/disable the policy. (Default: enabled.)
• Timers: Update
seconds. TimeoutGarbage
120 seconds.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 65
User Manual / IBR900/IBR950 1/5/17
• Oset list in:
to the incoming and outgoing metric for routes
is 0, no action is taken.
• Oset list out:
Networks: Set the RIP-enabled interfaces by
network. RIP is enabled on the interfaces that have addresses within the network range.
Interfaces:
• Device: Select network interface device.
• Send version: Select the RIP version that will be sent on this interface, overriding the global setting.
Version can be 1 or 2, or 0 to select both.
• Receive version: Select the RIP version that will be accepted on this interface, overriding the global
setting. Version can be 1 or 2, or 0 to select both.
• Passive: Select passive mode for the interface. In passive mode, RIP routing updates are accepted by, but
not sent out of, the interface.
• No split horizon: Disable the split horizon mechanism. Enabling prevents RIP from advertising routes over
the interface on which they were learned.
• Distribute Access-list In/Out:
routes.
• Distribute Prex-list In/Out:
routes.
Neighbors: When a neighbor doesn’t understand multicast, this command is used to specify neighbors. In some
cases, not all routers will be able to understand multicasting, where packets are sent to a network or a group
of addresses. In a situation where a neighbor cannot process multicast packets, it is necessary to establish a
direct link between routers. The neighbor command allows the network administrator to specify a router as a
RIP neighbor. The no neighbor a.b.c.d command will disable the RIP neighbor. Assign a neighbor by inputting an
IP address.
Redistribute Routes
• Type: The type is the source of the route. Select from: Main, Connected, Static, OSPF, BGP.
• Metric: RIP metric is a value for distance for the network. Usually RIP increments the metric when the
network information is received. The metric for redistributed routes is set to 1.
• Route Map
applied to routes.
RIP
RIPng (RIP next generation) extends RIPv2 to support IPv6. See RIPng on Wikipedia and RFC 2080 for details.
RIPng Editor
• Name: Unique name of the policy.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 66
User Manual / IBR900/IBR950 1/5/17
• Metric: RIPng metric is a value for distance for the network. Usually
the RIP service increments the metric when the network information
is received. The metric for redistributed routes is set to 1.
• Enabled: Click to enable/disable the policy. (Default: enabled.)
Networks: Set the RIPng-enabled interfaces by network using IPv6
addresses. RIPng is enabled on the interfaces that have addresses within
the network range.
Routes
address.
Redistribute Routes
• Type: The type is the source of the route. Select from: Main, Connected, Static, OSPF, BGP.
• Metric: RIPng metric is a value for distance for the network. Usually the RIP service increments the metric
when the network information is received. The metric for redistributed routes is set to 1.
• Route Map
applied to routes.
QOS
allowing the user to prioritize applications.
Enable QoS
WAN Prole Speeds
Upload Speed and Download Speed: Setting the Upload
maximum upload and/or download speed for the Internet
source(s) you are using. For example, you might restrict
the upload speed to prioritize available bandwidth for
download or to reduce overall bandwidth use in order to
lower costs. It is recommended that you experiment with
for best results.
NOTE: Upload speed is the speed at which data can be
transferred to your ISP. Download speed is the speed at
which data can be transferred to you from your ISP. You
can test your connection speeds with a service such as
speedtest.net.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 67
User Manual / IBR900/IBR950 1/5/17
Queues
Queues and rules work in conjunction
to prioritize bandwidth for the most
critical operations. Multiple rules can be
associated with one queue. Use rules to
associate your more critical operations
with queues that have higher
bandwidth settings. For example, you
might have two queues, one for “critical” and one for “secondary” with critical having most of the bandwidth
percentage. Use rules to associate your most important bandwidth needs (POS system, VoIP, etc.) with the
critical queue. Restrict the bandwidth available for less important functions with the secondary queue.
Assign percentages of both upload and download bandwidth to each queue. If you assign 80% download
Click Add
Queue Name: Choose a name that is meaningful
to you.
DSCP (DiffServ) Tag
Code Point (DSCP) is the successor to TOS (Type
putting the value in the DSCP header of each IP
value of ‘0’ to clear the existing DSCP value in the
packet header.
DSCP Tagging is sometimes used so that other
networking equipment, upstream or post-NAT,
opposed to IP addresses or ports.
This setting is optional.
Upload Bandwidth
Enable Upload QoS: (Default: Enabled.) Deselect
if you want your rule to apply to download
restrictions with this queue.
Borrow Spare Bandwidth: (Default: Enabled.) When this is enabled, the interfaces/protocols associated with
Upload Bandwidth: This is the percentage of the connected WAN upload bandwidth that will be reserved for
their share.
Upload Priority
• Lowest
• Lower
• Below Normal
• Normal
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 68
User Manual / IBR900/IBR950 1/5/17
• Above Normal
• High
• Higher
• Highest
Click Next to continue to the next page.
Download Bandwidth
Enable Download QoS
this selected to include download restrictions with this queue.
Borrow Spare Bandwidth: (Default: Enabled.) When this is enabled, the interfaces/protocols associated with
Download Bandwidth: This is the percentage of the connected WAN upload bandwidth that will be reserved for
their share.
Download Priority
Normal):
• Lowest
• Lower
• Below Normal
• Normal
• Above Normal
• High
• Higher
• Highest
Click Finish to save this queue.
Rules
above.
Click Add
Traffic Shaping / QoS Rule Editor
a protocol for the rule, and select a queue to associate the rule with.
Rule Enabled: (Default: Enabled.) Deselect this to disable this rule. This
and download QoS are disabled then the rule will disable automatically.
Rule Name: Create a name for the rule that is meaningful to you.
Protocol: The protocol used by the messages: TCP/UDP, TCP, UDP, or ICMP.
Queue Name: Select a queue to associate this rule with.
Click Next to continue to the next page.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 69
User Manual / IBR900/IBR950 1/5/17
are optional.
Source Port(s) and/or Destination Port(s): Enter
a port number between 1 and 65535. To enter
a single port number, input the number into
both boxes separated by the colon. For example
“80:90” would represent all ports between 80
and 90 including 80 and 90 themselves.
Source IP Address, Source Netmask,
Destination IP Address, and Destination
Netmask: Specify an IP address or range of IP
addresses by combining an IP address with a
netmask for either “source” or “destination”
EXAMPLE: If you want to associate this rule with your guest LAN, you could input the IP address and netmask for
the guest LAN here (leaving the last slot “0” to allow for any user attached to the guest network):
• Source IP Address: 192.168.10.0
• Source Netmask: 255.255.255.0
Application Set
Application sets require an active license to exist on the device for them to function.
DSCP (DiffServ)
sensitive equipment such as VoIP phones. This setting is optional.
DSCP Negate
Click Finish to save this rule.
DNS SERVERS
DNS, or Domain Name System, is a naming system that translates between domain names (www.cradlepoint.
com, for example) and Internet IP addresses (206.207.82.197). A DNS server acts as an Internet phone book,
page for the device has these distinct functions:
• DNS Settings: By default your router is set to automatically acquire DNS servers through your Internet
provider (Automatic). DNS Settings allows you to specify DNS servers of your choosing instead (Static).
• Split DNS
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 70
User Manual / IBR900/IBR950 1/5/17
• Dynamic DNS Conguration: Allows you to host a server (Web, FTP, etc.) using a domain name that you
have purchased (www.example.com) with your dynamically assigned IP address.
• Known Hosts Conguration: Allows you to map a name (printer, scanner, laptop, etc.) to an IP address of a
device on the network.
DNS Settings
assigned by your Internet provider. The default DNS servers are usually adequate. You may want to assign DNS
servers if the default DNS servers are performing poorly, if you want WiFi clients to access DNS servers that
you use for customized addressing, or if you have a local DNS server on your network.
Mode: Automatic or Static (default: Automatic). Switching to
Primary DNS
and Secondary DNS
Primary DNS and Secondary DNS: If you choose to specify your
DNS servers, then enter the IP addresses of the servers you want
DNS server settings will be pre-populated with public DNS server
IP addresses. You can override the IP address with any other DNS
server IP address of your choice. For example, Google Public DNS
servers have the IP addresses 8.8.8.8 and 8.8.4.4 while 4.2.2.2 and
4.2.2.3 are servers from Level 3 Communications.
Force All DNS Requests To Router: Enabling this will redirect all DNS requests from LAN clients to the router’s
DNS server. This will allow the router even more control over IP addresses even when clients have their own
DNS servers statically set.
