Furthermore, the manufacturer must maintain a copy of the Digi TransPort WR11 user manual documentation and ensure the final product does not exceed the ...
Set calling numbers to answer or reject. 790. Configuring telemetry (GPS). Configure GPS parameters. 793. Configure WR31 Cellular GPS.
Digi TransPort® Routers
Models WR11, WR21, WR31, WR41, WR44, WR44 R, WR44 RR
User Guide
Revision history--90001019
Revision R
Date May 2018
S
July 2018
T
March 2019
U
July 2019
V
December 2019
Description Updated content for the Digi TransPort version 6.1.x.
n Added support for IPv6. n Updated content for configuring supported cellular
modules. n Added instructions for enabling health reporting via
Digi Remote Manager. n Added descriptions for backup and restore settings. n Miscellaneous editorial corrections.
Updated content for the Digi TransPort version 6.1.x.
n Added support for Cellular GPS to the WR31.
Updated content for the Digi TransPort version 7.0.x.
n Added support for automatic APN selection. n Added Network start verbose call end reasons to
troubleshooting information. n Added IFETEL certification information for certain
models of WR11, WR21, and WR31 devices.
n Corrected power statements for the WR44 R. n Added "Powering the WR44 R" Section.
Updated content for Digi TransPort release 8.0.x.
n Changed default password behavior to comply with California law.
Digi TransPort® Routers User Guide
2
Revision W
Date September 2020
X
December 2020
Description
Updated content for Digi Transport release 8.2.x.
n Updated information related to the LAN0 port on certain variants of the WR44R.
n Added sendsms command information. n Corrected information about the WR31 cellular
antenna port. n Added description of Async Mode for serial port
configuration. Applicable to specific hardware models only. n Corrected information about the character limit for usernames and passwords in the GUI. n Added description of the solid amber state for the Service LED on WR11. n Clarified documentation for the default password behavior.
Updated content for Digi Transport release 8.3.0.1.
n Added sendsms CLI command to the documentation.
n Corrected information about antenna ports on the WR31.
n Updated LED blink codes for the WR11. n Updated baud rate information for serial devices.
Trademarks and copyright
Digi, Digi International, and the Digi logo are trademarks or registered trademarks in the United States and other countries worldwide. All other trademarks mentioned in this document are the property of their respective owners. © 2020 Digi International Inc. All rights reserved.
Disclaimers
Information in this document is subject to change without notice and does not represent a commitment on the part of Digi International. Digi provides this document "as is," without warranty of any kind, expressed or implied, including, but not limited to, the implied warranties of fitness or merchantability for a particular purpose. Digi may make improvements and/or changes in this manual or in the product(s) and/or the program(s) described in this manual at any time.
Digi TransPort® Routers User Guide
3
Warranty
To view product warranty information, go to the following website:
www.digi.com/howtobuy/terms
Customer support
Gather support information: Before contacting Digi technical support for help, gather the following information: Product name and model Product serial number (s) Firmware version Operating system/browser (if applicable) Logs (from time of reported issue) Trace (if possible) Description of issue Steps to reproduce Contact Digi technical support: Digi offers multiple technical support plans and service packages. Contact us at +1 952.912.3444 or visit us at www.digi.com/support.
Feedback
To provide feedback on this document, email your comments to
techcomm@digi.com
Include the document title and part number (Digi TransPort® Routers User Guide, 90001019 X) in the subject line of your email.
Digi TransPort® Routers User Guide
4
Contents
Digi TransPort® routers
TransPort WR11
16
TransPort WR21
18
TransPort WR31
19
TransPort WR41
21
TransPort WR44 / WR44 R
22
TransPort WR44 RR
23
Hardware features
TransPort WR11 hardware features
25
TransPort WR11 EVDO model
25
TransPort WR11 HSPA+ model
27
TransPort WR11 LTE-MIMO
28
TransPort WR11 XT
30
TransPort WR11 accessories
32
TransPort WR11 hardware specifications
33
Regulatory and safety statements
34
TransPort WR21 hardware features
39
TransPort WR21 front panel
39
TransPort WR21 rear panel features
40
Reset the TransPort WR21
41
TransPort WR21 serial pinout
42
TransPort WR21 accessories
44
TransPort WR21 hardware specifications
45
Regulatory and safety statements
45
TransPort WR31 hardware features
50
TransPort WR31 hardware specifications
53
TransPort WR31 accessories
54
TransPort WR31 mounting options
55
Hazardous Location installation
56
TransPort WR31 serial pinout
57
TransPort WR31 digital and analog inputs and outputs
59
I/O connector pin assignments
59
TransPort WR31 digital input/output: representative circuit
60
TransPort WR31 analog input: representative circuit
60
Example digital and analog I/O wiring
61
Digital output
61
Digital and analog I/O specifications
63
Regulatory and safety statements
65
Digi TransPort® Routers User Guide
5
TransPort WR41 hardware features
70
Front panel
70
Rear panel
71
Underside of unit features
72
Additional hardware features
73
TransPort WR41 hardware specifications
75
TransPort WR41 accessories
76
TransPort WR41 serial pinout
77
Regulatory and safety statements
78
TransPort WR44 / WR44 R hardware features
82
Front panel
82
TransPort WR44 models with cellular interface
82
TransPort WR44 models without SIM card slots
82
Rear panel
83
Underside of unit
84
Enclosure features
85
TransPort WR44 additional hardware features
86
Powering the TransPort WR44 R
87
TransPort WR44 hardware specifications
88
TransPort WR44 R hardware specifications
89
TransPort WR44 accessories
90
TransPort WR44 R accessories
91
TransPort WR44 / WR44 R RS232 serial pinout
92
Regulatory and safety statements
93
TransPort WR44 RR hardware features
97
Front panel
97
Rear panel
97
Enclosure features
98
TransPort WR44 RR hardware specifications
99
TransPort WR44 RR accessories
100
TransPort WR44 RR Ethernet cable connectors and pinouts
101
Regulatory and safety statements
103
Purchase additional serial cables
107
Signal strength indicators
108
Antenna specifications for Wi-Fi 2.4 GHz modules
109
Using the command-line interface
About the Digi TransPort command line interface
111
Supported command types
112
Required software for using the command line
113
Connect to the TransPort router from a PC
114
Log in to the command line interface
115
Exit the command line interface
116
Commands and the active port
117
When commands take effect
118
View current configuration changes
119
Save changes
120
Configure network settings
121
Establish a remote connection
123
Application commands
124
Application commands are case-insensitive
124
One command per line
124
Application command syntax
124
Use wildcards in commands
124
Digi TransPort® Routers User Guide
6
Use special usernames in commands
125
Using the command-line parameter tables in this guide
126
Activate and deactivate interfaces
128
ana command: Clear the Analyser Trace
129
config command: show/save configuration
130
config changes command: show number of changes counter
131
clear command: Clear the event log
132
gpio command: General Purpose Input Output (GPIO)
133
ping command: Troubleshoot connectivity problems
135
qdl command: Select cellular image to load
136
reboot command: reboot router
137
tcpperm command: establish a permanent serial to IP connection
138
tcpdial command: Establish a manually initiated serial to IP connection
140
tcpdab command: Cancel a tcpdial connection
141
templog command: monitor router temperature
142
traceroute command: Troubleshoot connectivity problems
143
sendSMS command: Send SMS messages
143
AT commands
144
The AT command interface
144
Enter multiple commands
144
Use escape sequences
144
AT command result codes
145
S registers
146
atd: Dial a call
147
ath: Hang-up
148
atz: Reset
149
at&c: Control the DCD signal
150
at&f: Load factory settings
151
at&r: Control the CTS signal
152
at&v: View profiles
153
at&w: Write SREGS.DAT file
154
at&y: Select power-up profile
155
at&z: Store phone number
156
at\at: Ignore invalid AT commands
157
at\gps command: Send GPS data to ASY port
157
at\ls: Lock speed
158
at\port: Set the active port for text commands
159
at\smib commands
160
S register definitions
166
Configuring network interfaces
Configure Ethernet interfaces
171
IPv6 addressing support on Ethernet interfaces
171
Configure basic Ethernet IP address parameters
172
Configure advanced Ethernet parameters
174
Configure Ethernet Quality of Service (QoS) parameters
184
Configure Ethernet Virtual Router Redundancy Protocol (VRRP)
187
Configure logical Ethernet interfaces
191
Configure which Ethernet devices can send packets to the router (MAC filtering)
192
Configure an Ethernet bridge between two networks (MAC bridging)
194
Configure Rapid Spanning Tree Protocol (RSTP)
196
Configure Virtual LAN (VLAN) support
198
Configure Wi-Fi interfaces
200
Configure global Wi-Fi settings
201
Digi TransPort® Routers User Guide
7
Configure advanced global Wi-Fi settings
205
Configure a Wi-Fi node as a hotspot
206
Configure Wi-Fi filtering
207
Configure a Wi-Fi node
208
Perform a rogue scan
214
Configure mobile (cellular) interfaces
215
Configuration parameters required from your mobile network
215
Supported cellular modules in Digi TransPort products
216
Configure SIMs
217
Configure mobile connection settings
218
Configure SIM failover
223
Configure advanced mobile parameters
224
Configure sending and receiving SMS messages
234
Verify mobile connectivity and check mobile status
238
Automatic SIM detection
240
Determine the cellular module type and carrier firmware version
241
Switch the cellular carrier firmware
242
Update carrier firmware
246
Configure DSL interfaces
249
Configure permanent virtual circuit (PVC) parameters
250
Configure DSL network settings
251
Configure PVC traffic shaping parameters
255
Configure advanced DSL parameters
257
Configure Generic Routing Encapsulation (GRE) interfaces
259
Configure GRE tunnel parameters
260
Configure advanced GRE parameters
263
Configure ISDN interfaces
265
Configure the ISDN interface to receive incoming calls
266
Configure ISDN dialing parameters
271
Configure advanced ISDN parameters
276
Configure ISDN Link Access Protocol D (LAPD) parameters
280
Configure ISDN to answer V.120 calls
283
Configure PSTN interfaces
285
Configure advanced PSTN parameters
290
Configure DialServ interfaces
294
Configure DialServ network settings
295
Configure advanced DialServ parameters
299
Configure serial interfaces
303
Configure advanced serial port parameters
306
Configure synchronous communications
310
Configure rate adaptation
312
Configure command alias mappings
314
Configure protocol bindings
316
Configure virtual serial ports
318
Configure port redirection using RealPort
320
Configure sending serial data to multiple serial ports
324
Configure IPv6 addressing support
327
IPv6 support is for Ethernet interfaces only
327
IPv6 modes
327
Typical IPv6 configuration
327
IPv6 support in the web interface
329
IPv6 support in the command-line interface
331
Configure a WAN for IPv6
335
Configure a LAN for IPv6
336
Show and update the IPv6 source IP address policy table
339
Digi TransPort® Routers User Guide
8
Show DHCPv6 server status
340
Show DHCPv6 client status
341
Use DHCPv6 to learn IPv6 addresses
342
Use the Neighbor Discovery Protocol (NDP) cache
343
Delete a Neighbor Discovery Protocol (NDP) cache
344
Show the IPv6 routing table
345
Show IPv6 routing and address information
346
Show the IPv6 addresses assigned to an interface
347
Support for IPv6 packets in firewall rules
348
Configure PPP and external modems
349
Configure external modem support
350
Configure PPP mappings
352
Configure PPP parameters
356
Configure mobile PPP parameters
365
Configure advanced PPP parameters
366
Configure PPP negotiation
378
Configure PPP sub-configurations
385
Configure PPP over Ethernet
387
Configuring DHCP servers
About DHCP servers
389
Configure DHCP server for Ethernet interfaces
390
Configure advanced DHCP parameters
393
Configure advanced DHCP options
394
Configure DHCP options
396
Configure static lease reservations
398
Configuring network services
Configure network services
401
Configuring DNS
Configure DNS servers
407
DNS Server n parameters
407
DNS Server Update parameters
408
Configure Dynamic DNS (DynDNS)
412
Dynamic DNS parameters
412
Advanced Dynamic DNS parameters
415
Configuring IP routing and forwarding
Supported routes
418
Dynamic routes
418
Static routes
418
Default routes
418
Routing modes
418
View the TransPort routing table
420
Configure route metrics
421
Configure IP routing parameters
422
Configure static routes
425
Advanced Static Route parameters
426
Digi TransPort® Routers User Guide
9
Related CLI commands
429
Configure default IP routes
433
Advanced Default route parameters
434
Configure Routing Information Protocol (RIP) settings
439
Configure global RIP Settings
439
Configure access lists
440
Configure authentication keys
441
Configure RIP advertisements
442
Configure Open Shortest Path First (OSPF) parameters
445
Configure Border Gateway Protocol (BGP) settings
448
Configure IP port forwarding and static NAT mappings
450
Configure multicast routes
452
Configure Virtual Routing and Forwarding (VRF)
454
Support for Virtual Routing and Forwarding in the web and command-line interfaces
454
Configure VRF for Ethernet interfaces
454
Configure VRF for GRE tunnel interfaces
454
Configuring Virtual Private Networking (VPN)
Virtual Private Networks (VPNs)
457
Configure Internet Protocol security (IPsec)
458
About Internet Protocol Security (IPSec)
459
Configure IPsec tunnels
461
Configure IPsec tunnel default action
475
Configure IPsec groups
477
Configure Dead Peer Detection (DPD)
486
Configure Internet Key Exchange (IKE)
488
Configure IKEv2
499
Configure Layer 2 Tunneling Protocol (L2TP)
505
Use X.509 certificates with IPsec tunnels
510
Configure Point-to-Point Tunneling Protocol (PPTP)
513
Configure OpenVPN
515
Additional information on OpenVPN configuration
515
Supported Cipher and Digest values for OpenVPN
522
Configuring Secure Sockets Layer (SSL)
About the Secure Sockets Layer (SSL)
524
Configure the SSL server
525
Configure SSL clients
527
Configuring Secure Shell (SSH) server and client
About the Secure Shell (SSH) server
530
Configure SSH servers
531
Configure the SSH client
536
Generate SSH private keys
541
Perform SSH authentication with a public/private key pair
543
Configuring FTP Relay
Configure FTP Relay
545
Configure FTP Relay agents
545
Digi TransPort® Routers User Guide
10
Configure Advanced FTP Relay parameters
548
Configure an SMTP client, as needed
549
Configuring IP passthrough
Configure IP passthrough
551
Configuring UDP echo
Configure a UDP echo client
555
Configuring Quality of Service (QoS)
Configure Quality of Service (QoS)
558
Configuring time bands
Configure a time band
566
Enable and disable time bands for a PPP or Wi-Fi interface
568
Configuring advanced network settings
Configure advanced network settings
571
Configure first settings group
571
Configuring legacy protocols
About legacy protocols
578
Configure Systems Network Architecture over IP (SNAIP)
579
Forcing SNAIP to use a specific instance
586
Configure TPAD parameters
587
Set TPAD parameters:
592
Configure X.25 parameters
601
Configure general X.25 parameters
602
Configure X.25 LAPB parameters
604
Configure NUI mappings
609
Configure NUA / NUI interface mappings
610
Configure X.25 call macros
613
Configure IP to X.25 call strings
615
Configure Packet Assembler Dissassembler (PADS)
618
Configure an X.25 Permanent Virtual Circuit (PVC)
633
X.25 packet switching
636
Configure a MODBUS gateway
645
Requirements for MODBUS support in TransPort devices
645
Configure the MODBUS gateway
645
Configure MODBUS slaves
647
Configure Protocol Switch software
649
Protocol Switch software logic
651
Configure the Protocol Switch
653
Configure CUD mappings parameters
661
Configure IP sockets to protocol switch
662
Configure NUA to interface mappings
665
Digi TransPort® Routers User Guide
11
Configure NUA mappings
667
Configuring alarms
Configure events to trigger alarms
669
Configure sending email alert messages when events occur
671
Configure SNMP traps
676
Send SMS alert messages when events occur
679
Log events to a secondary log file on an external flash drive
681
Log events to a Syslog server
682
Edit event descriptions
685
Configure event logcodes
687
Configure handling of the reasons for an event
690
Configure an SMTP email account to send alarms
692
Configuring system settings
Set device identity parameters
696
Set system date and time
698
Using NTP is recommended for greater accuracy
698
Set system date and time manually
698
Set system date and time automatically using an SNTP server
700
Set system date and time automatically using an NTP server
702
ntpstat command: Check NTP client status
708
Set commands to run automatically at bootup
709
Set web and command line interface options
710
Set miscellaneous system options
713
Set power control options
715
Functional areas for saving power
715
Power control profiles
715
Additional information on power control
716
Set temperature monitoring
719
Configuring remote management
Use Digi Remote Manager to manage devices
721
Configure Digi Remote Manager
722
Configure using SMS messages for remote management
724
Enable device health reporting
726
Configure advanced remote management settings
728
Use SNMP for remote management
731
Supported SNMP versions
731
Supported Management Information Bases (MIBs)
731
at\smib commands
731
Configure SNMP settings
732
Configure SNMP users
733
Configure SNMP filters
735
Configure SNMP traps
736
Configuring security
Configure system security settings
740
Configure user security settings
742
Digi TransPort® Routers User Guide
12
Configure advanced user settings
744
Change the default user name and password for a user
746
Firewall
748
Configure firewall rules
749
Configure stateful inspection settings
751
Use firewall scripts
753
Use a RADIUS client for authentication
790
Configure advanced RADIUS client parameters
793
Use TACACS+ to control access to the router
794
Functions of the AAA services
794
TACACS+ to local privilege level mappings
795
Configure advanced TACACS+ security settings
798
Use command filtering
799
Enable command filtering
800
Set calling numbers to answer or reject
801
Configuring telemetry (GPS)
Configure GPS parameters
804
Configure WR31 Cellular GPS
809
Configure GPS support for the GOBI3000 module
811
Managing applications and programs
Manage ScriptBasic applications
812
Manage Python applications
814
Managing networks and connections
Show network interface status
816
Show Ethernet status and statistics
817
Show Wi-Fi status and statistics
820
Show mobile status and statistics
823
Show DSL status and statistics
829
Show GRE interface status
832
Show ISDN status and statistics
834
Show PSTN interface status and statistics
835
Show serial status and statistics
837
Show PPP status and statistics
839
Show IP statistics
843
Show the IP routing table
845
Show the IP hash table
847
Show the port forwarding table
849
Show firewall statistics
850
Show firewall trace output
853
Show DHCP status
854
Show DNS status
855
Show IGMP status
856
Show Quality of Service (QoS) status
857
Show NTP status
858
Manage connections
860
Show IP connections
861
Manage PPP connections
864
Digi TransPort® Routers User Guide
13
Show VPN connections
865
Show GPS data
870
View and manage the event log
872
Analyze data traffic
874
Capture data traffic
875
Show captured data traffic
881
Set PCAP (such as Wireshark) traces
882
Use the Top Talkers monitor
883
Configure Top Talkers monitor
884
Show the Top Talkers trace
885
Performing device administration tasks
View system information
886
Manage files
889
FLASH directory
889
WEB Directory
890
File Editor
891
copy command: Copy a file
892
del command: Delete a file
893
dir command: List the file directory
893
fattr command: Set or remove read only flag for a file
894
flock command: Lock files
894
funlock command: Unlock files
894
move command: Move a file
894
ren command: Rename a file
895
scan/scanr command: Scan the file system
895
type command: Display a text file
895
xmodem command: Initiate an XMODEM file upload
895
TransPort file system
897
Manage files using USB storage devices
899
Create a universal config.da0 file using tags
907
Use comments in configuration files
908
Manage X.509 certificates and host key pairs
909
Manage Certificate Authorities (CAs)
910
Manage IPsec/SSH/HTTPS certificates
912
Manage RSA key files
917
Generate private keys
918
Split a private key
920
Back up and restore configuration settings
921
Configuration files associated with your TransPort router
921
Methods for saving configuration files
921
Back up the configuration to a file on your PC or a server
922
Restore the configuration to a file on your PC or a server
922
Update firmware
923
Reset the router to factory defaults
925
Using the web interface
925
Using the reset button on the router
926
Save configuration settings to a file
927
Save the current configuration
927
Save All: Save the entire configuration
927
Execute a command from the web interface
929
Reboot the router
930
Digi TransPort® Routers User Guide
14
Troubleshooting
Troubleshooting resources
932
Download the debug.txt file
933
Cannot open the web interface
935
Cannot log into the web interface
936
Troubleshoot the LTE-MIMO antenna orientation
937
Network start verbose call end reasons
937
Digi TransPort® Routers User Guide
15
Digi TransPort® routers
The Digi TransPort WR family of 3G/4G cellular routers offers an all-in-one mobile communications solution with true enterprise class routing, security and firewall. These multifunction cellular routers feature a flexible design with optional integrated Wi-Fi access point (with multi SSID) / client, USB, serial, VDSL, 1-, 2- or 4-port Ethernet switch with VLAN. Additional configuration options include multiple serial ports (async or sync), GPS or telemetry I/O. The Digi TransPort family offers an advanced routing, security and firewall feature set including stateful inspection firewall and integrated VPN. Enterprise class protocols incorporate BGP, OSPF and VRRP+, a patented technology built upon the popular VRRP failover standard providing true autosensing, auto-failure and auto-recovery of any line drop. Digi TransPort WR routers are ideal for transportation, POS, energy, medical, financial and digital signage as well as cellular backup and remote device connectivity applications. Digi management solutions provide easy setup, configuration and maintenance of large installations of remote Digi TransPort devices. Digi Remote Manager offers web-based device management for remote Digi cellular routers and gateways. Digi TransPort routers have the following features:
n Enterprise class cellular routers with advanced dynamic routing, security and firewall features. n High speed LTE/4G router with fall back to both GSM and CDMA 3G/2G technologies. n Optional integrated Wi-Fi access point and multiport Ethernet switch. n Flexible interfaces including serial (async/sync), GPS, VDSL, USB, CAN Bus and telemetry I/O,
with flexible DC power options. n Powerful integrated end user programming. n Remote Management via windows remote management software or cloud hosted Remote
Manager.
TransPort WR11
Digi TransPort WR11 is a full-featured, cellular router offering the flexibility to scale from basic connectivity applications to enterprise class routing and security solutions. With its high performance architecture, Digi TransPort WR11 is designed for Wide Area Network connectivity including 2.5G, 3G, and 4G networks. The TransPort WR11 XT model has a metal enclosure and allows an extended operating temperature range.
Digi TransPort® Routers User Guide
16
Digi TransPort® routers
TransPort WR11
Digi TransPort® Routers User Guide
17
Digi TransPort® routers
TransPort WR21
TransPort WR21
Digi TransPort WR21 is a full-featured, cellular router offering the flexibility to scale from basic connectivity applications to enterprise class routing and security solutions. With its high performance architecture, Digi TransPort WR21 is designed for Wide Area Network connectivity including 2.5G/3G/4G networks.
Digi TransPort WR21 is available with a range of Ethernet, Serial (RS232, RS422/485), and Power connector options.
Digi TransPort WR21 also offers an optional advanced routing, security. and firewall feature set including stateful inspection firewall and integrated VPN. Enterprise class protocols incorporate BGP, OSPF, and VRRP+, a patented technology built upon the popular VRRP failover standard providing true auto sensing, auto failure, and auto recovery of any line drop.
Digi TransPort® Routers User Guide
18
Digi TransPort® routers
TransPort WR31
TransPort WR31
Digi's TransPort WR31 is an intelligent 4G LTE router designed for critical infrastructure and industrial applications.
Key features of the TransPort WR31 include:
n Global HSPA+ and 4G LTE support and certification on major carrier networks around the world.
n Software defined multi-carrier networking with Gobi 4G LTE, meaning one device that operates in 2G, 3G, or 4G across all major North American carriers.
n Ethernet, serial, and I/O for connecting diverse field assets. n Extremely resilient cellular connection through Digi's patented SureLinkTM, VRRP+ protocol, and
dual SIM slots. n Enterprise Routing features for security, logging, and redundancy (e.g. stateful firewall, VPN,
SNMP); no annual enterprise software license required. n GPS capabilities are available for GPS-enabled models. n Digi Remote Manager provides mass configuration, device management, and troubleshooting
tools. n Rugged aluminum enclosure, optimized for Din rail or shelf mounting. n Optional weatherproof enclosure. n 5 year warranty standard--no additional cost.
The TransPort WR31 provides a secure, reliable connection to industrial controllers, process automation equipment, and smart grid assets on third party sites or remote locations. This drop-in connectivity gives operators a way to reduce the cost of downtime and service calls and also increase revenue by bringing distributed sites online faster.
Digi TransPort® Routers User Guide
19
Digi TransPort® routers
The TransPort WR31 is ideal for connecting the following: n Building and process automation controllers n Smart grid assets (meters, switches, controllers) n IP Cameras and access controllers n Remote data loggers, flow meters, and sensing equipment n Telco infrastructure n Traffic and obstruction lighting
TransPort WR31
Digi TransPort® Routers User Guide
20
Digi TransPort® routers
TransPort WR41
TransPort WR41
The Digi TransPort WR family of cellular routers offers an all-in-one mobile communications solution with true enterprise class routing, security, and firewall. These multifunction cellular routers feature a flexible design with an optional integrated Wi-Fi access point (with multi SSID) / Client, USB, serial, and Ethernet, as well as a variety of configuration options including multiple serial ports (async or sync), GPS or I/O telemetry modules.
The Digi TransPort family also offers an advanced routing, security, and firewall feature set including stateful inspection firewall and integrated VPN. Enterprise class protocols incorporate BGP, OSPF, and VRRP+, a patented technology built upon the popular VRRP failover standard providing true auto sensing, auto failure and auto recovery of any line drop.
Digi TransPort WR routers are ideal for transportation and mobile applications. Flexible power options include AC, DC and 4-pin Molex connectors for direct integration into vehicle applications.
Also available is the Digi Remote ManagerTM, which provides easy setup, configuration, and maintenance of large installations of Digi TransPort devices.
Digi TransPort® Routers User Guide
21
Digi TransPort® routers
TransPort WR44 / WR44 R
TransPort WR44 / WR44 R
The Digi TransPort WR44 cellular router is an all-in-one mobile communications solution with true enterprise-class routing, security, and firewall. This multifunction cellular router features a flexible design with integrated Wi-Fi access point, USB, serial, and 4-port Ethernet switch, as well as a variety of configuration options including multiple serial ports (async or sync) and GPS or I/O telemetry modules.
The Digi TransPort family offers an advanced routing, securityb and firewall feature set including stateful inspection firewall and integrated VPN. Enterprise-class protocols incorporate BGP, OSPF, and VRRP+, a patented technology built upon the popular VRRP failover standard providing true auto sensing, auto failure and auto recovery of any line drop.
Digi TransPort WR44 is ideal for transportation and mobile applications. Flexible power options include 9-36 VDC barrel or molex connectors for direct integration into vehicle applications. Digi Remote ManagerTM provides easy setup, configuration, and maintenance of large installations of Digi TransPort devices.
Digi TransPort® Routers User Guide
22
Digi TransPort® routers
TransPort WR44 RR
TransPort WR44 RR
Digi TransPort WR44 RR is a rugged enterprise-class cellular router designed for rail environments. Its rail industry ratings, versatility, security features, and performance make it ideal for applications such as Positive Train Control (PTC), wayside device communications, and on-board passenger Internet access.
Digi TransPort WR44 RR provides a reliable primary high speed cellular network connection or can act as a secure backup connection to the existing railroad network. It features a flexible communications design with 3G/4G multicarrier GSM/CDMA cellular, plus integrated Wi-Fi a/ac/b/g/n access point, serial, and 4-port Ethernet switch. It also features full on-board train certifications, including AREMA C/H and EN50155. Communications interfaces include hardened connectors, including M12 for Ethernet and serial, as well as TNC connectors for antenna connections.
Digi management solutions provide easy setup, configuration, and maintenance of large installations of remote Digi TransPort devices. Digi Remote Manager offers web-based device management for remote Digi cellular routers and gateways.
Digi TransPort® Routers User Guide
23
Hardware features
TransPort WR11 hardware features
25
TransPort WR21 hardware features
39
TransPort WR31 hardware features
50
TransPort WR41 hardware features
70
TransPort WR44 / WR44 R hardware features
82
TransPort WR44 RR hardware features
97
Signal strength indicators
108
Antenna specifications for Wi-Fi 2.4 GHz modules
109
Digi TransPort® Routers User Guide
24
Hardware features
TransPort WR11 hardware features
TransPort WR11 EVDO model
TransPort WR11 hardware features
1. LAN port: Connects the device to a 10/100 base-T Local Area Network (LAN). The port can perform auto-sensing for speed and wiring, so it can accept straight-through or cross-over cable connections.
2. Power connector: This locking power connector connects the device to a power source. The connector should be inserted and rotated to lock in place. Center pin is positive.
Digi TransPort® Routers User Guide
25
Hardware features
TransPort WR11 hardware features
3. LEDs: n Service LED: Indicates the presence and level of cellular service running on the device. l For the WR11 and WR11 XT versions: Off: No cellular service 1 blink: GPRS mode 2 blinks: EDGE mode 3 blinks: UMTS mode 4 blinks: HSDPA mode 5 blinks: HSUPA mode 6 blinks: LTE mode l For the WR11 CMDA version: Off: No cellular service 1 Blink: Device is running 1xRTT service 2 Blinks: Device is running EDVO Rev 0 service 3 Blinks: Device is running EDVO Rev A service n Signal LED: Indicates strength of cellular signal. Off: Poor or No signal. Place the device in a location where it gets a better signal. Amber: Fair Green: Good n Power LED Off: No power Green: TransPort device is powered
4. Cellular antenna connector: This SMA female connector connects the device's primary cellular antenna.
5. Reset button: Resets the router to factory defaults. See Reset the router to factory defaults.
Digi TransPort® Routers User Guide
26
Hardware features
TransPort WR11 HSPA+ model
TransPort WR11 hardware features
1. LAN port: Connects the device to a 10/100 base-T Local Area Network (LAN). The port can perform auto-sensing for speed and wiring, so it can accept straight-through or cross-over cable connections.
2. Power connector: This locking power connector connects the device to a power source. The connector should be inserted and rotated to lock in place. Center pin is positive.
3. LEDs: n SERVICE LED: Indicates the presence and level of cellular service running on the device.
Off: No cellular service Solid Amber: PPP connection is being established 1 Blink: GPRS mode 2 Blinks: EDGE mode 3 Blinks: UMTS mode 4 Blinks: HSDPA mode 5 Blinks: HSUPA mode
n SIGNAL LED: Indicates strength of cellular signal.
Off: Poor or No signal. Place the device in a location where it gets a better signal. Amber: Fair Green: Good
n POWER LED:
Off: No power Green: TransPort device is powered
4. SIM door: Encloses the SIM sockets. The SIM door must be removed to install the SIM cards For installation details, refer to the Quick Start Guide that came with your device.
Note To remove the SIM door, hold the device on a flat surface and using a screwdriver, firmly pull the cover straight up.
5. Cellular antenna connector: This SMA female connector connects the device's primary cellular antenna.
Digi TransPort® Routers User Guide
27
Hardware features
TransPort WR11 hardware features
6. Reset button: Resets the router to factory defaults. See Reset the router to factory defaults. 7. SIM Sockets: SIM 1 and SIM 2 are for use with the SIMs.
TransPort WR11 LTE-MIMO
1. LAN port: Connects the device to a 10/100 base-T Local Area Network (LAN). The port can perform auto-sensing for speed and wiring, so it can accept straight-through or cross-over cable connections.
2. Power connector: This locking power connector connects the device to a power source. The connector should be inserted and rotated to lock in place. Center pin is positive.
Digi TransPort® Routers User Guide
28
Hardware features
TransPort WR11 hardware features
3. LEDs: n SERVICE LED: Indicates the presence and level of cellular service running on the device.
Off: No cellular service Solid Amber: PPP connection is being established 1 Blink: GPRS mode 2 Blinks: EDGE mode 3 Blinks: UMTS mode 4 Blinks: HSDPA mode 5 Blinks: HSUPA mode 6 Blinks: LTE mode
n SIGNAL LED: Indicates strength of cellular signal.
Off: Poor or No signal. Place the device in a location where it gets a better signal. Amber: Fair Green: Good
n POWERLED:
Off: No power Green: TransPort device is powered
4. SIM door: Encloses the SIM sockets. The SIM door must be opened to install the SIM cards. For installation details, refer to the Quick Start Guide that came with your device.
Note To open the SIM door, slide the SIM door out using your finger.
5. Reset button: Resets the router to factory defaults. See Reset the router to factory defaults. 6. SIM sockets: SIM 1 and SIM 2 are for use with the SIMs. 7. Primary LTE antenna connector: This SMA female connector connects the device's primary
cellular antenna. 8. Secondary LTE antenna connector: This SMA female connector connects the device's
secondary cellular antenna.
Digi TransPort® Routers User Guide
29
Hardware features
TransPort WR11 XT
TransPort WR11 hardware features
1. LAN port: Connects the device to a 10/100 base-T Local Area Network (LAN). The port can perform auto-sensing for speed and wiring, so it can accept straight-through or cross-over cable connections.
2. Power connector: This locking power connector connects the device to a power source. The connector should be inserted and rotated to lock in place. Center pin is positive.
3. LEDs: n SERVICE LED: Indicates the presence and level of cellular service running on the device.
Off: No cellular service Solid Amber: PPP connection is being established 1 Blink: GPRS mode 2 Blinks: EDGE mode 3 Blinks: UMTS mode 4 Blinks: HSDPA mode 5 Blinks: HSUPA mode 6 Blinks: LTE mode
n SIGNAL LED: Indicates strength of cellular signal.
Off: Poor or No signal. Place the device in a location where it gets a better signal. Amber: Fair Green: Good
n POWER LED:
Off: No power Green: TransPort device is powered
4. SIM door: Encloses the SIM sockets. The SIM door must be opened to install the SIM cards. For installation details, refer to the Quick Start Guide that came with your device.
5. Reset button: Resets the router to factory defaults. See Reset the router to factory defaults.
Digi TransPort® Routers User Guide
30
Hardware features
TransPort WR11 hardware features
6. SIM sockets: SIM 1 and SIM 2 are for use with the SIMs. Insert SIM cards with the notch facing the bottom-right corner of the device. If you are using one SIM card only, insert it in the SIM 1 slot.
7. Primary cellular antenna connector: This SMA female connector connects the device's primary cellular antenna.
8. Secondary cellular antenna connector: This SMA female connector connects the device's secondary cellular antenna.
Digi TransPort® Routers User Guide
31
Hardware features
TransPort WR11 hardware features
TransPort WR11 accessories
A variety of accessories are available for TransPort products. For the current list of accessories and their Digi part numbers, go to the TransPort WR11 Part Numbers and Accessories page.
Digi TransPort® Routers User Guide
32
Hardware features
TransPort WR11 hardware specifications
TransPort WR11 specifications TransPort WR11 XT specifications
TransPort WR11 hardware features
Digi TransPort® Routers User Guide
33
Hardware features
TransPort WR11 hardware features
Regulatory and safety statements
RF exposure statement
In order to comply with RF exposure limits established in the ANSI C95.1 standards, the distance between the antenna or antennas and the user should not be less than 20 cm.
FCC Part 15 Class B
Radio Frequency Interference (RFI) (FCC 15.105) This device has been tested and found to comply with the limits for Class B digital devices pursuant to Part 15 Subpart B, of the FCC rules. These limits are designed to provide reasonable protection against harmful interference in a residential environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try and correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help.
Labeling Requirements (FCC 15.19) This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. If the FCC ID is not visible when installed inside another device, then the outside of the device into which the module is installed must also display a label referring to the enclosed module FCC ID.
Modifications (FCC 15.21) Changes or modifications to this equipment not expressly approved by Digi may void the user's authority to operate this equipment.
TransPort WR11 EU Declaration of Conformity
Digi has issued Declarations of Conformity for the Digi TransPort WR11 concerning emissions, EMC, and safety. For more information, see Digi government agency certifications page.
Important note Digi customers assume full responsibility for learning and meeting the required guidelines for each country in their distribution market. Refer to the radio regulatory agency in the desired countries of operation for more information.
IFETEL (Mexico) Some Transport WR11 models are certified for use in Mexico. These models use a pre-approved IFETEL module, as required by IFETEL the certificate number is as follows: TransPort WR11 Mexico IFETEL Certificate Numbers: Este equipo contiene el módulo Telit LE910-NA1 con Número IFETEL: RTITEKE17-1320
Digi TransPort® Routers User Guide
34
Hardware features
TransPort WR11 hardware features
CE mark (Europe)
The Digi TransPort WR11 is certified for use in several European countries. For information, visit Digi government agency certifications page. If the Digi TransPort WR11 is incorporated into a product, the manufacturer must ensure compliance of the final product with articles 3.1a and 3.1b of the RE Directive (Radio Equipment Directive). A Declaration of Conformity must be issued for each of these standards and kept on file as described in the RE Directive (Radio Equipment Directive).
Furthermore, the manufacturer must maintain a copy of the Digi TransPort WR11 user manual
documentation and ensure the final product does not exceed the specified power ratings, antenna specifications, and/or installation requirements as specified in the user manual. If any of these specifications are exceeded in the final product, a submission must be made to a notified body for compliance testing to all required standards.
OEM labeling requirements The "CE" marking must be affixed to a visible location on the OEM product.
CE labeling requirements
The CE mark shall consist of the initials "CE" taking the following form:
n If the CE marking is reduced or enlarged, the proportions given in the above graduated drawing must be respected.
n The CE marking must have a height of at least 5 mm except where this is not possible on account of the nature of the apparatus.
n The CE marking must be affixed visibly, legibly, and indelibly.
Digi TransPort® Routers User Guide
35
Hardware features
TransPort WR11 hardware features
Maximum power and frequency bands
Max power 2W 1W
Frequencies Cellular 850 and 900 MHZ bands Cellular 850 and 900 MHZ bands
Innovation, Science, and Economic Development Canada (IC) certifications
This digital apparatus does not exceed the Class B limits for radio noise emissions from digital apparatus set out in the Radio Interference Regulations of the Canadian Department of Communications. Le present appareil numerique n'emet pas de bruits radioelectriques depassant les limites applicables aux appareils numeriques de la class B prescrites dans le Reglement sur le brouillage radioelectrique edicte par le ministere des Communications du Canada.
Restricted Access Location notice for Trans Port WR11 XT
Because of the hot metal surface of the enclosure, installations with operating temperatures greater than 122 F (50 C) must be limited to Restricted Access Locations accessible only to trained service personnel.
Safety notices
1. Please read all instructions before installing and powering the router. You should keep these instructions in a safe place for future reference.
2. If the power supply shows signs of damage or malfunction, stop using it immediately, turn off the power and disconnect the power supply before contacting your supplier for a repair or replacement.
3. Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. Use only the accessories, attachments, and power supplies provided by the manufacturer-connecting non-approved antennas or power supplies may damage the router, cause interference or create an electric shock hazard, and will void the warranty.
4. Do not attempt to repair the product. The router contains no electronic components that can be serviced or replaced by the user. Any attempt to service or repair the router by the user will void the product warranty.
5. The TransPort WR11 is designed for indoor use. Use it in an environment suitable for computers and other electronic equipment.
6. Ports that are capable of connecting to other apparatus are defined as SELV ports. To ensure conformity with IEC60950 ensure that these ports are only connected to ports of the same type on other apparatus.
Digi TransPort® Routers User Guide
36
Hardware features
TransPort WR11 hardware features
Special notes on safety for wireless routers
Digi International products are designed to the highest standards of safety and international standards compliance for the markets in which they are sold. However, cellular-based products contain radio devices which require specific consideration. Please take the time to read and understand the following guidance. Digi International assumes no liability for an end user's failure to comply with these precautions.
Wireless routers incorporate a wireless radio module. Users should ensure that the antenna(s) is (are) positioned at least 1 meter away from themselves and other persons in normal operation. When in a hospital or other health care facility, observe the restrictions on the use of mobile phones. Do not use the router in areas where guidelines posted in sensitive areas instruct users to switch off mobile phones. Medical equipment may be sensitive to RF energy. The operation of cardiac pacemakers, other implanted medical equipment and hearing aids can be affected by interference from cellular terminals such as the wireless routers when places close to the device. If in doubt about potential danger, contact the physician or the manufacturer of the device to verify that the equipment is properly shielded. Pacemaker patients are advised to keep the wireless router away from the pacemaker while it is on.
Wireless routers must NOT be operated on aircraft. The operation of wireless appliances in an aircraft is forbidden to prevent interference with communications systems. Failure to observe these instructions may lead to the suspension or denial of cellular services to the offender, legal action, or both.
As with any electrical equipment, do not operate the router in the presence of flammable gases, fumes or potentially explosive atmospheres. Do not use radio devices anywhere that blasting operations occur.
Wireless routers receive and transmit radio frequency energy when power is on. Interference can occur when using the router close to TV sets, radios, computers or inadequately shielded equipment. Follow any special regulations and always power off your router wherever forbidden or when it may cause interference or danger.
SOS IMPORTANT! Wireless routers operate using radio signals and cellular networks cannot be guaranteed to connect in all possible conditions. Therefore, never rely solely upon any wireless device for life critical communications.
WARNING! For environments where the temperature is 55° C or above, this device must be installed in a restricted access area.
Digi TransPort® Routers User Guide
37
Hardware features
TransPort WR11 hardware features
Product Disposal Instructions
The WEEE (Waste Electrical and Electronic Equipment: 2002/96/EC) directive has been introduced to ensure that electrical/ electronic products are recycled using the best available recovery techniques to minimize the impact on the environment. This product contains high quality materials and components which can be recycled. At the end of its life this product MUST NOT be mixed with other commercial waste for disposal. Check with the terms and conditions of your supplier for disposal information. Digi International Ltd WEEE Registration number: WEE/HF1515VU
Digi TransPort® Routers User Guide
38
Hardware features
TransPort WR21 hardware features
TransPort WR21 front panel
TransPort WR21 hardware features
1. SIM/R-UIM sockets (SIM card models only): SIM 1 and SIM 2 are for use with SIMs or R-UIMs (Removable User Identification Modules).
2. POWER LED: n Off: No power n Green: TransPort device is powered
3. SERVICE LED: n Off: No WWAN network connection n Green: WWAN network connection n Flashing: WWAN traffic being transmitted or received
4. WWAN (Wireless Network) LED: Indicates the presence and level of cellular service running on the device. n Off: No cellular service n 1 Blink: GPRS mode n 2 Blinks: EDGE mode n 3 Blinks: UMTS mode n 4 Blinks: HSDPA mode n 5 Blinks: HSUPA mode n 6 Blinks: LTE mode
5. SIGNAL LED: Indicate strength of cellular signal. n 3 LEDs: Excellent n 2 LEDs: Good n 1 LED: Fair n 0 LEDs: Poor or No signal
6. Reset button: Returns the router to its factory default settings. See Reset the router to factory defaults.
7. USB host connector: Connects compatible USB 2.0 client devices such as memory sticks, and serial adapters. The total current available to power USB devices is 0.5 A.
Digi TransPort® Routers User Guide
39
Hardware features
TransPort WR21 rear panel features
TransPort WR21 hardware features
1. Secondary cellular (WWAN) antenna connector: This SMA female connector connects the router's secondary cellular antenna. It is highly recommended to use the secondary antenna for diversity. In most circumstances, dual antennas provide improved signal strength and better performance.
2. LAN 0 port: This RJ45 port connects the router to a 10/100 base-TLAN. The port is autosensing for speed and wiring (straight-through or cross-over).