Split DNS
Split DNS allows you create two zones for the same domain, one
to be used by the internal network, the other used by the external
network. Split DNS directs internal hosts to an internal domain
name server for name resolution and external hosts are directed to
an external domain name server for name resolution.
Primary Split DNS and Secondary Split DNS: If you choose to specify
your DNS servers, then enter the IP addresses of the servers you
Domain: Click Add to add desired domain for Split DNS.
Dynamic DNS Conguration
The Dynamic DNS feature allows you to host a server (Web, FTP, etc.) using a domain name that you have
purchased (www.yourname.com) with your dynamically assigned IP address. Most broadband Internet Service
Providers assign dynamic (changing) IP addresses. When you use a Dynamic DNS service provider, you can enter
your host name to connect to your server, no matter what your IP address is.
• Enable Dynamic DNS: Enable this option only if you have purchased your own domain name and registered
with a Dynamic DNS service provider.
• Server Type. Select a dynamic DNS service provider from the dropdown list:
• DynDNS
• DNS-O-Matic
• ChangeIP
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 71
User Manual / IBR900/IBR950 1/5/17
• NO-IP
• Custom Server (DynDNS clone)
• Custom Server Address. Only available if you
select Custom Server from the Server Address
dropdown list. Enter your custom DynDNS
clone server address here. For example: www.
mydyndns.org.
• Use HTTPS: Use the more secure HTTPS protocol.
This is recommended, but can be disabled if not
compatible with the server.
• Host name
For example: myhost.mydomain.net.
• User name: Enter the user name or key provided
by the dynamic DNS service provider. If the
dynamic DNS provider supplies only a key, enter
that key for both the User name and Password
• Password: Enter the password or key provided by
the dynamic DNS service provider.
Advanced Dynamic DNS Settings
Update period (hours): (Default: 576) The time between periodic updates to the dynamic DNS, if your dynamic
IP address has not changed. The timeout period is entered in hours so valid values are from 1 to 8760.
Override External IP
http://myip.dnsomatic.com in a web browser.
Known Hosts Conguration
to map a name (printer, scanner, laptop, etc.) to an
IP address of a device on the network. This assigns
a new hostname that can be used to conveniently
identify a device within the network, such as an
Click Add to name a device in your network.
• Hostname
• IP address: The address of the device within your network.
EXAMPLE: a personal laptop with IP address 192.168.0.164 could be assigned the name “MyLaptop.”
Since the assigned name is mapped to an IP address, the device’s IP address should not change. To ensure that
the device keeps the same IP address, go to NETWORKING > Local Networks > DHCP Server and reserve the IP
address for the device by selecting the device in the Active Leases list and clicking Reserve.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 72
User Manual / IBR900/IBR950 1/5/17
WIFI AS WAN
WiFi as WAN uses an outside WiFi network as its Internet source. When WiFi as WAN is enabled, the router
unprotected network, you will need to know its password
or key.
• WiFi Radio #1 (2.4 GHz)
• WiFi Radio #2 (5 GHz)
All Cradlepoint routers and some other routers use
the same default IP address for the primary network:
192.168.0.1. If you attempt to set up WiFi as WAN and
address. The router is attempting to use the same IP
address for both WAN and LAN, which is impossible. Go
to Network Settings > WiFi / Local Networks. Select the
network and click Edit. You can change the IP address
under IPv4 Settings. For example, you might change
192.168.0.1 to 192.168.1.1.
Saved Proles
is in range, then the router will connect with the highest priority network.
Network
BSSID
connect to a hidden network using WiFi as WAN. It is optional when connecting to a visible network. If it is
Auth Mode: The type of encryption that is used by the network.
• None
• WEP Auto
• WEP Open
• WEP Shared
• WPA1 Personal
• WPA2 Personal
• WPA1 & WPA2 Personal
• Automatic – Select a WiFi network in Site Survey
and click Import
• Manual – Click on Add under Saved Profiles and
input the required information.
Site Survey
This is a list of WiFi networks that the router can
such as its mode and channel. Click “Refresh” if a WiFi
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 73
User Manual / IBR900/IBR950 1/5/17
If you import a network from Site Survey, most of the information about the network will already be
completed. You need to input the password (if there is one) and then click submit to save the WiFi as WAN
Wireless Scan Settings
Scan Interval: How often WiFi as WAN scans the
environment for updates. (Default: 60 seconds. Range:
5–3600 seconds.)
Scan While Connected: Continue to scan for WiFi as
occurs the wireless communication of the router will be
temporarily interrupted. Normally this should be disabled.
WAN AFFINITY
your network so that particular bandwidth uses are
associated with particular WAN sources. This allows
you to prioritize bandwidth.
EXAMPLE: You could specify that your guest LAN is
only associated with your Ethernet connection with
no failover. Then if your Ethernet connection goes
down and the embedded modem connects for failover for your primary LAN, your guest LAN will not take
bandwidth from your primary LAN, saving you money.
Click Add
Name: Give a name for your rule that is meaningful to
you.
DSCP (DiServ)
is the successor to TOS (Type of Service). Use this
sensitive equipment such as VoIP phones. If you know
DSCP Negate: When checked this rule will match on
Protocol: Select from the dropdown list to specify the
protocol for a particular data use. Otherwise, leave
“Any” selected.
• Any
• ICMP
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 74
User Manual / IBR900/IBR950 1/5/17
• TCP
• UDP
• GRE
• ESP
• SCTP
Source IP Address, Source Netmask, Destination IP Address, and Destination Netmask: Specify an IP address
or range of IP addresses by combining an IP address with a netmask for either “source” or “destination” (or
EXAMPLE: If you want to associate this rule with your guest LAN, you could input the IP address and netmask
for the guest LAN here (leaving the last slot “0” to allow for any user attached to the guest network):
• Source IP Address: 192.168.10.0
• Source Netmask: 255.255.255.0
Failover
interrupted, the router will fail over to another available WAN device. Deselect this option to restrict this
When Condition Value
Port Is USB Port 1
Type Is not WiMax
• When:
• Port – Select by the physical port on the router that you are plugging the modem into (e.g., “USB Port
2”).
• Manufacturer – Select by the modem manufacturer (e.g., “Cradlepoint Inc.”).
• Model
• Type – Select by type of Internet source (Ethernet, LTE, Modem, Wireless as WAN, WiMAX).
• Serial Number – Select a 3G or LTE modem by the serial number.
• MAC Address – Select from a dropdown list of attached devices.
• Unique ID – Select by ID. This is generated by the router and displayed when the device is connected
to the router.
• Condition: Select “is,” “is not,” “starts with,” “contains,” or “ends with” to create your condition’s
statement.
• Value: If the correct values are available, select from the dropdown list. You may need to manually input
the value.
Load Balance Algorithm
dropdown options:
• Round-Robin: Evenly distribute each session to the available WAN connections.
• Rate: Distribute load based on the current upload and download rates. A WAN device’s upload and
download bandwidth values can be set in CONNECTION MANAGER.
• Spillover
the most available bandwidth. The estimated bandwidth rate is based on a combination of the upload and
• Data Usage
keep data usage between interfaces at a similar percentage of the assigned data cap in the data usage rule
for each interface, rather than distributing sessions based solely on bandwidth. For proper functioning you
need to create data usage rules for each WAN device you will be load balancing. Make certain to select the
“Use with Load Balancing” checkbox in the data usage rule editor.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 75
User Manual / IBR900/IBR950 1/5/17
CLIENT DATA USAGE
Client Data Usage displays upload and download
Enable Client Data
Usage Monitoring Service to begin tracking this
information. This data is not retained between
router reboots.
For each client this shows: Name, IP address, MAC
address, amount of data uploaded (MB), amount of
The names that are shown are received during a DHCP exchange. If a client disconnects and reconnects with a
new IP address there will be an additional entry in this list.
Pressing Reset Statistics will restart all counters at 0.
NHRP
Next Hop Resolution Protocol is a protocol used
to discover addresses of clients on Non-Broadcast
Multiple Access (NBMA) networks. It is used
to create next-generation VPN technologies
that allow shortcutting between spokes. With
NHRP, systems attached to an NBMA network
dynamically learn the NBMA address of the other
systems that are part of that network, allowing these systems to directly communicate without requiring an
intermediate hop.
NOTESYSTEM >
Administration > Feature Licenses to enable this feature.
• Name: Name of the GRE tunnel that NHRP will use
• Protocol Address/Prex: GRE tunnel endpoint mapping that NHRP associates with the NBMA server
• NBMA Address
• Flags:
• SD: Shortcut-Destination
• N: Non-Caching
• S: Shortcut
• R: Redirect
Click Add to create a new NHRP interface.