3. LAN 1 port (optional): This RJ45 port connects the router to a 10/100 base-TLAN. The port is auto- sensing for speed and wiring (straight-through or cross-over).
4. Serial 0 port: This DB9 port provides an asynchronous RS232 (RS485 optional) serial port with optional RS422/485 support for connecting the router to a compatible serial device. This is a DCE serial port and allows CLI access to the device by default; the baud rate is 115200. For a pinout, see TransPort WR21 serial pinout.
5. Power connector: This connector connects the router to a power source using either the supplied power supply or DC power cord. Secure the barrel plug connector by rotating it by 90 degrees once installed into the Digi TransPort router. Center pin is positive.
6. Primary cellular (WWAN) antenna connector: This SMA female connector connects the router's primary cellular antenna.
7. Power cord input (terminal block variant): This socket connects the router to an alternative power source.
Digi TransPort® Routers User Guide
40
Hardware features
TransPort WR21 hardware features
Reset the TransPort WR21
1. Turn the router on and wait 15 seconds for the router to complete its initialization process. 2. Press and hold the reset button for 5 seconds. The router automatically reboots and displays a
pattern of alternating LEDs flashing followed by the normal boot sequence.
CAUTION! Do not remove power from the router during this operation, as corruption of the flash memory may occur.
Digi TransPort® Routers User Guide
41
Hardware features
TransPort WR21 serial pinout
Note that all TransPort serial ports are DCE.
TransPort WR21 hardware features
RS232 pinout
Pin # Direction
1
Out
2
Out
3
In
4
In
5
N/A
6
Out
7
In
8
Out
9
Out
RS422/RS485 pinout
Pin # 1 2 3 4 5
Direction Out Out In In N/A
RS232 DCE DCD RXD TXD DTR GND DSR RTS CTS RI
Description Data Carrier Detect Receive Data Transmit Data Data Terminal Ready Ground Data Set Ready Ready To Send Clear To Send Ring Indicate
RS422/ RS485 CTSRD+ TD+ RTS B RTSGND
Description Clear To Send Receive Data + Transmit Data+ Ready To Send Ground
Digi TransPort® Routers User Guide
42
Hardware features
TransPort WR21 hardware features
Pin # 6 7 8 9
Direction Out In Out In
RS422/ RS485 RDRTS+ CTS+ TD-
Description Receive Data Ready To Send + Clear To Send + Transmit -
Notes
n For true RS485 mode (2-wire half-duplex mode), the TD+ and RD+ pair and TD- and RD- pair should be connected together.
n The CTS and RTS signals are optional and not normally needed for RS485.
Digi TransPort® Routers User Guide
43
Hardware features
TransPort WR21 hardware features
TransPort WR21 accessories
A variety of accessories are available for TransPort products. For the current list of accessories and their Digi part numbers, go to the TransPort WR21 Part Numbers and Accessories page.
Digi TransPort® Routers User Guide
44
Hardware features
TransPort WR21 hardware features
TransPort WR21 hardware specifications
TransPort WR21 hardware specifications
Regulatory and safety statements
RF exposure statement
In order to comply with RF exposure limits established in the ANSI C95.1 standards, the distance between the antenna or antennas and the user should not be less than 20 cm.
FCC Part 15 Class B
Radio Frequency Interference (RFI) (FCC 15.105) This device has been tested and found to comply with the limits for Class B digital devices pursuant to Part 15 Subpart B, of the FCC rules. These limits are designed to provide reasonable protection against harmful interference in a residential environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try and correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help.
Labeling Requirements (FCC 15.19) This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. If the FCC ID is not visible when installed inside another device, then the outside of the device into which the module is installed must also display a label referring to the enclosed module FCC ID.
Modifications (FCC 15.21) Changes or modifications to this equipment not expressly approved by Digi may void the user's authority to operate this equipment.
TransPort WR21 EU Declaration of Conformity
Digi has issued Declarations of Conformity for the Digi TransPort WR21 concerning emissions, EMC, and safety. For more information, see Digi government agency certifications page.
Important note
Digi customers assume full responsibility for learning and meeting the required guidelines for each country in their distribution market. Refer to the radio regulatory agency in the desired countries of operation for more information.
Digi TransPort® Routers User Guide
45
Hardware features
TransPort WR21 hardware features
IFETEL (Mexico) Some Transport WR21 models are certified for use in Mexico. These models use a pre-approved IFETEL module, as required by IFETEL the certificate number is as follows: TransPort WR21 Mexico IFETEL Certificate Numbers: Este equipo contiene el módulo Telit LE910-NA V2 con Número IFETEL: RCPTELE17-1296
CE mark (Europe)
The Digi TransPort WR21 is certified for use in several European countries. For information, visit Digi government agency certifications page. If the Digi TransPort WR21 is incorporated into a product, the manufacturer must ensure compliance of the final product with articles 3.1a and 3.1b of the RE Directive (Radio Equipment Directive). A Declaration of Conformity must be issued for each of these standards and kept on file as described in the RE Directive (Radio Equipment Directive). Furthermore, the manufacturer must maintain a copy of the Digi TransPort WR21 user manual documentation and ensure the final product does not exceed the specified power ratings, antenna specifications, and/or installation requirements as specified in the user manual. If any of these specifications are exceeded in the final product, a submission must be made to a notified body for compliance testing to all required standards.
OEM labeling requirements The "CE" marking must be affixed to a visible location on the OEM product.
CE labeling requirements
The CE mark shall consist of the initials "CE" taking the following form:
n If the CE marking is reduced or enlarged, the proportions given in the above graduated drawing must be respected.
n The CE marking must have a height of at least 5 mm except where this is not possible on account of the nature of the apparatus.
n The CE marking must be affixed visibly, legibly, and indelibly.
Digi TransPort® Routers User Guide
46
Hardware features
Maximum power and frequency bands
TransPort WR21 hardware features
Max power 2W 1W 200 mW
Frequencies Cellular 850 and 900 MHz bands Cellular 1800 and 1900 MHz Bands Cellular @450 MHz Band
Innovation, Science, and Economic Development Canada (IC) certifications
This digital apparatus does not exceed the Class B limits for radio noise emissions from digital apparatus set out in the Radio Interference Regulations of the Canadian Department of Communications. Le present appareil numerique n'emet pas de bruits radioelectriques depassant les limites applicables aux appareils numeriques de la class B prescrites dans le Reglement sur le brouillage radioelectrique edicte par le ministere des Communications du Canada.
Hazardous Location installation information for TransPort WR21
For Hazardous Location installation, see the TransPort WR21 Hazardous Location User Guide (Digi part number 90001532).
Safety notices
1. Please read all instructions before installing and powering the router. You should keep these instructions in a safe place for future reference.
2. If the power supply shows signs of damage or malfunction, stop using it immediately, turn off the power and disconnect the power supply before contacting your supplier for a repair or replacement.
3. Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. Use only the accessories, attachments, and power supplies provided by the manufacturer-connecting non-approved antennas or power supplies may damage the router, cause interference or create an electric shock hazard, and will void the warranty.
4. Do not attempt to repair the product. The router contains no electronic components that can be serviced or replaced by the user. Any attempt to service or repair the router by the user will void the product warranty.
5. The TransPort WR21 is designed for indoor use. Use it in an environment suitable for computers and other electronic equipment.
6. Ports that are capable of connecting to other apparatus are defined as SELV ports. To ensure conformity with IEC60950 ensure that these ports are only connected to ports of the same type on other apparatus.
Digi TransPort® Routers User Guide
47
Hardware features
TransPort WR21 hardware features
Special notes on safety for wireless routers
Digi International products are designed to the highest standards of safety and international standards compliance for the markets in which they are sold. However, cellular-based products contain radio devices which require specific consideration. Please take the time to read and understand the following guidance. Digi International assumes no liability for an end user's failure to comply with these precautions.
Wireless routers incorporate a wireless radio module. Users should ensure that the antenna(s) is (are) positioned at least 1 meter away from themselves and other persons in normal operation. When in a hospital or other health care facility, observe the restrictions on the use of mobile phones. Do not use the router in areas where guidelines posted in sensitive areas instruct users to switch off mobile phones. Medical equipment may be sensitive to RF energy. The operation of cardiac pacemakers, other implanted medical equipment and hearing aids can be affected by interference from cellular terminals such as the wireless routers when places close to the device. If in doubt about potential danger, contact the physician or the manufacturer of the device to verify that the equipment is properly shielded. Pacemaker patients are advised to keep the wireless router away from the pacemaker while it is on.
Wireless routers must NOT be operated on aircraft. The operation of wireless appliances in an aircraft is forbidden to prevent interference with communications systems. Failure to observe these instructions may lead to the suspension or denial of cellular services to the offender, legal action, or both.
As with any electrical equipment, do not operate the router in the presence of flammable gases, fumes or potentially explosive atmospheres. Do not use radio devices anywhere that blasting operations occur.
Wireless routers receive and transmit radio frequency energy when power is on. Interference can occur when using the router close to TV sets, radios, computers or inadequately shielded equipment. Follow any special regulations and always power off your router wherever forbidden or when it may cause interference or danger.
SOS IMPORTANT! Wireless routers operate using radio signals and cellular networks cannot be guaranteed to connect in all possible conditions. Therefore, never rely solely upon any wireless device for life critical communications.
WARNING! For environments where the temperature is 55° C or above, this device must be installed in a restricted access area.
Digi TransPort® Routers User Guide
48
Hardware features
TransPort WR21 hardware features
Product Disposal Instruction
The WEEE (Waste Electrical and Electronic Equipment: 2002/96/EC) directive has been introduced to ensure that electrical/ electronic products are recycled using the best available recovery techniques to minimize the impact on the environment. This product contains high quality materials and components which can be recycled. At the end of its life this product MUST NOT be mixed with other commercial waste for disposal. Check with the terms and conditions of your supplier for disposal information. Digi International Ltd WEEE Registration number: WEE/HF1515VU
Digi TransPort® Routers User Guide
49
Hardware features
TransPort WR31 hardware features
TransPort WR31 hardware features
1. SIM card slot cover: On the underside of the router. Remove and replace with a Phillips-head screwdriver.
2. SIM 1 and SIM 2 card slots: On the underside of the router. SIM 1 and SIM 2 are for use with . When inserting the SIM card(s) into SIM sockets, SIM 1 is toward the middle of the router, and SIM 2 is toward the outside of the router. In both cases, the end of the SIM card with the chamfered corner should be inserted first.
3. LAN 0 port: This RJ45 port connects the router to a 10/100 base-TLAN. The port is autosensing for speed and wiring (straight-through or cross-over).
4. LAN 1 port: This RJ45 port connects the router to a 10/100 base-TLAN. The port is autosensing for speed and wiring (straight-through or cross-over).
5. USB host connector: Connects compatible USB 2.0 client devices such as memory sticks, and serial adapters. The total current available to power USB devices is 0.5 A.
WARNING! The USB port is for use in a normal location only, not a hazardous location.
6. Reset button: Returns the router to its factory default settings. See Reset the router to factory defaults.
Digi TransPort® Routers User Guide
50
Hardware features
TransPort WR31 hardware features
7. Serial connector: This DB9 port provides an asynchronous RS232 (RS485 optional) serial port with optional RS422/485 support to connect the router to a compatible serial device. This is a DCE serial port and allows CLI access to the device by default; the default serial baud rate is 115200. For a pinout, see TransPort WR31 serial pinout.
8. Power connector: A pluggable connector that connects the router to a power source using either the separately available power supply: Digi part number 76000736, or a DIN rail power supply.
9. WWAN primary connector: This SMA female connector connects the router's primary cellular antenna.
10. WWAN secondary connector: This SMA female connector connects the router's secondary cellular antenna. For multiple-input and multiple-output (MIMO), both cellular antennas are needed for downloading data. Not shown: GPS antenna connector (GPS models only): An SMA male connector that connects the router's GPS antenna.
11. LEDs: Indicate startup states and status for various signals and services: n POWER LED:
Off: No power Green: TransPort device is powered
n SERVICE LED:
Off: No WWAN network connection Green: WWAN network connection Flashing: WWAN traffic being transmitted or received
n WWAN LED: Indicates the presence and level of cellular service running on the device.
Off: No cellular service 1 Blink: GPRS mode 2 Blinks: EDGE mode 3 Blinks: UMTS mode 4 Blinks: HSDPA mode 5 Blinks: HSUPA mode 6 Blinks: LTE mode
n SIGNAL LEDs: Indicate strength of cellular signal.
3 LEDs: Excellent 2 LEDs: Good 1 LED: Fair 0 LEDs: Poor or No signal
n SYSTEM LED: Reserved for user-defined functions. 12. Earth ground
Digi TransPort® Routers User Guide
51
Hardware features
TransPort WR31 hardware features
13. Digital/analog I/O connector: An input/output connector with two digital input/output connections, and a single analog input connection. For more information and wiring diagrams see TransPort WR31 digital and analog inputs and outputs.
Digi TransPort® Routers User Guide
52
Hardware features
TransPort WR31 hardware specifications
Digi TransPort WR31 specifications
TransPort WR31 hardware features
Digi TransPort® Routers User Guide
53
Hardware features
TransPort WR31 hardware features
TransPort WR31 accessories
A variety of accessories are available for TransPort products. For the current list of accessories and their Digi part numbers, go to the TransPort WR31 Part Numbers and Accessories page.
Digi TransPort® Routers User Guide
54
Hardware features
TransPort WR31 hardware features
TransPort WR31 mounting options
You can mount the TransPort WR31 on a DIN rail, directly to a wall, or in a NEMA enclosure. For DIN Rail mounting, purchase the WR31 DIN Rail Mounting Bracket (Digi part number 76000977). For wallmounting or NEMA enclosure installation, purchase the TransPort WR31 Wall Mount Bracket (Digi part number 76000966) and NEMA enclosure equipment, such as the NEMA enclosure, mounting plate, special cabling, and cable glands.
Digi TransPort® Routers User Guide
55
Hardware features
TransPort WR31 hardware features
Hazardous Location installation
For information on installing the TransPort WR31 in a Hazardous Location environment, see the Digi TransPort WR31 Hazardous Locations User Guide.
Digi TransPort® Routers User Guide
56
Hardware features
TransPort WR31 serial pinout
Note that all TransPort serial ports are DCE.
TransPort WR31 hardware features
RS232 pinout
Pin # 1 2 3 4 5 6 7 8 9
Direction Out Out In In N/A Out In Out Out
RS232 DCE DCD RXD TXD DTR GND DSR RTS CTS RI
Description Data Carrier Detect Receive Data Transmit Data Data Terminal Ready Ground Data Set Ready Ready To Send Clear To Send Ring Indicate
Digi TransPort® Routers User Guide
57
Hardware features
TransPort WR31 hardware features
RS422/RS485 pinout
Pin # 1 2 3 4 5 6 7 8 9
Direction Out Out In In N/A Out In Out In
RS422/ RS485 CTSRD+ TD+ RTS_B RTSGND RDRTS+ CTS+ TD-
Description Clear To Send Receive Data + Transmit Data+ Ready To Send Ground Receive Data Ready To Send + Clear To Send + Transmit -
Notes
n For true RS485 mode (2-wire half-duplex mode), the TD+ and RD+ pair and TD- and RD- pair should be connected together.
n The CTS and RTS signals are optional normally not needed for RS485.
Digi TransPort® Routers User Guide
58
Hardware features
TransPort WR31 hardware features
TransPort WR31 digital and analog inputs and outputs
The TransPort WR31 has an input/output connector with two digital input/output connections, and a single analog input connection.
I/O connector pin assignments
The figure and table show the I/O connector, pin assignments, and the signals for each pin.
Pin# 5 4 3 2 1
Symbol AIN0 AGND DIO0 GND DIO1
Description Analog Input 0 Analog Return Digital I/O 0 Digital Return Digital I/O 1
Digi TransPort® Routers User Guide
59
Hardware features
TransPort WR31 hardware features
TransPort WR31 digital input/output: representative circuit
TransPort WR31 analog input: representative circuit
Digi TransPort® Routers User Guide
60
Hardware features
Example digital and analog I/O wiring
Digital input with pullup
TransPort WR31 hardware features
Digital input without pullup Note that input is HIGH when the contact is CLOSED.
Digital output
The wiring diagram assumes a current-limiting resistor provided by installation or connected device is in use.
Digi TransPort® Routers User Guide
61
Hardware features
TransPort WR31 hardware features
Analog input, 4-20mA input mode Analog input, 0-10V input mode
Digi TransPort® Routers User Guide
62
Hardware features
TransPort WR31 hardware features
Digital and analog I/O specifications
Digital I/O specifications
Specification Rated Input Voltage Rated Input Current Pull-Up Resistance
Min
Nom
Max
Units
-0.2
30
V
-1.0
200
mA
10 k
Ohms
Digital input specifications
n This input is a non-inverting Schmitt-trigger input. n The default state at power-up with no voltage applied is LOW.
Specification + Threshold - Threshold Input impedance
Min
Nom
Max Units
..
1.6
..
V
..
1.0
..
V
..
1M
..
Ohms
Digital output
n This output is an open-collector, sinking driver output. n The default state at power-up is off.
Specification Sink Current Pull-up Voltage
Min
Nom
Max
Units
..
..
200
mA
3
V
Analog input specifications
Specification Resolution Accuracy Rated Input Voltage Rated Input Current
Min
Nom
Max
Units
..
..
12
BITS
..
..
0.2
%
-0.2
30
V
0
40
mA
Digi TransPort® Routers User Guide
63
Hardware features
Voltage input mode (default)
Specification Input Voltage Input Impedance
Current loop mode
Specification Minimum Input Voltage Load Resistance
TransPort WR31 hardware features
Min
Nom
Max
Units
-0.2
..
10.25
V
..
291 K
..
Ohms
Min
Nom
..
2
..
200
Max
Units
..
V
..
Ohms
Digi TransPort® Routers User Guide
64
Hardware features
TransPort WR31 hardware features
Regulatory and safety statements
RF exposure statement
In order to comply with RF exposure limits established in the ANSI C95.1 standards, the distance between the antenna or antennas and the user should not be less than 20 cm.
FCC Part 15 Class B
Radio Frequency Interference (RFI) (FCC 15.105) This device has been tested and found to comply with the limits for Class B digital devices pursuant to Part 15 Subpart B, of the FCC rules. These limits are designed to provide reasonable protection against harmful interference in a residential environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try and correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help.
Labeling Requirements (FCC 15.19) This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. If the FCC ID is not visible when installed inside another device, then the outside of the device into which the module is installed must also display a label referring to the enclosed module FCC ID.
Modifications (FCC 15.21) Changes or modifications to this equipment not expressly approved by Digi may void the user's authority to operate this equipment.
TransPort WR31 EU Declaration of Conformity
Digi has issued Declarations of Conformity for the Digi TransPort WR31 concerning emissions, EMC, and safety. For more information, see Digi government agency certifications page.
Important note Digi customers assume full responsibility for learning and meeting the required guidelines for each country in their distribution market. Refer to the radio regulatory agency in the desired countries of operation for more information.
IFETEL (Mexico) Some Transport WR31 models are certified for use in Mexico. These models use a pre-approved IFETEL module, as required by IFETEL the certificate number is as follows: TransPort WR31 Mexico IFETEL Certificate Numbers: Este equipo contiene el módulo Telit LE910-NA V2 con Número IFETEL: RCPTELE17-1296
Digi TransPort® Routers User Guide
65
Hardware features
TransPort WR31 hardware features
CE mark (Europe)
The Digi TransPort WR31 is certified for use in several European countries. For information, visit Digi
government agency certifications page. If the Digi TransPort WR31 is incorporated into a product, the manufacturer must ensure compliance of the final product with articles 3.1a and 3.1b of the RE Directive (Radio Equipment Directive). A Declaration of Conformity must be issued for each of these standards and kept on file as described in the RE Directive (Radio Equipment Directive). Furthermore, the manufacturer must maintain a copy of the Digi TransPort WR31 user manual documentation and ensure the final product does not exceed the specified power ratings, antenna specifications, and/or installation requirements as specified in the user manual. If any of these specifications are exceeded in the final product, a submission must be made to a notified body for compliance testing to all required standards.
OEM labeling requirements The "CE" marking must be affixed to a visible location on the OEM product.
CE labeling requirements
The CE mark shall consist of the initials "CE" taking the following form:
n If the CE marking is reduced or enlarged, the proportions given in the above graduated drawing must be respected.
n The CE marking must have a height of at least 5 mm except where this is not possible on account of the nature of the apparatus.
n The CE marking must be affixed visibly, legibly, and indelibly.
Digi TransPort® Routers User Guide
66
Hardware features
TransPort WR31 hardware features
Maximum power and frequency bands
Max power 2W 1W 200 mW
Frequencies Cellular 850 and 900 MHz bands Cellular 1800 and 1900 MHz bands Cellular @450 MHz band
Innovation, Science, and Economic Development Canada (IC) certifications This digital apparatus does not exceed the Class B limits for radio noise emissions from digital apparatus set out in the Radio Interference Regulations of the Canadian Department of Communications. Le present appareil numerique n'emet pas de bruits radioelectriques depassant les limites applicables aux appareils numeriques de la class B prescrites dans le Reglement sur le brouillage radioelectrique edicte par le ministere des Communications du Canada.
Hazardous Location installation information for TransPort WR31 For information on installing the TransPort WR31 in a Hazardous Location environment, see the Digi TransPort WR31 Hazardous Locations User Guide.
Safety notices
1. Please read all instructions before installing and powering the router. You should keep these instructions in a safe place for future reference.
2. If the power supply shows signs of damage or malfunction, stop using it immediately, turn off the power and disconnect the power supply before contacting your supplier for a repair or replacement.
3. Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. Use only the accessories, attachments, and power supplies provided by the manufacturer-connecting non-approved antennas or power supplies may damage the router, cause interference or create an electric shock hazard, and will void the warranty.
4. Do not attempt to repair the product. The router contains no electronic components that can be serviced or replaced by the user. Any attempt to service or repair the router by the user will void the product warranty.
5. The TransPort WR31 is designed for indoor use. Use it in an environment suitable for computers and other electronic equipment.
6. Ports that are capable of connecting to other apparatus are defined as SELV ports. To ensure conformity with IEC60950 ensure that these ports are only connected to ports of the same type on other apparatus.
Digi TransPort® Routers User Guide
67
Hardware features
TransPort WR31 hardware features
Special notes on safety for wireless routers
Digi International products are designed to the highest standards of safety and international standards compliance for the markets in which they are sold. However, cellular-based products contain radio devices which require specific consideration. Please take the time to read and understand the following guidance. Digi International assumes no liability for an end user's failure to comply with these precautions.
Wireless routers incorporate a wireless radio module. Users should ensure that the antenna(s) is (are) positioned at least 1 meter away from themselves and other persons in normal operation. When in a hospital or other health care facility, observe the restrictions on the use of mobile phones. Do not use the router in areas where guidelines posted in sensitive areas instruct users to switch off mobile phones. Medical equipment may be sensitive to RF energy. The operation of cardiac pacemakers, other implanted medical equipment and hearing aids can be affected by interference from cellular terminals such as the wireless routers when places close to the device. If in doubt about potential danger, contact the physician or the manufacturer of the device to verify that the equipment is properly shielded. Pacemaker patients are advised to keep the wireless router away from the pacemaker while it is on.
Wireless routers must NOT be operated on aircraft. The operation of wireless appliances in an aircraft is forbidden to prevent interference with communications systems. Failure to observe these instructions may lead to the suspension or denial of cellular services to the offender, legal action, or both.
As with any electrical equipment, do not operate the router in the presence of flammable gases, fumes or potentially explosive atmospheres. Do not use radio devices anywhere that blasting operations occur.
Wireless routers receive and transmit radio frequency energy when power is on. Interference can occur when using the router close to TV sets, radios, computers or inadequately shielded equipment. Follow any special regulations and always power off your router wherever forbidden or when it may cause interference or danger.
SOS IMPORTANT! Wireless routers operate using radio signals and cellular networks cannot be guaranteed to connect in all possible conditions. Therefore, never rely solely upon any wireless device for life critical communications.
WARNING! For environments where the temperature is 55° C or above, this device must be installed in a restricted access area.
Digi TransPort® Routers User Guide
68
Hardware features
TransPort WR31 hardware features
Product Disposal Instructions
The WEEE (Waste Electrical and Electronic Equipment: 2002/96/EC) directive has been introduced to ensure that electrical/ electronic products are recycled using the best available recovery techniques to minimize the impact on the environment. This product contains high quality materials and components which can be recycled. At the end of its life this product MUST NOT be mixed with other commercial waste for disposal. Check with the terms and conditions of your supplier for disposal information. Digi International Ltd WEEE Registration number: WEE/HF1515VU
Digi TransPort® Routers User Guide
69
Hardware features
TransPort WR41 hardware features
Front panel
TransPort WR41 hardware features
1. USB host connector: Connects compatible USB 2.0 client devices such as memory sticks, and serial adapters. The total current available to power USB devices is 0.5 A.
2. POWER LED: n Off: No power n Green: TransPort device is powered
3. LAN LED: Illuminates steadily when there is a network connection to the LAN port and flashes when data is transmitted or received.
4. WN LED: n Wi-Fi models: Illuminates steady if Wi-Fi activity is present. n Non-Wi-Fi models: Flashes to show which network mode the router is operating in:
Off: No service 1 blink: GPRS mode 2 blinks: EDGE mode 3 blinks: UMTS mode 4 blinks: HSDPA mode 5 blinks: HSUPA mode 6 blinks: LTE mode
5. LINK LED: Illuminates steadily when a wireless WAN data connection has been established. 6. SIM LED: Illuminates steadily when a valid SIM card is installed. 7. ACT LED: Flashes to indicate that data is being transferred over the wireless WAN network. 8. SIGNAL LEDs: Indicate strength of cellular signal.
n 3 LEDs: Excellent n 2 LEDs: Good n 1 LED: Fair n 0 LEDs: Poor or No signal 9. SERIAL LED: Illuminates steady if a terminal is connected to the SERIAL port and the DTR signal is on. Flashes when data is transmitted or received.
Digi TransPort® Routers User Guide
70
Hardware features
TransPort WR41 hardware features
10. SIM / R-UIM Sockets (SIM card models only): SIM 1 and SIM 2 are for use with the Subscriber Identification Module(s) (SIMs) or Removable User Identification Module(s) (R-UIMs).
11. Primary Wi-Fi antenna connector (Wi-Fi models only): This SMA connector connects the router's primary Wi-Fi antenna.
12. Secondary Wi-Fi antenna connector (Wi-Fi models only): This SMA connector connects the router's secondary Wi-Fi antenna.
Rear panel
1. WWAN Secondary Antenna Connector (WR41-U and WR41-C models): An SMA female connector that connects the unit's secondary cellular antenna. It is highly recommended to use the secondary antenna for diversity. In most circumstances, dual antennas provide improved signal strength and better performance.
2. Power connector: Connects the router to a power source. The power cord input can be AC, DC and 4-pin Molex connectors. Secure the barrel plug connector by rotating it by 90 degrees once installed into the Digi TransPort router. Center pin is positive.
3. Serial 0 Port: This RJ45 port provides an asynchronous RS232 serial port for connecting the unit to a compatible serial device. This is a DCE serial port and allows CLI access to the device by default; the baud rate is 115200. See TransPort WR41 serial pinout for a pinout diagram.
4. Hardware Expansion Port: Various hardware upgrades are available for this unit and are populated via this expansion port. See Additional hardware features below for further information.
5. Case Ground: Connect an additional case ground if necessary.
6. WWAN Primary Antenna Connector: An SMA female connector that connects the unit's primary cellular antenna.
7. LAN Port: This RJ45 port connects the unit to a 10/100 base-T LAN. The port performs autosensing for speed and wiring, and can handle a straight-through or cross-over cable.
Digi TransPort® Routers User Guide
71
Hardware features
Underside of unit features
TransPort WR41 hardware features
1. Reset button: The reset button is on the underside of the unit. It performs a factory reset. It is recessed to avoid an accidental reset. See Reset the router to factory defaults.
Digi TransPort® Routers User Guide
72
Hardware features
Additional hardware features
TransPort WR41 hardware features
1. ASY Serial Port: Provides an additional asynchronous RS232 serial port using a DB25 connector.
2. ASY Serial Port (3x): Provides three additional asynchronous RS232 serial ports using RJ45 connectors.
3. SYN/ASYN Serial Port: Provides an X.21/RS422/RS232 synchronous / asynchronous serial port using a DB25 connector.
4. GPS: Provides GPS capabilities using an SMA male connector.
5. ISDN: Provides an ISDN Basic Rate Interface (BRI) via an RJ45 port. This can be configured either as a TE (terminal endpoint) or as NT-1 (network termination). The option also includes an additional asynchronous serial port via a second RJ45 port.
Digi TransPort® Routers User Guide
73
Hardware features
TransPort WR41 hardware features
6. Telemetry 1 I/O Interface: Provides 4 opto-isolated digital input ports and 1 opto-isolated digital output port. It also provides a relay I/O port, a voltage monitoring port, and internal temperature monitoring.
7. Telemetry 2 I/O Interface: Provides 4 isolated analog I/O ports and 4 non-isolated digital I/O ports.
8. Fleet I/O Interface: Provides a CAN and J1708 interface, GPS, 4 non-isolated digital I/O ports, ignition sense port, and a 3-axis accelerometer.
9. PSTN: Provides a PSTN interface via an RJ45 connector for dialing out and receiving calls.
10. ISDN-U/PSTN: Provides an ISDN-U interface suitable for the USA plus PSTN interface. It can be configured for Bell-103 modulation in leased line mode as well as a normal PSTN interface.
11. DialServ: This RJ11/FXS connection converts a PSTN analog modem to a RS-232 serial signal.
For more information on the Telemetry 1 Interface, Telemetry 2 Interface, and the Fleet I/O Interface, see the product specific user's guides, available on www.digi.com on the TransPort WR41 Product Support page.
Digi TransPort® Routers User Guide
74
Hardware features
TransPort WR41 hardware specifications
Digi TransPort WR41 specifications
TransPort WR41 hardware features
Digi TransPort® Routers User Guide
75
Hardware features
TransPort WR41 hardware features
TransPort WR41 accessories
A variety of accessories are available for TransPort products. For the current list of accessories and their Digi part numbers, go to the TransPort WR41 Part Numbers and Accessories page.
Digi TransPort® Routers User Guide
76
Hardware features
TransPort WR41 serial pinout
Note that all TransPort serial ports are DCE.
TransPort WR41 hardware features
RS232 port pinouts
Description
Transmit Data Receive Data Ready To Send Clear To Send Data Set Ready Ground Data Carrier Detect Transmitter Clock Receiver Clock Data Terminal Ready Ring Indicate External Transmitter Clock
RS232 signal Direction
TxD
in
RxD
out
RTS
in
CTS
out
DSR
out
GND
n/a
DCD
out
TxC
out
RxC
out
DTR
in
RI
out
ETC
in
DB 25 Pin# 2 3 4 5 6 7 8 15 17 20 22 24
RJ45 Pin# 6 3 1 8 n/a 5 7 n/a n/a 2 n/a n/a
Digi TransPort® Routers User Guide
77
Hardware features
TransPort WR41 hardware features
Regulatory and safety statements
RF exposure statement
In order to comply with RF exposure limits established in the ANSI C95.1 standards, the distance between the antenna or antennas and the user should not be less than 20 cm.
FCC Part 15 Class B
Radio Frequency Interference (RFI) (FCC 15.105) This device has been tested and found to comply with the limits for Class B digital devices pursuant to Part 15 Subpart B, of the FCC rules. These limits are designed to provide reasonable protection against harmful interference in a residential environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try and correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help.
Labeling Requirements (FCC 15.19) This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. If the FCC ID is not visible when installed inside another device, then the outside of the device into which the module is installed must also display a label referring to the enclosed module FCC ID.
Modifications (FCC 15.21) Changes or modifications to this equipment not expressly approved by Digi may void the user's authority to operate this equipment.
TransPort WR41 EU Declaration of Conformity
Digi has issued Declarations of Conformity for the Digi TransPort WR41 concerning emissions, EMC, and safety. For more information, see Digi government agency certifications page.
Important note Digi customers assume full responsibility for learning and meeting the required guidelines for each country in their distribution market. Refer to the radio regulatory agency in the desired countries of operation for more information.
CE mark (Europe)
The Digi TransPort WR41 is certified for use in several European countries. For information, visit Digi
government agency certifications page. If the Digi TransPort WR41 is incorporated into a product, the manufacturer must ensure compliance of the final product with articles 3.1a and 3.1b of the RE Directive (Radio Equipment Directive). A
Digi TransPort® Routers User Guide
78
Hardware features
TransPort WR41 hardware features
Declaration of Conformity must be issued for each of these standards and kept on file as described in the RE Directive (Radio Equipment Directive). Furthermore, the manufacturer must maintain a copy of the Digi TransPort WR41 user manual documentation and ensure the final product does not exceed the specified power ratings, antenna specifications, and/or installation requirements as specified in the user manual. If any of these specifications are exceeded in the final product, a submission must be made to a notified body for compliance testing to all required standards.
OEM labeling requirements The "CE" marking must be affixed to a visible location on the OEM product.
CE labeling requirements
The CE mark shall consist of the initials "CE" taking the following form:
n If the CE marking is reduced or enlarged, the proportions given in the above graduated drawing must be respected.
n The CE marking must have a height of at least 5 mm except where this is not possible on account of the nature of the apparatus.
n The CE marking must be affixed visibly, legibly, and indelibly.
Maximum power and frequency bands
Max power 2W 1W
Frequencies Cellular 850 and 900 MHz bands Cellular 1800 and 1900 MHz bands
Innovation, Science, and Economic Development Canada (IC) certifications
This digital apparatus does not exceed the Class B limits for radio noise emissions from digital apparatus set out in the Radio Interference Regulations of the Canadian Department of Communications.
Digi TransPort® Routers User Guide
79
Hardware features
TransPort WR41 hardware features
Le present appareil numerique n'emet pas de bruits radioelectriques depassant les limites applicables aux appareils numeriques de la class B prescrites dans le Reglement sur le brouillage radioelectrique edicte par le ministere des Communications du Canada.
Safety notices
1. Please read all instructions before installing and powering the router. You should keep these instructions in a safe place for future reference.
2. If the power supply shows signs of damage or malfunction, stop using it immediately, turn off the power and disconnect the power supply before contacting your supplier for a repair or replacement.
3. Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. Use only the accessories, attachments, and power supplies provided by the manufacturer-connecting non-approved antennas or power supplies may damage the router, cause interference or create an electric shock hazard, and will void the warranty.
4. Do not attempt to repair the product. The router contains no electronic components that can be serviced or replaced by the user. Any attempt to service or repair the router by the user will void the product warranty.
5. Products in the TransPort WR family are designed for indoor use. Use them in an environment suitable for computers and other electronic equipment.
6. Ports that are capable of connecting to other apparatus are defined as SELV ports. To ensure conformity with IEC60950 ensure that these ports are only connected to ports of the same type on other apparatus.
Special notes on safety for wireless routers
Digi International products are designed to the highest standards of safety and international standards compliance for the markets in which they are sold. However, cellular-based products contain radio devices which require specific consideration. Please take the time to read and understand the following guidance. Digi International assumes no liability for an end user's failure to comply with these precautions.
Wireless routers incorporate a wireless radio module. Users should ensure that the antenna(s) is (are) positioned at least 1 meter away from themselves and other persons in normal operation. When in a hospital or other health care facility, observe the restrictions on the use of mobile phones. Do not use the router in areas where guidelines posted in sensitive areas instruct users to switch off mobile phones. Medical equipment may be sensitive to RF energy. The operation of cardiac pacemakers, other implanted medical equipment and hearing aids can be affected by interference from cellular terminals such as the wireless routers when places close to the device. If in doubt about potential danger, contact the physician or the manufacturer of the device to verify that the equipment is properly shielded. Pacemaker patients are advised to keep the wireless router away from the pacemaker while it is on.
Digi TransPort® Routers User Guide
80
Hardware features
TransPort WR41 hardware features
Wireless routers must NOT be operated on aircraft. The operation of wireless appliances in an aircraft is forbidden to prevent interference with communications systems. Failure to observe these instructions may lead to the suspension or denial of cellular services to the offender, legal action, or both.
As with any electrical equipment, do not operate the router in the presence of flammable gases, fumes or potentially explosive atmospheres. Do not use radio devices anywhere that blasting operations occur.
Wireless routers receive and transmit radio frequency energy when power is on. Interference can occur when using the router close to TV sets, radios, computers or inadequately shielded equipment. Follow any special regulations and always power off your router wherever forbidden or when it may cause interference or danger.
SOS IMPORTANT! Wireless routers operate using radio signals and cellular networks cannot be guaranteed to connect in all possible conditions. Therefore, never rely solely upon any wireless device for life critical communications.
WARNING! For environments where the temperature is 55° C or above, this device must be installed in a restricted access area.
Product Disposal Instructions
The WEEE (Waste Electrical and Electronic Equipment: 2002/96/EC) directive has been introduced to ensure that electrical/ electronic products are recycled using the best available recovery techniques to minimize the impact on the environment. This product contains high quality materials and components which can be recycled. At the end of its life this product MUST NOT be mixed with other commercial waste for disposal. Check with the terms and conditions of your supplier for disposal information. Digi International Ltd WEEE Registration number: WEE/HF1515VU
Digi TransPort® Routers User Guide
81
Hardware features
TransPort WR44 / WR44 R hardware features
TransPort WR44 / WR44 R hardware features
Front panel TransPort WR44 models with cellular interface
TransPort WR44 models without SIM card slots
1. USB host connector: Connects compatible USB 2.0 client devices such as memory sticks and serial adapters. The total current available to power USB devices is 0.5 A.
2. POWER LED: n Off: No power n Green: TransPort device is powered
3. LAN (0, 1, 2, 3) LED: Illuminates steadily when there is a network connection to the LAN port and flashes when data is transmitted or received.
4. Wi-Fi LED: n Wi-Fi models: Illuminates steadily if Wi-Fi activity is present.
5. SERIAL LED: Illuminates steadily if a terminal is connected to the SERIAL port and the DTR signal is on. Flashes when data is transmitted or received.
6. LINK LED: Illuminates steadily when a wireless data connection has been established. 7. SIM LED:
n Cellular models: Illuminates steadily when a valid SIM card is installed. n Models without cellular interface: Not operational. 8. ACT LED: Flashes to indicate that data is being transferred over the wireless network.
Digi TransPort® Routers User Guide
82
Hardware features
TransPort WR44 / WR44 R hardware features
9. SIGNAL LED: n Cellular models: Indicate strength of cellular signal. 3 LEDs: Excellent 2 LEDs: Good 1 LED: Fair 0 LEDs: Poor or No signal n Models without cellular interface: Not operational.
10. SIM / R-UIM Sockets: n Cellular SIM card models only: Illuminates steadily when a valid SIM card is installed. n Models without cellular interface: Not operational or accessible.
Rear panel
1. Primary cellular (WWAN) antenna connector: An SMA female connector that connects the router's primary cellular antenna.
2. Secondary Wi-Fi (WLAN) Antenna connector (Wi-Fi models only): An SMA male connector that connects the router's secondary Wi-Fi antenna.
3. Secondary cellular (WWAN) antenna connector (WR44-U and WR44-C models): An SMA female connector that connects the router's secondary cellular antenna. It is highly recommended to use the secondary antenna for diversity. In most circumstances, dual antennas will provide improved signal strength thus better performance.
4. Primary Wi-Fi (WLAN) antenna connector (Wi-Fi models only): An SMA male connector that connects the router's primary Wi-Fi antenna.
5. Power connector: Connects the router to a power source. The power supply has a twist-lock connector which can be secured by rotating it 90 degrees once installed into the TransPort router. Center pin is positive.
6. 9-36 VDC (Aux): Connects the router to an alternative 11-58VDC power supply (not supplied) using a fused power cable which can be purchased separately. This cable also contains two programmable IO signal lines, one is an input signal, and the other is an input/output signal.
7. SERIAL 0 port: This DB9 port provides an asynchronous RS232 serial port for connecting the router to a compatible serial device. This is a DCE serial port and allows CLI access to the device by default; the baud rate is 115200.
8. Hardware expansion port: Various hardware upgrades are available for this router and are populated via this expansion port. See TransPort WR44 additional hardware features for more information.
Digi TransPort® Routers User Guide
83
Hardware features
TransPort WR44 / WR44 R hardware features
9. LAN ports: Connect the router to a 10/100 base-T LAN. These ports are auto- sensing for speed and wiring (straight-through or cross-over).
Note For certain variants of the WR44 R, the LAN0 port is configured as a WAN interface. In this case, connect the LAN0 port to a device that has an internet connection.
Underside of unit
TransPort WR44
TransPort WR44 R
Digi TransPort® Routers User Guide
84
Hardware features
TransPort WR44 / WR44 R hardware features
1. Mounting holes. 2. SIM slot cover plate mounting hole. 3. Reset button: The reset button is on the underside of the unit. It performs a factory reset. It is
recessed to avoid an accidental reset. See Reset the router to factory defaults.
Enclosure features
TransPort WR44
1. Commercial enclosure 2. Mounting feet
TransPort WR44 R
1. Rugged enclosure 2. Mounting tabs
Digi TransPort® Routers User Guide
85
Hardware features
TransPort WR44 / WR44 R hardware features
TransPort WR44 additional hardware features
1. ASY serial port (3x): Provides three additional asynchronous RS232 serial ports using RJ45 connectors.
2. SYN/ASYN serial port: Provides an X.21/RS422/RS232 synchronous / asynchronous serial port using a DB25 connector.
3. GPS antenna connector (GPS models only): Provides GPS capabilities using an SMA male connector.
4. ISDN: Provides an ISDN Basic Rate Interface (BRI) via an RJ45 port. This can be configured either as a TE (terminal endpoint) or as NT-1 (network termination). The option also includes an additional asynchronous serial port via a second RJ45 port.
5. Telemetry 1 I/O interface: Provides 4 opto-isolated digital input ports and 1 opto-isolated digital output port. It also provides a relay I/O port, a voltage monitoring port, and internal temperature monitoring.
6. Telemetry 2 I/O interface: Provides 4 isolated analog I/O ports and 4 non-isolated digital I/O ports.
Digi TransPort® Routers User Guide
86
Hardware features
TransPort WR44 / WR44 R hardware features
7. Fleet I/O interface: Provides CAN and J1708 interface, GPS, 4 non-isolated digital I/O ports, ignition sense port, and a 3 axis accelerometer.
8. PSTN: Provides a PSTN interface via an RJ45 connector for dialing out and receiving calls. 9. ISDN-U/PSTN: Provides an ISDN-U interface suitable for the USA plus PSTN interface. It can be
configured for Bell-103 modulation in leased line mode as well as a normal PSTN interface. 10. DialServ: This RJ11/FXS connection converts a PSTN analog modem to a RS-232 serial signal.
For more information on the Telemetry 1, Telemetry 2, and the Fleet I/O Interfaces please see the product specific user's guides, available on www.digi.com on the TransPort WR44 product Resources page.
Powering the TransPort WR44 R
Vehicle installation
The TransPort WR44 R shall be powered from a 5A fused circuit or shall be installed with an in-line Slow Blow fuse rated at 5A. Maximum ambient operating temperature is limited to 70 C.
Note Always follow the vehicle manufacturer recommendations for electrical accessories connections. Vehicle installations are considered Service persons only and Restricted Access. All components used in the electrical connection to the vehicle should be UL listed.