• Enabled: Enable or disable the interface.
• Name: Give the interface a unique name that matches the mGRE (multipoint GRE) tunnel. Select from
• Peer Authentication: Embeds the secret plaintext password to outgoing NHRP packets. Incoming NHRP
packets on this interface are discarded unless this password is present. Max length: eight characters.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 76
User Manual / IBR900/IBR950 1/5/17
• Holding Time
NHRP registration requests and resolution
replies.
• Shortcut-Destination: Reply with
authoritative answers on NHRP resolution
requests destined to addresses in this
interface (instead of forwarding the packets).
• Non-Caching: Disables caching of peer
information from forwarded NHRP resolution
reply packets.
• Shortcut: Enable creation of shortcut routes.
• Redirect: Enable sending of proprietary
packets.
• Multicast: Determines how multicast
packets should be forwarded through NHRP
interfaces.
• NHS: Multicast packets will be forwarded
server. This is default and is typical for
• Dynamic: Multicast packets will be forwarded to each connected peer. This is typically used for an
NHRP hub.
You also have the option to create static mappings for this interface. Click Add in the table to open the static
mapping editor.
• Protocol Address: Mapped endpoint to from protocol address to NBMA address
• Protocol Prex
• NBMA Address
• RegisterRegistration Request should be sent to this peer on
R in the static mapping table if selected)
• Proprietary OS
C in the static mapping table if selected).
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 77
User Manual / IBR900/IBR950 1/5/17
SECURITY
IDENTITIES
HOST ADDRESSES
match on any single item in the group will cause the rule to match. Identities are
referenced in rules by their name. Choosing descriptive names like “NW Sales Team”
or “Engineering” will aid in understanding existing rules and in choosing identities
for new rules.
A single identity can contain a combination of IPv4 and IPv6 addresses. IPv4/6
addresses cannot be combined with FQDN addresses in the same identity.
IP addresses are entered using CIDR notation, e.g. 1.2.3.4/32 and
0123:4567::CDEF/128. FQDN addresses are entered with at least one dot separating a
top-level domain from a root zone, e.g. cradlepoint.com.
To add a Host Address Identity, click Add.
PORTS
A port identity member can be entered as a single Start port number or as a port range by entering both a
Start and End port number.
To add a Port Identity, click Add.
MAC ADDRESSES
To add a MAC Address Identity, click Add.
REPUTATION
www.spamhaus.org/drop/
applied to them. Files should be in the format where each line starts with an IP address or IP network and
To add a Reputation Identity, click Add,
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 78
User Manual / IBR900/IBR950 1/5/17
ZONE FIREWALL
ZONE DEFINITION
A Zone is a group of network interfaces. By default all interfaces within
a zone are allowed to initialize network communication with each
interfaces within the zone will be denied.
To add a zone, click Add.
FILTER POLICIES
Edited, or Removed.
• Default Allow All
to another zone. The state of the connection is
tracked to allow responses to traverse the zones
back to the source. LAN to WAN forwardings use
this policy by default. The policy can be removed or
• Default Deny All
to another zone. WAN to LAN forwardings use this
policy by default. The policy can be removed or
Click Add
editor.
• Name: Create a name meaningful to you.
• Action: Choose either Allow or Deny
• Log: When checked, every rule in the policy will log matching packets as if the rule’s Log option had been
selected.
Click Add
Editor.
• Name: Create a rule name meaningful to you.
• Action
• Log
• IP Version: Select the IP version to match.
• Enter match criteria under Source, Destination, Protocols and Application Sets.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 79
User Manual / IBR900/IBR950 1/5/17
OPTIONS
Firewall Options
• Anti-Spoof: Anti-Spoof checks help protect against malicious users faking the source address in packets
they transmit in order to either hide themselves or to impersonate someone else. Once the user has
spoofed their address they can launch a network attack without revealing the true source of the attack or
attempt to gain access to network services that are restricted to certain addresses.
• Log Web Access: Enable this option to create a syslog record of web (IP port 80) access. Each entry will
contain the the IP address of the server and the client. Note that this may create a lot of log entries,
especially on a busy network. Sending the system log to a syslog server is recommended.
ZONE FORWARDING
be Added, Edited, Removed, or Toggled. Toggling a
Forwarding will either enable or disable the Forwarding.
Source and Destination zones are chosen from the list
be selected for forwarding endpoints:
• The All
forwardings.
• The Router
• Source
individual criteria for the appropriate Host, Port
and MAC address columns to match the source
• Host: Enter an IP address or select a host
identity.
• Port: Enter a port, port range, or select a
port identity.
• MAC: Enter a MAC address or select a MAC
address identity.
• Destination
individual criteria for the appropriate Host,
Port and MAC address columns to match the
Source for the
• Protocols
• Application Sets
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 80
User Manual / IBR900/IBR950 1/5/17
NETWORK PREFIX TRANSLATION
IPv6 prex
translationRFC 6296) trying to achieve address independence similar to NAT
in IPv4. Unlike NAT, however, NPT is stateless and preserves the IPv6 principle that each device has a routable
public address. But it still breaks any protocol embedding IPv6 addresses (e.g. IPsec) and is generally not
recommended for use by the IETF. NPT can help to keep internal network ranges consistent across various IPv6
The primary purpose for Cradlepoint’s NPT implementation is for failover/failback and load balancing setups.
LAN clients can potentially retain the original IPv6 lease information and may experience a more seamless
transition when WAN connectivity changes than if not utilizing NPT.
Mode:
• None – No translation is performed
• Load Balance Only – (Default) Only translate networks when actively load balancing
• First
• Static
the LANs may lose IPv6 connectivity.
REMOTE ACCESS RESTRICTION
Add any IPv4 addresses that need access to remote administration to this list. Clicking Add will allow the
Edit will allow you to change settings for
the selected address. Remove will remove a selected entry.
Application Gateways
to function, or for an application to improve functionality or add features.
NOTE: Exercise caution in enabling application gateways as they impact the security of your network.
• PPTP: For virtual private network access using Point to Point Tunneling Protocol.
• SIP: For Voice over IP using Session Initiation Protocol.
• TFTP:
• FTP: To allow normal mode when using File Transfer Protocol. Not needed for passive mode.
• IRC: For Direct Client to Client (DCC) transfer when using Internet Relay Chat. You may wish to forward TCP
port 113 for incoming identd (RFC 1413) requests.
DMZ (Demilitarized Zone)
remotely access network services at the DMZ IP address. Typical uses involve running a public web server,
NOTE: As with port forwarding, caution should be used when enabling the DMZ feature as it can threaten the
security of your network.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 81
User Manual / IBR900/IBR950 1/5/17
the Internet to reach a computer on the
inside of your network. For example, a port
forwarding rule might be used to run a Web
server.
NOTE: Exercise caution when adding new
rules as they impact the security of your
network.
Click Add to create a new port forwarding
rule, or select an existing rule and click Edit.
Add/Edit Port Forwarding Rule
• Name: Name your rule.
• Enabled: Toggle whether your rule is enabled. Selected by default.
• Use Port Range: Changes the selection options to allow you to input a range of ports (if desired).
• Internet Port(s)
same as the local port numbers, but they do not have to be. These numbers will be mapped to the local
port numbers.
• Local Computer: Select the IP address of
an attached device from the dropdown
menu, or manually input the IP address
of a device.
• Local Port(s): The port number(s) that
corresponds to the service (Web server,
FTP, etc.) on a local computer or device.
For example, you might input “80” in
for a Web server on a computer within
could then also be 80, or you could
choose another port number that will be used across the Internet to access your Web server. If you choose
a number other than 80 for the Internet Port, connections to that number will be mapped to 80 – and
therefore the Web server – within your network.
• Protocol: Select from the following options in the dropdown menu:
• TCP
• UDP
• TCP & UDP
Click Save to save your completed port
forwarding rule.
Port Proxying Rules
computer/IP address on the Internet.
Click Add to create a new port proxying
rule, or select an existing rule and click
Edit.
Add/Edit Port Proxying Rule
PORT FORWARD & PROXY
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 82
User Manual / IBR900/IBR950 1/5/17
NAT
Zone NAT is similar to Port Forwarding and provides that functionality by mapping ports available on interfaces
associated with the Zone to ports available on local clients. Zone NAT also has the ability to map many types
endpoints to local client thereby limiting exposure to the
Click Add to create a Zone NAT.
• Source Zone Name: The Zone created in Zone Firewall.
Select the Zone to NAT.
• Original Destination IP:
this router will have the destination IP translated to an
internal network.
• Inbound Port(s): Specify the IP port(s) on the inbound
• Local Computer: Specify the local computer to receive
• Local Port(s):
• Protocol:
Dynamic 1:1 NAT
Dynamic NAT allows translating the destination ip of
protocols will be forwarded. Netmasks should generally
match. If the local network range is larger than the incoming
port overloading. One-to-One NAT can be accomplished by
specifying a host address or a /32 cidr address.
Click Add to create a Dynamic 1:1 NAT.
• Name: Name your rule.
• Enabled: Toggle whether your rule is enabled. Selected by default.
• Use Port Range: Check this box to create a rule which proxies a contiguous range of ports instead of a
single port. The remote port(s) will require the same number of contiguous ports.
• Local Port(s): Specify the IP port(s) on the LAN to proxy to a remote computer.
• Remote Computer
• Remote Port(s)
• Protocol
• TCP
• UDP
• TCP & UDP
Click Save to save your completed port proxying rule.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 83
User Manual / IBR900/IBR950 1/5/17
Select a third-party Cloud Provider from the dropdown list.
• Zscaler Internet Security
• Zscaler Secure Web Gateway
• Umbrella by OpenDNS
Zscaler
Zscaler
several plan options. Depending on your Zscaler implementation, this
could include:
• Global Cloud Platform
• Real-Time Reporting
• Behavioral Analysis
• URL Filtering
• Advanced Threat Protection
• Inline Anti-Virus & Anti-Spyware
• Web 2.0 Control
• Data Loss Prevention
• Bandwidth Management
• Web Access Control
• And more…
NOTE: Zscaler requires a feature license. Go to SYSTEM > Feature
Licenses to enable this feature.
Enter your Zscaler account information to enable these settings. Input
local network information (Network Address and Netmask) to assign
your Zscaler implementation to one or more local network(s).
Umbrella by OpenDNS
http://
www.opendns.com/business-security for information about Umbrella.
Enter your Umbrella account information in order to use these content
OpenDNS ISP Filter Bypass Algorithm: It is possible that your Internet
not appear to be working correctly, enabling this will attempt to bypass
CLOUD-BASED SECURITY
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 84
User Manual / IBR900/IBR950 1/5/17
MAC Address WebFilter Rules allow you to control
or websites. To add a rule, click Add.
• MAC Address: Enter MAC Address.
• Filter Action: Select Block or Allow.
• Domain/URL/IP: Enter the Domain Name or URL
(address) of the website you wish to control access
for, e.g. www.google.com. To make sure the full
domain is blocked, enter the most inclusive domain
com as well as maps.google.com and images.google.
com). Alternatively you can use an IP address, e.g.
8.8.8.8, or address range written in CIDR notation,
e.g. 8.8.8.0/24.
• Rule Priority: Higher number rules overrule lower number rules.
• Enabled: A rule can be enabled or disabled by selecting or deselecting the checkbox.
Use MAC Address WebFilter Defaults together with MAC Address WebFilter Rules to control website access for
Add/Edit to change this
setting for a MAC address.
Input the MAC Address and Default Action you would like to apply to that MAC address.
Default Action: Select from the following dropdown options:
• Allow Access (default)
• Block Access
When a network is set to Allow Access, it will allow access to sites
is set to Block Access
allowed in the WebFilter Rules.
MAC WEB FILTER RULES
WEB ACCESS FILTERING
UPSTREAM PROXY SETTINGS
Upstream Proxy Settings
Enabled: Select whether the use of
an Upstream Proxy server is enabled.
Proxy Address: The Proxy Address is
the address the desired HTTP proxy
is hosted at. Addresses can be input
as host names or as ip addresses. If
HTTP Port: The port the HTTP Proxy is listening on.
HTTPS Port (Optional)
as a proxy for HTTPS to work properly.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 85
User Manual / IBR900/IBR950 1/5/17
NETWORK WEB FILTER RULES
access from your network to any external domain
network and the highest priority rule will have
be added by URL/Domain name or by IP address.
notation, e.g. 4.2.2.2/24.
Exceptions to existing rules can be created by
adding another rule with higher priority. For
example if access to maps.example.com is desired,
but example.com is blocked with a priority of 50.
The addition of an allow rule for maps.example.
com with a priority of 49 or less will allow access.
When creating rules keep in mind that some sites
use multiple domains so each domain may need a rule added to produce the desired behavior.
To add a Network Web Filter Rule, click Add.
Default Network Filter Settings
When a network is set to Allow (Blacklist) it will
allow access to those sites not blocked in the
Filter Rules. Selecting Block (Whitelist) will only
allow access to websites with an Allow action in
the Filter rules, all other sites will be blocked.
Selecting to Filter URLs by IP Address will cause
the router to perform a DNS lookup on URL
entries and the IP addresses will be appended
to the appropriate block/allow list. This can have
hosted across many domains may need every domain added the list for full functionality.
The settings can be changed by selecting a network and clicking the Edit button.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 86
User Manual / IBR900/IBR950 1/5/17
CERTIFICATE MANAGEMENT
LOCAL CERTIFICATES
• Name
• Location
• Organization Information
issuer belongs
• Common Name: Name used to match authentication credentials
Add.
Remove button.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 87
User Manual / IBR900/IBR950 1/5/17
CERTIFICATE SIGNING REQUEST
security issues
information).
Generate a certicate signing requestCertificate Name
When you export the CSR, select a Digest, or cryptographic hash function. These are listed in order of increasing
security. More security requires more router resources.
• MD5
• SHA-128
• SHA-256
PKCS12
PKCS #12 is one of the public-key cryptography standards
because it is protected by an encryption key.
PEM
PEM is a container format for encoding data – in this case,
email (PEM stands for Privacy-enhanced Electronic Mail), but
it has never been widely used for that purpose. The format is
The PEM format uses Base64 and DER (Distinguished Encoding
Rules) encoding.
computer or local device and upload it to the router. Give the
download it to your computer or local device in PEM format.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 88
User Manual / IBR900/IBR950 1/5/17
and download it to your computer or local device in PKCS
passphrase to protect it. This key is required for future use of
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 89
User Manual / IBR900/IBR950 1/5/17
SYSTEM
ADMINISTRATION
ROUTER SECURITY
When the router is
advanced security mode,
several aspects of the
networking functionality
will be extended to support
high security environments. This includes support for multiple user accounts,
use your router in a PCI DSS compliant environment this option is mandatory.
REMOTE ADMIN
Remote Management allows a user to enable incoming WAN pings or change settings for the router from the
Internet using the router’s Internet address.
Allow WAN pings – When enabled the functionality allows an external WAN client to ping the router.
Allow Remote Web Administration – When remote administration is enabled it allows access to these
administration web pages from the Internet. With it disabled, you must be a client on the local network to
access the administration website. For security, remote access is usually done via a non-standard http port.
Additionally, encrypted connections can be required for an added level of security.
• Require HTTPS Connection – Requiring a secure (https) connection is recommended
• HTTP Port: Default – 8080. This option is disabled if you select “Require Secure Connection”
• Secure HTTPS Port – Default: 8443.
NOTESECURITY > Zone Firewall > Remote
Access Restriction.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 90
User Manual / IBR900/IBR950 1/5/17
FEATURE LICENSES
SYSTEM CLOCK
Allow Remote SSH Access – This will enable SSH access
to the router from the Internet. It is only available
when SSH access is enabled in the Local Management
tab. Some carriers block the remote SSH access ports.
If a ping to the router’s WAN port does not work, it is
unlikely that remote SSH access will work.
Some Cradlepoint features may require a license. These
features are disabled by default. To obtain a feature
license, contact your Cradlepoint sales representative.
Enabling NTP will tell the router to get its system time
from a remote server on the Internet. If you do not
enable NTP then the router time will be based on when
be wrong. Whenever the Internet connection is re-
established and once a week thereafter the router will
ask the server for the current time so it can correct
itself.
You then have the option of selecting an NTP server and
adjusting the NTP server port. Select the NTP server
from the dropdown list. Any of the given NTP servers
synchronize your router’s time with other devices in a
network.
• Time Zone – Select from a dropdown list. Setting your Time Zone is required to properly show time in your
router log.
• Daylight Savings Time – Select this checkbox if your location observes daylight saving time.
LOCAL MANAGEMENT
• Enable Internet Bounce Pages – Bounce pages show up in your web browser when the router is not
connected to the Internet. They inform you that you are not connected and try to explain why. If you disable
bounce pages then you will just get the usual browser timeout. In the normal case when the router is
connected to the Internet you don’t see them at all.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 91
User Manual / IBR900/IBR950 1/5/17
• Reboot Count – Track number of router reboots.