Alternate installations
The TransPort WR44 R shall be powered by a certified ITE LPS power supply (9-36 VDC, 18W minimum). Supplies shall be suitable for the ambient for which they are installed. Maximum ambient operating temperature is limited to the lower of the maximum ambient operating temperature of the power supply or 70 C. Digi recommends the power supplies in the following accessory kits:
n Installations 0 C to +40 C: Digi part number 76000823 n Installations -40 C to +70 C: Digi part number 76000816 (US), 76000904 (EU)
Digi TransPort® Routers User Guide
87
Hardware features
TransPort WR44 / WR44 R hardware features
TransPort WR44 hardware specifications
For TransPort WR44 hardware specifications, see Digi TransPort WR44 specifications.
Digi TransPort® Routers User Guide
88
Hardware features
TransPort WR44 / WR44 R hardware features
TransPort WR44 R hardware specifications
For TransPort WR44 R hardware specifications, see Digi TransPort WR44 R specifications.
Digi TransPort® Routers User Guide
89
Hardware features
TransPort WR44 / WR44 R hardware features
TransPort WR44 accessories
A variety of accessories are available for TransPort products. For the current list of accessories and their Digi part numbers, go to the TransPort WR44 Part Numbers and Accessories page.
Digi TransPort® Routers User Guide
90
Hardware features
TransPort WR44 / WR44 R hardware features
TransPort WR44 R accessories
A variety of accessories are available for TransPort products. For the current list of accessories and their Digi part numbers, go to the TransPort WR44 R Part Numbers and Accessories page.
Digi TransPort® Routers User Guide
91
Hardware features
TransPort WR44 / WR44 R hardware features
TransPort WR44 / WR44 R RS232 serial pinout
Description
Transmit Data Receive Data Ready To Send Clear To Send Data Set Ready Ground Data Carrier Detect Transmitter Clock Receiver Clock Data Terminal Ready Ring Indicate External Transmitter Clock
RS232 signal Direction
TxD
in
RxD
out
RTS
in
CTS
out
DSR
out
GND
n/a
DCD
out
TxC
out
RxC
out
DTR
in
RI
out
ETC
in
DB 25 Pin# 2 3 4 5 6 7 8
15
17 20
22 24
DB 9 Pin# 3 2 7 8 6 5 1
RJ45 Pin # 6 3 1 8 n/a 5 7
n/a
n/a
n/a
n/a
4
2
9
n/a
n/a
n/a
Digi TransPort® Routers User Guide
92
Hardware features
TransPort WR44 / WR44 R hardware features
Regulatory and safety statements
RF exposure statement
In order to comply with RF exposure limits established in the ANSI C95.1 standards, the distance between the antenna or antennas and the user should not be less than 20 cm.
FCC Part 15 Class B
Radio Frequency Interference (RFI) (FCC 15.105) This device has been tested and found to comply with the limits for Class B digital devices pursuant to Part 15 Subpart B, of the FCC rules. These limits are designed to provide reasonable protection against harmful interference in a residential environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try and correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help.
Labeling Requirements (FCC 15.19) This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. If the FCC ID is not visible when installed inside another device, then the outside of the device into which the module is installed must also display a label referring to the enclosed module FCC ID.
Modifications (FCC 15.21) Changes or modifications to this equipment not expressly approved by Digi may void the user's authority to operate this equipment.
TransPort WR44 Declaration of Conformity
Digi has issued Declarations of Conformity for the Digi TransPort WR44 concerning emissions, EMC, and safety. For more information, see Digi government agency certifications page.
Important note Digi customers assume full responsibility for learning and meeting the required guidelines for each country in their distribution market. Refer to the radio regulatory agency in the desired countries of operation for more information.
CE mark (Europe) The Digi TransPort WR44 is certified for use in several European countries. For information, visit Digi government agency certifications page. If the Digi TransPort WR44 is incorporated into a product, the manufacturer must ensure compliance of the final product with articles 3.1a and 3.1b of the RE Directive (Radio Equipment Directive). A
Digi TransPort® Routers User Guide
93
Hardware features
TransPort WR44 / WR44 R hardware features
Declaration of Conformity must be issued for each of these standards and kept on file as described in the RE Directive (Radio Equipment Directive). Furthermore, the manufacturer must maintain a copy of the Digi TransPort WR44 user manual documentation and ensure the final product does not exceed the specified power ratings, antenna specifications, and/or installation requirements as specified in the user manual. If any of these specifications are exceeded in the final product, a submission must be made to a notified body for compliance testing to all required standards.
OEM labeling requirements The "CE" marking must be affixed to a visible location on the OEM product.
CE labeling requirements
The CE mark shall consist of the initials "CE" taking the following form:
n If the CE marking is reduced or enlarged, the proportions given in the above graduated drawing must be respected.
n The CE marking must have a height of at least 5 mm except where this is not possible on account of the nature of the apparatus.
n The CE marking must be affixed visibly, legibly, and indelibly.
Maximum power and frequency bands
Max power 2W 1W 200 mW
251.19 mW
Frequencies Cellular 850 and 900 MHz bands
Cellular 1800 and 1900 MHz bands
13 overlapping channels, each 22 or 40 MHz wide and spaced at 5 MHz. Centered at 2.412 to 2.472 MHz.
165 overlapping channels, each 22 or 40 or 80 MHz wide and spaced at 5 MHz. Centered at 5180 to 5825 MHz.
Digi TransPort® Routers User Guide
94
Hardware features
TransPort WR44 / WR44 R hardware features
Innovation, Science, and Economic Development Canada (IC) certifications
This digital apparatus does not exceed the Class B limits for radio noise emissions from digital apparatus set out in the Radio Interference Regulations of the Canadian Department of Communications. Le present appareil numerique n'emet pas de bruits radioelectriques depassant les limites applicables aux appareils numeriques de la class B prescrites dans le Reglement sur le brouillage radioelectrique edicte par le ministere des Communications du Canada.
Safety notices
1. Please read all instructions before installing and powering the router. You should keep these instructions in a safe place for future reference.
2. If the power supply shows signs of damage or malfunction, stop using it immediately, turn off the power and disconnect the power supply before contacting your supplier for a repair or replacement.
3. Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. Use only the accessories, attachments, and power supplies provided by the manufacturer-connecting non-approved antennas or power supplies may damage the router, cause interference or create an electric shock hazard, and will void the warranty.
4. Do not attempt to repair the product. The router contains no electronic components that can be serviced or replaced by the user. Any attempt to service or repair the router by the user will void the product warranty.
5. TransPort WR44 devices except for the WR44 R are designed for indoor use. Use them in an environment suitable for computers and other electronic equipment.
6. Ports that are capable of connecting to other apparatus are defined as SELV ports. To ensure conformity with IEC60950 ensure that these ports are only connected to ports of the same type on other apparatus.
Special notes on safety for wireless routers
Digi International products are designed to the highest standards of safety and international standards compliance for the markets in which they are sold. However, cellular-based products contain radio devices which require specific consideration. Please take the time to read and understand the following guidance. Digi International assumes no liability for an end user's failure to comply with these precautions.
Digi TransPort® Routers User Guide
95
Hardware features
TransPort WR44 / WR44 R hardware features
Wireless routers incorporate a wireless radio module. Users should ensure that the antenna(s) is (are) positioned at least 1 meter away from themselves and other persons in normal operation. When in a hospital or other health care facility, observe the restrictions on the use of mobile phones. Do not use the router in areas where guidelines posted in sensitive areas instruct users to switch off mobile phones. Medical equipment may be sensitive to RF energy. The operation of cardiac pacemakers, other implanted medical equipment and hearing aids can be affected by interference from cellular terminals such as the wireless routers when places close to the device. If in doubt about potential danger, contact the physician or the manufacturer of the device to verify that the equipment is properly shielded. Pacemaker patients are advised to keep the wireless router away from the pacemaker while it is on.
Wireless routers must NOT be operated on aircraft. The operation of wireless appliances in an aircraft is forbidden to prevent interference with communications systems. Failure to observe these instructions may lead to the suspension or denial of cellular services to the offender, legal action, or both.
As with any electrical equipment, do not operate the router in the presence of flammable gases, fumes or potentially explosive atmospheres. Do not use radio devices anywhere that blasting operations occur.
Wireless routers receive and transmit radio frequency energy when power is on. Interference can occur when using the router close to TV sets, radios, computers or inadequately shielded equipment. Follow any special regulations and always power off your router wherever forbidden or when it may cause interference or danger.
SOS IMPORTANT! Wireless routers operate using radio signals and cellular networks cannot be guaranteed to connect in all possible conditions. Therefore, never rely solely upon any wireless device for life critical communications.
WARNING! For environments where the temperature is 55° C or above, this device must be installed in a restricted access area.
Product Disposal Instructions
The WEEE (Waste Electrical and Electronic Equipment: 2002/96/EC) directive has been introduced to ensure that electrical/ electronic products are recycled using the best available recovery techniques to minimize the impact on the environment. This product contains high quality materials and components which can be recycled. At the end of its life this product MUST NOT be mixed with other commercial waste for disposal. Check with the terms and conditions of your supplier for disposal information. Digi International Ltd WEEE Registration number: WEE/HF1515VU
Digi TransPort® Routers User Guide
96
Hardware features
TransPort WR44 RR hardware features
Front panel
TransPort WR44 RR hardware features
1. POWER LED: n Off: No power n Green: TransPort device is powered
2. LAN (0, 1, 2, 3) LED: Illuminates steadily when there is a network connection to the LAN port and flashes when data is transmitted or received.
3. Wi-Fi LED: n Wi-Fi models only: Illuminates steady if Wi-Fi activity is present.
4. SERIAL LED: Illuminates steadily if a terminal is connected to the SERIAL port and the DTR signal is on.
5. LINK LED: Illuminates steadily when a wireless WAN data connection has been established. 6. SIM LED: Illuminates steadily when a valid SIM card is installed. 7. ACT LED: Flashes to indicate that data is being transferred over the wireless WAN network. 8. SIGNAL LEDs: Indicate strength of cellular signal.
n 3 LEDs: Excellent n 2 LEDs: Good n 1 LED: Fair n 0 LEDs: Poor or No signal 9. SIM / R-UIM sockets (SIM card models only): SIM 1 and SIM 2 are for use with the SIMs or RUIMs (Removable User Identification Modules).
Rear panel
Digi TransPort® Routers User Guide
97
Hardware features
TransPort WR44 RR hardware features
1. Primary cellular (WWAN) antenna connector: A TNC female connector that connects the router's primary cellular antenna.
2. Primary Wi-Fi (WLAN) antenna connector (Wi-Fi models only): A TNC male connector that connects the router's secondary Wi-Fi antenna.
3. GPS antenna connector (GPS models only): A TNC male connector that connects the router's GPS antenna.
4. Secondary cellular (WWAN) antenna connector: A TNC female connector that connects the router's secondary cellular antenna. It is highly recommended to use the secondary antenna for diversity. In most circumstances, dual antennas will provide improved signal strength thus better performance.
5. Secondary Wi-Fi (WLAN) antenna connector (Wi-Fi models only): A TNC male connector that connects the router's secondary Wi-Fi antenna.
6. 9-36VDC socket: An M12 socket that connects the router to an alternative 9-36VDC power supply (not supplied) using the supplied fused power cable. This cable also contains two programmable GPIO signal lines.
7. Serial port: This M12 port provides an asynchronous RS232 serial port for connecting the router to a compatible serial device. This is a DCE serial port and allows CLI access to the device by default; the baud rate is 115200.
8. LAN ports: These M12 ports connect the router to a 10/100 base-T LAN. These ports are autosensing for speed and wiring (straight-through or cross-over).
Enclosure features
1. Rugged Enclosure 2. Mounting Tabs
Digi TransPort® Routers User Guide
98
Hardware features
TransPort WR44 RR hardware features
TransPort WR44 RR hardware specifications
For TransPort WR44 hardware specifications, see Digi TransPort WR44 RR specifications
Digi TransPort® Routers User Guide
99
Hardware features
TransPort WR44 RR hardware features
TransPort WR44 RR accessories
A variety of accessories are available for TransPort products. For the current list of accessories and their Digi part numbers, go to the TransPort WR44 RR Part Numbers and Accessories page.
Digi TransPort® Routers User Guide
100
Hardware features
TransPort WR44 RR hardware features
TransPort WR44 RR Ethernet cable connectors and pinouts
Pin locations
4-pin connector pin locations
8-pin connector pin locations
Power connector
The power connector is an M12-4 pin, A Coded connector. Pinout is as follows:
Pin
Signal
1
Power +ve
2
GPIO 0
3
Power -ve
3
GPIO 1
Digi TransPort® Routers User Guide
101
Hardware features
TransPort WR44 RR hardware features
Serial connector
The serial connector is an M12-5 pin, A Coded connector. Pinout is as follows:
Pin
DB-9 (DCE)
1
2 (RXD)
2
3 (TXD)
3
8 (CTS)
4
7 (RTS)
5
5 (GTM)
Ethernet connectors
Ethernet connector M12-4 pin, D coded
M12 Pin 1 3 2 4
RJ45 1 2 3 6
Signal TX+ TXRX+ RX-
Notes Twisted pair
Twisted pair
Ethernet connector M12-4 pin, D coded
M12 Pin 4 6 5 8 1 2 3 7
RJ45 6 3 1 2 N/C N/C N/C N/C
Signal RXRX+ TX+ TX-
Notes Twisted pair
Twisted pair
Digi TransPort® Routers User Guide
102
Hardware features
TransPort WR44 RR hardware features
Regulatory and safety statements
RF exposure statement
In order to comply with RF exposure limits established in the ANSI C95.1 standards, the distance between the antenna or antennas and the user should not be less than 20 cm.
FCC Part 15 Class B
Radio Frequency Interference (RFI) (FCC 15.105) This device has been tested and found to comply with the limits for Class B digital devices pursuant to Part 15 Subpart B, of the FCC rules. These limits are designed to provide reasonable protection against harmful interference in a residential environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try and correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help.
Labeling Requirements (FCC 15.19) This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. If the FCC ID is not visible when installed inside another device, then the outside of the device into which the module is installed must also display a label referring to the enclosed module FCC ID.
Modifications (FCC 15.21) Changes or modifications to this equipment not expressly approved by Digi may void the user's authority to operate this equipment.
TransPort WR44 RR Declaration of Conformity
Digi has issued Declarations of Conformity for the Digi TransPort WR44 RR concerning emissions, EMC, and safety. For more information, see Digi's government agency certifications page.
Important note Digi customers assume full responsibility for learning and meeting the required guidelines for each country in their distribution market. Refer to the radio regulatory agency in the desired countries of operation for more information.
CE mark (Europe) The Digi TransPort WR44 RR is certified for use in several European countries. For information, visit Digi's government agency certifications page.
If the Digi TransPort WR44 RR is incorporated into a product, the manufacturer must ensure
compliance of the final product with articles 3.1a and 3.1b of the RE Directive (Radio Equipment
Digi TransPort® Routers User Guide
103
Hardware features
TransPort WR44 RR hardware features
Directive). A Declaration of Conformity must be issued for each of these standards and kept on file as described in the RE Directive (Radio Equipment Directive).
Furthermore, the manufacturer must maintain a copy of the Digi TransPort WR44 RR user manual
documentation and ensure the final product does not exceed the specified power ratings, antenna specifications, and/or installation requirements as specified in the user manual. If any of these specifications are exceeded in the final product, a submission must be made to a notified body for compliance testing to all required standards.
OEM labeling requirements The "CE" marking must be affixed to a visible location on the OEM product.
CE labeling requirements
The CE mark shall consist of the initials "CE" taking the following form:
n If the CE marking is reduced or enlarged, the proportions given in the above graduated drawing must be respected.
n The CE marking must have a height of at least 5 mm except where this is not possible on account of the nature of the apparatus.
n The CE marking must be affixed visibly, legibly, and indelibly.
Maximum power and frequency bands
Max power 2W 1W 200 mW
251.19 mW
Frequencies Cellular 850 and 900 MHz bands
Cellular 1800 and 1900 MHz bands
13 overlapping channels each 22 or 40 MHz wide and spaced at 5 MHz. Centered at 2.412 to 2.472 MHz
165 overlapping channels, each 22 or 40 or 80 MHz wide and spaced at 5 MHz. Centered at 5180 to 5825 MHz.
Digi TransPort® Routers User Guide
104
Hardware features
TransPort WR44 RR hardware features
Innovation, Science, and Economic Development Canada (IC) certifications
This digital apparatus does not exceed the Class B limits for radio noise emissions from digital apparatus set out in the Radio Interference Regulations of the Canadian Department of Communications. Le present appareil numerique n'emet pas de bruits radioelectriques depassant les limites applicables aux appareils numeriques de la class B prescrites dans le Reglement sur le brouillage radioelectrique edicte par le ministere des Communications du Canada.
Safety notices
1. Please read all instructions before installing and powering the router. You should keep these instructions in a safe place for future reference.
2. If the power supply shows signs of damage or malfunction, stop using it immediately, turn off the power and disconnect the power supply before contacting your supplier for a repair or replacement.
3. Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. Use only the accessories, attachments, and power supplies provided by the manufacturer-connecting non-approved antennas or power supplies may damage the router, cause interference or create an electric shock hazard, and will void the warranty.
4. Do not attempt to repair the product. The router contains no electronic components that can be serviced or replaced by the user. Any attempt to service or repair the router by the user will void the product warranty.
5. The TransPort WR44 RR is designed for indoor use. Use it in an environment suitable for computers and other electronic equipment.
6. Ports that are capable of connecting to other apparatus are defined as SELV ports. To ensure conformity with IEC60950 ensure that these ports are only connected to ports of the same type on other apparatus.
Special notes on safety for wireless routers
Digi International products are designed to the highest standards of safety and international standards compliance for the markets in which they are sold. However, cellular-based products contain radio devices which require specific consideration. Please take the time to read and understand the following guidance. Digi International assumes no liability for an end user's failure to comply with these precautions.
Digi TransPort® Routers User Guide
105
Hardware features
TransPort WR44 RR hardware features
Wireless routers incorporate a wireless radio module. Users should ensure that the antenna(s) is (are) positioned at least 1 meter away from themselves and other persons in normal operation. When in a hospital or other health care facility, observe the restrictions on the use of mobile phones. Do not use the router in areas where guidelines posted in sensitive areas instruct users to switch off mobile phones. Medical equipment may be sensitive to RF energy. The operation of cardiac pacemakers, other implanted medical equipment and hearing aids can be affected by interference from cellular terminals such as the wireless routers when places close to the device. If in doubt about potential danger, contact the physician or the manufacturer of the device to verify that the equipment is properly shielded. Pacemaker patients are advised to keep the wireless router away from the pacemaker while it is on.
Wireless routers must NOT be operated on aircraft. The operation of wireless appliances in an aircraft is forbidden to prevent interference with communications systems. Failure to observe these instructions may lead to the suspension or denial of cellular services to the offender, legal action, or both.
As with any electrical equipment, do not operate the router in the presence of flammable gases, fumes or potentially explosive atmospheres. Do not use radio devices anywhere that blasting operations occur.
Wireless routers receive and transmit radio frequency energy when power is on. Interference can occur when using the router close to TV sets, radios, computers or inadequately shielded equipment. Follow any special regulations and always power off your router wherever forbidden or when it may cause interference or danger.
SOS IMPORTANT! Wireless routers operate using radio signals and cellular networks cannot be guaranteed to connect in all possible conditions. Therefore, never rely solely upon any wireless device for life critical communications.
WARNING! For environments where the temperature is 55° C or above, this device must be installed in a restricted access area.
Product Disposal Instructions
The WEEE (Waste Electrical and Electronic Equipment: 2002/96/EC) directive has been introduced to ensure that electrical/ electronic products are recycled using the best available recovery techniques to minimize the impact on the environment. This product contains high quality materials and components which can be recycled. At the end of its life this product MUST NOT be mixed with other commercial waste for disposal. Check with the terms and conditions of your supplier for disposal information. Digi International Ltd WEEE Registration number: WEE/HF1515VU
Digi TransPort® Routers User Guide
106
Hardware features
TransPort WR44 RR hardware features
Purchase additional serial cables
For TransPort models that include serial ports with RJ45 connectors, Digi offers the following serial cables for connectivity:
Digi part number 76000855 76000856 76000857
Description RJ45 to DB9 Female 6' RJ45 to DB25 Male 6' RJ45 to DB25 Female 6'
Digi TransPort® Routers User Guide
107
Hardware features
Signal strength indicators
Signal strength indicators
On routers equipped with W-WAN modules, there are three LEDs on the front panel that indicate signal strength.
Digi TransPort® Routers User Guide
108
Hardware features
Antenna specifications for Wi-Fi 2.4 GHz modules
Antenna specifications for Wi-Fi 2.4 GHz modules
The Wi-Fi 2.4 GHz modules for this product obtained its complete certification by using the antenna described here. End users in North America should use an antenna that matches these specifications to maintain the module's certification. You can use antennas of the same type but operating with a lower gain.
Attribute Frequency Range Impedance VSWR Return Loss Gain Polarization Radiation Pattern Admitted Power Electrical
Property 2.4 to 2.5 GHz 50 Ohm 1.92 max -10 dB max 1.8 dBi Linear Near omnidirectional in the horizontal plane 1W
1/2 Dipole
Digi TransPort® Routers User Guide
109
Using the command-line interface
About the Digi TransPort command line interface
111
Supported command types
112
Required software for using the command line
113
Connect to the TransPort router from a PC
114
Log in to the command line interface
115
Exit the command line interface
116
Commands and the active port
117
When commands take effect
118
View current configuration changes
119
Save changes
120
Configure network settings
121
Establish a remote connection
123
Application commands
124
AT commands
144
Digi TransPort® Routers User Guide
110
Using the command-line interface
About the Digi TransPort command line interface
About the Digi TransPort command line interface
Using a Web browser to modify values in the configuration pages is the simplest way to configure the router. This process is described in the next chapter. However, if you do not have access to a Web browser, the router can be configured using text commands. You can enter these commands directly through one of the serial ports or via a Telnet session. Remote configuration is also possible using Telnet or X.25.
Note Low level permission users are designed to work in the web interface only. Command line use is not supported for these users.
Digi TransPort® Routers User Guide
111
Using the command-line interface
Supported command types
Supported command types
There are several types of text commands:
n Application commands, also known as text commands: Application commands are specific to Digi International products and control most features of the router when the Web interface is not being used. For more information about application commands, see Application commands.
n AT commands and S registers: Digi TransPort supports AT commands and Special registers (S registers) to maintain compatibility with modems, when using the router as a modem replacement. For more information about the AT commands, see AT commands.
n X.3 commands: These are standard X.3 commands for X.25 PAD mode only. See Configure X.25 parameters.
n TPAD commands: These are for TPAD mode only. See Configure TPAD parameters.
Digi TransPort® Routers User Guide
112
Using the command-line interface
Required software for using the command line
Required software for using the command line
Using the command line requires the following:
n A PC connected to the Digi TransPort router. n Terminal emulation/communications software, such as HyperTerminal TM (supplied with
Windows) or TeraTermTM.
Digi TransPort® Routers User Guide
113
Using the command-line interface
Connect to the TransPort router from a PC
Connect to the TransPort router from a PC
If you configured the router by using the Getting Started Wizard at setup time, following instructions in the Quick Start Guide for your product, your router is already configured.
Command line
1. Verify that the router is connected to a PC. 2. Verify that terminal emulation software, such as TeraTerm or HyperTerminal, is installed on
the PC. 3. Configure your terminal emulation software:
n COM Port: select the appropriate port, typically COM1 n Baud Rate: 115200 n Data Bits: 8 n Stop Bits: 1 n Parity: No n Parity: No Parity n Flow Control: None 4. Verify that the connection is active by typing at (in upper or lower case) and pressing ENTER. If the device is functioning properly, it will return the response OK. To learn more about the AT commands, see AT commands. 5. Verify that the COM port is configured correctly by typing ati5 and pressing ENTER.
Digi TransPort® Routers User Guide
114
Using the command-line interface
Log in to the command line interface
Log in to the command line interface
Command line
When the login prompt displays on the command line, enter the default user name and password:
n User name: admin n Password: The default password is printed on the device label.
n If a device that was manufactured prior to release 8.0.0.3 has been upgraded to the current release: l If the device was upgraded using the Web UI Update Firmware, the router retains the existing default user accounts. For example, after upgrading from release 7.1.2.2 to the current release, the default user account name remains username, and the default password is password. o After upgrading using the Web UI Update Firmware, if you then factory reset the device, the user name will be admin, and the default password will be default. l If the device was upgraded using Flashwriter, the user name is admin, and the default password is default.
n If a device that was manufactured with release 8.x is downgraded to a release prior to 8.0.0.3: l If the device was downgraded using the Web UI Update Firmware, the user name is admin, and the default password is default. l If the device was downgraded using Flashwriter, the admin account is longer be present. Instead, the default account user name is username, and the default password is password. o After downgrading with Flashwriter, if you then upgrade to 8.0.0.3 or greater using the Web UI Update Firmware, the router will retain the username/password account and not include an admin account. If you then factory default the router, the admin account with the preprogrammed unique password will return. o After downgrading with Flashwriter, if you then upgrade to 8.0.0.3 or greater using Flashwriter, the admin account with the preprogrammed unique password will again be present and the username/password account will be removed.
Note You should change the default username and password for all users. See Configure user security settings.
Digi TransPort® Routers User Guide
115
Using the command-line interface
Exit the command line interface Command line
To exit the command line interface, type exit and press ENTER.
Exit the command line interface
Digi TransPort® Routers User Guide
116
Using the command-line interface
Commands and the active port
Commands and the active port
In most cases, when entering AT or text commands, the command only affects the settings for the active port. This is usually the port to which you are physically connected, but you may, if necessary, set the active port to another port of your choice using the AT\PORT=N command, where N is a port number from 0-3.
Digi TransPort® Routers User Guide
117
Using the command-line interface
When commands take effect
All entered commands take effect immediately.
When commands take effect
Digi TransPort® Routers User Guide
118
Using the command-line interface
View current configuration changes
View current configuration changes Command line
To view the current configuration settings, type the following command:
config c show
Digi TransPort® Routers User Guide
119
Using the command-line interface
Save changes Command line
To save changes made to the router, type the following command: config 0 save
Save changes
Digi TransPort® Routers User Guide
120
Using the command-line interface
Configure network settings
Configure network settings
To configure the router with an IP address as part of an existing network, use the following commands.
Command line
Note The DHCP server will still operate unless it is disabled.
1. Set the IP address of Eth 0: eth 0 ipaddr xxx.xxx.xxx.xxx
2. Set the subnet mask for Eth 0:
eth 0 mask xxx.xxx.xxx.xxx
For example, to assign the IP address 192.168.10.254/24, enter:
eth 0 ipaddr 192.168.10.254 eth 0 mask 255.255.255.0
Note When the subnet mask is set to 255.255.255.0, this value does not display in the output of the config c show command because 255.255.255.0 is a default value.
3. To disable the DHCP server, use the ipmin ! option with the dhcp command. This command removes the minimum IP address for DHCP, which in turn disables the DHCP server. The exclamation point (!) character removes a value or sets it back to its default.
dhcp 0 ipmin !
4. To configure the DHCP server for a different subnet, use the ipmin option with the dhcp command by setting the minimum IP address to the start of the DHCP pool on the new subnet:
dhcp 0 ipmin xxx.xxx.xxx.xxx
5. Set the number of IP addresses in the DHCP pool:
dhcp 0 iprange <value>
where <value> is a number between 1-255, representing the number of addresses that the DHCP server should serve within the DHCP pool. 6. Set the IP gateway address that the DHCP clients should use. Normally, this address is the router's LAN IP address.
dhcp 0 gateway xxx.xxx.xxx.xxx
7. Set the subnet mask DHCP clients should use:
dhcp 0 mask xxx.xxx.xxx.xxx
Digi TransPort® Routers User Guide
121
Using the command-line interface
8. Set the DNS server DHCP clients should use: dhcp 0 dns
Configure network settings
Digi TransPort® Routers User Guide
122
Using the command-line interface
Establish a remote connection
Establish a remote connection
Once you have configured the router, there are several ways to establish a link to a remote system:
n Use the ATD command to make an outgoing V.120 call. See atd: Dial a call. n Initiate a DUN session to establish a dial-up PPP connection. n Make an outgoing X.25 call using the ATD command followed by the X.28 CALL command. n Make an outgoing TPAD (Transaction PAD) call using the TPAD a (address) command followed
by the appropriate NUA. This is normally only carried out under software control.
Similarly, incoming calls are handled according to the protocols bound to the ASY ports, and whether answering is enabled for each protocol.
Digi TransPort® Routers User Guide
123
Using the command-line interface
Application commands
Application commands
The Digi TransPort router also supports numerous text-based application commands that are specific to Digi International products, and do not require the AT prefix. Some of these are generic, such as they are related to the general operation of the router; others are application- or protocol-specific.
Application commands are case-insensitive
Digi application commands (referred to as text commands or CLI commands throughout the remainder of this guide), can be entered in upper or lower case.
One command per line
Unlike AT commands, only one command may be entered on a line. After each successful command, the OK result code will be issued. An invalid command will cause the ERRORresult code to be issued.
Application command syntax
The general syntax for an application commands is: <entity> <instance> <param_name> <value> where: <entity> is the name of the router feature being configured. <instance> is the instance number for the entity that you are configuring. <param_name> is the name of the parameter that you wish to configure. <value> is the new value for the specified parameter. For example, to set the window size to 5 for X.25 PAD instance 1, type:
pad 1 window 5
If there is only once instance of particular entity, type 0 for the instance number.
Use wildcards in commands
Command line
When viewing and not setting parameters, you can use wildcards in the field <param_name>. For example, to view all PPP 1 parameters that start with r, enter:
ppp 1 r* ?
The output is: ppp 1 r* ? r_mru: 1500 r_acfc: OFF r_pfc: OFF r_pap: ON r_chap: ON r_accm: 0xffffffff
Digi TransPort® Routers User Guide
124
Using the command-line interface
Application commands
r_comp: OFF r_addr: OFF r_callb: 0 rxtimeout: 23 rdoosdly: 0 restdel: 2000 rebootfails: 0 rip: 0 ripip: ripauth: 1 ripis: OFF r_md5: 1 r_ms1: 1 r_ms2: 1 rbcast: OFF OK
Use special usernames in commands
You can use several special usernames for local and remote authentication:
Username %s %i %c
Description Uses the serial number of the router as the username. Uses the IMEI of the cellular module as the username. Uses the ICCID of the SIM as the username.
If a % symbol is part of the username, you must enter another % symbol as an escape character. For example, enter user%1 as user%%1.
Digi TransPort® Routers User Guide
125
Using the command-line interface
Application commands
Using the command-line parameter tables in this guide
Command line
Many sections in this guide include tables showing the command-line interface parameters that relate to the web-based settings. With a few exceptions, these parameters nearly always take the following format: <entity> <instance> <param_name> <value> Where:
<entity> The name of the router feature being configured. eth, ppp, modemcc, wifi, ike, eroute, etc.
<instance> The instance of the feature, such as 0, 1, 2, 3, etc... Some entities only use 0. Others have multiple instances.
<parameter> The parameter name, such as, ipaddr, mask, gateway, etc.
<value> The value to set, such as, off, on, 192.168.1.1, username, free_text, etc. For example, the following table is displayed for Ethernet parameters:
Command Instance Parameter
eth
n
descr
eth
n
ipaddr
eth
n
mask
eth
n
eth
n
eth
n
eth
n
gateway dnsserver secdns dhcpcli
Values
Equivalent web parameters
Free text field Description
Valid IP address IP Address
Valid Subnet Mask
Mask
IP address
Gateway
IP address
DNS Server
IP address
Secondary DNS Server
Off / On
On=Get an IP address automatically using DHCP Off=Use the following IP address
To use this table, read the row from left to right and replace values as appropriate. The first four columns only are needed for entering commands; the rightmost column shows the equivalent setting in the web interface.
If the Instance is n in the table, it is because there are multiple instances available. Use the instance number you need for your requirements. If the Instance is set to a specific number, such as 0, use the number specified in the table.
For example, to set a Description of Local LAN on Ethernet 0, enter:
Digi TransPort® Routers User Guide
126
Using the command-line interface
Application commands
eth 0 descr "Local LAN" Because of the space between Local and LAN, the wording is enclosed in double quotes. To set an IP address on 192.168.1.1 on Ethernet 0: eth 0 ipaddr 192.168.1.1 To set an IP address of 172.16.0.1 on Ethernet 1: eth 1 ipaddr 172.16.0.1 To enable the DHCP client on Ethernet 2: eth 2 dhcpcli on
Digi TransPort® Routers User Guide
127
Using the command-line interface
Application commands
Activate and deactivate interfaces
To manually activate (or raise) an interface, type the following command as an activation request: <entity> <instance> act_rq To manually deactivate (or lower) an interface, type the following command as an activation request: <entity> <instance> deact_rq Where <entity> can be:
n PPP for PPP interfaces n TUN for GRE TUN interfaces n OVPN for OpenVPN interfaces And <instance> is the interface number, such as 0, 1, 2 etc. For example, to activate PPP 1: ppp 1 act_rq To deactivate PPP 1: ppp 1 deact_rq
Digi TransPort® Routers User Guide
128
Using the command-line interface
ana command: Clear the Analyser Trace
To clear the Analyser trace, type: ana 0 anaclr
Application commands
Digi TransPort® Routers User Guide
129
Using the command-line interface
Application commands
config command: show/save configuration
The config command shows the current or stored configuration settings, saves the current configuration, and specifies which configuration to use when powering up or rebooting the router. The format of the config command is:
config <0|1|c> <save|saveall|show|showall|powerup>
You can store two separate configurations, numbered 0 and 1. The first parameter of the config command specifies to which configuration the command applies. The letter c indicates the current configuration settings, such as those currently in use. The second parameter is one of the following keywords:
n save saves the current settings as the specified configuration (either 0 or 1). This is the same functionality as the Save button described at Save the current configuration.
n saveall saves the configuration as well as default settings to a file config.alx, where x is the config number. This is the same functionality as the Save All button described at Save All: Save the entire configuration.
n show displays the specified configuration (either 0, 1 or c for the current configuration). n showall shows the config file config.alx, or the current config including all default values. n powerup sets the specified configuration (either 0 or 1) to use at power-up or reboot.
For example, to display the current configuration, type:
config c show
The output is similar to the following:
config c show eth 0 descr "LAN 0" eth 0 IPaddr "192.168.1.1" eth 0 mask "255.255.255.0" eth 0 bridge ON eth 1 descr "LAN 1" eth 2 descr "LAN 2" eth 3 descr "LAN 3" eth 4 descr "ATM PVC 0"
The configuration files only contain details of those settings that are different from the router's default settings. If you configure a setting that is the same as the default setting, it does not appear in a stored configuration. To save the current settings to configuration file 1, type:
config 1 save
To use configuration file 1 when the powering up or rebooting the router, type:
config 1 powerup
Digi TransPort® Routers User Guide
130
Using the command-line interface
Application commands
config changes command: show number of changes counter
The config changes command shows the number of changes to the current configuration since the router has powered up and the initial configuration file run. It also shows the time when the configuration file was last saved.
Digi TransPort® Routers User Guide
131
Using the command-line interface
clear command: Clear the event log
To clear the event log, type: clear_ev
Application commands
Digi TransPort® Routers User Guide
132
Using the command-line interface
Application commands
gpio command: General Purpose Input Output (GPIO)
GPIO commands are necessary to configure a WR44, which has one Digital Input/Output port and one Digital Input port. The gpio command configures an I/O port either as an input port or an output port. For example:
Command gpio inout input gpio inout output gpio inout on gpio inout off
Description Configures the I/O port as an input. Configures the I/O port as an output. Sets the I/O port to on when configured as an output. Sets the I/O port to off when configured as an output.
The syntax of the command is as follows: gpio [inout ON|OFF|input|output]
Display current status of ports
With no parameters, the gpio command displays the current status of the ports. For example:
gpio Input(s):
Output(s):
OK
in : OFF inout : OFF
Set the I/O port as an output To set the I/O port to be an output:
gpio inout output Input(s):
Output(s):
OK
in : OFF inout : OFF
Set the I/O port to ON when configured as an output To set the I/O port to ON when it is configured as an output:
gpio inout on Input(s):
in : OFF Output(s):
inout : ON OK
The Input and Input/Output connections (pins 2 and 3) are programmed via the command line using the gpio command. The default setting for pins 2 and 3 is OFF, as seen in the above example.
Digi TransPort® Routers User Guide
133
Using the command-line interface
Application commands
Note Use only one of the power connectors. Never apply power to both the MAIN and AUX connectors at the same time.
Pin Pin 1 Pin 2 Pin 3 Pin 4
Description GROUND INPUT Input/ Output Power
The following image shows the pins and the corresponding numbers:
For more information on wiring and other details, see the 4-pin DC Power Cord User Guide, Digi part number 90001246.
Digi TransPort® Routers User Guide
134
Using the command-line interface
Application commands
ping command: Troubleshoot connectivity problems
Use the ping command to help troubleshoot connectivity problems. The syntax of the ping command is:
ping <ip address|FQDN> [n]
Where n (if specified) is the number of ICMP echo requests to send. If not specified, only 1 echo request is sent. To stop pings when n has been set to a high value, use ping stop.
Digi TransPort® Routers User Guide
135
Using the command-line interface
Application commands
qdl command: Select cellular image to load
The qdl command selects which image to load onto a GOBI3000 cellular module. The syntax of the command is:
qdl 0 fw <n>
where n can be 0-14. The meaning of each value is below. The default value is 0.
Instance 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14
Value Generic UMTS Verizon Sprint PCS IUSACELL Bell Mobility Alltel Cingular Blue Cingular Orange T-Mobile Docomo Orange Vodafone Telefonica Telital OMH
Digi TransPort® Routers User Guide
136
Using the command-line interface
Application commands
reboot command: reboot router
The reboot command reboots the router after altering the configuration. The reboot command executes a complete hardware reset, loading and running the main image from cold. It has three modes of operation:
n reboot: Reboots the router after any FLASH write operations have been completed. The following operations allow 1 second to be completed before a reboot occurs: l IPSec SA delete notifications are created and sent l TCP sockets are closed l PPP interfaces are disconnected
n reboot <n>: A time reboot; reboots the router in <n> minutes where n is 1 to 65535. n reboot cancel: Cancels a timed reboot if entered before the time period has passed.
Digi TransPort® Routers User Guide
137
Using the command-line interface
Application commands
tcpperm command: establish a permanent serial to IP connection
The tcpperm command is available only as an application command, and has no equivalent web page. The tcpperm command establishes a permanent "serial to IP" connection between one of the ASY ports and a remote IP host. After tcpperm executes, the router automatically opens a socket connection to the remote peer whenever data is received from a terminal attached to the specified ASY port. When the socket is first opened and the connection is established, the router issues a CONNECT message to the terminal and subsequently relays data between the socket and the ASY port. You can modify the format of the CONNECT message using the standard AT commands (such as ATV, ATE, etc.) or using the web interface page Configuration > Network > Interfaces > Serial > Serial Port n.
Note Preconfigure the serial port to use the appropriate word format, speed, and flow control.
While the serial-to-IP connection is established, if the attached serial device drops the DTR signal, the socket connection is terminated, much as with a standard modem or terminal adapter. You can modify this behavior using the AT&D command or the serial port settings. The format of the command is: TCPPERM <[ASY 0-1]> <Dest Host> <Dest Port> [UDP] [nodeact] [l<listening port>] [-i<inact_timeout>] [-f<fwd_time>] [-e<eth_ip>][-d (deact link)] [-k<keepalive_time>] [-s<src_port>] [-ok] [-t<telnet_ mode>] [-ho(host only)] [-ssl] [-ao(always open)] [-m<mhome idx>] The tcpperm parameters are as follows:
Parameter ASY Dest Host Dest Port UDP -ao -e
-d
-f -ho
-i -k
Description
Use the address of Ethernet port n for the socket connection rather than the default of the address of the interface over which the socket is opened (that is, ppp 1, ppp 2, etc.) Deactivate link. If non-zero, when the socket is closed and there are no other sockets using the interface then the interface connection is dropped (switched connections only). The forwarding time (x10ms) for packetizing data from the serial port. Host. Indicates that the socket should only accept connections from the specified host. The inactivity timeout (s) after which the socket will be closed. Keep alive packet timer (s).
Digi TransPort® Routers User Guide
138
Using the command-line interface
Application commands
Parameter -l
-m -ok
-s -ssl -t
Description
Listening port. Allows the user to set a new TCP port number to listen on rather than the default value of 4000+ASY port #.
Multihome additional consecutive addresses index
Open socket in quiet mode, so that there is no OK response to the TCPPERM command.
Source port number
Use SSL mode
Use Telnet mode. Opens socket in the corresponding Telnet mode (port 23 default), 0=raw, 1=Telnet Mode, 2=Telnet Mode with null stuffing. If this is not specified, the router uses the mode specified for the associated ASY port in general setup. The -t option sets use of the ok option always.
Use the tcpperm command to execute automatically on power-up by using the cmd n autocmd `cmd' macro command. For example:
cmd 0 autocmd 'tcpperm asy 0 192.168.0.1 -f3 -s3000 -k10 -e1'
Considerations for use with VPN or GRE tunnels
When the socket being used by TCPPERM is opened, the default behavior is to use the address of the interface over which the socket is carried (ETHn or PPPn) as the source address of the socket. If the socket data is to be tunneled, you may need to use -en modifier so the source address of the socket matches the local subnet address specified in the appropriate eroute. You can also set this behavior in the web interface on the Configuration > Network > Advanced Network Settings page by setting the parameter Default source IP address interface: Ethernet n.
Digi TransPort® Routers User Guide
139
Using the command-line interface
Application commands
tcpdial command: Establish a manually initiated serial to IP
connection
tcpdial operates in an identical manner to tcpperm, except that establishment of the socket connection is not automatic and must be initiated by the tcpdial command. The simplest method of achieving this is to map a command using the Configuration > Network > Interfaces > Serial > Command Mappings, such as, Command to Map ATDT0800456789 maps to tcpdial asy 1 217.36.133.29 -e0. Now, whenever the attached terminal device attempts to dial the number defined, the router maps it to an IP socket connection. In this way, you can direct multiple dial commands to the same or different IP hosts with other simple command mappings.
The tcpdial command is available only as an application command, and has no equivalent setting in the web interface.
Digi TransPort® Routers User Guide
140
Using the command-line interface
Application commands
tcpdab command: Cancel a tcpdial connection
The tcpdab command cancels a tcpdial connection before the connection has been made. You can also use this command to disconnect an existing tcpdial connection on another ASY port. The format of the command is:
tcpdab <instance> ATH
where <instance> is the number of the ASY port.
Digi TransPort® Routers User Guide
141
Using the command-line interface
Application commands
templog command: monitor router temperature
The on-board temperature sensors are sampled every 60 seconds. Any interesting changes in the temperature are logged to a special flash file, templog.c1. Use templog 0 status to view the last stored record in this file.
There are two temperature sensors built in: one on the motherboard and one on the modem module. If a temperature is reached that is outside of normal operating limits, an event will be logged in the eventlog.txt file.