• Enable Login Banner – Add the CLI banner to the
router’s login page.
• Local Domain – The local domain is used as the
the hostnames of DHCP clients as DHCP_HOSTNAME.
LOCAL_DOMAIN.
• System Identier – This is a customizable identity
that will be used in router reporting and alerting. The
default value is the product name and the last three
characters of the MAC address of the router.
• Asset Identier – This is a customizable string that
will be used in router reporting and alerting.
• Require HTTPS Connection – Check this box if
you want to encrypt all router administration
communication.
• Secure HTTPS Port – Enter the port number you want
to use. The default is 443.
• Enable SSH Server – When the router’s SSH server is enabled you may access the router’s command line
interface (CLI) using the standards-based SSH protocol. Use the username “admin” and the standard system
password to log in.
• SSH Server Port – Default: 22.
• Automatically Set System Identier
client that gets a DHCP lease. This feature cannot be used with email alerts but alerts can be sent to ECM.
GPS
If you have an attached device with GPS support, you can enable a
graphical view of your router’s location, which appears in STATUS > GPS.
You can also enable GPS NMEA format sentence reporting to a server (LAN,
WAN, or remote). This GPS reporting functionality requires a separate
software client to listen/query for these sentences. SIM-based models
with GPS support require that the SIM be inserted. Some carriers disable
GPS support in otherwise supported modems. If you encounter issues with
GENERAL SETTINGS
Enable GPS – Enable support for querying GPS information from capable
modems.
Enable GPS Lock LED – Use the USB LED to show if the GPS has received
available.
Enable GPS Keepalive – Poll the GPS every 10 seconds to keep hardware
from sleeping.
TAIP Vehicle ID
to identify TAIP messages as being sent from some unique vehicle.
GPS CLIENTS, SERVERS, AND SERIAL
GPS reporting requires separate software to listen/query for NMEA (or
TAIP) sentences. The router must either act as a GPS server (which
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 92
User Manual / IBR900/IBR950 1/5/17
separate clients can connect to) or as a GPS client (which reports to a server). Set up a GPS Server, GPS Client, or
GPS Serial on the device by clicking on the Add button in the appropriate table.
• GPS Clients – Use this to set up a local client. This client will send periodic reports of GPS sentences to a
remote server.
• GPS Servers – Use this to set up a local server. Clients can connect to and receive GPS sentences from this
server.
• GPS Serial - Use this to set up a local serial. Clients can connect to and receive GPS sentences from this
server.
Send to Client(s)
• Enable this Server - Enables a local server to which clients can connect and recieve GPS sentences.
• Server Name - Your server’s name should include only Aa-Zz, numerals, and ‘_’.
• Enable GPS server on LAN
sentences to TCP connected clients.
• Enable GPS server on WAN - Enables a server on the
GPS sentences to TCP connected clients.
• Port - Choose a port between 1 and 65535.
Language Settings (NMEA)
• Choose Language - NMEA
• Include System ID - Include the router’s “System ID”
sentence with every data message. This can be useful
when a single remote client or server is handling GPS
position reports from multiple routers. This creates a
custom GPS sentence with the System ID as part of
the sentence and the checksum.
• Prepend System ID - Include the routers “System ID”
sentence with every GPS message. This can be useful
when a single remote client or server is handling GPS
position reports from multiple routers. This simply
prepends the system ID and a comma ahead of the
GPS sentence.
• Report NMEA GGA sentences
NMEA GGA sentence format (if available).
• Report NMEA RMC sentences
NMEA RMC sentence format (if available).
• Report NMEA VTG sentences
NMEA VTG sentence format (if available).
Depending on your selections (and other possible factors),
reporting may include proprietary sentences. For example,
if you select Include System ID, the report will include
proprietary sentences of the following format (in addition
to the standard sentences):
$PCPTI,{System ID},{router timestamp},{GGA
timestamp},{GGA checksum}*{checksum}
NOTE: “PCPTI” stands for Proprietary, CradlePoinT,
Identification (P-CPT-I).
Language Settings (TAIP)
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 93
User Manual / IBR900/IBR950 1/5/17
The Trimble ASCII Interface Protocol (TAIP) was designed
for vehicle tracking. For more information about TAIP, see
these instructions from Trimble.
• Choose Language - TAIP
• Enable Vehicle ID Reporting - Include the vehicle ID #
with every TAIP sentence. This can be useful when a
single remote client or server is handling GPS position
reports from multiple routers.
• Enable TAIP sentence checksum reporting - Include a
checksum with each TAIP sentence.
• Prepend a newline character to each TAIP sentence -
Prepends [CR][LF] characters to each TAIP sentence.
• Report TAIP AL sentences
TAIP AL sentence format.
• Report TAIP CP sentences
TAIP CP sentence format.
• Report TAIP ID sentences
TAIP ID sentence format.
• Report TAIP LN sentences
TAIP LN sentence format.
• Report TAIP PV sentences
TAIP PV sentence format.
Language Settings (Modem-Status) - A string containing
GPS position as well as cellular modem status (RSRP,
DBM, RSRQ, ECIO, etc). NOTE: Modem-Status has no
configurable options.
Reporting Intervals
• Default Time Interval (seconds) - Set the interval in
seconds between periodic GPS sentence reports. Use
as long an interval as is practical for your application.
The shorter the interval the more router resources
and bandwidth will be used by the GPS subsystem.
Too frequent reports may cause performance and/or
availability issues. (Specifying a value of 0 seconds
disables default time interval reporting.)
• Stationary Time Interval (seconds) - The time interval
(seconds) while remaining stationary to pass before
triggering reporting of GPS sentence(s). While the
unit is stationary, the “Default Time Interval” is
overridden and a report will be triggered every
seconds disables stationary time interval reporting.)
• Stationary Event Threshold (seconds) - When
movement ceases for longer than the Stationary
Event Threshold, a GPS report will be triggered.
An additional GPS report will be triggered when
movement resumes (i.e. when the Stationary Distance
Threshold is exceeded). While stationary, additional
GPS Reports can be triggered by the Default Time
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 94
User Manual / IBR900/IBR950 1/5/17
Threshold reporting.)
• Stationary Distance Threshold (meters)
discount, treating the unit as stationary to be used in conjunction with stationary time reporting. Note:
Setting the Stationary Distance Threshold to
values near the low end increases the possibility of
incorrectly detecting the vehicle as moving due to GPS
• Distance Interval (meters) - The distance (meters)
will trigger reporting of GPS sentence(s). Note: Setting
the Distance Interval to values near the lower end
increases the possibility of incorrectly issuing a report
due to GPS “jitter.” (Specifying a value of 0 meters
disables distance interval reporting.)
Send to Server(s)
• Enable this client - Enables periodic reporting of GPS
GPS sentences if errors are encountered or if the
sentences when the connection is restored.
• Client name - Your client’s name should include only
Aa-Zz, numerals, and ‘_’.
• Server - Remote server hostname or IP.
• Port - Remote server port.
• Use UDP - Using UDP instead of TCP reduces the load
on the router and may save bandwidth. However,
UDP does not provide any guarantee for delivery. The
router will typically assume sentences have been
those sentences.
• Number of stored sentences - Set the maximum
number of sentences that can be stored when the
router does not have a connection to a server.
• Specify Time Interval - Restricts the GPS sentence
interval.
• Start Time - Reporting start time.
• End Time - Reporting end time.
NOTE: Language Settings and Reporting Intervals options are identical to those for Send to Client(s).
Send to Serial
• Enable this client - Enables periodic reporting of GPS sentences on the serial port. The serial port settings
can be adjusted at SYSTEM > Serial Redirector under Serial Adapter Configuration.
• Client name - Your client’s name should include only Aa-Zz, numerals, and ‘_’.
• Port - Remote server port.
NOTE: Language Settings and Reporting Intervals options are identical to those for Send to Client(s).