Digi TransPort® Routers User Guide
142
Using the command-line interface
Application commands
traceroute command: Troubleshoot connectivity problems
Use the traceroute command to help troubleshoot connectivity problems. The syntax of the traceroute command is:
traceroute <ip address|FQDN> To stop a failed trace if hosts cannot be detected, use traceroute stop.
sendSMS command: Send SMS messages
Use the sendsms command to send SMS messages. The syntax of the sendsms command is:
sendsms <dest> <message> were dest is the phone number of the device to send the message to, and message is the message to be sent.
Digi TransPort® Routers User Guide
143
Using the command-line interface
AT commands
AT commands
Digi TransPort supports AT commands and Special registers (S registers).
The AT command interface
The AT command prefix is for commands that are common to modems. To configure the router using AT commands, you must first connect it to a suitable asynchronous terminal.
1. Set the interface speed/data format for your terminal to 115,200 bits per second, 8 data bits, no parity and 1 stop bit. You can change these settings later if necessary.
2. When your terminal is correctly configured, apply power and wait for the B2 indicator to stop flashing. The device is now ready to respond to commands from an attached terminal and is in command mode. Alternatively, you can configure the router to automatically connect to a remote system on powerup.
3. Type at (in upper or lower case), and press [Enter]. The router should respond with the message OK. This message is issued after successful completion of each command. If an invalid command is entered, the router will respond with the message ERROR. If there is no response, check that the serial cable is properly connected and that your terminal or PC communications software is correctly configured before trying again. If you have local command echo enabled on your terminal, the AT command may display as aatt. If this happens, use the ate0 command (which appears as aattee00), to prevent the router from providing command echo. After entering this command, further commands display without the echo.
Enter multiple commands
After the prefix, you can type one or more commands on the same line, up to 40 characters. When the line is entered, the router will execute each command in turn.
Use escape sequences
If you enter a command such as atd, which results in the router successfully establishing a connection to a remote system, it will issue a CONNECT result code and switch from command mode to on-line mode. This means that it will no longer accept commands from the terminal. Instead, data will be passed transparently through the router to the remote system. In the same way, data from the remote system will pass straight through to your terminal. The router will automatically return to command mode if the connection to the remote system is terminated. To return to command mode manually, you must enter a special sequence of characters called the escape sequence. This consists of three occurrences of the escape character, a pause (user configurable) and then at. The default escape character is +. The default escape sequence is:
+++ {pause} at
Entering this sequence when the router is on-line causes the router to return to command mode but it will NOT disconnect from the remote system unless you specifically instruct it to do so by using ath or another method of disconnecting. If you have not disconnected the call, use the ato command to go back on-line.
Digi TransPort® Routers User Guide
144
Using the command-line interface
AT commands
AT command result codes
Each time an AT command line executes, the router responds with a result code to indicate whether the command was successful. If all commands entered on the line are valid, the OK result code will be issued. If any command on the line is invalid, the ERROR result code will be issued.
Result codes may take the form of an English word or phrase (verbose code) or an equivalent number (numeric code), depending on the setting of the atv command. The default is to use verbose codes.
Use the atv0 command to select numeric codes if required. The results from the text based commands can be numeric or verbose. The following table lists the result codes:
Numeric Code 0 1 2 3 4 6 7 8
Verbose Code OK CONNECT ISDN RING NO CARRIER X.25 ERROR NO DIALTONE ISDN BUSY NO ANSWER
Meaning Command line executed correctly connection established Incoming ring signal detected service not available Error in command line service not available B-channel(s) in use No response from remote
Digi TransPort® Routers User Guide
145
Using the command-line interface
AT commands
S registers
S (Special) registers are registers in the router for storing certain types of configuration information. They are essentially a legacy feature included to provide compatibility with software that was originally designed to interact with modems. See S register definitions for a list of S registers.
Digi TransPort® Routers User Guide
146
Using the command-line interface
AT commands
atd: Dial a call
The atd command causes the router to initiate an ISDN call. The format of the command depends on the mode of operation. When using the router to make data calls on one of the ISDN B-channels, enter the atd command followed by the telephone number. For example, to dial 01234 567890 enter the command: atd01234567890 Spaces in the number are ignored. If the call is successful the router will issue the CONNECT result code and switch to on-line mode.
Dialing with a specified sub-address
You can use the ATD command to route a call to an ISDN sub-address by following the telephone with the letter S and the required sub-address. The sub-address can be up to 15 digits long. For example: atd01234567890s003
Dialing stored numbers
To dial numbers that have previously been stored within the router using the AT&Z command, insert the S= modifier within the dial string. For example, to dial stored number 3, use the command: atds=3
Combining ISDN and X.25 calls
A further option for the ATD command for X.25 applications is to combine the ISDN call and the subsequent X.25 CALL in the same command. To do this, follow the telephone number with the = symbol and the X.25 call string. For example: atd01234 567890=123456789 Pressing any key while the ATD command is being executed will abort the call attempt.
Digi TransPort® Routers User Guide
147
Using the command-line interface
AT commands
ath: Hang-up
The ath command terminates an ISDN call. If the router is still on-line, you must first switch back to command mode by entering the escape sequence, such as +++, wait 1 second, then enter an AT command or simply at<CR>.
After entering the ath command, the call is disconnected and the NO CARRIER result is issued.
Digi TransPort® Routers User Guide
148
Using the command-line interface
AT commands
atz: Reset
The atz command loads one of the stored profiles for the active ASY port. The command is issued in the format atzn where n is the number (0 or 1) of the ASY port profile you want to load.
Digi TransPort® Routers User Guide
149
Using the command-line interface
AT commands
at&c: Control the DCD signal
The at&c command configures how the router controls the DCD signal to the terminal. Options include:
n &C0 DCD is always On. n &C1 DCD is On only when an ISDN connection has been established (Layer 2 is UP). n &C2 DCD is always Off. n &C3 DCD is normally On, but pulses low for a time in 10 millisecond routers, determined by S
register 10.
Digi TransPort® Routers User Guide
150
Using the command-line interface
AT commands
at&f: Load factory settings
The at&f command loads a predefined default set of S-register and AT command settings (the default profile). These settings are:
E1, V1, &C1, &K1, &D2, S0=0, S2=43
All other values are set to 0.
Digi TransPort® Routers User Guide
151
Using the command-line interface
AT commands
at&r: Control the CTS signal
The at&r command configures how the router controls the CTS signal to the terminal. There are three options:
n &R0 CTS is always On. n &R1 CTS follows RTS. The delay between RTS changing and CTS changing is set in AT register
56 in multiples of 10 milliseconds. n &R2 CTS is always Off.
Digi TransPort® Routers User Guide
152
Using the command-line interface
AT commands
at&v: View profiles
The at&v command displays a list of the current AT command and S register values, and the settings for the two stored profiles. For example: at&v CURRENT PROFILE: &c1 &d2 &k1 &s1 &r0 e1 q0 v1 &y0 S0=0 S2=43 S12=50 S31=3 S45=5 states DTR:1 RTS:1
STORED PROFILE 0: &c1 &d2 &k1 &s1 &r0 e1 q0 v1 S0=0 S2=43 S12=50 S31=3 S45=5
STORED PROFILE 1: &c1 &d2 &k1 &s1 &r0 e1 q0 v1 S0=0 S2=43 S12=50 S31=3 S45=5 OK
Digi TransPort® Routers User Guide
153
Using the command-line interface
AT commands
at&w: Write SREGS.DAT file
The at&w command saves the current command and S registers settings (for the active port), to the file SREGS.DAT. You can reload the settings in this file at any time using the atz command. After the at&w command, you can specify a profile number, either 0 or 1, to store the settings in the specified profile. For example, the following command stores the current settings as profile 1: at&w1 If no profile number is specified, profile 0 is assumed. at&w writes all S register values and the following command settings: e, &c, &d, &k
Digi TransPort® Routers User Guide
154
Using the command-line interface
AT commands
at&y: Select power-up profile
The at&y command selects the power-up profile (0 or 1). For example, to ensure that the router boots up using stored profile 1, enter: at&y1
Digi TransPort® Routers User Guide
155
Using the command-line interface
AT commands
at&z: Store phone number
The at&z command stores "default" telephone numbers within the router that may subsequently dialed when DTR dialing is enabled or by using the S= modifier in the ATD dial command. You can store one telephone number for each ASY port. For example, to store the phone number 0800 123456 as the default number to be associated with ASY 2, enter:
at&z2=0800123456
If the number of the ASY port is not specified, the number is stored according to the port from which the command was entered. For example, entering this command from ASY 3:
at&z=0800123456
Has the same effect as this command being entered from any port:
at&z3=0800123456
Once a number is stored, you can dial it from the command line using the atd command with the S= modifier:
atds=3
This means that you can dial any stored number from any port. If DTR dialing has been is enabled by setting S33=1 for the port, the number associated with that port is dialed when the DTR signal for that port changes from Off to On. This is because you can use DTR dialing with the number associated with the port to which the terminal is connected only.
Digi TransPort® Routers User Guide
156
Using the command-line interface
AT commands
at\at: Ignore invalid AT commands
This command is a work-around for use with terminals that generate large amounts of extraneous text. If not ignored, this text can cause many error messages to be generated by the router, and may result in a communications failure. To turn on this feature, type the following command: at\at=1 To turn off the feature, type the following command: at\at=0 When this feature is turned on, the ASY port ignores all commands except real AT commands. As with other ASY modes this can be saved by at&w but is not included in the at&v status display. To determine whether or not this mode is enabled type: at\at ? The router displays 0 if the feature is off, 1 if it is on.
at\gps command: Send GPS data to ASY port
The at\gps command causes messages from the GPS receiver to be sent directly to the ASY port from which the command has been entered. This requires that the gpson parameter is set to on for one of the command interpreter instances. For more information on the gpson parameter, see Configure GPS parameters. As soon as the at\gps command has been issued, data from the GPS receiver will be sent to that ASY port. To stop the GPS data, the +++ escape sequence must be entered, followed by a pause, followed by at.
Digi TransPort® Routers User Guide
157
Using the command-line interface
AT commands
at\ls: Lock speed
The at\ls command locks the speed and data format of the port at which it is entered to the current settings so that you can use non-AT application commands.
Digi TransPort® Routers User Guide
158
Using the command-line interface
AT commands
at\port: Set the active port for text commands
Text commands which affect the settings associated with the serial ports normally operate on the port at which they are entered, such as entering the at&k command from a terminal connected to ASY 1 will affect only the flow control settings for port 1. The at\port command selects a different "active" port from that at which the commands are entered. For example, if your terminal is connected to port 0 and you need to reconfigure the settings for port 2, you would first enter the command: at\port=2 PORT 2 OK Port 2 is now the active port and any AT commands or changes to S registers settings which affect the serial ports will now be applied to port 2 only. This includes: Commands: Z, &D, &F, &K, &V, &Y, &W S registers: S31, S45 The at\prt? command displays the port to which you are connected and the active port for command/ S register settings. For example: at\port? PORT 2 ASY0 OK Here, ASY2 is the active port and ASY0 is the port at which the command was entered. If the default port and the port to which you are connected are the same, only one entry will be listed. To reset the default port to the one to which you are connected, use the at\port command without a parameter.
Digi TransPort® Routers User Guide
159
Using the command-line interface
AT commands
at\smib commands
The at\smib command allows you to view a single standard MIB variable. For more information on MIBs and SNMP, see Use SNMP for remote management.
To view the MIB variable, use the at\smib=mib_name command, where mib_name is the variable to be displayed. The variables are sorted according to the hierarchy shown below.
Commands for displaying system information
The system hierarchy consists of the following:
at\smib=mib-2.system.sysdescr: Show software version information Shows the software version information; equivalent to what is shown on the ati5 CLI command output.
Digi TransPort® Routers User Guide
160
Using the command-line interface
AT commands
mib-2.system.sysdescr = Software Build Ver5121. Jan 31 2011 12:26:04 9W
at\smib=mib-2.system.sysobjectid: Show network management subsystem identification The authoritative identification of the network management subsystem. TransPort does not support outputting OID variables. Instead, oid is output.
mib-2.system.sysobjectid = oid
at\smib=mib-2.system.sysuptime: Show system uptime Shows the time the router has been running in 10-millisecond units (hundredths of a second).
mib-2.system.sysuptime = 1806718
The above example shows that the router has been running for 5 hours, 1 minute and 7.18 seconds.
at\smib=mib-2.system.syscontact: Show contact information Shows a description of the contact person for the router. For TransPort, this is always a zero-length string.
at\smib=mib-2.system.sysname: Show router name Shows the name of the router. This is the name set in the Router Identity parameter on the Configuration > System > Device Identity page. mib-2.system.sysname = digi.router
at\smib=mib-2.system.syslocation: Show router location Shows the physical location of the router. For TransPort, this is always a zero-length string.
at\smib=mib-2.system.sysservices: Show router network layer services Shows a value that represents the set of services the router provides. For each OSI layer, the router provides services for, 2(L-1) is added to the value, where L is the layer. The layers are shown below. For TransPort, this value is always 7 (Physical layer (21-1)+Data Link layer (22-1)+Network layer (231)).
Layer 1 2 3 4 5 6 7
Functionality Physical Data Link Network Transport Session Presentation Application
Commands for displaying interface information
The Interfaces hierarchy consists of the ifnumber variable and the iftable node:
Digi TransPort® Routers User Guide
161
Using the command-line interface
AT commands
at\smib=mib-2.interfaces.ifnumber: Show total interfaces on the router Shows the total number of interfaces on the router. This includes Ethernet, PPP and virtual interfaces (such as IPSec tunnels) and SYNC ports.
mib-2.interfaces.ifnumber = 52
at\smib=mib-2.interfaces.iftable: Show the interface table Shows the interface table. The iftable node contains ifentry nodes for each interface. For each table entry, an index specifier must be appended to the end of each variable (such as for PPP0, 1 must be appended).
at\smib=mib-2.interfaces.iftable.ifentry
at\smib=mib-2.interfaces.iftable.ifentry.ifindex: Show index number for interface Displays the unique index number of the interface.
at\smib=mib-2.interfaces.iftable.ifentry.ifdescr: Show information about an interface Shows information about the interface. This information is displayed in the format <interface type><instance>, where: <interface type> can be one of PPP, ETH, TUN (for IPSec tunnels), SNAIP (for SNAIP links) or SYNC, and <instance> is the instance. For example:
mib-2.interfaces.iftable.ifentry.ifdescr.1 = PPP-0
at\smib=mib-2.interfaces.iftable.ifentry.iftype: Show interface type Shows the type of interface, as described by the physical/link protocol below the network layer in the protocol stack. Values can be one of the following:
n PPP 23 n ETH 6 n IPSec Tunnel 131 n SNAIP 17 n SYNC port 118
For example:
mib-2.interfaces.iftable.ifentry.iftype.1 = 23
at\smib=mib-2.interfaces.iftable.ifentry.ifmtu: Show size of largest datagram sent over interface Shows the size of the largest datagram (in octets) which can be sent on the interface. SNAIP and SYNC ports always return 0. IPSec tunnel interfaces will return the underlying interface if it can be located, otherwise 0 is returned. PPP interfaces will return the negotiated MTU if the link is connected, otherwise 0 is returned. For example:
mib-2.interfaces.iftable.ifentry.ifmtu.21 = 1504
Digi TransPort® Routers User Guide
162
Using the command-line interface
AT commands
at\smib=mib-2.interfaces.iftable.ifentry.ifspeed: Show interface's current bandwidth Shows an estimate of the interface's current bandwidth in bits per second. SNAIP and SYNC ports will always return 0. PPP ports will always return 64000. For example:
mib-2.interfaces.iftable.ifentry.ifspeed.1 = 64000
at\smib=mib-2.interfaces.iftable.ifentry.ifphysaddress: Show interface address Shows the interface's address at the protocol layer immediately below the network layer in the protocol stack. For interfaces without such an address, a zero-length octet string is returned. For PPP, SNAIP and SYNC ports, a zero-length string is returned.
at\smib=mib-2.interfaces.iftable.ifentry.ifadminstatus: Show administrative state of an interface Shows the desired state of the interface. The testing state (3) indicates no operational packets can be passed.
at\smib=mib-2.interfaces.iftable.ifentry.ifoperstatus: Show operational state of an interface The current operational state of the interface. The testing state (3) indicates no operational packets can be passed.
at\smib=mib-2.interfaces.iftable.ifentry.ifinoctets: Show number of octets on an interface Shows the total number of octets received on this interface, including framing characters.
at\smib=mib-2.interfaces.iftable.ifentry: Show unicast packets delivered by an interface Shows the number of subnetwork-unicast packets delivered by this interface to a higher-layer protocol.
at\smib=mib-2.interfaces.iftable.ifentry.ifinnucastpkts: Show non-unicast packets delivered by an interface Shows the number of non-unicast (such as broadcast or multicast) packets delivered by this interface to a higher-layer protocol.
at\smib=mib-2.interfaces.iftable.ifentry.ifinerrors: Show packets received on an interface containing errors Shows the number of inbound packets received by this interface that contained errors preventing them from being delivered to a higher-level protocol.
at\smib=mib-2.interfaces.iftable.ifentry.ifoutoctets: Show octets transmitted by an interface Show the total number of octets transmitted by this interface, including framing characters.
at\smib=mib-2.interfaces.iftable.ifentry.ifoutucastpkts: Show number of transmitted unicast packets Shows the total number of packets that higher-level protocols requested this interface to transmit to a subnetwork-unicast address, including those that were discarded or not sent.
at\smib=mib-2.interfaces.iftable.ifentry.ifoutnucastpkts: Show number of transmitted nonunicast packets Shows the total number of packets that higher-level protocols requested this interface to transmit to a non-unicast (such as broadcast or multicast) address, including those that were discarded or not
Digi TransPort® Routers User Guide
163
Using the command-line interface
AT commands
sent.
at\smib=mib-2.interfaces.iftable.ifentry.ifouterrors: Show number of outbound packets containing errors Shows the number of outbound packets that this interface could not transmit because of errors.
Commands for displaying IP node information
The IP node consists of the ipforwarding variable and the ipaddrtable and iproutetable nodes.
at\smib=mib-2.ip.ipforwarding: Show whether router is an IP gateway Indicates whether the router is acting as an IP gateway in respect to the forwarding of datagrams received by, but not addressed to, the router. IP gateways forward datagrams, IP hosts do not. For the router, this value is always 1.
at\smib=mib-2.ip.ipaddrtable: Show IP address table Shows the IP address table. The ipaddrtable node contains ipaddrentry nodes for each IP address assigned to each interface of the router. For each table entry, an index specifier must be appended to the end of each variable that specifies the interface (such as for PPP0, 1 must be appended).
at\smib=mib-2.ip.ipaddrtable.ipaddrentry
at\smib=mib-2.ip.ipaddrtable.ipaddrentry.ipadentaddr: Show IP address Shows the IP address to which this entry's addressing information pertains.
at\smib=mib-2.ip.ipaddrtable.ipaddrentry.ipadentifindex: Show index number for an IP address Shows the index identifier for the interface associated with this IP address.
at\smib=mib-2.ip.ipaddrtable.ipaddrentry.ipadentnetmask: Show the subnet mask for an IP address Shows the subnet mask associated with the IP address.
at\smib=mib-2.ip.ipaddrtable.ipaddrentry.ipadentbcastaddr: Show IP broadcast address Shows the value of the least-significant bit in the IP broadcast address for sending datagrams on the IP address of this interface.
at\smib=mib-2.ip.iproutetable: Show IP route table Shows the IP route table. The iproutetable node contains iprouteentry nodes for each route defined on the router.
at\smib=mib-2.ip.iproutetable.iprouteentry
at\smib=mib-2.ip.iproutetable.iprouteentry.iproutedest: Show the destination IP address for the route Shows the destination IP address for the route. An entry with a value of 0.0.0.0 is considered the default route. Multiple routes to a single destination can appear in the routing table, but access to such multiple entries is dependent on the table-access mechanisms defined by the network management protocol in use.
Digi TransPort® Routers User Guide
164
Using the command-line interface
AT commands
at\smib=mib-2.ip.iproutetable.iprouteentry.iprouteifindex: Show index number for next hop of the route Shows the index value which uniquely identifies the local interface through which the next hop of the route should be reached.
at\smib=mib-2.ip.iproutetable.iprouteentry.iproutemetric1: Show the metric for a route Shows the primary routing metric for the route.
at\smib=mib-2.ip.iproutetable.iprouteentry.iproutenexthop: Show the IP address of the next hop of the route Shows the IP address of the next hop of the route.
at\smib=mib-2.ip.iproutetable.iprouteentry.iproutetype: Show route type Shows the type of route. Valid values are:
1. Valid 2. Invalid 3. Direct 4. Indirect
at\smib=mib-2.ip.iproutetable.iprouteentry.iproutemask: Show the netmask for the route Shows the netmask for the route.
Digi TransPort® Routers User Guide
165
Using the command-line interface
AT commands
S register definitions
In addition to the AT commands there are a number of Special ("S") registers. These registers contain numeric values that may represent time intervals, ASCII characters or operational flags.
To display the contents of a particular "S" register, use the ats command in the form atsn? where n is the number of the register for which contents are shown.
To store a new value into a register, use the S command in the form atsn=x where n is the number of the register to be changed and x is the new value. For example, ats31=4 stores the value 4 in S31.
The router maintains one set of registers for each ASY port. By default, the S command operates ONLY on the S register set for the active port. To select an alternative default port, use the at\port command first.
Each register can only be set to a limited range of values as shown in the table below:
Register S0 S1 S2 S9 S10 S12 S15 S16 S23 S31 S33 S45
Description
Units
V.120 Answer enable
Rings
Ring count
Rings
Escape character
ASCII
DCD on delay
ms x 20
Pulse time for DCD Low
ms x 10
Escape delay
ms
Data forwarding timer
ms
RS422/485 serial port settings N/A
Parity
N/A
ASY interface speed
refer to full description
DTR dialing
N/A
DTR loss de-bounce
0.05 seconds
Default 0 n/a 43 0 0 50 2 0 0 n/a 0 (0.25s)
Range 0-255 n/a 0-255 0-255 0-255 0-255 0-255 0, 2, 3 0-2 5 6 0-11 01 1-255
S0: V.120 answer enabled
Units: Rings Default: 0 Range: 0-255
Used in V.120 mode only. Enables or disables automatic answering of incoming ISDN calls. Auto answering is disabled when S0 is set to the default value of 0. Setting S0 to a non-zero value enables auto-answering.
The actual value stored determines the number of "rings" that the router will wait before answering. For example, the command ATS0=2 enables auto-answering after two incoming rings have been detected.
With each ring the RING result code is issued and the value stored in S1 is incremented. When the value in S1 equals the value in S0 the call is answered.
Digi TransPort® Routers User Guide
166
Using the command-line interface
AT commands
S1: Ring count
Units: Rings Default: n/a Range: n/a When ADAPT detects an incoming ISDN call on an ASY port, it will print RING to the ASY port at 2 second intervals. It also increments the S1 register, counting how many times RING is printed.
S2: Escape character
Units: ASCII Default: 43 Range: 0-255 The value stored in S2 defines which ASCII character is the Escape character. By default, the escape character is the + symbol. Entering this character three times followed by a delay of 1-2 seconds and then an AT command causes the router to switch from on-line mode to command mode.
S12: Escape delay
Units: ms Default: 50 Range: 0-255 The value stored in S12 defines the delay between sending the escape sequence and entering an AT command for the router to switch from on-line mode to command mode.
S15: Data forwarding timer
Units: 10ms Default: 0 Range: 0-255 S15 sets the data forwarding timer for the ASY port in multiples of 10ms. The default data forwarding time is 20 milliseconds. Normally, there is no need to change this setting. However, setting S15 to 1 enables a special mode of operation in which data is forwarded as fast as possible for the data rate for which the port is configured (at 115000 bits per second, this will typically be 2-3 milliseconds). Note that the default value of 0 is equivalent to setting the register to 2 to maintain compatibility with older systems.
S16: RS422/485 serial port settings
The RS485 option is only available on specific hardware versions. Units: N/A Default: 0 Range: 0, 2, 3, where 0=RS232, 2=RS485 full duplex, 3=RS485 half duplex Following example shows how to setup and save ASY 0 in 485 half-duplex mode AT\port=0 ATS16=3 AT&w AT\port The at\port=0 is needed to ensure that subsequent AT commands are directed to the right port (ASY0). The port settings can be saved permanently using at&w.
Digi TransPort® Routers User Guide
167
Using the command-line interface
AT commands
Issue the command ats16? and check that the value of this S register is 3. To set it back to RS232 then set ats16 to 0 and save it with the at&w command.
S23 Parity
Units: N/A Default: 0 Range: 0-2,5,6 The value stored in S23 determines whether the parity for the ASY port is set to None (0), Odd (1), Even (2), 8DataOdd (5) or 8DataEven (6).
S31 ASY Interface Speed
Units: N/A Default: 0 Range: 0-11 Register S31 sets the speed and data format for the ASY port to which you are currently connected. The default value for ASY 0 is 0, such as the port speed/data format is not set to a specific value, it is determined automatically from the AT commands that you enter. The default value for ASY 1, 2, and 3 is 3, meaning the ports only accept AT commands at 115,200 bits per second (8 data bits, no parity and 1 stop bit). To set the speed of one of the ports to a particular value, set the appropriate register to the required value from the following table:
S31
Port Speed (bps)
0
Auto-detect
1
Reserved
2
Reserved
3
115200
4
57600
5
38400
S31
Port Speed (bps)
6
19200
7
9600
8
4800
9
2400
10
1200
11
300
For example, to change the speed of ASY 1 to 38,400 bits per second:
1. Connect your terminal to that port with the speed set to 9600 bits per second. 2. Enter the command:
ats31=5
3. Change the speed of your terminal to 38,400 bits per second before entering any more AT commands.
When entering the ats31=n command, the data format selected becomes the data format for all further commands. The auto-detect option is only available for ASY0 and ASY1.
Digi TransPort® Routers User Guide
168
Using the command-line interface
AT commands
S33: DTR dialing
Units: N/A Default: 0 Range: 0, 1 S33 enables or disables DTR dialing for the port. When DTR dialing is enabled, the router dials the number stored for that port (see atz: Reset ) when the DTR signal from the terminal changes from Off to On.
S45: DTR loss de-bounce
Units: 0.05 seconds Default: 5 Range: 1-255 The value in S45 determines the length of time for which the DTR signal from the terminal device must go off before the router acts upon any options that are set to trigger on loss of DTR. Increasing or decreasing the value in S45 makes the router less or more sensitive to "bouncing" of the DTR signal respectively.
Digi TransPort® Routers User Guide
169
Configuring network interfaces
Configure Ethernet interfaces
171
Configure Wi-Fi interfaces
200
Configure mobile (cellular) interfaces
215
Configure DSL interfaces
249
Configure Generic Routing Encapsulation (GRE) interfaces
259
Configure ISDN interfaces
265
Configure PSTN interfaces
285
Configure DialServ interfaces
294
Configure serial interfaces
303
Configure IPv6 addressing support
327
Configure PPP and external modems
349
Digi TransPort® Routers User Guide
170
Configuring network interfaces
Configure Ethernet interfaces
Configure Ethernet interfaces
Web
Go to Configuration > Network > Interfaces >Ethernet. The Configuration > Network > Interfaces > Ethernet page displays configuration pages for each of the available Ethernet instances on the router. Each page allows the user to configure parameters such as the IP address, mask, gateway, and others. On routers with only one Ethernet port, if more than one Ethernet instance exist these are treated as logical Ethernet ports. You can use these instances to assign more than one Ethernet IP address to a router. On routers with more than one physical Ethernet port, the Ethernet instances refer to the different physical Ethernet ports. These routers can be configured for either HUB mode or Port Isolate mode. In HUB mode all the Ethernet ports are linked together and behave like an Ethernet hub or switch. This means that the router will respond to all of its Ethernet IP addresses on all of its ports (as the hub/ switch behavior links the ports together). In Port Isolate mode, the router will only respond to its Ethernet 0 IP address on physical port LAN 0, its Ethernet 1 IP address on physical port LAN 1, etc. The router will not respond to its Ethernet 1 address on port LAN 0 unless routing has been configured appropriately. When configured for HUB mode it is important that no more than one of the router's ports is connected to another hub or switch on the same physical network. Otherwise an Ethernet loop can occur. The default behavior is HUB rather than Port Isolate. VLAN tagging is not available when the router is configured for Port Isolate mode.
IPv6 addressing support on Ethernet interfaces
TransPort routers support IPv6 addressing on Ethernet interfaces only, and on a limited number of Ethernet interfaces. For more information, see Configure IPv6 addressing support.
Digi TransPort® Routers User Guide
171
Configuring network interfaces
Configure Ethernet interfaces
Configure basic Ethernet IP address parameters
Note To configure the Ethernet interface to support IPv6 addressing, see Configure IPv6 addressing support.
Web
1. Go to Configuration > Network > Interfaces >Ethernet> ETH n. The Configuration > Network > Interfaces >Ethernet> ETH n initial view only shows basic IP address parameters. The choice is to obtain an IP address by using a DHCP server or to manually configure the IP addressing for this interface.
2. Configure basic Ethernet IP address settings:
Description Use a memorable name for this Ethernet instance, to make it easier to identify.
Get an IP address automatically using DHCP Enables the DHCP client on this interface. You can elect to override the DHCP server settings for the Mask, Gateway, DNS Server, and Secondary DNS Server.
Use the following settings Enables manual configuration of the IP addressing parameters
IP Address Specifies the IP address of this Ethernet port on your LAN.
Mask The subnet mask of the IP subnet to which the router is attached via this Ethernet port. Typically, this would be 255.255.255.0 for a Class C network.
Gateway The IP address of a gateway the router uses. IP packets whose destination IP addresses are not on the LAN to which the router is connected are forwarded to this gateway.
Digi TransPort® Routers User Guide
172
Configuring network interfaces
Configure Ethernet interfaces
DNS Server / Secondary DNS Server The IP address of DNS servers the router uses for resolving IP hostnames.
Note If the IP address, Mask, Gateway, DNS server or Secondary DNS server parameters are specified manually, but the option to use a DHCP server is later selected, any existing manually specified parameters will override the DHCP supplied parameters. To change from manual configuration to DHCP, be sure to remove all manually specified parameters first.
3. Click Apply.
Command line
Command Instance
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
Parameter descr ipaddr mask gateway dnsserver secdns dhcpcli
ipv6_mode ipv6_wan
ipv6_lan
vrf vrfexport
Values
Equivalent web parameters
Free text field Description
Valid IP address IP Address
Valid Subnet Mask
Mask
IP address
Gateway
IP address
DNS Server
IP address
Secondary DNS Server
on, off
On=Get an IP address automatically using DHCP Off=Use the following IP address
off, wan, lan
Configuration > Network> Interfaces > IPv6 > ???
0, <number of ipv6_wan parameter instances>, 1
Configuration > Network> Interfaces > IPv6 WAN settings
0, <number of ipv6_wan parameter instances>, 1
Configuration > Network> Interfaces > IPv6 WAN settings
integer
VRF
integer
VRFexport
Digi TransPort® Routers User Guide
173
Configuring network interfaces
Configure Ethernet interfaces
Configure advanced Ethernet parameters
On routers with only one Ethernet port, there may be multiple configurable Ethernet instances. Ethernet 0 is the physical interface. These extra instances are treated as logical Ethernet ports. You can use them to assign more than one Ethernet IP address to a router. On routers with more than one physical Ethernet port, the Ethernet instances refer to the different physical Ethernet ports. These routers can be configured for either HUB mode or Port Isolate mode. In HUB mode all the Ethernet ports are linked together and behave like an Ethernet hub or switch. This means that the router will respond to all of its Ethernet IP addresses on all of its ports (as the hub/ switch behavior links the ports together). In Port Isolate mode, the router will only respond to its Ethernet 0 IP address on physical port LAN 0, its Ethernet 1 IP address on physical port LAN 1, etc. The router will not respond to its Ethernet 1 address on port LAN 0 unless routing has been configured appropriately. When configured for HUB mode, no more than one of the router's Ethernet interfaces should be connected to another hub or switch on the same physical network otherwise an Ethernet loop can occur. The default behavior is HUB rather than Port Isolate.
Web
1. Go to Configuration - Network > Interfaces > Ethernet > ETH n > Advanced.
2. Configure the advanced Ethernet settings as needed:
Digi TransPort® Routers User Guide
174
Configuring network interfaces
Configure Ethernet interfaces
Port Isolate mode If the router is running in Port Isolate mode, the following will be displayed, with an option to switch to Hub mode.
Hub Mode (factory default) If the router is running in Hub mode, the following is displayed, with an option to switch to Port Isolate mode.
Ethernet Hub group On routers with a built-in hub/switch, the Ethernet Hub group parameter for each port is normally set to 0. This means that all ports belong to the same hub. If required, you can use the
Digi TransPort® Routers User Guide
175
Configuring network interfaces
Configure Ethernet interfaces
Ethernet Hub group parameter to isolate specific ports to create separate hubs. For example, if Ethernet 0 and Ethernet1 have their Group parameter set to 0 and Ethernet 2 and Ethernet 3 have their Group parameter set to 1, the router is configured as two 2-port hubs instead of one 4-port hub. This means that traffic on physical ports LAN 0 and LAN 1 is not visible to traffic on physical ports LAN 2 and LAN 3 (and vice versa). Group numbers can be 0-3 or use 255 for an interface to be in all groups. This parameter is not available on the web page when the router is configured for Port Isolate mode.
Metric The connected metric of an interface. Changing this value will alter the metric of dynamic routes created automatically for this interface. The default metric of a connected interface is 1. By allowing the interface to have a higher value (lower priority), static routes can take preference to interface-generated dynamic routes. For normal operation, leave this value unchanged.
MTU The Maximum Transmit Unit for the specified interface. The default value is 0, meaning that the MTU will either be 1504 (for routers using a Kendin Ethernet device) or 1500 (for nonKendin devices). The non-zero values must be greater than 128 and not more than the default value. Values must also be multiples of 4 and the router will automatically adjust invalid values entered by the user. For example, if the MTU is set to 1000, the largest IP packet that the router will send is 1000 bytes.
Enable auto-negotiation Allows the router and a connected Ethernet device to auto-negotiate the speed and duplex of the Ethernet connection.
Speed (currently 100Base-T) Select either of the 10Base-T, 100Base-T, or Auto modes. The currently selected mode is shown in brackets after the parameter name. Enabling Auto-negotiation and manually setting the speed allows only the selected speed to be negotiated.
Duplex Select either of Full Duplex, Half Duplex or Auto mode. Enabling Auto-negotiation and manually setting the Duplex will only allow the selected Duplex mode to be negotiated.
Max Rx rate On models with multiple Ethernet interfaces, this parameter specifies a maximum data rate in Kbps that the router receives on this interface. This may be useful in applications where separate Ethernet interfaces are allocated to separate LANs and it is necessary to prioritize traffic from one LAN over another.
Max Tx rate On models with multiple Ethernet interfaces, this parameter specifies a maximum data rate in kbps that the router will transmit on this interface. This may be useful in applications where separate Ethernet interfaces are allocated to separate LANs and it is necessary to prioritize traffic from one LAN over another.
Digi TransPort® Routers User Guide
176
Configuring network interfaces
Configure Ethernet interfaces
TCP transmit buffer size
When set to a non-zero value, this parameter sets the TCP buffer size of transmitted packets in bytes. This is useful for slow / lossy connections such as satellite. Setting this buffer to a low value will prevent the amount of unacknowledged data from getting too high. If retransmits are required, a smaller TX buffer helps prevent the flooding of the connection by retransmits.
Take this interface out of service after n seconds when the link is lost (such as cable removed or broken)
The length of time, in seconds, the router will wait after detecting that an Ethernet cable has been removed before routes that were using that interface are marked as out of service. If the parameter is set to 0, the feature is disabled and routes using the interface will not be marked as out of service if the cable is removed.
Enable NAT on this interface
Selects whether the Ethernet interface uses IP, Network Address Translation (NAT), or Network Address and Port Translation (NAPT). When the parameter is disabled, no NAT occurs. When enabled, extra options are displayed, described below.
NAT and NAPT have many uses, but the router generally uses them to allow a number of private IP hosts (PCs for example) to connect to the Internet through a single shared public IP address. This has two main advantages: it saves on IP address space (the ISP only need assign you one IP address), and it isolates the private IP hosts from the Internet (effectively providing a simple firewall because unsolicited traffic from the Internet cannot be routed directly to the private IP hosts).
To use NAT or NAPT correctly in the example of connecting private hosts to the Internet, NAT or NAPT should be enabled on the router's WAN side interface and should be disabled on the router's LAN side interface.
IP address
When a private IP host sends a UDP or TCP packet to an Internet IP address, the router will change the source address of the packet from the private host IP to the router's public IP address before forwarding the packet onto the Internet host. Additionally it will create an entry in a NAT table containing the private IP source address, the private IP port number, the public IP destination address and the destination port number. Conversely, when the router receives a reply packet back from the public host, it checks the source IP, source port number and destination port number in the NAT table to determine which private host to forward the
Digi TransPort® Routers User Guide
177
Configuring network interfaces
Configure Ethernet interfaces
packet to. Before it forwards the packet back to the private host, it changes the destination IP address of the packet from its public IP address to the IP address of the private host.
IP address and Port This mode behaves like NAT, but in addition to changing the source IP of the packet from the private host, it can also change the source port number. This is required if more than one private host attempts to connect using the same local port number to the same Internet host on the same remote port number. If such a scenario were to occur with NAT, the router would be unable to determine which private host to route the returning packets to, and the connection would fail.
Enable IPsec on this interface Enables or disables IPSec security features for this Ethernet interface.
Use interface x,y for the source IP address of IPsec packets By default, the source IP address for an IPsec Eroute is the IP address of the interface on which IPSec was enabled. By setting this parameter to either PPP or Ethernet and the relevant interface number, the source address IPSec uses matches that of the Ethernet or PPP interface specified.
Enable the firewall on this interface Turns Firewall script processing On or Off for this interface.
Enable DNS inbound blocking Enables or disables blocking DNS requests on the Ethernet interface, to prevent the interface from responding to DNS requests over this interface.
Enable DMNR advertisement from this subnet Enables or disables the subnet defined on the Ethernet interface to be advertised on any defined Dynamic Mobile Network Routing (DMNR) tunnel. DMNR is available on Verizon Wireless Private Networks. DMNR provides direct access to devices on the Local Area Network (LAN) at your company's sites by dynamically advertising locally IP subnets attached to the router's Ethernet interface(s). Contact Verizon Wireless for more details on DMNR and whether your network uses DMNR or is eligible for DMNR. For more information on configuring DMNR, see the Digi document Application Note 53: Configure a Digi TransPort Router to use DMNR (Dynamic Mobile Network Routing), available on www.digi.com.
Remote management access The Remote access options parameter can be set to No restrictions, Disable management, Disable return RST, or Disable management an return RST.
Digi TransPort® Routers User Guide
178
Configuring network interfaces
Configure Ethernet interfaces
n When set to No restrictions, users on this interface can access the router's Telnet, FTP, and web services for the purpose of managing the router.
n When set to Disable management, users on this interface are prevented from managing the router via Telnet, FTP, or the web interface.
n For Disable return RST, whenever a router receives a TCP SYN packet for one of its own IP addresses with the destination port set to an unexpected value, such as a port that the router would normally expect to receive TCP traffic on, it will reply with a TCP RST packet. This is normal behavior. However, the nature of internet traffic is such that whenever an internet connection is established, TCYP SYN packets are to be expected. As the router's PPP inactivity timer is restarted each time the router transmits data (but not when it receives data), the standard response of the router to SYN packets such as transmitting an RST packet, will restart the inactivity timer and prevent the router from disconnecting the link even when there is no genuine traffic. This effect can be prevented by using the appropriate commands and options within the firewall script. However, on Digi 1000 series routers, or where you are not using a firewall, the same result can be achieved by selecting this option, such as when this option is selected the normal behavior of the router in responding to SYN packets with RST packets is disabled. The option will also prevent the router from responding to unsolicited UDP packets with the normal ICMP destination unreachable responses.
n The Disable management & return RST option prevents users from managing the router via the Telnet, FTP, and web interfaces and also disables the transmission of TCP RST packets as above.
Multihome additional consecutive addresses Defines how many additional (consecutive) addresses the Ethernet driver will own. For example, if the IP address of the interface is 10.3.20.40, and Multihome additional consecutive addresses is set to 3, the IP addresses 10.3.20.41, 10.3.20.42, and 10.3.20.43 also belong to the Ethernet interface.
Enable IGMP on this interface Enables or disables the Internet Group Management Protocol for this Ethernet interface.
Enable Bridge on this interface Bridge mode only applies to models with built-in Wi-Fi. If Wi-Fi is enabled, you must enable bridge mode on Eth 0. This creates an Ethernet bridge between the Wi-Fi access point and the
Digi TransPort® Routers User Guide
179
Configuring network interfaces
Configure Ethernet interfaces
physical Ethernet interface.
Generate Heartbeats on this interface
Enabling this option displays the parameters for heartbeat packets. These are UDP packets that can contain status information about the router. You can use them in conjunction with Remote Manager.
Send Heartbeat messages to IP address a.b.c.d every h hrs m mins s seconds For this setting, a.b.c.d specifies the destination IP address for heartbeat packets and h, m and s specifies how often the router will transmit heartbeat packets to the specified destination in (h) Hours, (m) Minutes and (s) Seconds.
Use interface x,y for the source IP address By default, heartbeat packets is sent with the source IP address of the interface on which they were generated. If the heartbeat is required to be sent via an IPSec tunnel, use this parameter to specify the source IP address of the heartbeat packet to ensure the source and destination match the eroute selectors.
Select the transmit interface using the routing table When enabled, the UDP heartbeats chooses the best route from the routing table. If disabled the exit interface will be interface on which the heartbeat is configured.
Include IMSI information in the Heartbeat message When enabled, the heartbeat includes the IMSI of the cellular module.
Include GPS information in the Heartbeat message When enabled and the appropriate GPS hardware is installed, the heartbeat includes the GPS co-ordinates of the router.
Generate Ping packets on this interface Enabling this option displays the parameters for enabling auto-pings to be transmitted from this interface. The interface can monitor these pings. If auto-pings were enabled on and if there is no ping reply, the router takes the interface out of service for a specified amount of time, before allowing use of the interface again. Another option is to enable auto-pings on this interface and let the firewall handle taking the interface out of service in the event of a failure. Both methods are explained in Application Notes on your TransPort product's Product Support page.
Digi TransPort® Routers User Guide
180
Configuring network interfaces
Configure Ethernet interfaces
Send n byte pings to IP host a.b.c.d every h hrs m mins s seconds For this setting, n specifies the payload size of a ping packet when using the auto ping feature. Leaving this parameter blank uses the default value. The address a.b.c.d specifies the destination IP address for auto-ping ICMP echo request. The values h, m and s specifies how often the router transmits Auto-ping packets to the specified destination in (h) Hours, (m) Minutes and (s) Seconds.
Switch to sending pings to IP host a.b.c.d after n failures For this setting, a.b.c.d specifies an alternative destination IP address for the auto-ping ICMP echo request to be sent to, should the main IP address specified in the parameter above fail to respond. This allows the router to double check there is a problem with the connection and not just with the remote device not responding. The value n specifies the number of pings that must fail before the checking the second IP address. The extra IP address check is only enabled if this parameter is set to something other than 0.
Only send Pings when this Ethernet interface is "In Service" If this parameter is enabled, this interface sends ICMP echo requests when it is in service only. The default setting is disabled; ICMP echo requests are sent when the interface is in service and out of service.