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 95
User Manual / IBR900/IBR950 1/5/17
NMEA GGA, RMC, and VTG SENTENCES
Some devices report GPS information with multiple NMEA (National Marine Electronics Association) sentence
formats: GGA, RMC, and VTG. See the examples below. For more examples and information about NMEA
sentences, see the following websites:
• http://aprs.gids.nl/nmea/
• http://www.gpsinformation.org/dale/nmea.htm#nmea
GGA
Example: $GPGGA,1753405,4916.450,N,12311.127,W,2,06,1.5,117.3,M,−26.574,M,6.0,0138*47
Sample Data Description
1753405
4916.450,N Latitude 49 deg. 16.450 min North
12311.127,W Longitude 123 deg. 11.127 min Wes
2
Float RTK; 6 = estimated (dead reckoning); 7 = Manual input mode; 8 = Simulation mode
06 Number of satellites being tracked
1.5 Horizontal dilution of precision (HDOP) – relative accuracy of horizontal position
117.312,M Altitude in meters above mean sea level
-26.574,M Geoidal separation: height of mean sea level above WGS-84 earth ellipsoid (negative value means mean sea level
is below ellipsoid)
6.0
0138
*47 Checksum – used by program to check for transmission errors
RMC
Example: $GPRMC,144317.0,A,4337.190528,N,11612.329073,W,0.0,329.2,161015,0.0,E,A*16
Sample Data Description
144317
A Navigation receiver warning A = OK, V = warning
4337.190528,N Latitude 43 deg. 37.190528 min North
11612.329073,W Longitude 116 deg. 12.329073 min West
0.0 Speed over ground, knots
329.2 Course made good, true
161015
0.0,E Magnetic variation: 0.0 degrees East
A*16 Mode Indicator
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 96
User Manual / IBR900/IBR950 1/5/17
SMS
SMS (Short Message Service, or text messaging) requires a cellular modem with an active data plan. SMS is not
designed to be a full remote management feature: SMS allows you to connect to the router for a few simple
queries or commands with a text messaging service (e.g., from your phone). A modem that does not have
SMS is enabled on the router by default. However, it only works if SMS is supported and enabled on the modem.
Most modems have SMS enabled by default, but the carrier may charge a fee for each text message sent or
received. Contact your carrier to review these fees and/or to enable an SMS plan.
Important notes about SMS:
• Messages are limited to 160 characters.
• SMS is not a guaranteed delivery protocol. The carriers do not guarantee that the SMS message will be
delivered to the modem or that the modem’s response will be delivered to the sender. This means an
administrator might have to send messages multiple times before the desired action is performed.
• SMS is a slow protocol. It can take seconds or up to a few minutes for messages to be delivered.
• SMS messages are not encrypted; they are sent in full readable text over the network.
Enable SMS support – SMS support is enabled
by default on the router. Deselect this to
disable.
Password – By default, the password is the
last eight characters of the router’s MAC
address (i.e., the Default Password on the
product label). You can change this password
to anything between 1 and 16 characters.
It should be long enough to be useful for
security but short enough to easily type into
your phone (or other texting client).
White List – This list is blank by default,
which means that the router will accept SMS
messages from any phone number. Leaving
this blank is unsecure, so Cradlepoint recommends that you add phone numbers to this list. Once any numbers
are listed, only those numbers have the ability to connect to the router via SMS.
VTG
$GPVTG – Vector track and speed over ground
Example: $GPVTG,054.7,T,034.4,M,005.5,N,010.2,K
Sample Data Description
054.7,T Track, degrees relative to true north
034.4,M Track, degrees relative to magnetic north
005.5,N Ground speed, knots
010.2,K Ground speed, kilometers per hour
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 97
User Manual / IBR900/IBR950 1/5/17
SYSTEM LOGGING
Logging Level: Setting the log level controls which
Debug
will record the most information while a log level of
Critical will only record the most urgent messages. Each
level includes all messages from all of the levels below
it on the list (e.g. “Warning” includes all “Error” and
“Critical” messages as well).
• Debug
• Info
• Warning
• Error
• Critical
Enable Logging to a Syslog Server: Enabling this option
enabling, type the Hostname or IP address of the Syslog
server (or select from the dropdown menu).
• Syslog Server Address: Select the Hostname or IP address from the dropdown menu, or type this in
manually.
• Include System ID: This option will include the router’s “System ID” at the beginning of every log message.
This is often useful when a single remote Syslog server is handling logs for several routers.
• Include UTF8 Byte Order Mark: The log message is sent using UTF-8 encoding. By default the router will
attach the Unicode Byte Order Mark (BOM) to the Syslog message in compliance with the Syslog protocol,
RFC5424. Some Syslog servers may not fully support RFC5424 and will treat the BOM as ASCII text, which
will appear as garbled characters in the log. If this occurs, disable this option.
Log to attached USB stick: Only enable this option if instructed by a Cradlepoint support agent. This will write a
USB stick, or you may lose some logging data.
Verbose modem logging: Only enable this option if instructed by a Cradlepoint support agent.
Create support log
instructed by a Cradlepoint support agent.
ROUTER SERVICES
By default, router services (Enterprise Cloud Manager,
NTP, etc.) connect to the router via the WAN. In some
setups it makes sense to use the LAN instead. For
example, if your router is used strictly for 3G/4G failover
behind another router, you may not want to use 3G/4G
data unnecessarily. Select Use LAN Gateway to set your
router services to connect via the LAN.
LAN Gateway Address: Input the IP address of the
LAN side connection. If this is a 3G/4G failover router
operating behind another router, the LAN Gateway
Address is the IP address of that other router.
DNS Server and Secondary DNS Server: The primary and secondary DNS server numbers match the static DNS
values (set at NETWORKING > DNS Servers). You can leave the default values or set them manually here.
(Changing these values also changes the static DNS values.)
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 98
User Manual / IBR900/IBR950 1/5/17
DEVICE ALERTS
YOU MUST
ENABLE AN SMTP EMAIL SERVER TO RECEIVE ALERTS.
Alerts can be included for the following:
• Firmware Upgrade Available
• System Reboot Occurred: This router has rebooted. This depends on NTP being enabled and available to
report the correct time.
• Unrecognized MAC Address: Used with the MAC monitoring lists. An alert is sent when a new unrecognized
MAC address is connected to the router.
ENTERPRISE CLOUD MANAGER
Cradlepoint Enterprise Cloud Manager
(ECM) is a cloud-based management
organizing your Cradlepoint routers. Key
features include the following:
•
management
• Health monitoring of router
connectivity and data usage
• Remote management and control of
routers
• Historical record keeping of device logs and status
Registering Your Router – Once you have signed up for ECM, click on the Register Router button to begin
managing the router through ECM. Input your ECM Username and ECM Password and click Register. You have
now registered the device with Enterprise Cloud Manager.
Suspending the ECM Client – Click on the Suspend Client button to stop communication between the device and
ECM. Suspending the client will make it stop any current activity and go dormant. It will not attempt to contact
the server while suspended. This is a temporary setting that will not survive a router reboot; to disable the
client altogether use the Advanced Enterprise Cloud Manager Settings panel (below).
Enterprise Cloud Manager Settings (Advanced)
• Enabled: Enable the ECM client to contact the server. While this box is unchecked, the ECM client will never
attempt to contact the server. (Default: Enabled)
• Server Host:Port: The DNS hostname and port number for your ECM server. (Default: stream.cradlepoint.com)
• Session Retry Timer: How long to wait, in seconds, before starting a new ECM session following a connection
• Unmanaged Checkin Timer: How often, in seconds, the router checks with ECM to see if the router is
network usage over time.
• Maximum Alerts Buffer
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 99
User Manual / IBR900/IBR950 1/5/17
• WAN Device Status Change: An attached WAN device
has changed status. The possible statuses are plugged,
unplugged, connected, and disconnected.
• Conguration Change: A change to the router
• Login Success: A successful login attempt has been
detected.
• Login Failure: A failed login attempt has been detected.
• Account Locked: Account has been locked due to
excessive failed login attempts.
• IP Address Banned: An IP address has been banned.
• VPN Tunnel Goes Down: Sends an alert when a VPN
tunnel goes down.
• Feature License Expiration: Sends an alert when a
feature license is about to expire.
• Router SDK Application: A router SDK Application may
send an alert.
• Full System Log
contains the contents of the system log.
• Recurring System Log: The system log is sent
periodically. This alert contains all of the system
events since the last recurring alert. It can be
scheduled for daily, weekly and monthly reports
(Frequency). You also choose the Time you want the alert sent.
SMTP Mail Server
Since your router does not have its own email server, to receive alerts you must enable an SMTP server. This is
possible through most email services (Gmail, Yahoo, etc.)
following is an example using Gmail:
• Server Address: smtp.gmail.com
• Server Port: 587 (for TLS, or Transport Layer Security port; the router does not support SSL).
• Authentication Required: For Gmail, mark this checkbox.
• User Name: Your full email address
• Password: Your Gmail password
• From Address: Your email address
• To Address: Your email address
should receive a test email at your account.
Delivery Options (Advanced)
Email Subject Prefix
Retry Attempts: The number of attempts made to send an alert to the mail server. After the attempts are
exhausted, the alert is discarded.
Retry Delay: The delay between retry attempts.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 100
User Manual / IBR900/IBR950 1/5/17
GPIOs allow you to monitor inputs and produce outputs with
simple conditions.
Special note for ‘1 on power cable’ and ‘5 on expander’ GPIOs: If
either one of these pins is set to Ignition Sensing, you must leave
the other pin unused and disconnected.
Wiring reference:
GPIO 1 - pins 7, 8 on serial cable
GPIO 2 - pins 2, 3 on serial cable
GPIO 3 - pins 4, 6 on serial cable
GPIO Name: Name of this GPIO. For example ‘East door’ or
‘Vehicle engine’. This will be used to form an alert string e.g.,
‘East door is closed.’ or ‘Vehicle engine is running.’
Low State Name: Name of the low state of this gpio. For
example ‘closed’ or ‘not running’. This will be used to form
an alert string e.g., ‘East door is closed.’ or ‘Vehicle engine is
running.’
High State Name: Name of the high state of this gpio. For
example ‘closed’ or ‘not running’. This will be used to form
an alert string e.g., ‘East door is closed.’ or ‘Vehicle engine is
running.’
Alert Trigger State:
Input Delay Duration: Input delay duration setting aims to minimize the number of false positives by waiting a
It’s important to note that there is an additional 200ms delay, even when this setting is at 0 seconds.
Action:
• Default/Low: In this mode the output pin is not used and is at 0V (ground potential).
SERIAL REDIRECTOR
A single USB Serial device can be used to establish a serial link to a host port on the router. The USB Serial
device can also be accessed by running “serial” from an SSH session.
Telnet to Serial Conguration
• Enabled: Enabling Telnet to Serial will start a Telnet server that
passes its connection to the serial adapter. Enabling this service
is not necessary when accessing serial through SSH.
• LAN: Enable serial redirector for LAN connections.
• Authenticated LAN: Enable serial redirector for Authenticated
LAN connections. You must be logged into the router to use the
redirector.
• WAN: Enable serial redirector for WAN connections.
• Server Port: Enter a port number for the redirector to use. (Default: 7218)
GPIO CONFIGURATION
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 101
User Manual / IBR900/IBR950 1/5/17
• Set High/Router Running: In these modes the output pin is logic low while the router is booting and
transitions to logic high when the router is fully running. If the router is reset, the output returns to low
until the router has fully rebooted.
• Modem Connected: In this mode the output pin is logic low until the modem has connected to the tower. If
the connection drops, this output is set low until the connection is restored.
Hardware note: The output pin is an open collector/drain.
SNMP CONFIGURATION
SNMP, or Simple Network Management Protocol, is an Internet standard protocol for remote management. You
might use this instead of Enterprise Cloud Manager if you want to remotely manage a set of routers that include
both Cradlepoint and non-Cradlepoint products.
SNMP Conguration
• Enable SNMP: Selecting “Enable SNMP”
options.
Network Settings
• Enable SNMP on LAN: Enabling SNMP on LAN
will make SNMP services available on the
LAN networks provided by this router. SNMP
will not be available on guest or virtual
networks that do not have administrative
access.
• LAN port #
access SNMP services on. (Default: 161)
• Enable SNMP on WAN: Enabling SNMP on
WAN will make SNMP services available to
the WAN interfaces of the router.
• WAN port #
wish to make SNMP services available on.
(Default: 161)
• SNMP Version
• SNMPv1
transmit with settings compatible with SNMP version 1 protocols.
• SNMPv2c: SNMP version 2c has the same features as v1 with some additional commands. SNMPv2c will
• SNMPv3: SNMP version 3 includes all prior features with security available. SNMPv3 is the most secure
SNMP v1 & v2c Settings
• Get community string: The “Get community string” is used to read SNMP information from the router. This
string is like a password that is transmitted in regular text with no protection.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 102
User Manual / IBR900/IBR950 1/5/17
• Set community string: The “Set community string” is used when writing SNMP settings to the router. This
SNMPv3
• Authentication type: Select the authentication and encryption type that will be used when connecting to
SNMP clients.
• MD5 with no encryption
• SHA with no encryption
• MD5 with DES encryption
• SHA with DES encryption
• MD5 with AES encryption
• SHA with AES encryption
• Username
• Password
password must be at least eight characters long.
• Enable SNMP traps
• Trap community string
community name.
• Address for trap server: Enter the address of the host system that you want trap alerts sent to.
• Trap server port #: Enter the port number that the remote host will be listening for trap alerts on. (Default:
162)
General Settings
Read Only.
• System Contact: Input the email address of the system administrator.
• System Name: Input the router’s hostname.
• System Location: Input the physical location of the router. This is simply a string for your own information.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 103
User Manual / IBR900/IBR950 1/5/17
the router, you may not want to upgrade just because a new version is
for information to decide if you should upgrade.
Current Firmware Version:
Shows the number of the
date it was updated.
Available Firmware Version:
version available, this will list
the version number. Click “Check Again” to have the router check for
Automatic Firmware Check:
updates once daily.
Manual Firmware Upload:
attached computer. (Go to cradlepoint.com/rmware to download the
System Cong Save/Restore
Download Settings: Click on “Dowload Settings” to save your current
Restore Settings: Click on “Restore Settings” to restore your previous
Firmware Management
a computer without rebooting between steps.
SYSTEM CONTROL
SYSTEM FIRMWARE
MODEM FIRMWARE
module due to carrier updates or defect resolution. If you are happy with the operation of the modem, you may
information to decide if you should upgrade or not.
within the device’s memory.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 104
User Manual / IBR900/IBR950 1/5/17
For modems supporting manual
carrier switching (such as LPE), select
File to browse to an appropriate,
memory.
Firmware updates can be performed
the Check/Upgrade or File (manual)
process.
The following actions are available to
• Automatically check for new firmware: Click the checkbox to indicate whether the system is to
This global setting applies to all modems connected to the router.
• Select Modem: Select the appropriate modem which you would like to update. Note that dual SIM devices
are listed as a single modem.
In the Installed Firmware grid, you will see the following columns:
• Active (Multi-firmware modems only): Indicates which carrier package is currently active on the modem.
Note: You cannot select the active image. On multi-firmware modems, the carrier firmware is selected
automatically.
• Carrier:
“Generic” will be displayed.
• Current Package Version:
• Available Firmware Version:
• Upgrade:
upgrade. If a connection error occurs, it is possible that HTTPS is blocked for the upgrade check. Enable Allow
HTTP Firmware Check in SYSTEM > System Control >System Firmware to address this issue.
• Check: Click this button to refresh or update the Available Firmware Version status column.
• File:
Note: For modems which
support manual carrier switching, find the appropriate modem firmware package file via ECM or the Cradlepoint
portal.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 105
User Manual / IBR900/IBR950 1/5/17
Reboot Options
• Reboot the Device: Manually restart the router.
• Factory Reset Router: Reset the router to its
original settings. Once reset your SSID and admin
password will match the sticker on the bottom of
the router.
• Device Console: Access router’s command line
interface (CLI) console.
Scheduled Reboot
• Scheduled Reboot: Router will restart at user-
• Enable Watchdog Reboot: Router will restart when
it determines an unrecoverable error condition has
occurred.
DEVICE OPTIONS
DIAGNOSTICS
Ping Test
A simple test to check Internet connectivity. Type the
Hostname or IP address of the computer you want to ping
and click the ‘Ping’ button.
Speed Test
• Tests Against Cradlepoint Server - Up to ten speed
tests are permitted against a Cradlepoint server.
• WAN Device - The WAN Device that is selected will
have the test run on it. If no device is selected then the
highest priority connected device will be used.
• Custom Server - Type the Hostname or IP address of
the server to which you wish to perform a test. If left
empty the test will be done to a Cradlepoint server.
• Custom Port (Optional) - The port to which the test is
directed.
• Max Duration - The Max Duration is the Maximum
amount of time for which the test should be run. The
• Data Limit - The Data Limit is the limit of how much
data will be transferred while measuring the connection speed; this should be limited to reduce the expense
of a speed test. Setting the limit to 0 will cause the test to run until enough data is collected or the
duration limit is met.
• Test Type - Select the type of test you would like to run. TCP Upload will test speed going to the server, TCP
Download will test speed coming to the client, and UDP will measure the speed going to the server.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 106
User Manual / IBR900/IBR950 1/5/17
Administrator Password and Time Zone
Enter a password for the administrator who will have full
access to the router’s management interface.