Take this interface "Out of Service" after receiving no responses for s seconds The length of time, in seconds, before a route will be designated as being out of service if there has been no response to ANY of the ICMP echo requests during that time period.
Keep this interface out of service for s seconds The length of time, in seconds, for which any routes using this Ethernet interface are held out of service after a ping failure is detected. 3. Click Apply.
Command line
Command Instance
n/a
n/a
n/a
n/a
Parameter ethvlan ethhub
Values n/a n/a
Equivalent web parameter Switch to Port Isolate Mode Switch to Hub Mode
Digi TransPort® Routers User Guide
181
Configuring network interfaces
Configure Ethernet interfaces
Command Instance
eth
n
eth
n
eth
n
eth
n
eth
n
Parameter group metric mtu auton speed
eth
n
duplex
eth
n
eth
n
eth
n
eth
n
eth
n
maxkbps maxtkbps tcptxbuf linkdeact
do_nat
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
ipsec ipsecent
ipsecadd
firewall block_dns dmnr_reg nocfg
Values 0-3,255 1-16 64-1500 0, 1 0, 10, 100
0, 1, 2
value in kbps value in kbps value in bytes 0-86400 0, 1, 2
0, 1 blank, eth, ppp
0-255
0, 1 on, off on, off 0, 1, 2, 3
Equivalent web parameter
Ethernet Hub group
Metric
MTU
Enable auto-negotiation
Speed 0=Auto 10=10-BaseT 100=100-BaseT
Duplex 0=Auto 1=Full 2=Half
Max Rx rate
Max Tx rate
TCP transmit buffer size
Take this interface out of service after n seconds when the link is lost
Enable NAT on this interface 0=Disabled 1=IP address 2=IP address and Port
Enable IPsec on this interface
Use interface x,y for the source IP address of IPsec packets x=Interface type
Use interface x,y for the source IP address of IPsec packets y=interface number
Enable the firewall on this interface
Enable DNS inbound blocking
Enable DMNR advertisement from this subnet
Remote management access 0=No restrictions 1=Disable management 2=Disable return RST 3=Disable management and return RST
Digi TransPort® Routers User Guide
182
Configuring network interfaces
Configure Ethernet interfaces
Command Instance Parameter
eth
n
mhome
eth
n
eth
n
eth
n
igmp bridge heartbeatip
eth
n
hrtbeatint
eth
n
hbipent
eth
n
hbipadd
eth
n
eth
n
hbroute hbimsi
Values 0-255 0, 1 0, 1 IP address 0-86400
blank, eth, ppp
0-255
0, 1 0, 1
Equivalent web parameter
Multihome additional consecutive addresses
Enable IGMP on this interface
Enable Bridge on this interface
Send Heartbeat messages to IP address a.b.c.d every h hrs m mins s seconds
Send Heartbeat messages to IP address a.b.c.d every h hrs m mins s seconds This CLI value is entered in seconds only.
Use interface x,y for the source IP address x=Interface type
Use interface x,y for the source IP address y=interface number
Select the transmit interface using the routing table
Include IMSI information in the Heartbeat message
Digi TransPort® Routers User Guide
183
Configuring network interfaces
Configure Ethernet interfaces
Configure Ethernet Quality of Service (QoS) parameters
Web
1. Go to Configuration > Network > Interfaces >Ethernet> ETH n > QoS. The parameters on the QoS page control the Quality of Service management facility. Each Ethernet interface has an associated QoS instance, where ETH 0 maps to QoS 5, ETH 1 maps to QoS 6 and so on. These QoS instances include ten QoS queues into which packets may be placed when using QoS. Each of these queues must be assigned a queue profile from the twelve available.
2. Enter the QoS parameters as needed:
Enable QoS on this interface When enabled, displays the following QoS configuration parameters:-
Link speed n Kbps Set this setting to the maximum data rate that this PPP link is capable of sustaining. The router uses this setting when calculating whether or not the data rate from a queue can exceed its minimum Kbps setting, as determined by the profile assigned to it and send at a higher rate (up to the maximum Kbps setting).
Queue n Below this column heading is a list of ten queue instances. Each instance is associated with the profile and priority on the same row.
Digi TransPort® Routers User Guide
184
Configuring network interfaces
Configure Ethernet interfaces
Profile n This column contains the profile to be associated with the queue. There are twelve available, 0-11, selected from the drop-down list boxes.
Priority This column contains drop-down menu boxes for assigning a priority to the selected queue. The priorities available are Very High, High, Medium, Low, and Very Low. 3. Click Apply.
Command line
Command Instance
qos
n
qos
n
qos
n
Parameter linkkbps q0prof q0prio
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
q1prof q1prio q2prof q2prio q3prof q3prio q4prof q4prio q5prof q5prio q6prof q6prio q7prof q7prio q8prof q8prio
Values Integer 0-11 0-4 0=Very high 1=High 2=Medium 3=Low 4=Very Low 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4
Equivalent web parameter Link speed n kbps Queue 0 Profile Queue 0 Priority
Queue 1 Profile Queue 1 Priority Queue 2 Profile Queue 2 Priority Queue 3 Profile Queue 3 Priority Queue 4 Profile Queue 4 Priority Queue 5 Profile Queue 5 Priority Queue 6 Profile Queue 6 Priority Queue 7 Profile Queue 7 Priority Queue 8 Profile Queue 8 Priority
Digi TransPort® Routers User Guide
185
Configuring network interfaces
Command Instance
qos
n
qos
n
Parameter q9prof q9prio
Values 0-11 0-4
Configure Ethernet interfaces
Equivalent web parameter Queue 9 Profile Queue 9 Priority
Digi TransPort® Routers User Guide
186
Configuring network interfaces
Configure Ethernet interfaces
Configure Ethernet Virtual Router Redundancy Protocol (VRRP)
VRRP (Virtual Router Redundancy Protocol) allows multiple physical routers to appear as a single gateway for IP communications in order to provide back-up WAN communications in the event that the primary router in the group fails in some way. It works by allowing multiple routers to monitor data on the same IP address. One router is designated as the master of the address and under normal circumstances it will route data as usual. However, the VRRP protocol allows the other routers in the VRRP group to monitor the master and if they detect that it is no longer operating, negotiate with each other to take over the role as owner. The protocol also facilitates the automatic reprioritization of the original owner when it returns to operation.
Web
1. Go to Configuration > Network > Interfaces >Ethernet> ETH n > VRRP.
2. Enter VRRP parameters:
Enable VRRP on this interface Enables VRRP on this interface.
VRRP Group ID The VRRP group ID parameter identifies routers that are configured to operate within the same VRRP group. The default value is 0 which means that VRRP is disabled on this Ethernet interface. The value may be set to a number from 1 to 255 to enable VRRP and include this Ethernet port in the specified VRRP group.
VRRP Priority The priority level of this Ethernet interface within the VRRP group from 0 to 255. 255 is the highest priority and setting the priority to this value would designate this Ethernet interface as the initial master within the group. The value selected for the VRRP priority should reflect the values selected for other routers within the VRRP group, such as no two routers in the group should be initialized with the same value.
Digi TransPort® Routers User Guide
187
Configuring network interfaces
Configure Ethernet interfaces
Boost the priority by n for s seconds after switching to the MASTER state
Increases the VRRP priority by the specified amount for the specified amount of time when the router has become the VRRP group master. This option can be used to provide network stability when the original master cycles between on- and offline, causing repeated VRRP state switches.
Enable VRRP+ Probing
Enables VRRP+ probing on this Ethernet interface. VRRP+ probing allows a secondary router to take over as master under a wider range of activity, by dynamically adjusting the VRRP priority of an interface and if necessary, changing the status of that interface from master to backup or vice-versa. It does this by probing an interface, either by sending an ICMP echo request (PING) or by attempting to open a TCP socket to the specified Probe IP address.
Send p probe to IP address a.b.c.d TCP port n Configures VRRP+ to send a probe packet to the appropriate IP address and TCP port. The TCP port is needed if the probe type is TCP. The routing code determines which interface to use. This allows the router to test other interfaces and adjust the VRRP priority according to the status of that interface. For example, the user may wish to configure probing in such a way that the Digi router WAN interface is tested, and adjust the VRRP priority down if the WAN is not operational. Another example would be to probe the WAN interface of another VRRP router, and adjust the local VRRP priority up if that WAN interface is not operational. When configured to probe in this manner, it is necessary to configure a second Ethernet interface to be on the same subnet as the VRRP interface. This is because you cannot use the VRRP interface when it is in backup mode. The probes should be sent on this second interface. The second interface has the other VRRP router as its gateway. Configure the routing table to direct packets for the probe address to the desired interface.
every n seconds when in Backup state The interval between successive probe attempts when the interface is in Backup state.
every n seconds when in Master state The interval between successive probe attempts when the interface is in Master state.
Adjust priority n dir after x probe failures Controls by how much and in which direction the VRRP priority is adjusted when the specified number of probes have failed.
Digi TransPort® Routers User Guide
188
Configuring network interfaces
Configure Ethernet interfaces
Reset probe failure count after n probe successes The number of consecutive successful probes required before the current failure count is reset to 0.
Use interface x,y over which to send probe Overrides the routing code and forces the probe packets to be sent out of a specific interface.
Get the source IP address from interface x,y Enables probe packets having the source IP address from a specific interface, rather than the interface over which it is being transmitted. 3. Click Apply.
Command line
Command Instance Parameter
eth
n
vrrpid
eth
n
vrrpprio
eth
n
vboostprio
eth
n
vboostsecs
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
eth
n
vprobemode vprobeip vprobeport vprobebackint vprobemastint vprobeadj vprobeadjup vprobefailcnt
Values 0-255 0-255 0-255
Integer
off, TCP, ICMP IP Address 0-65535 0-32767 0-32767 0-255 0=down 1=up 0-255
Equivalent web parameter
VRRP Group ID
VRRP Priority
Boost the priority by n for s seconds after switching to the MASTER state
Boost the priority by n for s seconds after switching to the MASTER state
Send p probe to IP address a.b.c.d TCP port n
Send p probe to IP address a.b.c.d TCP port n
Send p probe to IP address a.b.c.d TCP port n
every n seconds when in Backup state
every n seconds when in Master state
Adjust priority n dir after x probe failures
Adjust priority n dir after x probe failures
Adjust priority n dir after x probe failures
Digi TransPort® Routers User Guide
189
Configuring network interfaces
Command Instance Parameter
eth
n
vprobesuccesscnt
eth
n
vprobeent
eth
n
vprobeadd
eth
n
vprobeipent
eth
n
vprobeipadd
Configure Ethernet interfaces
Values
Equivalent web parameter
0-255
Reset probe failure count after n probe successes
Auto, ETH, PPP Use interface x,y over which to send probe
Integer
Use interface x,y over which to send probe
Auto, ETH, PPP Get the source IP address from interface x,y
Integer
Get the source IP address from interface x,y
Digi TransPort® Routers User Guide
190
Configuring network interfaces
Configure Ethernet interfaces
Configure logical Ethernet interfaces
Logical Ethernet interfaces are virtual Ethernet interfaces. Logical Ethernet interfaces assign extra IP addresses to the router on the same or an alternate subnet using the same physical Ethernet connection. You can use Logical Ethernet interfaces as a bridging feature, for example, in a Wi-Fi configuration, where it is desirable to not use a physical interface for the bridging. You can configure them similarly to standard Ethernet interfaces, except for the Speed and Duplex settings, which require a physical interface.
Web
1. Go to Configuration > Network > Interfaces >Ethernet> Logical Ethernet Interfaces.
2. Configure the Ethernet settings as needed. For parameter descriptions, see Configure basic Ethernet IP address parameters, Configure advanced Ethernet parameters, Configure Quality of Service (QoS), and Configure Ethernet Virtual Router Redundancy Protocol (VRRP).
3. Click Apply.
Command line
Use the eth and qos commands to configure logical Ethernet interfaces, as documented in the Command line sections of these topics: Configure basic Ethernet IP address parameters, Configure advanced Ethernet parameters, Configure Quality of Service (QoS), and Configure Ethernet Virtual Router Redundancy Protocol (VRRP).
Digi TransPort® Routers User Guide
191
Configuring network interfaces
Configure Ethernet interfaces
Configure which Ethernet devices can send packets to the router (MAC filtering)
Ethernet MAC filtering restricts which Ethernet devices can send packets to the router. If MAC filtering is enabled on an Ethernet interface, only Ethernet packets with a source MAC address that is configured in the MAC Filter table will be allowed. If the source MAC address is not in the MAC Filter table, the packet will dropped.
Web
1. Go to Configuration > Network > Interfaces >Ethernet> MAC Filtering. 2. Configure MAC filtering settings:
Enable MAC filtering on Ethernet interfaces Enables MAC filtering on a specific Ethernet interface.
MAC Address The Ethernet source MAC address to allow. It is possible to allow a range of MAC addresses by configuring only the significant part of the MAC address. such as 00:04:2d will allow all Ethernet packets with a source MAC address starting with 00:04:2d.
3. Click Apply.
Digi TransPort® Routers User Guide
192
Configuring network interfaces
Command line
Command Instance Parameter
eth
n
macfilt
macfilt n
mac
Configure Ethernet interfaces
Values
Equivalent web parameter
on, off
Enable MAC filtering on Ethernet interfaces
MAC address with no separators. Partial MAC address are allowed.
MAC Address
Digi TransPort® Routers User Guide
193
Configuring network interfaces
Configure Ethernet interfaces
Configure an Ethernet bridge between two networks (MAC bridging)
The Ethernet MAC bridge function creates an Ethernet bridge between two physically separate Ethernet networks. It is possible to allow bridging over DSL, W-Wan, ISDN and PSTN connections but note that the only restriction on the traffic sent across the link is done via MAC address filtering and that all Ethernet traffic will be bridged, no firewall restrictions are applied to this traffic. Once the bridge has been configured, the MAC addresses to bridge need to be configured in the MAC bridge table.
Web
1. Go to Configuration > Network > Interfaces >Ethernet> MAC Filtering.
2. Configure MAC bridging settings:
Enable Enables MAC bridging on the Ethernet interface.
Forward to Host The IP address of the remote router to which the Ethernet packets will be bridged.
Port The TCP port that the remote router is listening on.
Listen on Port The TCP port that the router will listen on for incoming bridged packet from the remote router.
MAC Address The Ethernet destination MAC address of packets to be bridged. It is possible to allow a range of MAC addresses by configuring only the significant part of the MAC address. such as 00042d will allow all Ethernet packets with a source MAC address starting with 00:04:2d. 3. Click Apply.
Digi TransPort® Routers User Guide
194
Configuring network interfaces
Configure Ethernet interfaces
Command line
Command eth eth eth bridgemac
Instance n n n n
Parameter srcbhost srchport srcblistenport mac
Values
IP Address
0-65535
0-65535
MAC address with no separators. Partial MAC address are allowed.
Equivalent web parameter Forward to IP address Port Listen on Port MAC Address
Digi TransPort® Routers User Guide
195
Configuring network interfaces
Configure Ethernet interfaces
Configure Rapid Spanning Tree Protocol (RSTP)
Note RSTP support is available on the WR44 family of devices only. It is not available on WR11, WR21, WR31, or WR41 devices.
The Rapid Spanning Tree Protocol (RSTP) is a Layer 2 protocol which ensures a loop free topology on a switched or bridged LAN while allowing redundant physical links between switches. When enabled, the TransPort device uses RSTP but this is backwards compatible with STP. If the router is in Port Isolate mode, RSTP is not enabled. If an Ethernet interface is configured with a hub group, RSTP is disabled on that interface.
Web
Enable RSTP Enables RSTP on the router.
Priority The RSTP priority.
Group The RSTP group that the router is in.
Command line
Command stp stp stp stp
Instance 0 0 0 0
Parameter enable prio group debug
Values on, off 0-65535 0, 1
Equivalent web parameter Enable RSTP Priority Group Not available on the web interface.
View port status
To view the status of RSTP/STP on a router's Ethernet ports, use the following commands:
stp show Port 0, Designated, Forwarding ctrl2:0x6 Port 1, Backup, Discarding ctrl2:0x1 Port 2, Backup, Discarding ctrl2:0x1 Port 3, Disabled, Discarding ctrl2:0x1
The port roles are:
Digi TransPort® Routers User Guide
196
Configuring network interfaces
Configure Ethernet interfaces
Role
Description
Disabled There is nothing physically connected to this Ethernet port.
Root
A forwarding port that has been elected for the spanning-tree topology, towards the
root bridge.
Designated A forwarding port for every LAN segment, away from the root bridge.
Alternate An alternate path to the root bridge. This path is different than using the root port.
Backup
A backup/redundant path to a segment where another bridge port already connects.
The STP port states are:
State
Description
Disabled The port is not functioning and cannot send or receive data.
Listening
The port is sending and receiving BPDUs and participates in the election process of the root bridge. Ethernet frames are discarded.
Learning
The port does not yet forward frames, but learns source addresses from frames received and adds them to the MAC address table.
Forwarding The port receiving and sending data, normal operation. STP still monitors incoming BPDUs that would indicate it should return to the blocking state to prevent a loop.
Locking
A port that would cause a switching loop, no user data is sent or received but it may go into forwarding mode if the other links in use were to fail and the spanning tree algorithm determines the port may transition to the forwarding state. BPDU data is still received in blocking state.
The RSTP port states are:
Role
Description
Learning
The port does not yet forward frames but it does learn source addresses from frames received and adds them to the MAC address table. The port processes BPDUs.
Forwarding The port receiving and sending data, normal operation. STP still monitors incoming BPDUs that would indicate it should return to the blocking state to prevent a loop.
Discarding
A port that would cause a switching loop, no user data is sent or received but it may go into forwarding mode if the other links in use were to fail and the spanning tree algorithm determines the port may transition to the forwarding state. BPDU data is still received in blocking state.
Digi TransPort® Routers User Guide
197
Configuring network interfaces
Configure Ethernet interfaces
Configure Virtual LAN (VLAN) support
Virtual LANs (VLANs) allow splitting a single physical LAN into separate Virtual LANs. This is useful for security reasons, and also helps cut down on broadcast traffic on the LAN.
Web
1. Go to Configuration > Network > Interfaces >Ethernet> VLANs.
2. Configure virtual LAN settings:
Enable VLAN support on Ethernet interfaces This parameter enables VLAN support on the Ethernet interface.
VLAN ID The ID of the Virtual LAN. The TCP header uses the VLAN ID to identify the destination VLAN for the packet.
Ethernet Interface
The Ethernet port that tags the outgoing packets. Packets sent from this interface have VLAN tagging applied.
Digi TransPort® Routers User Guide
198
Configuring network interfaces
Configure Ethernet interfaces
IP Address The destination IP address. This parameter is optional. If configured, only packets destined for this IP address have VLAN tagging applied.
Mask The destination IP subnet mask. This parameter is optional. If configured, only packets destined for this IP subnet mask have VLAN tagging applied.
Source IP Address The source IP address. This parameter is optional. If configured, only packets from this IP address have VLAN tagging applied.
Source Mask The source IP subnet mask. This parameter is optional. If configured, only packets from this IP subnet mask have VLAN tagging applied. 3. Click Apply.
Command line
Command eth
Instance n
Parameter vlan
vlan
n
vlan
n
vlan
n
vlan
n
vlan
n
vlan
n
vlanid ethctx ipaddr mask srcipaddr srcmask
Values on, off
0-4095 Integer IP Address IP Mask IP Address IP Mask
Equivalent web parameter Enable VLAN support on Ethernet interfaces VLAN ID Ethernet Interface IP Address Mask Source IP Address Source Mask
Digi TransPort® Routers User Guide
199
Configuring network interfaces
Configure Wi-Fi interfaces
Configure Wi-Fi interfaces
The Configuration > Network > Interfaces > Wi-Fi section of the web interface that contains the configuration options required to configure and enable the Wi-Fi features.
Digi TransPort® Routers User Guide
200
Configuring network interfaces
Configure Wi-Fi interfaces
Configure global Wi-Fi settings
Because of national restrictions on the channels available for use, the correct country should be selected from the drop down list to restrict the channels that are legal to use by the router. If required, a specific channel can be selected to override the auto selection. The Antenna setting is not available on some but not all TransPort WR routers.
Web
1. Go to Configuration > Network > Interfaces > Wi-Fi > Global Wi-Fi Settings.
2. Configure global Wi-Fi settings:
Country Selecting a country from the drop down list restricts the channels that the router will use. See for more info on licensed channels.
Network Mode Select your chosen mode of operation from the drop down list. The available options vary by router, and some operation modes may not be available on some models.
Channel Selecting Auto allows the router to scan for a free channel within the range of legal channels for the selected country. It is possible to manually select a specific channel to use, but make sure the selected channel is legal to use in the country. 3. Click Apply.
Digi TransPort® Routers User Guide
201
Configuring network interfaces
Configure Wi-Fi interfaces
Command line
Command Instance
wifi
0
wifi
0
wifi
0
wifi
0
wifi
0
Parameter country chanmode channel
nocfg
antenna
Values
Equivalent web parameter
Country name
Country
a, an, anac, bg, bgn Network Mode
auto, 1-14, 36, 40, 44, Channel 48, 56, 60, 64, 149, 153, 155, 157, 161, 165
0 - No restrictions 1 - Disable management 2 - Disable return RST 3 - Disable management and return RST
Remote Management access
0 - Auto 1 - Primary 2 - Secondary
Antenna
Restricting Wi-Fi channels by country
The web interface Country setting and CLI wifi country parameter allow specifying a country name to restrict the number of channels the router uses according to the channels supported in a particular country. Following is a list of the countries that are currently supported:
Digi TransPort® Routers User Guide
202
Configuring network interfaces
Configure Wi-Fi interfaces
Albania Algeria Argentina Armenia Australia Austria Azerbaijan Bahrain Belarus Belgium Belize Bolivia Brazil Brunei Bulgaria Canada Chile China Colombia Costa Rica Croatia Cyprus Czech Republic Denmark Dominican Republic Ecuador Egypt El Salvador Estonia Faroe Islands Finland France Georgia Germany Greece
Guatemala Honduras Hong Kong Hungary Iceland India Indonesia Iran Iraq Ireland Israel Italy Jamaica Japan Jordan Kazakhstan Kenya North Korea South Korea Kuwait Latvia Lebanon Libya Liechtenstein Lithuania Luxembourg Macau Macedonia Malaysia Mexico Monaco Morocco Netherlands New Zealand Nicaragua Norway
Oman Pakistan Panama Paraguay Peru Philippines Poland Portugal Puerto Rico Qatar Romania Russia Saudi Arabia Singapore Slovak Republic Slovenia South Africa Spain Sweden Switzerland Syria Taiwan Thailand Trinidad and Tobago Tunisia Turkey U.A.E. Ukraine United Kingdom United States Uruguay Uzbekistan Venezuela Vietnam Yemen Zimbabwe
Licensed channels when channel number is set to Auto
When the channel number is Auto, the licensed channels the router uses are:
Region EMEA (excluding France) France Americas (excluding Mexico) Mexico Israel China Japan
2.4 GHz channels 1-13 10-13 1-11 1-8 Indoor, 9-11 outdoor 3-9 1-11 1-14
5 GHz channels 36, 40, 44, 48 36, 40, 44, 48 36, 40, 44, 48, 149, 153, 157, 161, 165 36, 40, 44, 48, 149, 153, 157, 161, 165 36, 40, 44, 48, 149, 153, 157, 161, 165 149, 153, 157, 161, 165 36, 40, 44, 48
Digi TransPort® Routers User Guide
203
Configuring network interfaces Note It is illegal to use restricted channels in certain countries.
Configure Wi-Fi interfaces
Digi TransPort® Routers User Guide
204
Configuring network interfaces
Configure Wi-Fi interfaces
Configure advanced global Wi-Fi settings
The Advanced Global Wi-Fi settings control the behavior of the protocols used in Wi-Fi communications at a more detailed level.
Web
1. Go to Configuration > Network > Interfaces > Wi-Fi > Global Wi-Fi Settings > Advanced. 2. Configure advanced global Wi-Fi settings as needed:
EAP Timeout An inactivity timeout during enterprise mode authentication. This parameter is used when the device is configured as an Access Point.
EAP Identity Request Timeout When the device is configured as an Access Point, this parameter sets the time the device waits after sending an ID request to the Wi-Fi client.
Noise floor offset This parameter applies to TransPort WR44v2 models with a Wi-Fi a/b/g/n module only. Normally, users do not need to change this parameter. An offset, specified in dBm, that is added to the noise floor calculated by the Wi-Fi module and used in clear-channel assessment when frames are transmitted, and in determining the signal strength of clients. Using this parameter can address problems in noisy environments where the Wi-Fi module may calculate the noise floor as too low, which can result in a breakdown in Wi-Fi communications. Note, however, that a higher noise floor offset value can result in decreased sensitivity (range).
CAUTION! Changing this value from its default of 0 dBm can severely impact device performance. Change this setting only under the direction of Digi Technical Support.
3. Click Apply.
Command line
Command Instance
wifi
0
wifi
0
wifi
0
Parameter
Values
eapto
<seconds>; default is 30 seconds
eapidreqto
<seconds>; default is 30 seconds
noise_floor_offset <integer value>
Equivalent web parameter EAP Timeout
EAP Identity Request Timeout
Noise floor offset
Digi TransPort® Routers User Guide
205
Configuring network interfaces
Configure Wi-Fi interfaces
Configure a Wi-Fi node as a hotspot
The Wi-Fi Hotspot settings apply to using any Wi-Fi node as a hotspot.
Web
1. Go to Configuration > Network > Interfaces > Wi-Fi > Global Wi-Fi Settings > Wi-Fi Hotspot.
2. Configure Wi-Fi hotspot settings:
Enable Wi-Fi Hotspot on Enables or disables Wi-Fi Hotspot support on a particular Wi-Fi node.
Splashscreen filename Selects an ASP web file that will be presented to the client's internet browser when they connect for the first time.
Each client can connect for h hrs m mins The amount of time that a Wi-Fi client can use the Wi-Fi hotspot before having to reauthenticate.
Require Wi-Fi client authentication If enabled, specifies that Wi-Fi hotspot authentication is required for Wi-Fi clients. You can then select the RADIUS configuration to use.
Hotspot Exceptions It is possible to configure a number of web locations for which authentication is not required. These settings allow the splashscreen to access these locations in order to display them to the client when authenticating. 3. Click Apply.
Command line
Command Instance
wifinode n
wifi
0
wifi
0
wifi
0
wifi
0
hshosts n
Parameter hotspot hotspot_fname hotspot_lifetime
hotspot_auth hotspot_ radiuscfg host
Values on, off Filename Integer
on, off 0, 1
Hostname
Equivalent web parameter Enable Wi-Fi Hotspot on Splashscreen filename Each client can connect for h hrs m mins.The CLI value is entered in seconds only. Require Wi-Fi client authentication Use RADIUS instance
Hotspot Exceptions
Digi TransPort® Routers User Guide
206
Configuring network interfaces
Configure Wi-Fi interfaces
Configure Wi-Fi filtering
You can restrict access to the router via Wi-Fi. When the filtering is enabled, only MAC addresses configured in the table will be allowed to connect to the router.
Web
1. Go to Configuration > Network > Interfaces > Wi-Fi > Global Wi-Fi Settings > Wi-Fi Filtering.
2. Configure Wi-Fi filtering settings:
Enable Wi-Fi filtering Enable Wi-Fi filtering so that only clients who have their Wi-Fi MAC address configured in the MAC address table will be allowed to connect.
MAC Address MAC addresses of Wi-Fi client that you wish to allow access to. A valid MAC address has the format: 11:22:33:44:55:66. When entering this parameter, omit the : separators. For example, 112233445566.
Note Carefully review settings before applying changes. Incorrect settings can make the TransPort device inaccessible from the Wi-Fi network.
3. Click Apply.
Command line
Command Instance
wifinode n
wifi
0
Parameter macfilter mac
Values
Equivalent web parameter
on, off
Enable Wi-Fi filtering
MAC address MAC Address with no separators, such as 112233445566
Digi TransPort® Routers User Guide
207
Configuring network interfaces
Configure Wi-Fi interfaces
Configure a Wi-Fi node
When a Wi-Fi interface is configured to be an Access Point, an SSID must be configured for a Wi-Fi interface to operate. To forward packets to and from a Wi-Fi interface, the Wi-Fi interface must be bridged to a configured Ethernet interface. The Wi-Fi interface and Ethernet interface must be in the same Bridge instance. If a DHCP server is required to run on the Wi-Fi interface, the DHCP server instance corresponding bridged Ethernet interface should be configured. In some cases, it may be necessary to bridge multiple Ethernet instances to a single Wi-Fi instance. If this is required, only one Ethernet instance should be configured.
Web
1. Go to Configuration > Network > Interfaces > Wi-Fi > Wi-Fi Node n. 2. Configure the Wi-Fi node settings:
Enable this Wi-Fi interface
Enables or disables the Wi-Fi interface.
Description
A descriptive name for the Wi-Fi interface to make it easier to identify.
SSID
When the Wi-Fi interface is configured to be an Access Point, this is the SSID that is advertised to the Wi-Fi clients. When the Wi-Fi interface is configured to be a Client, this is the SSID of the Access Point to which you wish to connect.
Mode
The Wi-Fi interface can run in various modes. The options are: n Access Point n Client
Rogue Detection (Scan for unauthorised Access Points)
This Wi-Fi interface is a member of Bridge instance n and therefore bridged to the following interfaces. The options are:
n Access Point. When the Wi-Fi interface is configured to be an Access Point, to forward packets to and from the Wi-Fi interface, it must be bridged with an Ethernet interface using a Bridge instance.
n Client
Interface
Interfaces that are currently members of the selected Bridge instance. Note that multiple Wi-Fi interfaces can be members of the same Bridge instance.
Digi TransPort® Routers User Guide
208
Configuring network interfaces
Configure Wi-Fi interfaces
Link this Wi-Fi client interface with Ethernet n
When the Wi-Fi interface is configured to be a client, it must be bridged to a particular Ethernet interface.
This Wi-Fi rogue scanner will use Ethernet n
When the Wi-Fi interface is configured to be a rogue scanner, it uses the selected Ethernet interface.
Hide SSID
When enabled, the SSID is not included in the beacon messages transmitted by the Wi-Fi interface when in Access Point mode. This means that Wi-Fi clients cannot auto-detect the Access Point.
Enable station isolation
When enabled, connected Wi-Fi clients cannot communicate with other Wi-Fi clients or Ethernet hosts connected to this Access Point.
Click here to assign a timeband to this interface
You can optionally assign a time band to the Wi-Fi interface. Time bands determine periods of time during which the router allows activating PPP or Wi-Fi interfaces or prevents them from activating. The Configuration > Network > Timebands page opens with a list of interfaces. Go to the Wi-Fi interface list and enable time bands as desired. See Configure a time band for more information. 3. In the Security section, configure Wi-Fi security for the node: If you are using multiple Wi-Fi interfaces at the same time, the interfaces must use the same security settings, except for the pre-shared key (PSK). The only alternative is to use Wi-Fi with no security.
Use the following security on this Wi-Fi interface
Selects the security on this Wi-Fi interface. The options are: n None n WEP n WPA-Personal n WPA2-Personal n WPA-Enterprise n WPA2-Enterprise
WEP Settings
The various WEP security settings for both Access Point and Client modes.
WEP Key size
The WEP key size to use.
Digi TransPort® Routers User Guide
209
Configuring network interfaces
Configure Wi-Fi interfaces
WEP Key index
The WEP key index number. This needs to match the index selected on the connecting Wi-Fi clients or Access Points that this router wishes to connect to.
WEP Key / Confirm WEP Key
If the WEP key size is 64 bits, the key should be 5 characters long. If the WEP key size is 128 bits, the key should be 13 characters long.
WPA-PSK / WPA2-PSK
The various WPA-PSK / WPA2-PSK security settings for both Access Point and Client modes.
WPA Encryption
The encryption algorithm to use. The options are: n TKIP n AES (CCMP)
WPA pre-shared key / Confirm WPA pre-shared key
The pre-shared key (PSK) to use. It must be between 8 and 63 characters long.
WPA-RADIUS / WPA2-RADIUS
The various WPA-RADIUS / WPA2- RADIUS security settings for both Access Point and Client modes.
WPA Encryption
The encryption algorithm to use. The options are: n TKIP n AES (CCMP)
RADIUS NAS ID
The NAS ID of the RADIUS server.
RADIUS Server IP Address
The IP address of the RADIUS server
RADIUS Server Password / Confirm RADIUS Server Password
The password of the RADIUS server.
Digi TransPort® Routers User Guide
210
Configuring network interfaces
Configure Wi-Fi interfaces
4. To connect the Wi-Fi node to an existing Wi-Fi Access Point, click Network Scanning and click Perform Network Scan. The router scans the local airwaves for any Access Points that are present, and lists the results in a table:
Click Connect to connect to one of the Access Points. 5. Click Apply.
Command line
Basic Wi-Fi node settings
Command wifinode wifinode wifinode
wifinode
wifinode
eth eth
eth
wifinode wifinode wifinode wifinode
Instance 0 0 0
0
o
n n
n
0 0 n n
Parameter
Values
Equivalent web parameter
enabled
on, off
Enable this Wi-Fi interface
descr
String
Description
ssid
String up to 32 SSID
characters
mode
ap, client, rogue
Mode
bridge_inst
0-3
This Wi-Fi interface is a member of Bridge instance n and therefore bridged to the following interfaces
bridge_inst
0-3
Interface
wificli
on, off
Link this Wi-Fi client interface with Ethernet n
wificli_add
Integer
Link this Wi-Fi client interface with Ethernet n
broadcastssid on, off
Hide SSID
isolation
on, off
Enable station isolation
roam_threshold RSSI value
None; command-line only
roam_timeout Seconds
None; command-line only
Digi TransPort® Routers User Guide
211
Configuring network interfaces
Configure Wi-Fi interfaces
Note The roam_threshold and roam_timeout parameters can impact monitoring. If roam_threshold and roam_timeout are both non-zero, and the Wi-Fi node is configured in client mode, monitoring of the signal strength of the link to the currently associated Access Point starts as soon as the client has successfully connected to that Access Point. Signal strength monitoring stops at any time the client disconnects from the Access Point. If the RSSI of frames received from the Access Point stays below the roam_threshold for roam_timeout consecutive seconds, monitoring stops and the client starts scanning for Access Points.
Wi-Fi node security settings
Command wifinode
wifinode
wifinode wifinode wifinode wifinode radcli radcli radcli
Instance 0
0
0 0 0 0 n* n* n*
Parameter security
weptype
wepkeylen wepkeyindex wpatype sharedkey nasid server password
Values
none wep wpapsk wpa2psk wparadius wpa2radius
open, sharedkey
64, 128
1-4
tkip, aes
text
String
IP Address
String
Equivalent web parameter Use the following security on this Wi-Fi interface
Not available on the WEB.
WEP Key size WEP Key index WPA Encryption WEP Key/WPA pre-shared key RADIUS NAS ID RADIUS Server IP Address RADIUS Server Password
* The Wi-Fi interfaces each use a fixed RADIUS client. For example:
n Wi-Fi 0 uses radcli 1 n Wi-Fi 1 uses radcli 2 n Wi-Fi 2 uses radcli 3, and so on.
The following table details the authentication and encryption algorithms and the CLI commands needed to configure them.
Network Authentication Open Shared
Data Encryption Disabled Disabled
CLI Commands wifinode 0 security none Not supported
Digi TransPort® Routers User Guide
212
Configuring network interfaces Network Authentication Open
Shared
WPA WPA2 WPA-PSK WPA2-PSK WPA WPA2 WPA-PSK WPA2-PSK
Data Encryption WEP
WEP
TKIP TKIP TKIP TKIP AES AES AES AES
Configure Wi-Fi interfaces
CLI Commands
wifinode 0 security wep wifinode 0 weptype open wifinode 0 wepkeylen <64 | 128> wifinode 0 wepkeyindex <1..4> wifinode 0 sharedkey <5 or 13 char key>
wifinode 0 security wep wifinode 0 weptype sharedkey wifinode 0 wepkeylen <64 | 128> wifinode 0 wepkeyindex <1..4> wifinode 0 sharedkey <5 or 13 char key>
wifinode 0 security wparadius wifinode 0 wpatype tkip wifinode 0 radiuscfg 1
wifinode 0 security wpa2radius wifinode 0 wpatype tkip wifinode 0 radiuscfg 1
wifinode 0 security wpapsk wifinode 0 wpatype tkip wifinode 0 sharedkey <8..63 char key>
wifinode 0 security wpa2psk wifinode 0 wpatype tkip wifinode 0 sharedkey <8..63 char key>
wifinode 0 security wparadius wifinode 0 wpatype aes wifinode 0 radiuscfg 1
wifinode 0 security wpa2radius wifinode 0 wpatype aes wifinode 0 radiuscfg 1
wifinode 0 security wpapsk wifinode 0 wpatype aes wifinode 0 sharedkey <8..63 char key>
wifinode 0 security wpa2psk wifinode 0 wpatype aes wifinode 0 sharedkey <8..63 char key>
Digi TransPort® Routers User Guide
213
Configuring network interfaces
Configure Wi-Fi interfaces
Perform a rogue scan
Wi-Fi-equipped TransPort routers can perform a rogue scan to scan the Wi-Fi channels and will which Wi-Fi Access Points it detects. You can use rogue scans to detect unauthorized Access Points that might be trying to get unsuspecting Wi-Fi clients to connect them. When the router detects an authorized Access Point, the router creates an event log entry. In addition, you can configure triggering an alarm notification, such as email, SMS message, or SNMP trap. From the rogue scan results, you can save a list a list of the MAC addresses of the authorized Access Points that will not be reported when detected.
Web
1. Go to Configuration > Network > Interfaces > Wi-Fi > Rogue Scan.
2. In the MAC Address field, enter The MAC address of an authorized Access Point 3. Click Add to add the authorized Access Point to the list of authorized Access Points. 4. Click Perform Rogue Scan. The router scans the Wi-Fi channels to detect unauthorized Access
Points. 5. Click Apply.
Command line
Command Instance Parameter Values
macrogue n
mac
MAC address with no separators, for
example 112233445566
Equivalent web parameter
MAC Address
Digi TransPort® Routers User Guide
214
Configuring network interfaces
Configure mobile (cellular) interfaces
Configure mobile (cellular) interfaces
Configuration parameters required from your mobile network
Before attempting to connect to a wireless service, you must set several parameters specific to your mobile network operator. Have the following information on hand:
n The assigned APN (Access Point Name), unless the router is configured to select the APN automatically. For more information about automatic APN selecton, see Automatic APN configuration.
n PIN Number for your SIM card (if any) n Username and password (if any)
Digi TransPort® Routers User Guide
215
Configuring network interfaces
Configure mobile (cellular) interfaces
Supported cellular modules in Digi TransPort products
For the TransPort product family, Digi continues to add support for cellular modules as vendors make updates and improvements to support the latest chipsets and cellular technology. Digi provides the following support and testing for cellular modules:
n Full support for cellular modules currently shipping in Digi products. Digi verifies that these modules are running the latest module firmware, that this latest firmware is compatible and functions properly.
n Partial support for cellular modules that have shipped in Digi TransPort products previously but are no longer actively supported by the module vendor. Firmware testing no longer includes these modules, however every attempt is made to maintain support as features and improvements are implemented. Any issues with these modules that arise are verified, scoped, and either scheduled to be fixed or a newer, supported module offered as an upgrade option.
n Limited support for cellular modules that have never shipped in Digi TransPort products, and have never been part of firmware testing and verification efforts. These modules may be similar to fully- or partially-supported modules by the same vendor and may even have been informally tested and shown to work in Digi products. Any operational and performance issues with these modules are evaluated and scoped to be fixed on a business case basis.
For the current list of cellular modules for which Digi provides full, partial, and limited support, see the Release Notes for the most recent Digi TransPort firmware. The release notes are available on the Product Support page for your Digi TransPort product, under General Firmware.
Digi TransPort® Routers User Guide
216
Configuring network interfaces
Configure mobile (cellular) interfaces
Configure SIMs
1. Go to Configuration > Network > Interfaces > Mobile. At the top of the Mobile settings are several settings for configuring the SIM or SIMs for the cellular service.
2. Select a SIM to configure. SIM 1 specifies the SIM card fitted to the slot marked SIM 1 in the router's SIM card slots. SIM 2 specifies the SIM card fitted to the slot marked SIM 2.
Note When using a single SIM card, the default action is for the router to use PPP 1 as the mobile interface. To configure dual SIMs for fail-over, go to Configuration > Network > Interfaces > Mobile > SIM Selectionto launch the Dual SIM wizard. See Configure SIM failover.
Digi TransPort® Routers User Guide
217
Configuring network interfaces
Configure mobile (cellular) interfaces
Configure mobile connection settings
Select the service plan and connection settings for connecting to the mobile network.
Web
1. Go to Configuration > Network > Interfaces > Mobile > Mobile Settings. The Mobile Settings page has several groups of settings. These settings vary depending on the cellular module in your router.
2. Configure the mobile service provider settings:
Service Plan / APN Enter an Access Point Name (APN) to overwrite the built-in default. Select APN automatically Only available for routers with one of the following module types:
n SIERRA_LTE n TELIT_LTE_V2 For more information, see Automatic APN configuration. SIM PIN (optional) Some SIM cards are locked with a Personal Identification Number (PIN) code to prevent misuse if they are lost or stolen. The cellular service provider should be able to confirm if the SIM requires a PIN code. If you enter a PIN code in this field, the router will try to unlock the SIM before attempting to connect to the network. Confirm SIM PIN Enter the PIN again in this field to confirm it.
Re-establish connection when no data is received for a period of time. Sets up an inactivity timer to trigger a reconnection when no packets are received for a period of time.
Digi TransPort® Routers User Guide
218
Configuring network interfaces
Configure mobile (cellular) interfaces
Inactivity Timeout: h hrs m mins s seconds The amount of time the router waits without receiving any PPP packets before disconnecting. This inactivity timeout is reset with each received PPP packet.
1. Configure the mobile network settings:
Enable NAT on this interface Enables or disables IP Network Address Translation (NAT) on the mobile interface. When enabled, displays the following options:-
IP Address Enables standard Network Address Translation (NAT).
IP address and Port Enables Network Address and Port Translation (NAPT).
Enable IPsec on this interface Enables or disables IPSec processing on the mobile interface. If enabled, packets sent or received on this interface must pass through the IPSec code before being transmitted. IPSec may drop the packet, pass it unchanged, or encrypt and encapsulate within an IPSec packet. When enabled, displays the following parameters:-
Keep Security Associations (SAs) when this Mobile interface is disconnected Configures the router to keep any existing IKE and IPsec associations should the link drop. This is usually applied on head-end routers with fixed IP addresses.
Use interface X, Y for the source IP address of IPsec packets By default, the source IP address for an IPSec eroute will be the IP address of the interface on which IPSec was enabled. By setting this parameter to either a PPP or Ethernet interface, the source IP address IPSec uses will match that of the Ethernet or PPP interface specified.
Enable the firewall on this interface Enables or disables the firewall script processing for the mobile interface.
Note If the firewall is enabled on an interface and with the absence of any firewall rules, the default action is to block ALL traffic.
2. Click Apply.
Digi TransPort® Routers User Guide
219
Configuring network interfaces
Configure mobile (cellular) interfaces
Command line
Configure mobile service provider settings commands for SIM 1 (PPP 1)
Command Instance modemcc 0 modemcc 0 modemcc 0 modemcc 0 modemcc 0
ppp
1
ppp
1
Parameter apn autoapn usebuapn buapn pin
username password
Values Free text field on/off on/off Free text field SIM PIN number Free text field Free text field
Equivalent web parameter Service Plan / APN: Checkbox (Select APN automatically) Checkbox (Use Backup APN) Use backup APN SIM PIN:/Confirm SIM PIN
Username: Password:/Confirm Password
Configure mobile service provider settings commands for SIM 2 (PPP 1)
Command Instance modemcc 0 modemcc 0 modemcc 0 modemcc 0 modemcc 0
ppp
1
ppp
1
Parameter Apn_2 autoapn_2 Usebuapn_2 Buapn_2 Pin_2
username password
Values Free text field on/off on/off Free text field SIM PIN number Free text field Free text field
Equivalent web parameter Service Plan / APN: Checkbox (Select APN automatically) Checkbox (Use Backup APN) Use backup APN SIM PIN:/Confirm SIM PIN
Username: Password:/Confirm Password
Configure mobile connection settings
Command Instance Parameter
ppp
n
rxtimeout
ppp
1
rxtimeout
Values off, on
0-86400 (seconds)
Equivalent web parameter
Re-establish connection when no data is received for a period of time.
Inactivity Timeout: h hrs m mins s seconds
Digi TransPort® Routers User Guide
220
Configuring network interfaces
Configure mobile (cellular) interfaces
Configure mobile network settings
Command Instance
ppp
1
Parameter do_nat
ppp
1
do_nat
ppp
1
ppp
1
ipsec ipsec
ppp
1
ipsecent
ppp
1
ipsecadd
ppp
1
firewall
Values 1 2 1 2
blank,ETH,PPP
0-255
off, on
Equivalent web parameter
Enable NAT on this interface IP Address
Enable NAT on this interface IP Address and Port
Enable IPsec on this interface
Keep Security Associations (SAs) when this Mobile interface is disconnected
Use interface X, Y for the source IP address of IPsec packets x=Interface type
Use interface X, Y for the source IP address of IPsec packets y=interface number
Enable the firewall on this interface
Automatic APN configuration
Certain variants of Digi TransPort routers include support for automatically configuring an Access Point Name (APN). This functionality is only available for routers with the following cellular module types:
n SIERRA_LTE n TELIT_LTE_V2
Automatic APN configuration is enabled on these routers only when Select APN automatically is enabled and Service Plan / APN is empty. These can also be set at the command line with the modemcc command:
modemcc 0 autoapn on modemcc 0 apn none
To configure the APN, the router uses an IMSI to APN assignments file, imsi.txt. The imsi.txt file maps ICCID and IMSI prefixes to APN values. For more information about updating and editing the imsi.txt file, see imsi.txt.
Getting Started Wizard Automatic APN selection is initially configured in the Getting Started Wizard on the Cellular connectivity page, by using the Allow automatic APN detection? option. If the router detects a supported cellular module and can determine the APN, this option will default to Yes. This will set the APN name to None, which allows the router to automatically detect the name.
Digi TransPort® Routers User Guide
221
Configuring network interfaces
Configure mobile (cellular) interfaces
Web UI
The Mobile Settings page of the Web UI (Configuration > Network > Interfaces > Mobile > Mobile Settings) includes the Select APN automatically checkbox. This checkbox is automatically enabled if APN detection was enabled in the Getting Started Wizard.
If automatic APN selection is enabled in either the Getting Started Wizard or the Web UI, but the router cannot determine the APN, the APN will be set to None.
imsi.txt Digi TransPort routers that support the automatic assignment of APNs use a text file, imsi.txt, to configure APNs. The TransPort device compares the IMSI and ICCID values read from the modem with the prefixes in the entries in imsi.txt, and will use the APN associated with the first match found in imsi.txt to configure the APN for the selected SIM. If no match is found, the APN will be left unchanged. The imsi.txt file may be periodically updated by Digi personnel, and can be updated as part of the standard carrier firmware update procedures. For more information about updating your carrier firmware, see Update carrier firmware. You can also edit the imsi.txt to include additional ICCID and IMSI prefixes and corollary APNs. To edit the imsi.txt file:
1. Open the file in the File Editor (Administration > File Management > File Editor). See Manage files for further information.
2. For the Filename field, select imsi.txt. The file format used by the imsi.txt consists of three comma and space separated elements: the ICCID Fragment, the IMSI fragment, and the APN:
3. Add additional ICCID and IMSI fragments and APNs as necessary, using this format.
Note If there are multiple occurrences of the same ICCID and IMSI fragments, the device will use the APN associated with first occurrence of the ICCID and IMSI fragments in the file.
4. Click Save file.
Digi TransPort® Routers User Guide
222
Configuring network interfaces
Configure mobile (cellular) interfaces
Configure SIM failover
For TransPort routers equipped with dual SIMs, you can configure the router to fail over from one SIM to another. A SIM failover configuration will failover to a temporary "on demand" cellular connection using the second SIM card. When the second SIM card is in use, after a specified period of inactivity or after a maximum amount of time has been reached or the inactivity timeout is reached, the backup link will deactivate and the TransPort will attempt to use the first SIM card again. This method is useful when it is not desirable to use the second SIM card indefinitely, for example, if some functionality is lost or the data charges are higher.
Web
1. Go to Configuration > Network > Interfaces > Mobile > SIM Selection. You can also launch the SIM selection wizard from Wizards > Dual SIM wizard > Next.
2. Click the link text here to launch the Dual SIM wizard.
3. Follow the prompts of the wizard. The wizard configures the basic failover SIM failover settings. You may need to perform additional configuration after the wizard completes. See these application notes for more information:
n Application Note 14: Configure a Dual SIM cellular router to automatically failover to a second SIM card and revert back to the original SIM after a specified amount of time
n Application Note 15: Configure a Dual SIM cellular router to automatically failover to the second SIM card and remain on SIM 2 until a failure is detected, then revert to SIM 1
Digi TransPort® Routers User Guide
223
Configuring network interfaces
Configure mobile (cellular) interfaces
Configure advanced mobile parameters
It is recommended that you have the advanced mobile settings remain at their defaults.
Web
1. Go to Configuration > Interfaces > Mobile > Advanced.
2. Enter the advanced mobile parameters:
SIM PUK (Optional) If known, the SIM PUK code can be entered in these fields. If the router detects that a PUK is required due to a locked SIM, this number will be sent to the SIM. A SIM PIN must also be configured for the PUK parameter to take effect.
Confirm SIM PUK Enter the PUK code again in this field to confirm it.
Initialisation string <n> These parameters (Initialisation string 1, Initialisation string 2, Initialisation string 3) specify a number of command strings that are sent to the wireless module each time a wireless connection is attempted. You can use these parameters to set non-standard wireless operating modes. Before being sent to the wireless module, each string is prefixed with the characters AT, then sent to the wireless module in the order specified until an empty string is encountered. For example, Initialisation string 3 is not sent unless Initialisation string 1 and Initialisation string 2 are both specified. Initialisation strings are not normally required for most applications as the router will normally be preconfigured for correct operation with most networks.
Digi TransPort® Routers User Guide
224
Configuring network interfaces
Configure mobile (cellular) interfaces
Hang-up string In a typical wireless application, the connection to the network is always on and under normal circumstances it is not necessary to hang-up the wireless module. Under certain circumstances however, the router may use the ATH command to try and disconnect the wireless module from the network, such as if an incorrect APN has been specified and the module is unable to attach to the network correctly. This parameter specifies an alternative hang-up string that is sent to the wireless module when disconnecting a call. As with the Initialisation strings, it is not necessary to include the AT as this is inserted automatically by the router
Post Hang-up string Additional AT commands that are sent to the wireless module after it has been disconnected. As with the Initialisation strings, it is not necessary to include the AT as this is inserted automatically by the router.
Wait n seconds between hanging up and allowing another call The length of time, in seconds, that the router will wait after hanging up the wireless module before initiating another call attempt.
Wait n seconds between attachment attempts The number of seconds between network attachment attempts, some networks require 60 seconds between attempts to attach to the wireless network.
Reset the module after n unsuccessful connection attempts The router will normally make multiple attempts to connect to the wireless network in the event that the signal is lost. In some cases, this can result in a lock-up situation where the wireless network is unable to attach the wireless device due to the multiple attempts. This parameter specifies the number of attempts at connection that the router should make before power cycling the internal wireless module. Power cycling the wireless module forces it to reregister and reattach to the network. The default value varies depending on the router's cellular module . Using the default value is recommended. Setting this parameter to 0 prevents the router from power-cycling the wireless module if it cannot obtain an IP address.
Reset the module after n unsuccessful status retrieval attempts The router periodically collects status information from the internal wireless module. This information, which may be viewed on the Management > Network Status > Interfaces > Mobile web page, includes details of the signal strength and network attachment status. As a safeguard against problems communicating with the wireless module, you can use the status retries parameter to specify the number of unsuccessful attempts to retrieve status information from the wireless module before power cycling it. The default setting of 30 is the recommended value. Setting this parameter to 0 prevents the router from power-cycling the wireless module if it cannot read the wireless status information.
Create a signal strength event every n minutes Configures the router to write the signal strength to the Event Log every n minutes.
If registration is lost for 5 minutes Controls whether the router will power cycle the wireless module after the network registration has been lost for 5 minutes. Setting this parameter to do not reset the module will never recycle the wireless module, setting to reset the module if GSM registration is
Digi TransPort® Routers User Guide
225
Configuring network interfaces
Configure mobile (cellular) interfaces
lost will power cycle the module after 5 minutes loss of GSM registration, and setting to reset the module if GPRS registration is lost will power cycle the module after 5 minutes loss of GPRS, 4G/LTE, 3G, or HSPA registration.
Preferred System Controls which mobile technology is the preferred system (2G/3G).
n When set to Auto, the cellular module chooses the fastest technology available. n When set to GSM, the cellular module tries GSM (GPRS/EDGE) technology first. n When set to WCDMA, the cellular module tries WCDMA (UMTS/HSPA) technology first.
For CDMA: select CDMA for 2G (1xRTT) or EVDO for 3G. n When set to 4G/LTE, the cellular module tries 4G/LTE technology first. 3. In the Mobile Network Settings section, enter the mobile network settings.:
Metric The connected metric of the mobile interface. The default metric of a connected interface is 1. By allowing the interface to have a higher value (lower priority), static routes can take preference to interfaces. For normal operation, leave this value unchanged.
Generate Heartbeats on this interface Heartbeat packets are UDP packets that contain status information about the router that you can use to locate a remote unit's current dynamic IP address. When enabled, displays the following parameters:
Send Heartbeat messages to IP address a.b.c.d every h hrs m mins s secs If these parameters are set to a non-zero value, the router will transmit heartbeat packets to the specified IP address/hostname at the specified interval.
Use interface x,y for the source IP address Allows the selection of the source interface for the UDP heartbeats. For example, it may be required to send the heartbeat packets down a VPN tunnel. And in order to match the corresponding subnets of the VPN, it might require changing the source IP to match an inside Ethernet interface. For normal operation, using the mobile interface as the source IP address, leave this value unchanged.
Select transmit interface using the routing table When enabled, the UDP heartbeats chooses the best route from the routing table. If disabled the exit interface will be interface on which the heartbeat is configured.
Digi TransPort® Routers User Guide
226
Configuring network interfaces
Configure mobile (cellular) interfaces
Include IMSI information in the Heartbeat message When enabled, the heartbeat includes the IMSI of the wireless module.
Include GPS information in the Heartbeat message When enabled, the heartbeat includes the GPS co-ordinates of the router.
Generate Ping packets on this interface This section relates to monitoring pings which can be sent from the mobile interface. For more details, refer to Application Note 7: Wireless WAN problem Detection and Recovery. When enabled, displays the following parameters:
Send n byte pings to IP host a.b.c.d every h hrs m mins s secs If this parameter is set, the router automatically generates a ping of n size to the IP host specified (IP address or hostname) at the interval specified. Deleting the IP host value disables the monitoring ping facility. This parameter in conjunction with Reset the link if no response is received within s seconds, configures the router to use a back-up interface automatically should there be a problem with this interface.
Note The n parameter specifies the ping size when using monitoring ping feature. The size indicates how large the ICMP packet should be excluding the size of the IP header.
Send pings every h hrs m mins s secs if ping responses are not being received When set, the router uses this value as the interval to ping at when more than one ping request sent out the PPP interface is outstanding. This should be set to a shorter interval than the above ping request interval so that the router may more quickly react to a broken PPP link.
Switch to sending pings to IP host a.b.c.d after n failures Allows a for more reliable problem detection before fail over occurs by testing connectivity to 2 IP addresses/hostnames. If an IP address or host name is entered and the n parameter has a value greater than 0, when a ping failure is detected on the primary IP address, pings are sent to this second IP address/hostname. This ensures that if the main IP address becomes unavailable for any reason and stops responding to ICMP requests, the router will check another IP address before starting fail over procedures.
Digi TransPort® Routers User Guide
227
Configuring network interfaces
Configure mobile (cellular) interfaces
Ping responses are expected within n seconds When set to a non-zero value, the router waits for the interval specified for a response from a PING request before applying the Send pings every h hrs m mins s secs if ping responses are not being received. If this parameter is set to 0 (default), the time specified in the in Send n byte pings to IP host a.b.c.d every h hrs m mins s secs is allowed before applying the Send pings every h hrs m mins s secs if ping responses are not being received.
Only send Pings when this interface is "In Service" When enabled, the interface sends ICMP echo requests only when it is in service. The default setting is off, and ICMP echo requests are sent when the interface is in service and out of service.
New connections to resume with previous Ping interval When enabled, this parameter controls the ping interval after deactivating and subsequently reactivating the mobile interface. It sets the ping interval to the same interval in use when the mobile link last disconnected.
Reset the link if no response is received within s seconds An amount of time after which the device does not receive any ping response, the router terminates the mobile connection in an attempt to re-establish communications. Because by default the mobile link is always on, the router automatically attempts to re-establish a PPP connection that has been terminated.
Use the ETH 0 IP address as the source IP address When enabled, the router uses the IP address of ETH0 instead of the current IP address of the mobile interface as the source address for the auto ping packets.
Note This parameter is useful to send the monitoring pings down a VPN tunnel where the source IP address needs to match the LAN. Defer sending pings if IP traffic is being received
When enabled, the timer configured in the Send n byte pings to IP host a.b.c.d every h hrs m mins s secs parameter is reset if IP data is sent across the mobile link. 4. Click Apply.
Command line
Advanced mobile parameters for SIM Slot 1 (PPP 1)
Command Instance Parameter
modemcc 0
puk
modemcc 0
init_str
modemcc 0
init_str1
modemcc 0
init_str2
modemcc 0
hang_str
Values sim puk code Free text field Free text field Free text field Free text field
Equivalent web parameter SIM PUK/Confirm SIM PUK Initialisation string 1 Initialisation string 2 Initialisation string 3 Hang-up string:
Digi TransPort® Routers User Guide
228
Configuring network interfaces
Configure mobile (cellular) interfaces
Command Instance Parameter Values
modemcc 0
posthang_ str
Free text field
modemcc 0
intercall_idle 0-2147483647
modemcc 0
att_interval 0-2147483647
modemcc 0
link_retries 0-2147483647
modemcc 0
stat_retries 0-2147483647
modemcc 0
ss_interval 0-2147483647
modemcc 0
check_reg 0, 1, 2
modemcc 0
psys
0, 1, 2, 2G, 3G,
4G, 4G3G2G,
4G3G, 4G2G3G,
4G2G, 3G4G2G,
3G4G, 3G2G4G,
3G2G, 2G4G3G,
2G4G, 2G3G4G,
2G3G
Equivalent web parameter
Post Hang-up string:
Wait n seconds between hanging up and allowing another call
Wait n seconds between attachment attempts
Reset the module after n unsuccessful connection attempts
Reset the module after n unsuccessful status retrieval attempts
Create a signal strength event every n minutes
If registration is lost for 5 minutes 0=do not reset the module 1=reset the module if the GSM registration is lost 2=reset the module if the GPRS registration is lost
Preferred System.
This parameter allows the module to "lock" to a particular connection type. Possible values include: 0=Auto. Uses default setting, may be set by the carrier in the SIM 1=GSM 2=WCDMA 2G=2G only 3G=3G only 4G=4G only 4G3G2G=4G, 3G, or 2G only 4G3G=4G or 3G only 4G2G3G= 4G, 2G, 3G only 4G2G=4G, or 2G only 3G4G2G=3G, 4G, or 2G only 3G4G=3G or 4G only 3G2G4G=3G, 2G, or 4G only 3G2G=3G or 2G only 2G4G3G= 2G, 4G, or 3G only 2G4G=2G or 4G only 2G3G4G=2G, 3G, or 4G only 2G3G=2G or 3G only
Digi TransPort® Routers User Guide
229
Configuring network interfaces
Configure mobile (cellular) interfaces
Advanced mobile parameters-for SIM Slot 2 (PPP 1)
Command Instance Parameter Values
modemcc 0
Puk_2
sim puk code
modemcc 0
init_str_2 Free text field
modemcc 0
init_str1_2 Free text field
modemcc 0
init_str2_2 Free text field
modemcc 0
hang_str_ Free text field 2
modemcc 0
posthang_ Free text field str_2
modemcc 0
intercall_ 0-2147483647 idle_2
modemcc 0
att_
0-2147483647
interval_2
modemcc 0
link_
0-2147483647
retries_2
modemcc 0
stat_
0-2147483647
retries_2
modemcc 0
ss_
0-2147483647
interval_2
modemcc 0
check_ reg_2
0, 1, 2
Equivalent web parameter SIM PUK/Confirm SIM PUK
Initialisation string 1
Initialisation string 2
Initialisation string 3
Hang-up string:
Post Hang-up string:
Wait n seconds between hanging up and allowing another call
Wait n seconds between attachment attempts
Reset the module after n unsuccessful connection attempts
Reset the module after n unsuccessful status retrieval attempts
Create a signal strength event every n minutes
If registration is lost for 5 minutes 0=do not reset the module 1=reset the module if the GSM registration is lost 2=reset the module if the GPRS registration is lost
Digi TransPort® Routers User Guide
230
Configuring network interfaces
Configure mobile (cellular) interfaces
Command Instance Parameter Values
modemcc 0
Psys_
0, 1, 2, 2G, 3G, 4G, 4G3G2G, 4G3G, 4G2G3G, 4G2G, 3G4G2G, 3G4G, 3G2G4G, 3G2G, 2G4G3G, 2G4G, 2G3G4G, 2G3G
Equivalent web parameter
Preferred System 0=Auto 1=GSM 2=WCDMA 2G=2G only 3G=3G only 4G=4G only 4G3G2G=4G, 3G, or 2G only 4G3G=4G or 3G only 4G2G3G= 4G, 2G, 3G only 4G2G=4G, or 2G only 3G4G2G=3G, 4G, or 2G only 3G4G=3G or 4G only 3G2G4G=3G, 2G, or 4G only 3G2G=3G or 2G only 2G4G3G= 2G, 4G, or 3G only 2G4G=2G or 4G only 2G3G4G=2G, 3G, or 4G only 2G3G=2G or 3G only
Mobile network settings
Command ppp ppp
Instance 1 1
Parameter metric
ppp
1
hrtbeatip
ppp
1
hrtbeatint
ppp
1
ppp
1
ppp
1
hbipent hbipadd hbroute
Values 0-256 off, on IP address
0-2147483647 (seconds)
Default,PPP,Ethernet
number
on/off
Equivalent web parameter
Metric
Generate Heartbeats on this interface
Send Heartbeat messages to IP address a.b.c.d every h hrs m mins s secs
Send Heartbeat messages to IP address a.b.c.d every h hrs m mins s secs
Use interface x,y for the source IP address
Use interface x,y for the source IP address
Select transmit interface using the routing table
Digi TransPort® Routers User Guide
231
Configuring network interfaces
Command Instance Parameter
ppp
1
hbimsi
ppp
1
hbgps
ppp
1
ppp
1
pingsiz
ppp
1
pingip
ppp
1
pingint
ppp
1
pingint2
ppp
1
ppp
1
ppp
1
ppp
1
ppp
1
ppp
1
pingip2 ip2count pingresp pingis ping2cont pingdeact
Configure mobile (cellular) interfaces
Values on/off on/off off, on number IP address 0-2147483647 (seconds) 0-2147483647 (seconds)
IP address number 0-2147483647 on/off on/off 0-2147483647
Equivalent web parameter
Include IMSI information in the Heartbeat message
Include GPS information in the Heartbeat message
Generate Ping packets on this interface
Send n byte pings to IP host a.b.c.d every h hrs m mins s secs
Send n byte pings to IP host a.b.c.d every h hrs m mins s secs
Send n byte pings to IP host a.b.c.d every h hrs m mins s secs
Send pings every h hrs m mins s secs if ping responses are not being received
Switch to sending pings to IP host a.b.c.d after n failures
Switch to sending pings to IP host a.b.c.d after n failures
Ping responses are expected within n seconds
Only send Pings when this interface is In Service
New connections to resume with previous Ping interval
Reset the link if no response is received within s seconds
Digi TransPort® Routers User Guide
232
Configuring network interfaces
Command Instance Parameter
ppp
1
pingfreth0
ppp
1
pingresetint
Configure mobile (cellular) interfaces
Values on, off
on, off
Equivalent web parameter
Use the ETH 0 IP address as the source IP address
Defer sending pings if IP traffic is being received
Digi TransPort® Routers User Guide
233
Configuring network interfaces
Configure mobile (cellular) interfaces
Configure sending and receiving SMS messages
You can configure the mobile routers to send and receive SMS messages. The sending of SMS messages could for example be in conjunction with sending alarms and received messages for configuration changes, or status requests.
Note SMS messaging is supported in some, but not all, cellular modules in Digi TransPort routers.
Web
1. Go to Configuration - Network > Interfaces > Mobile > SMS Settings.
2. Enter the SMS settings:
Poll for incoming SMS messages When enabled, displays the following parameter:-
Every n minutes The interval, in minutes, that the router will wait in between checks for incoming SMS messages. Setting this interval to 0 turns off checking.
Send received SMS messages to the command interpreter If enabled, any received SMS messages are sent to the command interpreter.
Enable command replies via SMS Enables or disables replies to SMS commands.
Digi TransPort® Routers User Guide
234
Configuring network interfaces
Configure mobile (cellular) interfaces
Concatenate replies Normally an SMS message is limited to 160 characters. However, the ETSI standard specifies a way to allow a number of SMS messages to be linked together by the sender (in this case the router). This enables the router to reply with long responses to SMS commands of longer than 160 characters. The reply comes back as a series of linked SMS messages which the phone reassembles and displays as one big message.
Note The routers cannot handle received concatenated SMS messages, it can only transmit concatenated SMS messages
Use this SMS message centre number n instead of the network default This setting is optional. It is the number of the SMS message center (sometimes referred to as the Service Centre Address), for relaying SMS messages or alarms. This number must include the international dialing code, such as 44 for the UK, but not the + prefix or leading zeros, such as 44802000332. SMS alarms are generated when the SMS trigger priority is greater than 0 and an event of this priority or higher occurs. SMS alarms may be configured using the Configuration > Alarms > Event Settings > SMS web page. If no number is specified, it is possible that the router operates using the default message centre for the GSM service to which you have subscribed.
SMS access level The access level for SMS commands. The access level set here needs to match the level required by the command sent by SMS for the command to be accepted.
Use x as a command separator (default is CR) The character for separating multiple command lines when a remote SMS sender is controlling the router. The default separator is <CR>. As some SMS capable devices are not equipped with <CR> keys, an additional means of separating multiple lines is required.
Allow CLI commands from the following SMS numbers. You can specify up to 10 numbers. Specifying * permits commands from any SMS number. Numbers are applied in the following input box. Click Add to submit.
Command line
Commands-for SIM Slot 1 (PPP 1)
Command Instance Parameter Values
modemcc 0
sms_ interval
modemcc 0
sms_ replies
on/off
modemcc 0
sms_ concat
Number 0=off 10=default when enabled
Equivalent web parameter Poll for incoming SMS messages:Every n minutes Enable command replies via SMS
Concatenate replies
Digi TransPort® Routers User Guide
235
Configuring network interfaces
Configure mobile (cellular) interfaces
Command Instance Parameter Values
Equivalent web parameter
modemcc 0
sca
Free text field Use this SMS message centre number n instead of the network default
modemcc 0
sms_ access
0=Super (default) 1=High 2=Medium 3=Low 4=None 5=HighLow 6=HighMedium 7=CheckPar
SMS access level:
modemcc 0
sms_cmd_ Free text field Use as a command separator (default is CR) sep
modemcc 0
sms_ callerid
Mobile telephone number
Allow CLI commands from the following SMS numbers. (First SMS number)
modemcc 0
sms_ callerid_1 to 9
Mobile telephone number
Allow CLI commands from the following SMS numbers. (additional SMS numbers 1 to 9)
Commands-for SIM Slot 2 (PPP 1)
Command Instance Parameter
modemcc 0
sms_interval_2
modemcc 0 modemcc 0
sms_replies_2 sms_concat_2
modemcc 0
Sca_2
Values
Equivalent web parameter
Poll for incoming SMS messages:Every n minutes
on/off
Enable command replies via SMS
Number 0=off 10=default when enabled
Concatenate replies
Free text field
Use this SMS message centre number n instead of the network default
Digi TransPort® Routers User Guide
236
Configuring network interfaces
Command Instance Parameter
modemcc 0
sms_access_2
modemcc 0 modemcc 0
sms_cmd_sep sms_callerid
modemcc 0
sms_callerid_1 to 9
Configure mobile (cellular) interfaces
Values
Equivalent web parameter
0=Super (default) 1=High 2=Medium 3=Low 4=None 5=HighLow 6=HighMedium 7=CheckPar
SMS access level:
Free text field
Use as a command separator (default is CR)
Mobile telephone number
Allow CLI commands from the following SMS numbers. (First SMS number)
Mobile telephone number
Allow CLI commands from the following SMS numbers. (additional SMS numbers 1 to 9)
Digi TransPort® Routers User Guide
237
Configuring network interfaces
Configure mobile (cellular) interfaces
Verify mobile connectivity and check mobile status
Once the router is correctly configured for mobile service, verify that it has obtained an IP address from the mobile network, that the SIM is working correctly, and check the status of the mobile connection.
Web
1. Go to Management > Network Status > Interfaces > Mobile. 2. In the Mobile Statistics section, check the IP address value. It should contain an IP address
other than 0.0.0.0 or 1.2.3.4.
3. In the Mobile Information section, view the SIM status field to verify that the SIM is working correctly.
4. View the Signal strength field to check the signal strength.
For more information about the fields on the mobile status page, see Show mobile status and statistics.
Command line
1. Enter the command pppstat n , where n is the number of the PPP interface the mobile interface uses. Check the IP Address value.
pppstat 1 Name: W-WAN
Interface mode: NDIS Link Active With: USBHOST 0
IP Address: 100.75.30.168 DNS Server Address: 198.224.149.135 Secondary DNS Server Address: 198.224.148.135
Outgoing Call To: *98*3# Uptime: 1 Hrs 24 Mins 27 Seconds
OK
2. Enter the command modemstat ?. In the output, check the SIM status and Signal strength fields.
Digi TransPort® Routers User Guide
238
Configuring network interfaces
Configure mobile (cellular) interfaces
modemstat ?
Outcome: Got modem status OK: Time: 30 Jan 2018 14:05:37 SIM status: Ready Signal strength: -70 dBm Radio technology: LTE Signal quality (LTE): RSSI -70 dBm, RSRP -102 dBm, RSRQ -15 dB, SINR 5.2 dB Radio band: E-UTRA Operating Band 4 Channel: 2050 Manufacturer: Sierra Wireless, Incorporated Model: MC7455 IMEI: 359072060221435 MEID: 35907206022143 IMSI: 311480264291718 MDN: 6122573855 MIN: 6123322024 ICCID: 89148000002636797505 Firmware: SWI9X30C_02.24.05.06 r7040 CARMD-EV-FRMWR2 2017/05/19 06:23:09 Bootcode: SWI9X30C_02.24.05.06 r7040 CARMD-EV-FRMWR2 2017/05/19 06:23:09 Hardware version: 1.0 Firmware Carrier ID: VERIZON_002.034_000 APN in use: Context 3: vzwinternet Registration State: Registered tac:BE43 ci:02E90520 Attachment status: Attached Network: VZW, 311480 Preferred system: Auto Network Technology: LTE Temperature: 39C OK
Digi TransPort® Routers User Guide
239
Configuring network interfaces
Configure mobile (cellular) interfaces
Automatic SIM detection
Newer cellular modules in TransPort routers use a SIM-based image switching feature, called automatic SIM detection, which allows the module to automatically switch between carrier-approved firmware. Automatic SIM detection is currently supported in the following cellular module types:
n Sierra Wireless modules MC7430 and MC7455 n Telit modules LE910-NA1, LE910-EU1, LE910-NA V2, LE910-EU V2, LE910C1-NS, LE910C1-AP
To determine whether your router supports automatic SIM detection, enter the command modemcc 0 auto_sim ?. The response will display on if automatic SIM detection is supported, or off if not supported. When a Transport router equipped with automatic SIM detection boots, the cellular module checks the SIM's MCC/MNC or ICCID, and checks the list of cached images for a "best match:"
n If an exact or acceptable match is found, the router uses that image for the carrier firmware switch.
n If there is no exact or acceptable matching image, the router uses the Generic carrier firmware image, if available.
Otherwise, if there is no match, and no Generic carrier firmware image is available, no firmware image switch occurs, and the module continues to use the current configuration. You can disable automatic SIM detection if desired.
Disable automatic SIM detection
If you want to switch carriers by using the carrier command (see Switch the cellular carrier firmware), you need to first disable automatic SIM detection.
Command line
To disable automatic SIM detection, use the modemcc 0 auto_sim off command:
modemcc 0 auto_sim off
Digi TransPort® Routers User Guide
240
Configuring network interfaces
Configure mobile (cellular) interfaces
Determine the cellular module type and carrier firmware version
The capabilities and options available for carrier switching and carrier firmware updates can vary by cellular module. You can determine the cellular module type and current carrier firmware version running on the cellular module from the router's web and command-line interfaces. For more information on carrier switching, see Switch the cellular carrier firmware. For more information on carrier firmware updates, see Update carrier firmware.
Web
1. Go to Management > Network Status > Interfaces > Mobile. 2. On the mobile status display, check these fields:
n Manufacturer: The manufacturer of the cellular module. n Model: The cellular module type. n Firmware Carrier ID: The current carrier firmware running on the cellular module, and its
version number.
Command line
1. Enter the command modemstat ? 2. In the output, check these fields:
n Manufacturer: The manufacturer of the cellular module. n Model: The cellular module type. n Firmware Carrier ID: The current carrier firmware running on the cellular module, and
its version number.
Digi TransPort® Routers User Guide
241
Configuring network interfaces
Configure mobile (cellular) interfaces
Switch the cellular carrier firmware
You can switch the cellular carrier firmware for the router's cellular module. Depending on the cellular module running on the router, there are several methods available for switching cellular carrier firmware. See Determine the cellular module type and carrier firmware version.
n Some cellular modules require using the Carrier Switching Wizard in the web interface to switch carrier firmware.
n Some cellular modules, such as the Sierra Wireless MC7455, have all supported carrier firmware available on the module. For these modules, use the carrier command to switch carrier firmware.
Using the Carrier Switching Wizard
Web
Older cellular modules that do not support automatic SIM detection perform carrier switching through the Carrier Switching Wizard in the web interface.
1. If necessary, verify which carrier firmware is currently running on the cellular module. See Determine the cellular module type and carrier firmware version.
2. Verify that the router has enough available flash space to receive the firmware files. 3. (Optional) Depending on available router flash space, delete any unused *.cwe files to free up
space in the flash directory. Use the del command to delete files. For example: n Go to Administration > File Management > FLASH Directory. n Select the file or files to delete. n Click Delete Selected Files.
4. Load the carrier firmware images for the carrier in flash or USB drive, if they are not already loaded there.
5. Go to Wizards > Carrier Switching Wizard and click Next.
Digi TransPort® Routers User Guide
242
Configuring network interfaces 6. Select the required carrier and click Next.
Configure mobile (cellular) interfaces
The firmware update begins. Note The update process takes several minutes. Do not power-cycle the router until the process is complete.
7. Once the firmware update is complete, you may need to update the modem parameters, such as APN, for the carrier. To do this, click on the link in Click here to update Mobile Settings on the final wizard page.
Using the "carrier" command
Newer cellular modules that support automatic SIM detection perform carrier switching through the carrier command. The carrier command has several command variants; the availability of which depends on the cellular module.
Digi TransPort® Routers User Guide
243
Configuring network interfaces
Configure mobile (cellular) interfaces
"carrier" command variant carrier ?
carrier carrier optional msl
carrier carrier optional msl -ftp
carrier ftp-carrier-info carrier switch {auto|carrier} carrier all carrier status
Action
Displays help text for the carrier command. In the help text, the available carriers are listed under the Parameters: heading. Available command variants are listed under the Syntax: heading.
Downloads the carrier firmware files to the cellular modem. The carrier firmware file must be in flash or on a USB stick. You can also specify a Master Subsidy Lock (MSL) code, if the carrier requires it.
Downloads the carrier firmware files from the Digi FTP repository for the cellular modem's firmware to the cellular modem. You can also specify a Master Subsidy Lock (MSL) code, if the carrier requires it.
Downloads the specific carrier firmware for the carrier that is active on the module.
Switch to automatic SIM selection or a preloaded carrier image.
Supported for Telit cellular modules only. Loads all available carrier firmware onto the cellular module.
Show status of the current carrier firmware download operation.
1. Enter carrier ? to verify which carrier firmware is currently running on the cellular module. 2. Verify that the router has enough available flash space to receive the firmware files.
carrier ? Current images:
FW image: unique ID = 002.009_001 build ID = 02.08.02.00_ATT PRI image: unique ID = 002.009_001 build ID = 02.08.02.00_ATT
Available carriers <att|verizon|telus|rogers|bell|sprint|generic>
Parameters: att - AT&T
verizon - Verizon telus - Telus
rogers - Rogers bell - Bell
sprint - Sprint generic - Generic
Syntax: carrier <carrier> <optional msl> be in flash or USB stick
Download firmware to the modem, must
Digi TransPort® Routers User Guide
244
Configuring network interfaces
Configure mobile (cellular) interfaces
carrier <carrier> <optional msl> -ftp modem carrier ftp-carrier-info information file carrier switch <carrier> image carrier status download
FTP and download firmware to the FTP latest carrier
Switch to preloaded carrier Status of the current
msl - Enter Master Subsidy Lock Code for Sprint OK
3. (Optional) Depending on available router flash space, delete any unused *.cwe files to free up space in the flash directory. Use the del command to delete files. For example:
del att.cwe
4. Disable automatic SIM detection using the modemcc command:
modemcc 0 auto_sim off
5. Depending on the carrier command options available for the cellular module, enter the carrier command. For example, to switch the carrier firmware to Verizon, enter:
carrier verizon Checking the firmware and the carrier Waiting for the modem........................... Downloading verizon.cwe file 100% Download speed: 2702400 bps time 102720ms Downloading verizon.nvu file 100% Download speed: 2403200 bps time 250ms Waiting modem to complete firmware download Firmware download completed Done. Modem will be reset
Note The update process takes several minutes. Do not power-cycle the router until the process is complete.
6. Once the module's firmware image has been updated, you may need to configure the modem parameters for the carrier, for example, the APN value.
7. Enable automatic SIM detection using the modemcc command:
modemcc 0 auto_sim on
Additional model-specific carrier-switching documentation
For additional information on switching carriers on the cellular module, see these Digi TransPort application notes:
n Quick Note 39: Carrier Switching with the Sierra Wireless MC7354 Cellular Module (L5 models) n Quick Note 58: MC7455 Firmware update/SIM Switching
Digi TransPort® Routers User Guide
245
Configuring network interfaces
Configure mobile (cellular) interfaces
Update carrier firmware
Depending on the cellular module in the router, there are several options available for handling carrier firmware updates. See Determine the cellular module type and carrier firmware version.
n Using the Configuration > Network > Interfaces > Mobile > Mobile Firmware (OTA) Update page in the web interface. Currently available on select newer cellular modules only. If you do not see this settings group on the Mobile page for your device, the cellular module does not support this option.
n Using the carrier -ftp command. Available for all newer cellular modules.
The carrier firmware over-the-air update process is automated. It pulls the required firmware files from Digi's FTP site for TransPort WR routers, and performs the update. This update occurs for the active carrier only.
About carrier firmware files
While firmware files and file types can vary among manufacturers and model types, in general, carrier firmware files involve these file types:
n A text file that cross-references the carrier to the corresponding firmware and configuration files. Depending on the cellular module, this file may be named carrier.txt or have a more module-specific name, such as car_7455.txt for the Sierra Wireless MC7455 module.
n A cellular modem firmware file. The size of this file can vary among carriers. This file typically has the format *.cwe
n A carrier-specific configuration file, again with a file size that can vary in size by carrier. This file typically has the format *.nvu.
Web
1. Verify that the router has enough available flash space flash space for the carrier firmware files.
2. (Optional) Depending on available router flash space, delete any unused *.cwe files to free up space in the flash directory: n Go to Administration > File Management > FLASH Directory. n Select the file or files to delete. n Click Delete Selected Files.
3. Go to Network > Configuration > Interfaces > Mobile > Mobile Firmware (OTA) Update. 4. Click Start.
Command line
1. Verify that the router can ping to the location ftp1.digi.com. 2. Verify that the router has enough available flash space flash space for the carrier firmware files
(around 40 MB) . 3. (Optional) Depending on available router flash space, delete any unused *.cwe files to free up
space in the flash directory. Use the del command to delete files. For example:
Digi TransPort® Routers User Guide
246
Configuring network interfaces
Configure mobile (cellular) interfaces
del att.cwe
4. Use the carrier carrier_name or carrier carrier_name -ftp command to load the carrier firmware images onto the router. The carrier carrier_name command checks for the carrier firmware on a USB stick or in flash and loads it onto to the router. The carrier carrier_name -ftp command performs the following actions: n Downloads the latest firmware files for the current carrier from the Digi FTP site to flash. n Checks to see if a firmware download is required (a newer version is available) n Downloads the files from flash to the MC7354. n Reboots the cellular module. For example, to update the carrier firmware for AT&T, enter:
carrier att -ftp Checking the firmware and the carrier Please wait while retrieving the file..... OK config 0 save Please wait... Power Up Profile: 0 OK ...................................... Downloading att.cwe file 100% Download speed: 7473600 bps time 37240ms Waiting modem to complete firmware download Firmware download completed Resetting modem... Done. OK
The download operation requires several minutes.
Note Do not reboot the TransPort during the process.
5. Check the event log for the following messages when firmware is successfully downloaded; the message firmware download complete indicates a successful firmware download:
13:51:33, 07 Apr 2017,GOBI Modem enable 13:51:33, 07 Apr 2017,GOBI firmware download complete 13:51:33, 07 Apr 2017,GOBI file att.cwe download complete (34790809 bytes) 13:51:31, 07 Apr 2017,GOBI write unframed response timeout 13:51:23, 07 Apr 2017,GOBI write unframed response timeout 13:50:56, 07 Apr 2017,GOBI firmware download start Done. OK
Troubleshooting carrier firmware updates
If the carrier firmware file download fails and an error message is displayed, check the following things:
Digi TransPort® Routers User Guide
247
Configuring network interfaces
Configure mobile (cellular) interfaces
carrier download fails and an error message is displayed, try checking the following things:
n Check for errors in the event log; verify that the FTP download did not report errors. n If using FTP, verify that enough flash space is available. Required size varies by carrier; you may
need anywhere from 40 to 62 MB available. n If using FTP, verify that you can ping the location ftp1.digi.com. n If not using FTP, verify that the images are available in flash or USB. For example, for updating
the Verizon carrier firmware on a Sierra Wireless MC7455 module, the files car_7455.txt, verizon.cwe, and verizon.nvu must be available.
Digi TransPort® Routers User Guide
248
Configuring network interfaces
Configure DSL interfaces
Configure DSL interfaces
Router models incorporating a DSL broadband interface includes a configuration page having the title shown above. By default, the configuration in this section is suitable for the majority of ADSL service providers in the UK. However, advanced users or users outside of the UK may want or need to adjust some of the parameters.
Web
1. Go to Configuration > Network > Interfaces > DSL. 2. Configure the DSL parameters as needed:
Enable DSL
Enables or disables the use of DSL/ADSL functionality on the router.
Configure PVC
Select the required PVC instance from the drop-down selection box. Subsequent settings applies to the selected instance. See additional topics in this section. 3. Click Apply.
Digi TransPort® Routers User Guide
249
Configuring network interfaces
Configure DSL interfaces
Configure permanent virtual circuit (PVC) parameters
Web
1. Go to Configuration > Network > Interfaces > DSL > PVC. 2. Configure PVC parameters as needed:
Enable this PVC Check this box to enable PVC settings.
Encapsulation The method of encapsulation to use when transporting data over this APVC. The appropriate value can be selected from a drop list which includes the following options:
Option PPPoA VC-Mux PPPoA LLC PPPoE VC-Mux PPPoE LLC Bridged Ethernet VC-Mux Bridged Ethernet LLC Routed IP VC-Mux Routed IP LLC
Description RFC 2364 VC-multiplexed PPP over AAL5 RFC 2364 LLC encapsulated PPP over AAL5 RFC 2516 VC-multiplexed PPP over Ethernet RFC 2516 LLC encapsulated PPP over Ethernet RFC 2684 VC-multiplexed bridged Ethernet RFC 2684 LLC encapsulated bridged Ethernet RFC 1483 VC multiplexing routed IP over ATM RFC 1483 LLC encapsulated routed IP over ATM
To use PPPoA or PPPoE encapsulation, one of the available PPP instances must first be configured to use this APVC instance as its Layer 1 interface on the associated Configuration > Interfaces > PPP > PPP n > Advanced page.
VPI The Virtual Path Identifier for this APVC in the range 0-255.
VCI The Virtual Channel Identifier for this APVC in the range 0-65535. 3. Click Apply.
Command line
Command Instance
apvc
0
apvc
0
Parameter
Values 0-255 0-65535
Equivalent web parameter VPI VCI
Digi TransPort® Routers User Guide
250
Configuring network interfaces
Configure DSL interfaces
Configure DSL network settings
Web
1. Go to Configuration > Network > Interfaces > DSL > Network Settings. 2. Configure the DSL parameters as needed:
This DSL PVC is using PPP 1 The default interface for DSL. The default interface for DSL is PPP 1.
Description A description for the DSL. This field is optional.
Username The ADSL username.
Password The password for the DSL account.
Confirm password Enter the password for the DSL account again.
Enable NAT on this interface Enables or disables IP Network Address Translation (NAT) or Network Address and Port Translation (NAPT) at the Ethernet interface. When the parameter is set to disabled, no NAT occurs. When this parameter is enabled, the extra options described below are displayed. NAT and NAPT can have many uses, but they are generally employed to allow a number of private IP hosts (PCs for example) to connect to the Internet through a single shared public IP address. This has two main advantages, it saves on IP address space (the ISP only need assign you one IP address), and it isolates the private IP hosts from the Internet, effectively providing a simple firewall because unsolicited traffic from the Internet cannot be routed directly to the private IP hosts. To use NAT or NAPT correctly in the example of connecting private hosts to the Internet, enable NAT or NAPT on the router's WAN side interface and disable NAT or NAPT on the router's LAN-side interface.