You can use the default password on the back of your
product, or you can create a custom Administrator
Password.
Conguring Your Wireless Network
• Wireless Network Name - When you are browsing for
available wireless networks, this is the name that
will be broadcast from this router. This name is also
referred to as the SSID. For security purposes, it is
wireless network name.
• Enable Guest Network - If the guest network is
enabled, anyone can connect to the special guest
network which allows limited connectivity to the
Internet while preventing access to your local
network.
• Security Mode
• Best (WPA2): Select this option if your wireless
adapters support WPA2-only mode. This will
connect to most new devices and is the most secure, but may not connect to older devices or some
handheld devices such as a PSP.
• Good (WPA1 & WPA2): Select this option if your wireless adapters support WPA or WPA2. This is the
most compatible with modern devices and PCs.
• Poor (WEP): Select this option if your wireless adapters only support WEP. This should only be used if
a legacy device that only supports WEP will be connected to the router. WEP is insecure and obsolete
and is only supported in the router for legacy reasons. The router cannot use 802.11n modes if WEP is
enabled; router WiFi performance and range will be limited.
• None (OPEN): Select this option if you do not want to activate any security features.
SETUP WIZARDS
ECM REGISTRATION
To register the router with
have an account. If you need
to create an account you can
signup at cradlepoint.com.
Once you’ve created an
account, or if you already have
one, you can enter your ECM
username and password to
register the router.
FIRST TIME SETUP
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 107
User Manual / IBR900/IBR950 1/5/17
• WPA Password - The WPA Password must be between 8 and 64 characters long. A combination of upper
and lower case letters along with numbers and special characters is recommended to prevent hackers from
gaining access to your network.
Conguring Your APN and Modem Authentication
If you are using a SIM-based modem (LTE/GSM/HSPA) with
before it will properly connect to your carrier. Wireless
password on the back of your product, or you can create a
custom Administrator Password.
NOTE: DO NOT USE THIS APN WIZARD if you have already
CONNECTION MANAGER page, select your modem, and edit the settings. The SIM PIN/APN tab has more available
settings than are provided here.
• Authentication Protocol
• Username
• Password
Enable and Congure Failure Check
Failure check will test the connection to verify the WAN device is
connected.
• Idle Check Interval: Set the number of seconds the router will wait
between checks to see if the WAN is still available.
• Failure Check:
• Off: Once the link is established the router takes no action to
verify that it is still up.
• On: Modems will be set to use the Passive DNS failure check
type. Ethernet and WiFi as WAN connections will be set to use
Active Ping.
• Ping IP Address: This IP address must be an address that
can be reached through your WAN connection (modem/
Ethernet). Some ISPs/Carriers block certain addresses, so
choose an address that all of your WAN connections can
use.
Summary
Review your settings and click Finish to exit or Back to edit.
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 108
User Manual / IBR900/IBR950 1/5/17
IP passthrough takes a 3G/4G WAN data source (USB,
ExpressCard, or Cradlepoint business-grade modem) and
passes the IP address through to Ethernet LAN.
Enabling IP passthrough will make many changes to your
are compatible with how the router will be used.
• All Ethernet ports will be set to LAN
• All network groups except the primary network group
will be removed
• All WAN devices will have Load Balance disabled and the
highest priority device will be used
• All Wireless interfaces will be removed from the primary
network group
• All Router based VPN and GRE services will be disabled
• The Routing Mode will be set to IP Passthrough
• The Subnet Selection Mode will be set to “Automatically
Create Subnet” unless overridden via the Subnet
Selection Mode dropdown
Any Ethernet WAN connections should be disconnected before IP passthrough is enabled.
IP PASSTHROUGH SETUP
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 109
User Manual / IBR900/IBR950 1/5/17
APPENDIX A
EXTENSIBILITY DOCK
PINOUTS
Router to Dock Connector
Router to Dock Connector
Pin 1 Ethernet TX-
Pin 2 Ethernet TX+
Pin 3 Ethernet RX-
Pin 4 GND
Pin 5 Ethernet RX+
Pin 6 USB D-
Pin 7 USB D+
Pin 8 GPIO1
Pin 9 GPIO2
Pin 10 GPIO3
Pin 11 GPIO4
Pin 12 GND
Pin 13 Ignition Sense
Pin 14 Router power in/out (18 W in min; 6 W out max)
Pin 15 Router power in/out (18 W in min; 6 W out max)
2x10 Dock GPIO Connector
2x10 Dock GPIO Connector
Pin 1 Router+Dock power - input only (24 W min)
Pin 2 Router+Dock power - input only (24 W min)
Pin 3 Reserved
Pin 4 Reserved
Pin 5 GPI (ignition sense)
Pin 6 GPIO1
Pin 7 GPIO2
Pin 8 GPIO3
Pin 9 GPIO4
Pin 10 Low current 5 V output (50 mA max)
Pin 11-20 Ground
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 110
User Manual / IBR900/IBR950 1/5/17
GPIO CABLE
• Ignition Sense threshold: max 3.4 V,
protected to 33 V
• GPIOs: LLTL compatible, protected
to 33 V
Wire Signal
Black (2) GND
Yellow GPIO1
Blue GPIO2
White GPIO3
Green GPIO4
Orange Ignition sense
Red (2) Router power
©2017 Cradlepoint. All Rights Reserved. | +1.855.813.3385 | cradlepoint.com 111
User Manual / IBR900/IBR950 1/5/17
APPENDIX B
SAFETY, REGULATORY, AND WARRANTY GUIDE
WARRANTY INFORMATION
Cradlepoint, Inc. warrants this product against defects in materials and workmanship to the original purchaser for a period of three
(3) years from the date of shipment. This warranty is limited to a repair or replacement of the product, at Cradlepoint’s discretion, as
purchaser’s sole and exclusive remedy. Cradlepoint does not warrant that the operation of the device will meet your requirements or be
error free.
LIMITATION OF CRADLEPOINT LIABILITY
The information contained in this Safety, Regulatory, and Warranty Guide is subject to change without notice and does not represent
FOR ANY AND ALL: (A) DIRECT, INDIRECT, SPECIAL, GENERAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE OR EXEMPLARY DAMAGES, INCLUDING
WITHOUT LIMITATION FOR LOSS OF PROFITS OR REVENUE OR OF ANTICIPATED PROFITS OR REVENUE ARISING OUT OF THE USE OR INABILITY
TO USE THE DEVICE, EVEN IF CRADLEPOINT AND/OR ITS AFFILIATES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, AND EVEN
IF SUCH DAMAGES ARE FORESEEABLE; OR (B) CLAIMS BY ANY THIRD PARTY. NOTWITHSTANDING THE FOREGOING, IN NO EVENT SHALL THE
AGGREGATE LIABILITY OF CRADLEPOINT AND/OR ITS AFFILIATES ARISING UNDER OR IN CONNECTION WITH THE DEVICE, REGARDLESS OF THE
NUMBER OF EVENTS, OCCURRENCES, OR CLAIMS GIVING RISE TO LIABILITY, EXCEED THE PRICE PAID BY THE ORIGINAL PURCHASER OF THE
DEVICE.
PRIVACY
Cradlepoint collects general data pertaining to the use of Cradlepoint products via the Internet including, by way of example, IP address,
device ID, operating system, browser type and version number, etc. To review Cradlepoint’s privacy policy, please visit cradlepoint.com/
privacy.
OTHER BINDING DOCUMENTS; TRADEMARKS; COPYRIGHT
By activating or using your IBR900 or IBR950 device, you agree to be bound by Cradlepoint’s Terms of Use, User License and other
applicable Legal Policies.
© 2017 Cradlepoint, Inc. All rights reserved. Cradlepoint is not responsible for omissions or errors in typography or photography.
Cradlepoint, IBR900, IBR950, and the Cradlepoint logo are trademarks of Cradlepoint, Inc. in the US and other countries. Other
trademarks are property of their respective owners.
OPEN SOURCE SOFTWARE
This product contains software distributed under one or more of the following open source licenses: GNU General Public License Version
2, BSD License, Net-SNMP License, and PSF License Agreement for Python 3.3. For more information on this software, including licensing
terms and your rights to access source code, contact Cradlepoint at cradlepoint.com/opensource.
ROUTER COMMUNICATION/DATA USAGE
communication may result in data usage and applicable charges regardless of whether the router uses a wired or wireless Internet
connection. To avoid such data usage and potential charges, consult the following Knowledge Base article:
http://knowledgebase.cradlepoint.com/articles/support/router-communication-data-usage