IP address
Enable standard Network Address Translation (NAT) When a private IP host sends a UDP or TCP packet to an Internet IP address, the router changes the source address of the packet from the private host IP to the router's public IP address before forwarding the packet onto the Internet host. Additionally it will create an entry in a NAT table containing the private IP source address, the private IP port number, the public IP destination address and the destination port number. Conversely, when the router receives a reply packet back from the public host, it checks the source IP, source port number and destination port number in the NAT table to determine which private host to forward the packet to. Before it forwards the packet back to the private host, it changes the destination IP address of the packet from its public IP address to the IP address of the private host.
Digi TransPort® Routers User Guide
251
Configuring network interfaces
Configure DSL interfaces
IP address and Port
Enable Network Address and Port Translation (NAPT). This mode behaves like NAT but in addition to changing the source IP of the packet from the private host it can also change the source port number. This is required if more than one private host attempts to connect using the same local port number to the same Internet host on the same remote port number. If such a scenario were to occur with NAT the router would be unable to determine which private host to route the returning packets to and the connection would fail.
NAT Source IP address If specified, and NAT mode is set to NAT or NATP for this interface, then the source address of packets being sent out this interface is changed to this address, rather than the interface address.
Enable IPsec on this interface The IPSec parameter enables or disables IPSec processing on this interface. If this box is checked, packets sent or received on this interface must pass through the IPSec code before being transmitted. IPSec may drop the packet, pass it unchanged, or encrypt and encapsulate within an IPSec packet.
Keep Security Associations (SAs) when this Mobile interface is disconnected Configures the router to keep any existing IKE and IPsec associations should the link drop. This is usually applied on head-end routers with fixed IP addresses.
Use interface X, Y for the source IP address of IPsec packets By default, the source IP address for an IPSec Eroute is the IP address of the interface on which IPSec was enabled. By setting this parameter to either a PPP or Ethernet interface, the source IP address IPSec uses will match that of the Ethernet or PPP interface specified.
Enable the firewall on this interface Turns Firewall script processing On or Off for this interface. If the firewall is enabled on an interface and with the absence of any firewall rules, the default action is to block ALL traffic. To configure the firewall, see the Firewall section.
Limit the data transmitted over this interface On W-WAN networks (where charging is based on the amount of data transferred as opposed to time spent on-line), this parameter specifies a data limit after which the router will create an entry in the event log to indicate that this amount of data has been transferred. For example, if your monthly tariff includes up to 5 MB of data before you are charged an excess, you might set the Data limit warning level to 4000. This would cause the router to place a warning entry in the event log once you had transferred 4 MB. You could use this event to trigger an email alert message, SNMP trap or SMS alert message.
Issue a warning event after The maximum data to be transmitted before a warning entry is generated in the Event Log. You can select kilobytes, megabytes or gigabytes via the drop-down box.
Digi TransPort® Routers User Guide
252
Configuring network interfaces
Configure DSL interfaces
Stop data from being transmitted after The maximum amount of data that may be transferred before the router locks the interface and prevent further transfer. Along withthe Issue a warning event after parameter, networks use this setting when the tariff is based on the amount of data transferred to help prevent excess charges being incurred. You can select kilobytes, megabytes or gigabytes via the drop-down box.
Reset the data limit on the x day of the month If you wish to automatically unlock a locked interface at the start of a new billing period, set this parameter to the appropriate day of the month (from 1 to 28). When this date is reached the router will unlock the interface and data transfer may resume. If the parameter is set to 0, automatic unlocking will not occur and manual unlocking will be necessary (by clicking on the Clear Total Data Transferred button on the appropriate Diagnostics-Statistics > PPP > PPP n page. This parameter will also reset the statistics for the data limit warning level (in kilobytes). The factory default does not include any DSL settings and so when the router is first installed, the following message appears: This DSL PVC is not assigned to any PPP interface.
Click here to jump to the PPP Mapping page. When clicked, this link redirects the browser to the Configuration > Network > interfaces > Advanced > PPP Mappings page. From this page, select the desired PPP instance. 3. Click Apply.
Command line
Command Instance
ppp
1
ppp
1
ppp
1
ppp
1
Parameter description username password do_nat 1
ppp
1
do_nat 2
ppp
1
ppp
1
ppp
1
natip ipsec firewall
ppp
1
ppp
1
dlwarnkb dlstopkb
Values
Equivalent web parameter
Free text
Description
Free text
Username
Free text
Password
on
Enable NAT on this interface
(IP Address)
on
Enable NAT on this interface
(IP Address and port)
IP Address
NAT Source IP Address
on, off
Enable IPSec on this interface
on, off
Enable the firewall on this interface
Kbytes/Mbytes/GBytes Issue a warning event after
Kbytes/Mbytes/GBytes Stop data from being transmitted after x Bytes data
Digi TransPort® Routers User Guide
253
Configuring network interfaces
Command Instance
ppp
1
Parameter dlrstday
Values 1-28
Configure DSL interfaces
Equivalent web parameter Reset the data limit on the nth day of the month
Digi TransPort® Routers User Guide
254
Configuring network interfaces
Configure DSL interfaces
Configure PVC traffic shaping parameters
Web
Service category You can configure Each ATM PVC with a service category:
n UBR (unspecified bit rate, the default) n VBR-nrt (variable bit rate, non-real-time) n VBR-rt (variable bit rate, real-time) n CBR (constant bit rate) n Additional traffic parameters may be specified: n PCR (peak cell rate in cells/sec) n SCR (sustained cell rate in cells/sec) n MBS (maximum burst size in cells) The service categories are characterized by the various traffic parameters as follows:
Service category UBR VBR-nrt VBR-rt CBR
Traffic parameters PCR, which may be 0 for no limit PCR, SCR, MBS PCR, SCR, MBS PCR
This parameter specifies the maximum allowable rate at which cells can be transported along a connection in the ATM network. The PCR is the determining factor in how often cells are sent in relation to time in an effort to minimize jitter. PCR generally is coupled with the CDVT (Cell Delay Variation Tolerance), which indicates how much jitter is allowable.
Sustained cell rate (cells/sec) A calculation of the average allowable, long-term cell transfer rate on a specific connection.
Maximum burst size (cells) The maximum allowable burst size of cells that can be transmitted contiguously on a particular connection.
Digi TransPort® Routers User Guide
255
Configuring network interfaces
Related CLI commands
Command line
Entity apvc
Instance 0
Parameter servcat
apvc
0
pcr
apvc
0
scr
apvc
0
mbs
Configure DSL interfaces
Values UBR,VBR-ntr,VBRrt,CBR n n n
Equivalent web parameter Service category
Peak cell rate (cells/sec) Sustained cell rate (cells/sec) Maximum burst size (cells)
Digi TransPort® Routers User Guide
256
Configuring network interfaces
Configure DSL interfaces
Configure advanced DSL parameters
Web
1. Go to Configuration > Network > Interfaces > DSL > Advanced. 2. Configure the advanced DSL parameters as needed:
Operational mode The connection mode for the DSL link. The following options are available (default is Multi mode).
Values Multi-mode
ANSI G.dmt G.lite ADSL2 ADSL2+
Equivalent web parameter For Annex A models (such as PSTN / POTS) this option provides automatic selection between G.dmt, G.lite and ANSI (in the order listed). For Annex B models (such as ISDN) this option provides automatic selection between G.dmt (in the order listed)
Annex A only-attempt to connect in ANSI T1.413 mode
Attempt to connect in ITU G.992.1 G.dmt mode
Annex A only-attempt to connect in ITU G.992.2 G.lite mode
Connect using ADSL2
Connect using ADSL2+
Load DSL firmware from flash file `dspfw.bin' (if present) Enables use of alternative +ADSL driver firmware and should only be enabled on the advice of the technical support team. This option also requires that an additional file be loaded onto the router.
Enable watchdog This setting should only be enabled on the advice of Digi Technical Support.
Manage this PVC using ATM OAM cells Using Alarm indication signal (AIS) cells downstream and Remote defect indication (RDI) cells upstream, the router can detect faults between the connecting points of the VP/VC and suspend transfer of ATM cells until the VC fault condition is cleared. 3. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
adsl
0
oper_mode Multi,ANSI,G.dmt,G.lite,ADSL2, Operational mode ADSL2+
Digi TransPort® Routers User Guide
257
Configuring network interfaces
Configure DSL interfaces
Command Instance Parameter Values
adsl
0
usefwfile on, off
Equivalent web parameter
Load DSL firmware from flash file
adsl
0
apvc
0
watchdog on, off oammanage on, off
Enable watchdog
Manage this PVC using ATM OAM cells
Additional CLI commands The following command is not available from the web interface: adsl 0 debug {0|1} Where 0 is off and 1 causes debugging information to be sent to the CLI.
Digi TransPort® Routers User Guide
258
Configuring network interfaces
Configure Generic Routing Encapsulation (GRE) interfaces
Configure Generic Routing Encapsulation (GRE) interfaces
Generic Routing Encapsulation (GRE) is a means of transporting IP packets from one device to another through an unencrypted point-to-point IP tunnel. You can configure multiple tunnels to multiple devices. Once configured, a GRE tunnel is created between two devices.
Digi TransPort® Routers User Guide
259
Configuring network interfaces
Configure Generic Routing Encapsulation (GRE) interfaces
Configure GRE tunnel parameters
Web
1. Go to Configuration > Network > Interfaces > GRE > Tunnel n.
2. Configure the GRE tunnel parameters.
Description A memorable name for this GRE instance, to make it easier to identify it.
IP address The IP address of the virtual interface the tunnel uses. Use with the Mask parameter. You must enter this parameter for the tunnel to work.
Mask Use this parameter with the IP address parameter to clarify the subnet in use on the virtual interface. This would normally be a 30-bit mask as this is a point-to-point link (255.255.255.252).
Source IP Address The two sub options here allows you to specify a source address from a specified interface or by manually assigning an address. If you do not select either option, the router uses the default address for the route through which the packet leaves the router. If the interface through which the GRE packets exit does not have NAT enabled, the router uses the default router address, which is the Ethernet 0 address.
Use Interface: The GRE tunnel source interface, which allows the tunnel end point to be a physical interface rather than a virtual IP address. This is for using GRE without IPSec. Do not use these parameters if the parameter below uses the source address. Select the available interface type and number from the drop-down boxes.
Digi TransPort® Routers User Guide
260
Configuring network interfaces
Configure Generic Routing Encapsulation (GRE) interfaces
Use IP Address: A virtual host IP address for the local end of the tunnel, configured for routing purposes. This IP address has no other use and needs no mask as it is a host address, such as 1.1.1.1. Normally, use this option in conjunction with IPSec. Do not use this parameter if the interface is selected as the source using the Use Interface options above.
Destination IP Address or Hostname The FQDN or IP address of the remote end of the tunnel. This could also be the virtual host IP address for the remote end of the tunnel, configured for routing purposes. such as 2.2.2.2.
Enable keepalives on this GRE tunnel Enables or disables the GRE keepalive parameters. Keepalives are needed so allow the router to determine whether the tunnel interface is receiving traffic correctly or not. If keepalives fail, the tunnel is marked as down.
Send a keepalive every s seconds When configured to a non-zero value, keepalive packets is sent to the remote end of the tunnel and the response is monitored to detect if the tunnel is up or down. If the tunnel is detected as down, the routing table metric will be altered. Value is configured in seconds. If this value is set to 0, the router does not use keepalives.
Bring this GRE tunnel down after no replies to n keepalives The consecutive number of keepalive packets that need to fail before the tunnel is detected as being down.
Bring this GRE interface up to send keepalives Whether or not the GRE keepalive packets will activate the tunnel. If set to YES and the tunnel drops the GRE keepalive packet will try to raise the tunnel again. If set to NO and the tunnel has been marked as down due to the GRE keepalives not being received, the router will only raise the tunnel if a packet (other than a GRE keepalive) needs to be routed.
VRF Associates the interface with a particular VRF.
Destination VRF Associates the interface with a particular destination VRF. 3. Click Apply.
Command line
Command Instance Parameter Values
tun
n
descr
Free text field
tun
n
IPaddr
Valid IP address
Equivalent web parameter Description IP Address
Digi TransPort® Routers User Guide
261
Configuring network interfaces
Configure Generic Routing Encapsulation (GRE) interfaces
Command Instance Parameter Values
Equivalent web parameter
tun
n
mask
Valid Subnet Mask
Mask
tun
n
source_ent blank,ETH,PPP Use interface x,y for the source IP address of GRE packets x=Interface type
tun
n
source_ add
0-255
Use interface x,y for the source IP address of GRE packets y=interface number
tun
n
source
Valid IP address
Source IP address to use for GRE packets
tun
n
dest
Valid IP
address
Destination IP address to use for GRE packets
tun
n
kadelay Seconds
Send a keepalive every s seconds
tun
n
karetries Number
Bring this GRE tunnel down after no replies to n keepalives
tun
n
kaactrq On,off
Bring this GRE interface up to send keepalives
tun
n
vrf
integer
VRF
tun
n
vrfdest
integer
Destination VRF
Digi TransPort® Routers User Guide
262
Configuring network interfaces
Configure Generic Routing Encapsulation (GRE) interfaces
Configure advanced GRE parameters
Web
1. Go to Configuration > Network > Interfaces > GRE > Advanced.
2. Configure the advanced GRE tunnel parameters.
Metric The connected metric of an interface. The default metric of a connected interface is 1. By allowing the interface to have a higher value (lower priority), static routes can take preference to interfaces. For normal operation, leave this value unchanged.
MTU The maximum transmission unit. In this text box you can enter the greatest amount of data that can be transferred in one physical packet. The default value is 1400.
Include Tunnel Key The interface normally uses this parameter with multi GRE (mGRE). The tunnel key adds an extra field to the GRE header where a key number can be applied. When enabled, incoming GRE packets must have a matching tunnel key number to be accepted by this tunnel. When enabled, the IP address parameter is not required.
Enable the firewall on this GRE tunnel Turns Firewall script processing on or off for this interface. If using the firewall for problem detection on a tunnel interface, the interface to put OOS will need to be specified, such as:
pass out break end on tun n from any to 100.100.100.29 port=4000 flags S!A inspect-state oos ppp n 5
Digi TransPort® Routers User Guide
263
Configuring network interfaces
Configure Generic Routing Encapsulation (GRE) interfaces
Enable GRE checksums Selects whether to add GRE checksums to GRE packets when the router is terminating a GRE tunnel. Set this parameter to off to disable checksums, and to on to enables checksums.
Enable IGMP on this GRE tunnel This IGMP parameter enables or disables the transmission and reception of IGMP packets on this interface. IGMP advertises members of multicast groups. If IGMP is enabled, and a member of a multicast group is discovered on this interface, multicast packets for this group received on other interfaces are sent out this interface.
Enable DNS inbound blocking Enables or disables blocking DNS requests on the GRE tunnel, to prevent the tunnel from responding to DNS requests over this interface.
Enable IP analysis When set to on, the un-encapsulated IP traffic is captured into the analyser trace.
Enable Tunnel analysis When set to on, the GRE encapsulated packets and keepalives is captured to the analyser trace. 3. Click Apply.
Command line
Command Instance Parameter Values
tun
n
metric
Numeric Metric value
tun
n
MTU
MTU value
tun
n
tunkey Key number
tun
n
Firewall on,off
tun
n
csum
on,off
tun
n
block_dns on,off
tun
n
igmp
on, off
tun
n
ipanon
on, off
tun
n
tunanon on, off
Equivalent web parameter Metric for the route associated with this interface Maximum transmission unit size Key number Turn firewall on or off Enable GRE checksums Enable DNS inbound blocking Enable IGMP packets Enable IP analysis for traffic on this interface Enable GRE tunnel analysis
Note RIP Routing Parameters-command line only: In the command-line interface, there are commands and sub-parameters for GRE Tunnels that specifically relate to RIP. See Configure Routing Information Protocol (RIP) settings to configure these sub parameters.
Digi TransPort® Routers User Guide
264
Configuring network interfaces
Configure ISDN interfaces
Configure ISDN interfaces
TransPort routers fitted with an optional internal ISDN MODEM card have several ISDN configuration settings at Configuration > Network > Interfaces > ISDN. This page has several sets of configuration parameters:
n ISDN Answering n ISDN Dialling n LAPD
Digi TransPort® Routers User Guide
265
Configuring network interfaces
Configure ISDN interfaces
Configure the ISDN interface to receive incoming calls
Digi routers can answer incoming B-channel ISDN calls with three main protocols: rate adaption protocols, LAPB, and PPP. Usually several instances of these protocols exist. This section explains how answering priorities work for the different protocols.
Protocol entities
The following protocol instances are capable of answering an incoming ISDN call:
Adapt Adapt instances provide rate adaptation protocols such as V.120 or V.110.
LAPB LAPB instances allow the router to answer incoming X.25 calls over ISDN. These instances can optionally connect the caller to a synchronous serial port, an asynchronous serial port bound to a PAD, or switch the call to another interface.
PPP IP data tunneled over PPP instances allows remote access to the router's IP-based management features and also facilitates onward IP routing through any of the router's IP enabled interfaces. The router automatically answers an incoming ISDN call if any of the following statements are true, subject to the entity's MSN, Calling Number and Sub-address parameters being set to their default values:
n An Adapt instance is bound to an asynchronous serial port (ASY) and the answer ring count (S0) for that serial port is set to 1
n A LAPB instance has its answering parameter set to On n A PPP instance has its answering parameter set to On
If more than one of these protocols are configured to auto answer then the priority is as follows: Adapt instances (normally V.120) will take priority over LAPB, which will take priority over PPP. If an Adapt instance is bound to an asynchronous serial port (ASY port) but the answer ring count (ATS0) is not set to 1 for that same serial port then Adapt entity will not answer automatically. If any other protocol entities (such as LAPB, PPP or another Adapt instance) are configured to answer then one of these protocol entities will answer the call. If no other protocol entities are configured to answer then a repeating RING message will be sent out of the serial port and the RS232 ring indicator control will be activated. If a terminal attached to the serial port sends ATA followed by carriage return then the ISDN call will be answered by the Adapt entity and any incoming data will be channeled out of the serial port and vice-versa.
Multiple Subscriber Numbers
An MSN (multiple subscriber number) is an alternative number provided by the telephone service provider which when dialed will also route through to your ISDN line. It is possible to purchase several MSNs for an ISDN line. This means that in effect one ISDN line can have several ISDN numbers. Every entity in the router which is capable of answering an ISDN call (Adapt, LABP and PPP) has an MSN parameter. You can use a protocol entity's MSN parameter to:
Digi TransPort® Routers User Guide
266
Configuring network interfaces
Configure ISDN interfaces
n Cause a protocol instance not to answer an incoming ISDN call (if the trailing digits of the ISDN number called do not match the entry in this field).
n Increase the answering priority of an instance (if more than one protocol instance is configured to answer and the trailing digits of the ISDN number called match the value of the MSN parameter for a particular protocol instance).
Example Consider the following:
n An Adapt instance is bound to a serial port and ATS0 for that serial port is set to 1. n PPP instance 0 has answering turned On. n The ISDN line to which the router is connected has two numbers: the main number is 123456
and the MSN number is 123789.
Normally, because ADAPT has a higher answering priority than PPP, the Adapt instance will answer when either of the numbers are called. However if the ISDN number dialed is 123456 and 456 is entered into the MSN parameter of PPP, PPP will answer instead. This will also have the effect of preventing PPP from answering if any other ISDN number (such as 123457) has been called. This means that whenever 123456 is called the PPP instance will answer, and whenever 123789 is called, the V120 instance will answer. You can connect multiple ISDN devices to the same ISDN line. Then, you can use MSNs to allow the different ISDN devices to be dialed individually (such as dial the main ISDN number), and get through to ISDN device one, dial the first MSN and get through to ISDN device number two, dial the second MSN, and get through to ISDN device number three, etc.).
Multiple PPP Instances
It is also possible to configure multiple instances of a particular entity to answer. For example, PPP instance, 0, 1 and 4 could be configured to answer. In this case, provided none of the PPP instances are busy, the PPP instance with the highest number will answer first. You can use MSNs to ensure that a chosen PPP instance answers the call. The multiple protocol entity answering instance rules are as follows:
Adapt The lowest free Adapt instance with auto-answering enabled will answer first.
PPP The lowest free PPP instance with answering on will answer first.
LAPB The lowest free LAPB instance with answering on will answer first.
Web
1. Go to Configuration > Network > Interfaces > ISDNThe ISDN Answering. This page is for configuring the ISDN interface to receive incoming calls.
2. Configure the ISDN answering parameters:
Digi TransPort® Routers User Guide
267
Configuring network interfaces
Configure ISDN interfaces
Load answering defaults button
Click this to button resets the default answering PPP interface (PPP 0) to the factory answering defaults.
Description A memorable name for this PPP instance, to make it easier to identify it. Only accept calls from calling numbers ending with Restricts the range of numbers from which ISDN will answer incoming calls, such as the ISDN interface will only answer a call if the trailing digits of the calling number match what is specified by this parameter. For example, if this parameter was set to 3, incoming calls from 1234563 would be answered but calls from 1234567 would not.
with ISDN MSN ending with
If answering is disabled this parameter is not used. Provides the filter for the ISDN Multiple Subscriber Numbering facility. It is blank by default but when set to an appropriate value on an answering interface, it will cause the router to answer incoming calls to only telephone numbers where the trailing digits match the value selected. For example, setting this parameter to 123 will prevent the router from answering any calls to numbers that do not end in 123.
with ISDN sub-address ending with
If answering is disabled this parameter is not used. Provides the filter for the ISDN sub-address facility. It is blank by default but when set to an appropriate value on an ISDN answering interface, it will cause the router to answer incoming calls only to ISDN numbers where the trailing digits match the Sub-address value. For example, setting the this parameter to 123 will prevent the router from answering any calls to numbers that do not end in 123.
Use the following local IP configuration
Local IP Address: The IP address of the router's ISDN answering interface. Set this field to the desired local IP address.
Attempt to assign the following IP configuration to remote devices Set this parameter if the remote system needs a supplied address. The interface makes an attempt to negotiate an IP address from the IP address pool. Generally, this parameter is enabled for incoming connections. When enabled, displays the following parameters:
Assign remote IP addresses from a.b.c.d to a.b.c.d The range of IP addresses supplied to incoming callers. This parameter may require alteration if the default value 10.10.10.0 to 10.10.10.4 does not suit the remote network configuration.
Digi TransPort® Routers User Guide
268
Configuring network interfaces
Configure ISDN interfaces
Mask The IP netmask for the Remote network. Use this setting to create a dynamic route to the remote network whenever the ISDN interface is active.
Primary DNS server The answering ISDN interface would normally supply its own PPP IP address to the peer for DNS requests. This parameter allows you to specify an alternative DNS IP address.
Secondary DNS server A secondary DNS server IP address to the peer for DNS requests, if required.
Enable NAT on this interface Enables or disables IP Network Address Translation (NAT) on the answering ISDN interface. When enabled, displays the following options:
IP Address
Enable standard Network Address Translation (NAT).
IP address and Port
Enable Network Address and Port Translation (NAPT).
Enable IPsec on this interface Enables or disables IPSec processing on the ISDN interface. If enabled, packets sent or received on this interface must pass through the IPSec code before being transmitted. IPSec may drop the packet, pass it unchanged, or encrypt and encapsulate within an IPSec packet. When enabled, displays the following parameters:
Keep Security Associations (SAs) when this ISDN interface is disconnected Configures the router to keep any existing IKE and IPsec associations should the link drop. This is usually applied on head-end routers with fixed IP addresses.
Use interface X, Y for the source IP address of IPsec packets By default, the source IP address for an IPSec Eroute is the IP address of the interface on which IPSec was enabled. By setting this parameter to either a PPP or Ethernet interface, the source IP address IPSec uses will match that of the specified Ethernet or PPP interface.
Enable the firewall on this interface Enables or disables the Firewall script processing for the mobile interface.
Note If the firewall is enabled on an interface and with the absence of any firewall rules, the default action is to block ALL traffic. To configure the firewall, see Firewall.
3. Click Apply.
Digi TransPort® Routers User Guide
269
Configuring network interfaces
Command line
Command ppp ppp ppp
Instance 0 0 0
Parameter name cingnb msn
Values Free text field number number
ppp
0
sub
number
ppp
0
ppp
0
ppp
0
ipaddr mask ipmin
IP address Network mask IP address
ppp
0
iprange
1-255
ppp
0
ppp
0
ppp
0
dnsserver secdns do_nat
IP address IP address 1
ppp
0
do_nat
2
ppp
0
ppp
0
ipsec
1
ipsec
2
ppp
0
ppp
0
ppp
0
ipsecent
Default,Ethernet,PPP
ipsecadd number
firewall
on/off
Configure ISDN interfaces
Equivalent web parameter Description:
ending with
with ISDN MSN ending with
with ISDN sub-address ending with
Local IP Address:
Mask:
Assign remote IP addresses from a.b.c.d to a.b.c.d
Assign remote IP addresses from a.b.c.d to a.b.c.d
Primary DNS server:
Secondary DNS server:
Enable NAT on this interface IP Address:
Enable NAT on this interface IP address and Port:
Enable IPsec on this interface
Keep Security Associations (SAs) when this ISDN interface is disconnected
Use interface X, Y for the source IP address of IPsec packets
Use interface X, Y for the source IP address of IPsec packets
Enable the firewall on this interface
Digi TransPort® Routers User Guide
270
Configuring network interfaces
Configure ISDN interfaces
Configure ISDN dialing parameters
Web
1. Go to Configuration > Network > Interfaces > ISDN > ISDN Dialling. When the router is first powered up, navigating to the Configuration > Network > Interfaces > ISDN page displays a message indicating that the MODEM card does not have a PPP instance associated with it. Follow the link on the page and select an unassigned PPP interface to the MODEM. When the browser is refreshed and the Configuration > Network > Interfaces > ISDN page redisplayed, it should show the parameters described below, along with a message at the top of the page indicating which PPP instance has been selected.
2. Configure ISDN dialing parameters:
This ISDN interface is using PPP n This message simply states which PPP instance has been assigned to the interface.
Description A memorable name for the interface. This may be useful when referring to the interface, rather than having to remember the name and the function of the interface.
Dial out using numbers The telephone numbers to use to make an outgoing connection, in sequence.
Prefix n to the dial out number The dialing prefix to use, if needed. This may be necessary when using a PABX.
Username The username to use when using the PPP instance to connect to the remote peer. This username is normally provided by an ISP for use with a dial-in Internet access service.
Password The password to use for authenticating the remote peer, along with the above username.
Confirm password Type the password into this text box to enable the router to confirm that the password has been entered identically in both boxes.
Allow the remote device to assign a local IP address to this router When this radio button is selected, the remote peer will assign this PPP interface an IP address.
Try to negotiate a.b.c.d as the local IP address for this router If it would be useful, but not essential, to have a predefined IP address for the interface, the second radio button should be selected and the desired IP address entered into the text box to the right.
Digi TransPort® Routers User Guide
271
Configuring network interfaces
Configure ISDN interfaces
Use a.b.c.d as the local IP address for this router If it is essential that the PPP interface has a specific IP address, this radio button should be selected and the IP address entered into the text box.
Use the following DNS servers if not negotiated
Primary DNS server The IP address of the primary DNS server to use if a DNS server is not assigned as part of the PPP negotiation and connection process. It is fairly common practice for the DNS server to be assigned automatically by the ISP when making a connection.
Secondary DNS server The IP address of the secondary DNS server to use if one is not automatically assigned by the remote peer.
Attempt to assign the following IP configuration to remote devices When checked, this check box reveals the following four configuration parameters which control how the PPP instance assigns an IP address to a connecting remote peer. The primary and secondary DNS server addresses will also be sent to the remote peer
Assign remote IP addresses from a.b.c.d to a.b.c.d The IP addresses that define the pool of IP addresses to assign to remote peers during the IP protocol configuration phase of the PPP negotiation process.
Primary DNS server The IP address of the primary DNS server that the remote peer should use when making DNS requests over the link.
Secondary DNS server The IP address of the secondary DNS server that the remote peer should use when making DNS requests, should the primary server be unavailable.
Allow the PPP interface to answer incoming calls When enabled, causes the PPP instance to answer an incoming call.
Only allow calling numbers ending with n When set to answer calls, this setting provides a filter for ISDN sub-addresses. This value is blank by default but when the PPP instance is set to answer calls, only numbers having trailing digits that match the sub-address value in this test will be answered. So for example, if this value is set to 123, only calls from numbers with trailing digits that match this value will be answered; for example, 01942 605123.
Enable NAT on this interface Enables Network Address Translation to operate on this interface. This is the same as for other PPP interfaces.
IP address/IP address and Port Whether IP address translation only should be applied or whether port number translation should also be applied to IP packets.
Digi TransPort® Routers User Guide
272
Configuring network interfaces
Configure ISDN interfaces
Enable IPsec on this interface When enabled, causes the router to encrypt traffic on this interface using the IPsec protocol. The following two additional configuration parameters are revealed when this box is checked.
Keep Security Associations (SAs) when this ISDN interface is disconnected When enabled, causes the router to maintain (such as not flush) the SA when the interface becomes disconnected. The normal behavior is to remove the SAs when the interface becomes disconnected.
Use interface x,y for the source IP address of IPsec packets If it is required to use another interface (such as not the interface currently being configured) as the source address for IPsec packets, this may be achieved by selecting the desired interface from the drop-down list and typing the desired interface instance number into the adjacent text box.
Enable the firewall on this interface When enabled, applies the firewall rules to traffic using this interface. 3. Click Apply.
Command line
Command Instance Parameter
ppp
n
name
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
phonenum ph2 ph3 ph4 prefix
ppp
n
username
ppp
n
password
ppp
n
IPaddr
Values Up to 25 characters up to 25 digits " " " 0-9999999999
Up to 60 characters Up to 40 characters 0.0.0.0
Equivalent web parameter Description
Dial out using numbers " " " Prefix n to the dial out number Username
Password
Allow the remote device to assign a local IP address to this router
Digi TransPort® Routers User Guide
273
Configuring network interfaces
Command Instance Parameter
ppp
n
IPaddr
ppp
n
l_addr
ppp
n
ppp
n
DNSserver secDNS
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
IPmin
IPrange
transDNS sectransDNS ans cingnb do_nat
ppp
n
nat_ip
Configure ISDN interfaces
Values
Equivalent web parameter
Valid IP address a.b.c.d
Try to negotiate a.b.c.d as the local IP address for this router (in conjunction with l_ addr)
off, on When on, allows negotiation When off, forces use of specified IP address
Use a.b.c.d as the local IP address of this router
Valid IP address a.b.c.d
Use the following DNS servers if not negotiated Primary DNS server a.b.c.d
Valid IP address a.b.c.d
Use the following DNS servers if not negotiated Secondary DNS server a.b.c.d
Valid IP address a.b.c.d
Assign remote IP addresses from a.b.c.d to a.b.c.d
0-255
Assign remote IP addresses from a.b.c.d to a.b.c.d
Valid IP address Primary DNS server a.b.c.d a.b.c.d
Valid IP address Secondary DNS server
a.b.c.d
a.b.c.d
off, on
Allow this PPP interface to answer incoming calls
up to 25 digits
Only allow calling numbers ending with n
0, 1, 2 0=Disabled 1=IP address 2=IP address and port
Enable NAT on this interface IP address/IP address and Port
Valid IP address NAT Source IP address
a.b.c.d
a.b.c.d
Digi TransPort® Routers User Guide
274
Configuring network interfaces
Command Instance Parameter
ppp
n
ipsec
ppp
n
firewall
Configure ISDN interfaces
Values 0=Disabled 1=Enabled 2=Enabled and Keep SAs
off, on
Equivalent web parameter
Enable IPsec on this interface/ Keep Security Associations when this ISDN interface is disconnected
Enable the firewall on this interface
Digi TransPort® Routers User Guide
275
Configuring network interfaces
Configure ISDN interfaces
Configure advanced ISDN parameters
Web
1. Go to Configuration > Network > Interfaces > ISDN > Advanced 2. Configure advanced ISDN parameters as needed:
Metric The route metric that should be applied to this interface. For details, see Configure PPP parameters.
Enable "Always On" mode of this interface When enabled, causes the following two options to appear.
On/On and return to service immediately These two radio buttons select whether the always-on functionality should simply be enabled or whether the additional facility to return the interface to the In Service state should be applied.
Put this interface "Out of Service" when an always-on connection attempt fails Normally, always-on interfaces do not go out of service unless they have connected at least once. When enabled, causes the router to put the interface out of service even if the first connection attempt fails.
Attempt to re-connect after s seconds Specifies the length of time in seconds that the router should wait after an always-on PPP connection has been terminated before trying to re-establish the link.
If an inhibited PPP interface is connected, attempt to re-connect after s seconds The value in this setting takes precedence over the previous parameter when another PPP instance that is usually inhibited by this one is connected. This parameter typically reduces the connection retry rate when a lower priority PPP instance is connected.
Wait s seconds after power-up before activating this interface The initial delay that the router applies before activating the PPP instance after power-up. After the initial power-up delay the normal always-on activation timers apply. If set to 0, no delay will be applied.
Control when this interface can connect using Time band n Enables the time band function and allows selecting the desired time band instance. See Configuring time bands for more information on time bands.
Keep this interface up for at least s seconds The minimum period that the PPP interface should remain available. This means that even if the link becomes inactive before this period expires, the connection will remain open.
Digi TransPort® Routers User Guide
276
Configuring network interfaces
Configure ISDN interfaces
Close this interface
After s seconds The maximum time that the link remains active in any one session. After this time, the link will be deactivated.
If it has been up for m minutes in a day The router deactivates the PPP instance after it has been active for the value specified in this text box.
If the link has been idle for s seconds The router deactivates this interface after the time specified in this text box if it detects that the link has not passed any traffic for that period.
Alternative idle timer for static routes s seconds An alternative inactivity timeout for use in conjunction with the Make PPP n interface use the alternative idle timeout when this route becomes available parameter on the Configuration > Network > IP Routing/Forwarding > Static Routes > Routes n > Advanced web page. The router uses timeout until the PPP instance next deactivates only. After that, it uses the normal timeout value.
If the link has not received any packets for s seconds The amount of time that the router will wait without receiving any PPP packets before disconnecting. The timer is reset with each received PPP packet.
If the negotiation is not complete in s seconds The maximum time (in seconds) allowed for the PPP negotiation to complete. If negotiations have not completed within this period, the interface is deactivated.
Generate an event after this interface has been up for m minutes The number of minutes (if any) after which the router should create an event in the event log that states that the interface has been active for this period.
Limit the data transmitted over this interface When enabled, displays the following parameters that control any data volume restrictions that should be applied to this interface.
Issue a warning event after n units The amount of traffic which causes a warning event to be generated in the event log stating that the specified amount of data has been transferred. The units are specified by a drop-down list, having the options kilobytes, megabytes, gigabytes. For example, if the monthly tariff includes up to 5 MB of data before excess usage charges are levied, it would be useful to set this threshold to 4 MB. This would cause the router to create a warning entry in the event log once 4 MB of data had been transferred. You could use this event to trigger an email alert, SNMP trap or SMS alert message.
Stop data from being transmitted after n units The total amount of data that may be transmitted by this PPP instance before the link is blocked for further traffic, and the value in the drop-down list specifies the units which are kilobytes, megabytes, gigabytes.
Digi TransPort® Routers User Guide
277
Configuring network interfaces
Configure ISDN interfaces
Reset the data limit on the n day of the month The day of the month on which the data limit is reset to 0. 3. Click Apply.
Command line
Command ppp ppp
Instance n n
Parameter metric aodion
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
immoos
aodi_dly aodi_dly2
pwr_dly
tband
minup maxup maxuptime timeout timeout2 rxtimeout
Values
Equivalent web parameter
0-255
Metric
0-2 0=disabled 1=enabled 2=On and return to service immediately
Enable "Always On" mode of this interface, On, On and return to service immediately
on, off
Put this interface "Out of Service" when an always-on connection attempt fails
0-2147483647
Attempt to reconnect after s seconds
0-2147483647
If an inhibited PPP interface is connected, attempt to reconnect after s seconds
0-2147483647
Wait s seconds after power-up before activating this interface
0-4
Control when this interface
can connect using Time Band
n
0-2147483647
Keep this interface up for at least s seconds
0-2147483647
Close this interface after s seconds
0-2147483647
if it has been up for m minutes in a day
0-2147483648
if the link has been idle for s seconds
0-2147483648
Alternative idle timer for static routes s seconds
0-2147483648
if the link has not received any packets for s seconds
Digi TransPort® Routers User Guide
278
Configuring network interfaces
Command Instance Parameter
ppp
n
maxneg
ppp
n
uplogmins
ppp
n
ppp
n
ppp
n
dlwarnkb dlstopkb
dlrstday
Configure ISDN interfaces
Values 0-2147483648 0-2147483647
0-2147483647 0-2147483647 0-255
Equivalent web parameter
if the negotiation is not complete in s seconds
Generate an event after this interface has been up for m mins
Issue a warning after n units
Stop data from being transmitted after n units
Reset the data limit on the n day of the month
Digi TransPort® Routers User Guide
279
Configuring network interfaces
Configure ISDN interfaces
Configure ISDN Link Access Protocol D (LAPD) parameters
Link Access Protocol D (LAPD) is the protocol for ISDN D-channel signaling and call setup. You can use LAPD 0 and LAPD 1 as required for SAPI 16 traffic, such as X.25 over D-channel. LAPD 2 is normally reserved for ISDN call control.
Web
1. Go to Configuration > Network > Interfaces > ISDN > LAPD.The ISDN LAPD parameters page configures the ISDN LAPD interfaces.
2. Configure LAPD interface parameters:
Enable LAPD n Disabling this parameter disables the LAPD instance. This may be necessary if you have an installation where two or more routers are connected to the same ISDN S bus. In this case, only one of the routers may be configured for D-channel X.25 on TEI1, SAPI16. On each of the other routers you must disable any LAPD instance for which the TEI is set to 1 in order to prevent it from responding to X.25 traffic on that TEI that is actually destined for another router. When checked, this check box will also reveal the following configuration parameters.
Mode When the DTE/DCE mode parameter is set to DTE, the router behaves as a DTE. This is the default value and should not be changed for normal operation across the ISDN network. If your application involves using two routers back-to-back, one of the routers should have the DTE mode value set to DCE.
N400 Counter The standard LAPB/LAPD retry counter. The default value is 3 and it should not normally be necessary to change this.
RR Timer n msecs The standard LAPB/LAPD Receiver Ready timer. The default value is 10,000ms (10 seconds) and it should not normally be necessary to change this.
T1 Timer n msecs The standard LAPB/LAPD timer. The default value is 1000 milliseconds (1 second) and it should not normally be necessary to change this.
T200 Timer n msecs The standard LAPB/LAPD re-transmit timer, in milliseconds. The default value is 1000 milliseconds (1 second) and it should not normally be necessary to change this.
TEI Each ISDN terminal device connected to your ISDN basic rate outlet must be assigned a unique Terminal Endpoint Identifier (TEI). In most cases, this is negotiated automatically. In some cases however, it may be necessary to assign a fixed TEI. When TEI is set to 255, the TEI is negotiated with the ISDN network. To use a fixed TEI set the TEI parameter to the appropriate value as specified by your service provider.
Digi TransPort® Routers User Guide
280
Configuring network interfaces
Configure ISDN interfaces
D-channel X.25 Tx Window Size The transmit window size when using D-channel X.25. The default is 7.
Tx Throughput Used in conjunction with the Rx Throughput parameter to limit the maximum data throughput on a LAPD link in bits per second. If this parameter is set to 0, the router will transmit data across the LADP link as fast as possible whilst observing hardware or software flow control if enabled. When set to a value greater than 0, the router will limit the rate at which data is transmitted over the LAPD link.
Note If multiple PAD or IP instances are sharing this LAPD instance, the maximum transmission rates of all instances will be limited.
Rx Throughput Used in conjunction with the Tx Throughput parameter to limit the maximum data throughput on a LAPD link in bits per second. If this parameter is set to 0, the router will transmit data across the LADP link as fast as possible whilst observing hardware or software flow control if enabled. When set to a value greater than 0, the router will limit the rate at which data can be received over the LAPD link when it detects that receive throughput exceeds the specified rate.
Note If multiple PAD or IP instances are sharing this LAPD instance, the maximum transmission rates of all instances will be limited.
Reactivate D-channel connection When enabled, the router tries to reactivate a D-channel connection after disconnection by the network by transmitting SABME frames. If it is unable to reactivate the connection after retrying the number of times specified by the N400 counter, it will wait for 1 minute before repeating the retry sequence. Enabling this parameter also deactivates the Reactivate after n secs parameter. If this parameter is disabled, the router will not attempt to reactivate a D-channel link following deactivation by the network.
Reactivate after n secs The number of seconds a deactivation has to be present before the LAPD instance will try to reactivate itself.
After X.25 PAD session is terminated Determines whether the LAPD session is deactivated when an X.25 PAD session is terminated.
Deactivate the LAPD session Enables automatic deactivation of a LAPD session when an X.25 PAD session is terminated.
Do not deactivate the LAPD session Ensures the router does not deactivate the LAPD session when an X.25 PAD session is terminated.
Digi TransPort® Routers User Guide
281
Configuring network interfaces
Configure ISDN interfaces
Enable D64S Mode D64S mode is a mode for using ISDN B-channel(s) without the need to use any D channel protocol. It is sometimes referred to as nailed-up ISDN. To enable this mode for this LAPD instance, enable the D64S mode parameter, and make sure the TEI parameter is set to 255. This means that for any application that uses ISDN (such as. PPP) the application uses D64S mode.
First D64S B-channel When using D64S mode, there is no dialing protocol to negotiate which B-channel to use. This must therefore be specified using this parameter. Check the B1 radio button to select channel B1. Check the B2 radio button to select channel B2 (if another channel is requested from an application then it will use the other unused B channel). 3. Click Apply.
Command line
Command LAPD LAPD LAPD LAPD LAPD LAPD LAPD LAPD LAPD LAPD LAPD LAPD LAPD
LAPD
LAPD LAPD
Instance n n n n n n n n n n n n n
n
n n
Parameter enabled dtemode n400 tnoact t1time t200 tei window tthruput rthruput keepact reactsecs nodeact
nodeact
d64smode d64schan
Values off, on off, on 1-255 1000-60000 1-60000 1-60000 0-255 1-7 0-1410065407 0-1410065407 off, on 0-2147483647 off
on
off, on 1, 2
Equivalent web parameter Enable LAPD n Mode N400 Counter RR Timer n msecs T1 Timer n msecs T200 Timer n msecs TEI D-channel X.25 Tx Window Size Tx Throughput Rx Throughput Reactivate D-channel connection Reactivate after n secs After X.25 PAD session is terminated: Deactivate the LAPD session After X.25 PAD session is terminated: Do not deactivate the LAPD session Enable D64S Mode First D64S B-channel: B1, B2
Digi TransPort® Routers User Guide
282
Configuring network interfaces
Configure ISDN interfaces
Configure ISDN to answer V.120 calls
V.120 is a protocol designed to provide high-speed point-to-point communication over ISDN. It provides rate adaptation and can optionally provide error control. Both the calling and called routers must be configured to use V.120 before data can be transferred. Similarly, if one router is configured to use the error control facility, the other must be configured in the same way.
Initial setup
Before using V.120 you must first bind one of the two available V.120 instances to the required ASY port.
Web
1. Go to Configuration > Network > Interfaces > Serial > Protocol Bindings and bind one of the V.120 instances to the ASY port. See Configure protocol bindings for more information about these settings.
2. Select the appropriate method of flow control for the ASY port. Go to Configuration > Network > Interfaces > Serial > Serial Port n .
Command line
1. Use the bind command; for example:
bind v120 0 asy 0
2. Use the AT&K command to configure flow control for the ASY port. Configure other ASY port options such as command echo, result code format, etc. as needed.
Initiating a V.120 call
Command line
Once the initial configuration is complete, initiate V.120 calls using the appropriate ATD command. For example:
atd01234567890
A successful connection is indicated by a CONNECT result code being issued to the ASY port, and the router will switch into on-line mode. In this mode, all data from the terminal attached to the bound ASY port is passed transparently through the router across the ISDN network to the remote system. Similarly, all data from the remote system is passed directly to the terminal attached to the bound ASY port. If a V.120 call fails the router will issue the NO ANSWER or NO CARRIER result code to the ASY port and remain in command mode. You can use the ATD command to route a call to an ISDN sub-address by following the telephone number with the letter S and the required sub-address value. For example:
atd01234567890s003
In this case, the remote system only answers the call if it was configured to accept incoming calls on the specified sub-address.
Digi TransPort® Routers User Guide
283
Configuring network interfaces
Configure ISDN interfaces
Answering V.120 calls
Command line
To enable V.120 answering from the command interface, set register S0 for the appropriate ASY port to a non-zero value. For example:
ats0=1
To ensure that you have set S0 for the correct ASY port, either enter it directly on that port or use the AT\PORT command to select the correct port first. The actual value for the parameter sets the number of rings the router will wait before answering. Finally, you must ensure that there are no conflicts with other protocols configured to answer on other ASY ports. To do this, disable answering for the other ports/protocols or by using the MSN and/or Sub-address parameters to selectively answer calls to different telephone numbers using different protocols. For example, if you have subscribed to the ISDN MSN facility, you may have been allocated say four telephone numbers ending in 4, 5, 6, and 7. You could then set the MSN parameter for the appropriate V.120 instance to 4 to configure V.120 to answer only incoming calls to the MSN number ending in 4. If PPP answering is enabled, verify that you have not selected the same MSN and Sub-address values for PPP. If they are the same, V.120 will answer the call only if S0 is set to 1. Otherwise, PPP will take priority and answer the call.
Digi TransPort® Routers User Guide
284
Configuring network interfaces
Configure PSTN interfaces
Configure PSTN interfaces
These settings apply to TransPort routers fitted with an optional internal PSTN MODEM card.
Web
1. Go to Configuration > Network > Interfaces > PSTN. 2. When the router is first powered up, this page shows a message indicating that the MODEM
card does not have a PPP instance associated with it. Follow the link on the page and select an unassigned PPP interface to the MODEM. 3. Refresh your browser and go to Configuration > Network > Interfaces > PSTN. The page should show the following parameters, along with a message at the top of the page indicating the selected PPP instance. Configure these parameters as needed:
This PSTN interface is using PPP n
Which PPP instance has been assigned to the interface.
Description
A memorable name for the PSTN interface. This may be useful when referring to the interface, rather than having to remember the name and the function of the interface.
Dial out using numbers
The telephone numbers to make an outgoing connection, in sequence.
Prefix n to the dial out number
The dialing prefix to use, if needed. This may be necessary when using a PABX.
Username
The username to use when using the PPP instance to connect to the remote peer. This is normally provided by an ISP for use with a dial-in Internet access service.
Password
The password to use for authenticating the remote pee, along with the above username.
Confirm password
Type the password into this text box to enable the router to confirm that the password was entered identically in both boxes.
Allow the remote device to assign a local IP address to this router
When selected, the remote peer assigns this PPP interface an IP address.
Try to negotiate a.b.c.d as the local IP address for this router
If it is useful essential to have a predefined IP address for the interface, select the second radio button and enter the desired IP address into the text box to the right. This field is optional.
Digi TransPort® Routers User Guide
285
Configuring network interfaces
Configure PSTN interfaces
Use a.b.c.d as the local IP address for this router
If it is essential that the PPP interface has a specific IP address, select this radio button and the IP address entered into the text box.
Use the following DNS servers if not negotiated
Primary DNS server
The IP address of the primary DNS server to use if a DNS server is not assigned as part of the PPP negotiation and connection process. It is fairly common practice for the DNS server to be assigned automatically by the ISP when making a connection.
Secondary DNS server
The IP address of the secondary DNS server to use if one is not automatically assigned by the remote peer.
Attempt to assign the following IP configuration to remote devices
When enabled, reveals the following four configuration parameters which control how the PPP instance assigns an IP address to a connecting remote peer. The primary and secondary DNS server addresses are also sent to the remote peer
Assign remote IP addresses from a.b.c.d to a.b.c.d
The pool of IP addresses to assign to remote peers during the IP protocol configuration phase of the PPP negotiation process.
Primary DNS server
The IP address of the primary DNS server that the remote peer should use when making DNS requests over the link.
Secondary DNS server
The IP address of the secondary DNS server that the remote peer should use when making DNS requests, should the primary server be unavailable.
Allow the PPP interface to answer incoming calls
When enabled, causes the PPP instance to answer an incoming call.
Only allow calling numbers ending with n
When set to answer calls, the value in this text box provides a filter for ISDN sub-addresses. This value is blank by default but when the PPP instance is set to answer calls, only numbers having trailing digits that match the sub-address value in this test will be answered. So for example, if this value is set to 123, only calls from numbers with trailing digits that match this value will be answered; for example, 01942 605123.
Enable NAT on this interface
When enabled, enables Network Address Translation to operate on this interface. This is the same as for other PPP interfaces.
Digi TransPort® Routers User Guide
286
Configuring network interfaces
Configure PSTN interfaces
IP address/IP address and Port
Select whether IP address translation only should be applied or whether port number translation should also be applied to IP packets.
Enable IPsec on this interface
When enabled, causes the router to encrypt traffic on this interface using the IPsec protocol. The following two additional configuration parameters are revealed when this box is checked.
Keep Security Associations (SAs) when this PSTN interface is disconnected
When enabled, causes the router to maintain (such as not flush) the SA when the interface becomes disconnected. The normal behavior is to remove the SAs when the interface becomes disconnected.
Use interface x,y for the source IP address of IPsec packets
If it is required to use another interface (such as not the interface currently being configured) as the source address for IPsec packets, this may be achieved by selecting the desired interface from the drop-down list and typing the desired interface instance number into the adjacent text box.
Enable the firewall on this interface
When enabled, applies the firewall rules to traffic using this interface. 4. Click Apply.
Command line
Command Instance Parameter
ppp
n
name
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
phonenum ph2 ph3 ph4 prefix
ppp
n
username
ppp
n
password
Values Up to 25 characters up to 25 digits " " " 0-9999999999
Up to 60 characters Up to 40 characters
Equivalent web parameter Description
Dial out using numbers " " " Prefix n to the dial out number Username
Password
Digi TransPort® Routers User Guide
287
Configuring network interfaces
Command Instance Parameter
ppp
n
IPaddr
ppp
n
IPaddr
ppp
n
l_addr
ppp
n
ppp
n
DNSserver secDNS
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
IPmin IPrange transDNS sectransDNS ans cingnb do_nat
ppp
n
nat_ip
Configure PSTN interfaces
Values
Equivalent web parameter
0.0.0.0
Allow the remote device to assign a local IP address to this router
Valid IP address a.b.c.d
Try to negotiate a.b.c.d as the local IP address for this router (in conjunction with l_addr)
off, on When on, allows negotiation when off, force use of specified IP address
Use a.b.c.d as the local IP address of this router
Valid IP address a.b.c.d
Use the following DNS servers if not negotiated Primary DNS server a.b.c.d
Valid IP address a.b.c.d
Use the following DNS servers if not negotiated Secondary DNS server a.b.c.d
Valid IP address Assign remote IP addresses
a.b.c.d
from a.b.c.d to a.b.c.d
0-255
Assign remote IP addresses from a.b.c.d to a.b.c.d
Valid IP address Primary DNS server a.b.c.d a.b.c.d
Valid IP address Secondary DNS server
a.b.c.d
a.b.c.d
off, on
Allow this PPP interface to answer incoming calls
up to 25 digits
Only allow calling numbers ending with n
0, 1, 2 0=Disabled 1=IP address 2=IP address and port
Enable NAT on this interface IP address/IP address and Port
Valid IP address NAT Source IP address
a.b.c.d
a.b.c.d
Digi TransPort® Routers User Guide
288
Configuring network interfaces
Command Instance Parameter
ppp
n
ipsec
ppp
n
firewall
Configure PSTN interfaces
Values 0=Disabled 1=Enabled 2=Enabled and Keep SAs
off, on
Equivalent web parameter
Enable IPsec on this interface/ Keep Security Associations when this PSTN interface is disconnected
Enable the firewall on this interface
Digi TransPort® Routers User Guide
289
Configuring network interfaces
Configure PSTN interfaces
Configure advanced PSTN parameters
Web
1. Go to Configuration > Network > Interfaces > PSTN > Advanced. 2. Configure advanced PTSN parameters as needed:
Metric The route metric that should be applied to this interface. See Configure PPP parameters for more detail.
Enable "Always On" mode of this interface When enabled, causes the following two options to appear.
On/On and return to service immediately Select whether the always-on functionality should simply be enabled or whether the additional facility to return the interface to the In Service state should be applied.
Put this interface "Out of Service" when an always-on connection attempt fails Normally, always-on interfaces do not go out of service unless they have connected at least once. When enabled, causes the router to put the interface out of service even if the first connection attempt fails.
Attempt to re-connect after s seconds The length of time in seconds that the router should wait after an always-on PPP connection has been terminated before trying to re-establish the link.
If an inhibited PPP interface is connected, attempt to re-connect after s seconds The value in this text box takes precedence over the previous parameter when another PPP instance that is usually inhibited by this one is connected. Use this parameter to reduce the connection retry rate when a lower priority PPP instance is connected.
Wait s seconds after power-up before activating this interface The initial delay that the router applies before activating the PPP instance after power-up. After the initial power-up delay the normal always-on activation timers apply. If set to 0, no delay is applied.
Control when this interface can connect using Time band n These two controls, the check box and drop-down list, determine whether the time band function should be applied to this interface. Enabling this setting enables the functionality and the desired time band instance is selected from the drop-down list. See Configuring time bands for more information about the time band function.
Keep this interface up for at least s seconds The minimum period that the PPP interface should remain available. This means that even if the link becomes inactive before this period expires, the connection remains open.
Digi TransPort® Routers User Guide
290
Configuring network interfaces
Configure PSTN interfaces
Close this interface
After s seconds The maximum time that the link remains active in any one session. After this time, the link is deactivated.
If it has been up for m minutes in a day The router deactivates the PPP instance after it has been active for the value specified in this text box.
If the link has been idle for s seconds The router deactivates this interface after the time specified in this text box if it detects that the link has not passed any traffic for that period.
Alternative idle timer for static routes s seconds An alternative inactivity timeout for use in conjunction with the Make PPP n interface use the alternative idle timeout when this route becomes available parameter on the Configuration > Network > IP Routing/Forwarding > Static Routes > Routes n > Advanced page. The router uses this timeout until the PPP instance next deactivates only. After that, it uses the normal timeout value.
If the link has not received any packets for s seconds The amount of time that the router will wait without receiving any PPP packets before disconnecting. The timer is reset with each received PPP packet.
If the negotiation is not complete in s seconds The maximum time, in seconds, allowed for the PPP negotiation to complete. If negotiations have not completed within this period, the interface is deactivated.
Generate an event after this interface has been up for m minutes The number of minutes, if any, after which the router should create an event in the event log that states that the interface has been active for this period.
Limit the data transmitted over this interface When enabled, displays the following parameters that control what data volume restrictions (if any) should be applied to this interface.
Issue a warning event after n units The amount of traffic that causes a warning event to be generated in the event log stating that the specified amount of data has been transferred. The units are specified by a drop-down list, with the options of kilobytes, megabytes, gigabytes. For example, if the monthly tariff includes up to 5 MB of data before excess usage charges are levied, it is useful to set this threshold to 4 MB. This would cause the router to create a warning entry in the event log once 4 MB of data is transferred. You could use this event to trigger an email alert, SNMP trap, or SMS alert message.
Stop data from being transmitted after n units The total amount of data transmitted by this PPP instance before the link is blocked for further traffic. The value in the drop-down list specifies the units: kilobytes, megabytes, or gigabytes.
Digi TransPort® Routers User Guide
291
Configuring network interfaces
Configure PSTN interfaces
Reset the data limit on the n day of the month The day of the month on which the data limit is reset to 0. 3. Click Apply.
Command line
Command ppp ppp
Instance n n
Parameter metric aodion
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
immoos
aodi_dly aodi_dly2
pwr_dly tband minup maxup maxuptime timeout timeout2 rxtimeout maxneg
Values
Equivalent web parameter
0-255
Metric
0-2 0=disabled 1=enabled 2=On and return to service immediately
Enable "Always On" mode of this interface, On, On and return to service immediately
on, off
Put this interface "Out of Service" when an always-on connection attempt fails
0-2147483647 Attempt to reconnect after s seconds
0-2147483647
If an inhibited PPP interface is connected, attempt to reconnect after s seconds
0-2147483647 Wait s seconds after power-up before activating this interface
0-4
Control when this interface can
connect using Time Band n
0-2147483647 Keep this interface up for at least s seconds
0-2147483647 Close this interface after s seconds
0-2147483647 if it has been up for m minutes in a day
0-2147483648 if the link has been idle for s seconds
0-2147483648 Alternative idle timer for static routes s seconds
0-2147483648 if the link has not received any packets for s seconds
0-2147483648 if the negotiation is not complete in s seconds
Digi TransPort® Routers User Guide
292
Configuring network interfaces
Command Instance Parameter
ppp
n
uplogmins
ppp
n
ppp
n
ppp
n
dlwarnkb dlstopkb
dlrstday
Configure PSTN interfaces
Values 0-2147483647
0-2147483647 0-2147483647 0-255
Equivalent web parameter
Generate an event after this interface has been up for m mins
Issue a warning after n units
Stop data from being transmitted after n units
Reset the data limit on the n day of the month
Digi TransPort® Routers User Guide
293
Configuring network interfaces
Configure DialServ interfaces
Configure DialServ interfaces
The Dialserv option module mimics a telephone exchange in that it supplies the required voltages on the line, generates a RING signal and has off-hook detection circuitry. You can use Dialserv to provide similar functionality to dialing into an ISP using an analogue modem. The card also contains an analog modem to handle data on the line.
Web
1. Go to Configuration > Network > Interfaces > DialServ. 2. Configure DialServ parameters:
Use PPP/Protocol Switch
These radio buttons select whether the DialServ card uses a PPP instance or the protocol switch functionality to control traffic on the interface. If PPP is selected, the web page expands to display the standard PPP configuration settings. If Protocol Switch is selected, only the four settings described immediately below are visible.
Max time to RING line s seconds
The maximum number of seconds that the RING signal should be generated for.
RING frequency n Hz
The DialServ module generates a RING signal. The frequency of the RING is selected from this drop-down list. The available options are:
n 20Hz n 25Hz n 30Hz n 40Hz n 50Hz
Initialisation string 1
The text string in this text box contains any required modem initialization commands.
Initialisation string 2
The text string in this text box contain initialization commands that will be issued to the modem after the first initialization string. 3. Click Apply.
Digi TransPort® Routers User Guide
294
Configuring network interfaces
Configure DialServ interfaces
Configure DialServ network settings
Web
1. Go to Configuration > Network > Interfaces > DialServ > DialServ Network Settings. 2. You can configure the DialServ card to use PPP as the protocol to connect to the remote peer
and as such should be assigned a free PPP instance to use as part of the configuration. If no PPP instance has been assigned and the module has been configured to use PPP, a link to the PPP mappings page and message appear. If a PPP instance has been assigned, the following DialServ network settings appear. Configure these settings as needed:
This DialServ interface is using PPP n The PPP instance (n) the DialServ card uses.
Description A short string that describes the interface, which you can use as a convenience when referring to the interface.
Dial out using numbers The telephone numbers to use in making an outgoing connection, in sequence. Use these numbers to provide a dialback facility.
Prefix n to the dial out number The dialing prefix to use, if needed. This may be necessary when using a PABX.
Username The username to use when using the PPP instance to connect to the remote peer.
Password The password to use for authenticating the remote peer; specified in conjunction with the Username.
Confirm Password Type the password into this text box to enable the router to confirm that the password has been entered identically in both boxes.
Allow the remote device to assign a local IP address to this router When this radio button is selected, the remote peer will assign this PPP interface an IP address.
Try to negotiate a.b.c.d as the local IP address for this router If it would be useful, but not essential, to have a predefined IP address for the interface, the second radio button should be selected and the desired IP address entered into the text box to the right.
Use a.b.c.d as the local IP address for this router If it is essential that the PPP interface has a specific IP address, this radio button should be selected and the IP address entered into the text box.
Digi TransPort® Routers User Guide
295
Configuring network interfaces
Configure DialServ interfaces
Use the following DNS servers if not negotiated
Primary DNS server The IP address of the primary DNS server to use if a DNS server is not assigned as part of the PPP negotiation and connection process. It is fairly common practice for the DNS server to be assigned automatically by the ISP when making a connection.
Secondary DNS server The IP address of the secondary DNS server to use if one is not automatically assigned by the remote peer.
Attempt to assign the following IP configuration to remote devices When enabled, displays the following four configuration parameters that control how the PPP instance assigns an IP address to a connecting remote peer. The primary and secondary DNS server addresses will also be sent to the remote peer.
Assign remote IP addresses from a.b.c.d to a.b.c.d The IP addresses in these text boxes define the pool of IP addresses to assign to remote peers during the IP protocol configuration phase of the PPP negotiation process.
Primary DNS server The IP address of the primary DNS server the remote peer should use when making DNS requests over the link.
Secondary DNS server The IP address of the secondary DNS server that the remote peer should use when making DNS requests, should the primary server be unavailable.
Allow the PPP interface to answer incoming calls When enabled, causes the PPP instance to answer an incoming call.
Only allow calling numbers ending with n When the router is set to answer calls, this setting provides a filter for ISDN sub-addresses. This value is blank by default but when the PPP instance is set to answer calls, only numbers having trailing digits that match the sub-address value in this test will be answered. For example, if this value is set to 123, only calls from numbers with trailing digits that match this value will be answered; for example, 01942 605123.
Enable NAT on this interface When enabled, enables Network Address Translation to operate on this interface. This is the same as for other PPP interfaces.
IP address/IP address and Port Select whether IP address translation only should be applied or whether port number translation should also be applied to IP packets.
Enable IPsec on this interface When enabled, causes the router to encrypt traffic on this interface using the IPsec protocol. The following two additional configuration parameters are revealed when this box is checked.
Digi TransPort® Routers User Guide
296
Configuring network interfaces
Configure DialServ interfaces
Keep Security Associations (SAs) when this PSTN interface is disconnected When enabled, causes the router to maintain (such as not flush) the SA when the interface becomes disconnected. The normal behavior is to remove the SAs when the interface becomes disconnected.
Use interface x,y for the source IP address of IPsec packets If it is required to use another interface (such as not the interface currently being configured) as the source address for IPsec packets, this may be achieved by selecting the desired interface from the drop-down list and typing the desired interface instance number into the adjacent text box.
Enable the firewall on this interface When enabled, applies the firewall rules to traffic using this interface. 3. Click Apply.
Command line
Command Instance Parameter
ppp
n
name
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
phonenum ph2 ph3 ph4 prefix username
ppp
n
password
ppp
n
IPaddr
ppp
n
IPaddr
Values Up to 25 characters up to 25 digits " " " 0-9999999999 Up to 60 characters Up to 40 characters 0.0.0.0
Valid IP address a.b.c.d
Equivalent web parameter Description
Dial out using numbers Dial out using numbers Dial out using numbers Dial out using numbers Prefix Username
Password
Allow the remote device to assign a local IP address to this router Try to negotiate a.b.c.d as the local IP address for this router (in conjunction with l_ addr)
Digi TransPort® Routers User Guide
297
Configuring network interfaces
Command Instance Parameter
ppp
n
l_addr
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
DNSserver secDNS IPmin
IPrange
transDNS sectransDNS ans do_nat
ppp
n
ppp
n
natip ipsec
ppp
n
firewall
Configure DialServ interfaces
Values
Equivalent web parameter
off, on When on, allows negotiation When off, force use of specified IP address
Use a.b.c.d as the local IP address for this router (not negotiable)
Valid IP address Primary DNS server a.b.c.d
Valid IP address Secondary DNS server a.b.c.d
Valid IP address a.b.c.d
Assign remote IP addresses from a.b.c.d to a.b.c.d
0-255
Assign remote IP addresses from a.b.c.d to a.b.c.d
Valid IP address Primary DNS server
a.b.c.d
a.b.c.d
Valid IP address Secondary DNS server
a.b.c.d
a.b.c.d
off, on
Allow this PPP interface to answer incoming calls
0, 1, 2 0=Disabled 1=IP address 2=IP address and port
Enable NAT on this interface IP address/IP address and Port
Valid IP address NAT Source IP address
a.b.c.d
a.b.c.d
0=Disabled 1=Enabled 2=Enabled and Keep SAs
Enable IPsec on this interface/ Keep Security Associations when this DialServ interface is disconnected
off, on
Enable the firewall on this interface
Digi TransPort® Routers User Guide
298
Configuring network interfaces
Configure DialServ interfaces
Configure advanced DialServ parameters
Web
1. Go to Configuration > Network > Interfaces > DialServ > Advanced. 2. Configure advanced DialServ parameters as needed:
Metric The route metric that should be applied to this interface.
Enable "Always On" mode of this interface When enabled, the following two options are displayed:
On/On and return to service immediately Select whether the always-on functionality should simply be enabled or whether the additional facility to return the interface to the In Service state should be applied.
Put this interface "Out of Service" when an always-on connection attempt fails. Normally, always-on interfaces do not go out of service unless they have connected at least once. When enabled, this setting causes the router to put the interface out of service even if the first connection attempt fails.
Attempt to re-connect after s seconds The length of time, in seconds, the router should wait after an "always-on" PPP connection has been terminated before trying to re-establish the link.
If an inhibited PPP interface is connected, attempt to re-connect after s seconds This setting takes precedence over the previous parameter when another PPP instance that is usually inhibited by this one is connected. Use this parameter to reduce the connection retry rate when a lower priority PPP instance is connected.
Wait s seconds after power-up before activating this interface The initial delay that the router will apply before activating the PPP instance after power-up. After the initial power-up delay the normal always-on activation timers apply. If set to 0, no delay is applied.
Control when this interface can connect using Time band n Enables the time band function and allows selecting the desired time band instance. See Configuring time bands for more information on time bands.
Keep this interface up for at least s seconds The minimum period that the PPP interface should remain available. This means that even if the link becomes inactive before this period expires, the connection remains open.
Digi TransPort® Routers User Guide
299
Configuring network interfaces
Configure DialServ interfaces
Close this interface
after s seconds The maximum time that the link will remain active in any one session. After this time, the link will be deactivated.
If it has been up for m minutes in a day The router deactivates the PPP instance after it has been active for the value specified in this text box.
If the link has been idle for s seconds The router deactivates this interface after the time specified in this text box if it detects that the link has not passed any traffic for that period.
Alternative idle timer for static routes s seconds An alternative inactivity timeout for use in conjunction with the Make PPP n interface use the alternative idle timeout when this route becomes available parameter on the Configuration > Network > IP Routing/Forwarding > Static Routes > Routes n > Advanced web page. The router uses this timeout until the PPP instance next deactivates only. After that, it uses the normal timeout value.
If the link has not received any packets for s seconds The amount of time that the router waits without receiving any PPP packets before disconnecting. The timer is reset with each received PPP packet.
If the negotiation is not complete in s seconds The maximum time, in seconds, allowed for the PPP negotiation to complete. If negotiations have not completed within this period, the interface is deactivated.
Generate an event after this interface has been up for m minutes The number of minutes, if any, after which the router should create an event in the event log that states that the interface has been active for this period.
Limit the data transmitted over this interface When enabled, displays the following parameters that control what data volume restrictions, if any, should be applied to this interface:
Issue a warning event after n units The amount of traffic that will cause a warning event to be generated in the event log stating that the specified amount of data has been transferred. The units are specified by a drop-down list, having the following options; KBytes, MBytes, GBytes. For example, if the monthly tariff includes up to 5 MB of data before excess usage charges are levied, it would be useful to set this threshold to 4 MB. This causes the router to create a warning entry in the event log once 4 MB of data is transferred. You could use this event could to trigger an email alert, SNMP trap, or SMS alert message.
Stop data from being transmitted after n units The total amount of data that may be transmitted by this PPP instance before the link is blocked for further traffic. The value in the drop-down list specifies the units: KBytes, MBytes, or GBytes.
Digi TransPort® Routers User Guide
300
Configuring network interfaces
Configure DialServ interfaces
Reset the data limit on the n day of the month The day of the month on which the data limit is reset to 0. 3. Click Apply.
Command line
Command ppp ppp
Instance n n
Parameter metric aodion
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
immoos
aodi_dly aodi_dly2
pwr_dly tband minup maxup maxuptime timeout timeout2 rxtimeout maxneg
Values
Equivalent web parameter
0-255
Metric
0-2 0=disabled 1=enabled 2=On and return to service immediately
Enable "Always On" mode of this interface, On, On and return to service immediately
on, off
Put this interface "Out of Service" when an always-on connection attempt fails
0-2147483647 Attempt to reconnect after s seconds
0-2147483647
If an inhibited PPP interface is connected, attempt to reconnect after s seconds
0-2147483647 Wait s seconds after power-up before activating this interface
0-4
Control when this interface can
connect using Time Band n
0-2147483647 Keep this interface up for at least s seconds
0-2147483648 Close this interface after s seconds
0-2147483647 if it has been up for m minutes in a day
0-2147483648 if the link has been idle for s seconds
0-2147483648 Alternative idle timer for static routes s seconds
0-2147483648 if the link has not received any packets for s seconds
0-2147483648 if the negotiation is not complete in s seconds
Digi TransPort® Routers User Guide
301
Configuring network interfaces
Command Instance Parameter
ppp
n
uplogmins
ppp
n
ppp
n
dlwarnkb dlstopkb
ppp
n
dlrstday
Configure DialServ interfaces
Values 0-2147483647
0-2147483647 0-2147483647
0-255
Equivalent web parameter
Generate an event after this interface has been up for m mins
Issue a warning after n units
Stop data from being transmitted after n units
Reset the data limit on the n day of the month
Digi TransPort® Routers User Guide
302
Configuring network interfaces
Configure serial interfaces
Configure serial interfaces
Digi routers support a variety of serial interfaces, either inbuilt or as optional add-on modules. Each asynchronous serial (ASY) port may be configured to operate at different speed, data format etc. These parameters may be changed using the web interface or from the command line using AT commands and S registers.
Web
1. Go to Configuration > Network > Interfaces > Serial. 2. A list of supported serial interfaces displays below the Serial link. Click one of the interfaces to
configure basic serial configuration.
Note On models fitted with W-WAN modules, one of the interfaces and its associated web page are dedicated to the W-WAN module. The title will reflect this. Similarly, on models fitted with an analogue modem, one of the interfaces will be entitled PSTN port.
Enable this serial interface
When disabled, this is the only item that appears in the section. Enabling this setting displays additional configuration parameters.
Description
A description for the interface. For example, if the serial interface is connected to a card payment device, the description could read Till 1 or similar appropriate text.
Baud Rate
The required baud rate for the associated serial port.
Data Bits / Parity
The required data format for the interface. 8 data bits, no parity is a very common configuration.
Digi TransPort® Routers User Guide
303
Configuring network interfaces
Configure serial interfaces
Note When the serial port is not in 8-bit parity mode (such as it is in either 8-bit no parity, or 7bit with parity), the router will continually check for parity when receiving AT commands and adjust and match accordingly.
Flow Control
The router supports software flow control using XON/XOFF characters and hardware flow control using the RS232 RTS and CTS signals. Use this drop-down list to select Software, Hardware or a combination of Both. To disable flow control, select the None option.
Enable echo on this interface
When enabled, enables command echo when using the command line interpreter. Disable this setting if the attached terminal provides local echo.
CLI result codes
The required level of verbosity for command result codes. The available options are: n Verbose n Numeric n None
3. Click Apply.
Command line
Command Instance Parameter Values
asy
n/a
descr
Free text-description of
interface
S31=n
n/a
n/a
Where n= 2: 230400 3: 115200 4: 57600 5: 38400 6: 19200 7: 9600 8: 4800 9: 2400 10: 1200 11: 600 12: 300
S23=n
n/a
n/a
Where n= 0=None 1=Odd 2=Even 5=8 Data Odd 6=8 Data Even Default 0
Equivalent web parameter Description Baud rate
Data Bits / Parity
Digi TransPort® Routers User Guide
304
Configuring network interfaces
Command Instance Parameter Values
&Kn
n/a
n/a
Where n = 0=None 1=Hardware 2=Software 3=Both
&En
n/a
n/a
Where n = 0=No echo 1=echo
&Vn
n/a
n/a
Where n = 0=numeric 1=verbose
Configure serial interfaces Equivalent web parameter Flow Control
Enable echo on this interface CLI result codes
Digi TransPort® Routers User Guide
305
Configuring network interfaces
Configure serial interfaces
Configure advanced serial port parameters
Web
1. Go to Configuration > Network > Interfaces > Serial > Serial Port n > Advanced.
2. Configure advanced serial parameters as needed:
Answer V.120 calls after n rings (0 = Don't answer) Controls the answering of incoming V.120 calls. When set to 0, V.120 answering is disabled, otherwise V.120 answering is enabled on this interface. Enter the number of rings to wait before answering the call into this text box. This is equivalent to setting the value of the S0 register for the associated serial port.
DCD Selects how the Data Carrier Detect (DCD) signal is controlled. The available options are:
n Auto: Configures the router so that it will only assert the DCD line when an ISDN connection has been established; this is equivalent to AT&C1.
n On: Configures the router such that the DCD line is always asserted when the router is powered-up; this is equivalent to AT&C0.
n Off: Configures the router such that the DCD line is normally asserted but is deasserted for the time period specified by the S10 register after a call is disconnected; this is equivalent to AT&C2.
n Pulse Low
DTR Control This drop-down selection box controls how the router responds to the DTR signal. The available options are:
n None: Configures the router to ignore the DTR signal; this is equivalent to AT&D0. n Drop call: Configures the router to disconnect the current call and return to AT
command mode when the DTR signal from the attached terminal (DTE) is de-asserted; this is equivalent to AT&D1.
Digi TransPort® Routers User Guide
306
Configuring network interfaces
Configure serial interfaces
n Drop line and call: Configures the router to disconnect the current call, drop the line and return to AT command mode when the DTR signal is de-asserted; this is equivalent to AT&D2.
n Drop call on transition n Drop line and call on transition
DTR de-bounce time s x 20 milliseconds The length of time, in multiples of 20 milliseconds, for which the DTR signal must be deasserted before the router acts on any options that are set to trigger on loss of this signal. Enter the desired multiple into the text box. Increasing this value makes the router less sensitive to "bouncing" of the DTR signal. Conversely, decreasing this value makes the router more sensitive. The default of 100 milliseconds (5 times 20 milliseconds) is a reasonable value.
Escape Character The character for the escape sequence. The default is the + symbol (ASCII value 43, 0x2b). Changing this value has the same effect as changing the S2 register.
Escape Delay s x 20 milliseconds The required minimum length of the pause in the escape sequence, in multiples of 20 milliseconds. The default is 50 x 20 milliseconds, which means the escape sequence becomes +++, a pause of 1 second and then AT, to drop back to AT command mode. If a delay of some other value is required, enter it in the text box.
Forwarding Timeout s x 10 milliseconds The length of time that the router will wait for more data after receiving at least one octet of data through the serial port and transmitting it onwards. This timer is reset each time more data is received. The router will forward data onwards when either the forwarding timer expires or the input buffer becomes full. This parameter applies to ADAPT, TCPDIAL, TCPPERM and PANS.
Break Transmit Escape Character c The character in the escape sequence. The - symbol (ASCII value 45, 0x2d) is a recommended value. Changing this value has the same effect as changing the S3 register. To use the break sequence, type - three times, with a 1-second pause either side of the three - characters. When the Async port detects the following sequence, instead of outputting the three minus characters (they are removed from the output stream), a BREAK condition is placed on the Async transmitter for 1 second:
<guard time 1 sec>---<guard time 1 sec>
Async Mode Available on specific hardware versions only. The Async Mode allows you to select whether the serial port should use RS232 or RS485 mode. You can also select whether to use RS485 termination, and whether to use half-duplex (two wire) or full-duplex mode. 3. Click Apply.
Digi TransPort® Routers User Guide
307
Configuring network interfaces
Configure serial interfaces
Command line
Command Instance Parameter Values
S0=n
n/a
n/a
Where n=0-255
&Cn
n/a
n/a
Where n = 0=On 1=Auto 2=Off 3=Pulse low
&Dn
n/a
n/a
Where n = 0=None 1=Drop line 2=Drop line & call 5=Drop call on transition 6=Drop line & call on
transition
S45=n
n/a
n/a
Where n=0-255
S2=n
n/a
n/a
Where n=ASCII value
S12=n
n/a
n/a
Where n=0-255
S15=n
n/a
n/a
Where n=0-255
S3=n
n/a
n/a
Where n=ASCII value
Equivalent web parameter Answer V.120 call after n rings DCD
DTR
DTR de-bounce Escape Character Escape delay Forwarding Timeout Break Transmit Escape Character
Profiles
Each serial port can have two profiles which can be configured differently. The Profiles settings select which profile is in force when the router powers-up.
Web
Digi TransPort® Routers User Guide
308
Configuring network interfaces
Configure serial interfaces
Use profile n at power-up Select 0 from the drop-down selection box to choose profile 0 to be active when the router powers-up. Select 1 from the selection box to make profile 1 the active profile.
Load Config from Profile n Select 0 from the drop-down selection box and click the button to load profile 0.
Apply & Save Changes to Profile n Select 0 from the drop-down selection box and click the button to apply configuration changes and save profile 0 after making any changes.
Command line
Command &Yn &Zn &Wn
Instance
Parameter
Values Where n =0, 1 Where n =0, 1 Where n =0, 1
Equivalent web parameter Use profile n at power-up Load Config from Profile n Apply & Save Changes to Profile n
Digi TransPort® Routers User Guide
309
Configuring network interfaces
Configure serial interfaces
Configure synchronous communications
The most common form of serial communications currently is asynchronous. Synchronous serial communications links are still in use, and TransPort routers can support these. HDLC is a synchronous protocol still in use that you can use with TransPort routers. This section describes how to configure the synchronous communications interfaces. To enable synchronous mode, a protocol such as LAPB must be configured to use a synchronous port as its lower layer interface. On certain models, an informational message will appear on the web page which states that jumper settings may need to be changed in order to support synchronous serial operation.
Note The number of synchronous serial ports available varies depending on the model and any optional modules fitted.
Web
1. Go to Configuration > Network > Interfaces > Serial > Serial Port n > Sync Port n. 2. Configure synchronous port settings:
Description A description of the interface, if one is required.
Clock source Internal / External Specifies whether the synchronous port generates the clock signal (Internal) or relies on an external source for the clock signal (External).
Mode The specific serial protocol to use. Which buttons appear depend upon the capabilities of the interface. The options available are; V.35, EIA530, RS232, EIA530A, RS449, and X.21.
Invert RX clock When enabled, causes the router to invert the voltage level of the receive clock signal.
Invert TX clock When enabled, causes the router to invert the voltage level of the transmit clock signal.
Encoding NRZ / NRZI Select between non-return to zero (NRZ) and non-return to zero (inverted) (NRZI) signal encodings. 3. Click Apply.
Command line
Command Instance
sy
0
sy
0
Parameter descr clksrc
Values
Equivalent web parameter
Text description of interface Description
int,ext
Clock source
Digi TransPort® Routers User Guide
310
Configuring network interfaces
Command Instance
sy
0
sy
0
sy
0
Parameter rxclkinv txclkinv encode
Values off, on off, on nrz,nrzi
Configure serial interfaces
Equivalent web parameter Invert RX clock Invert TX clock Encoding
Digi TransPort® Routers User Guide
311
Configuring network interfaces
Configure serial interfaces
Configure rate adaptation
The router supports two rate adaptation protocol (Adapt) instances. Each instance enables the selection and configuration of the protocol to use for rate adaptation over an ISDN B channel. The supported protocols are V.110, V.120, and X.75. Depending on which protocol is selected, there may be an associated LAPB instance (distinct from the two general purpose LAPB instances), as for example, when error-corrected (multi-frame) mode uses V.120.
Web
1. Go to Configuration > Network > Interfaces > Serial > Rate Adaption. There are two rate adaption instances. These pages show displays the configuration parameters directly relevant to the rate adaptation protocol only, LAPB configuration pages are to be found here in the Configuration > Network > Legacy Protocols > X.25 > LAPB page. When configuring LAPB parameters, be aware that adapt 0 uses LAPB 2 and adapt 1 uses LAPB 3.
2. Configure rate adaption parameters as needed:
Attempt to redial the connection n times if rate adaption has not been negotiated If an ISDN connection is established, but rate adaption is not negotiated, the value in this text box specifies how many times the router should drop the connection and redial it.
Drop the connection if it is idle for h hrs m mins s secs The time to wait before dropping the connection if the connection becomes idle.
Leased line mode When enabled, allows the router to attempt to maintain the connection automatically once it has been established.
Enable TCP rate adaption When enabled, enables use of rate adaptation when using a TCP connection rather than an ISDN line. When enabled, the following controls become enabled:
Digi TransPort® Routers User Guide
312
Configuring network interfaces
Configure serial interfaces
Connect to IP Address a.b.c.d Port n When using a TCP connection, these text entry boxes allow the user to specify the IP address and port number that the protocol should use.
Listen on Port The port number that the router is listening on when in socket mode. 3. Click Apply.
Command line
Command adapt adapt adapt adapt
adapt
adapt adapt
Instance 0, 1 0, 1 0, 1 0, 1
0, 1
0, 1 0, 1
Parameter dial_retries tinact leased_line sockmode
ip_addr
ip_port lip_port
Values
Equivalent web parameter
0-255
Attempt to redial the connection n times
0-86400
Drop the connection if it is idle for h hrs m mins s secs
off, on
Leased line mode
0, 1 0=disable 1=enable
Enable TCP rate adaption
valid IP address a.b.c.d
Connect to IP Address a.b.c.d Port n
valid TCP port Connect to IP Address a.b.c.d Port
number
n
valid TCP port Listen on Port n number
Digi TransPort® Routers User Guide
313
Configuring network interfaces
Configure serial interfaces
Configure command alias mappings
The router supports a number of command aliases which specify strings to be substituted for commands entered at the command line.
Web
1. Go to Configuration > Network > Interfaces > Serial > Command Mappings. The table on the Command Mappings page contains two text entry boxes and an Add button. You can specify up to 23 command mappings. For example, suppose a user coming from a UnixTM background feels more comfortable typing ls rather than the native dir command in order to list the files in a directory. To achieve this aliasing, enter ls into the From column in the table, dir into the To column and then click the Add button.
2. Enter the command alias mappings
From The substitute text.
To The command that should be substituted.
Add Click this button to add the command mapping.
Delete When the mapping has been added, a Delete button is enabled in the right-hand column. Clicking this button removes the binding from the table.
Allow AT Responses Enables or disables entry of AT commands and their responses over the serial port.
Note If either the From or To string contains spaces, the entire string must be enclosed within double quotation marks. When substituting a command, upper case characters are considered the same as the corresponding lower case characters.
3. Click Apply.
Digi TransPort® Routers User Guide
314
Configuring network interfaces
Configure serial interfaces
Command line
Command Instance Parameter Values
cmd
n
cmdmapi Replacement command
cmd
n
cmdmapo Command to be substituted
Equivalent web parameter From To
Digi TransPort® Routers User Guide
315
Configuring network interfaces
Configure serial interfaces
Configure protocol bindings
Digi routers can be configured to allow using different protocols on different interfaces. The process of selecting which protocol to use on a particular interface is referred to as binding. For example, you could use Serial (ASY) port 0 for an ISDN B channel X.25 connection, where PAD 0 is bound to Serial 0 (assuming that PAD 0 is the required PAD). To complete this example it is also necessary to associate the PAD with a LAPB instance using the appropriate page. Protocols are bound to serial interfaces using a table with a drop-down list box for selecting the protocol and a drop-down list for selecting the serial port. By default, if no specific protocol is bound to a serial interface, a PPP instance is automatically associated with that port. This means that PPP is treated as the default protocol associated with the serial ports.
Web
1. Go to Configuration > Network > Interfaces > Serial > Protocol Bindings.
2. Bind protocols to serial interfaces:
Protocol Select the desired protocol from this drop-down list.
Bound to Select the desired serial port from this drop-down list.
Add Click this button to add the binding.
Delete When a binding has been added, it appears in the table and a Delete button is enabled in the right-hand column. Click this button to remove the binding. Note that the binding does not come into force until the Apply button at the bottom of the page has been clicked. 3. Click Apply.
Digi TransPort® Routers User Guide
316
Configuring network interfaces
Configure serial interfaces
Command line
Entity Instance Parameter Values
bind n
prot1
Valid protocol, such as PAD 0
bind n
id1
Valid serial port such as ASY 5
Equivalent web parameter Protocol Bound to
Display list of current bindings To display a list of the current bindings enter the command:
bind ?
Bind a V.120 instance 0 to asynchronous serial port 3
bind pad 0 asy 0 binds PAD 0 to serial port 0. bind v120 0 asy 3
Access the Internet using PPP To access the Internet using PPP via a terminal connected to serial interface 2, enter the command:
bind ppp 1 asy 2
Bind a TANS instance to an ADAPT instance Currently it is only possible to bind a TANS instance to an ADAPT instance using the bind command. The format of the command is:
bind adapt <instance> tans <instance>
Digi TransPort® Routers User Guide
317
Configuring network interfaces
Configure serial interfaces
Configure virtual serial ports
TransIP is a way of using virtual serial ports for serial connections over an IP socket, multiplying the number of concurrent serial connections to a router. You can configure TransIP to actively connect on a TCP socket, such as making outgoing connections.
Web
1. Go to Configuration > Network > Interfaces > Serial > TransIP Serial Ports. The message at the top of the TRANSIP Serial Ports page states which serial interface the TransIP connection uses.
2. Configure virtual serial ports:
Listen on port n The TCP port number that the router should listen on.
Connect to IP Address or Hostname a.b.c.d Port n A valid IP address or hostname the router uses to make the outgoing TransIP connection. If this parameter is set to a non-zero number, the number is the TCP port number to use when making TCP socket connections. When set to 0, TransIP listening on the port defined above only.
Send TCP Keep-Alives every s seconds The amount of time, in seconds, a connection stays open without any traffic being passed.
Enable Stay Connected mode When enabled, causes the router to refrain from clearing the TCP socket at the end of a transaction, data call or data session (depending on what the TansIP serial port was bound to and what protocol it was using). When disabled, the router can clear the socket. For example, if the TransIP port is bound to a TPAD and the setting is disabled, the TransIP TCP socket is cleared at the end of the TPAD transaction.
Digi TransPort® Routers User Guide
318
Configuring network interfaces
Configure serial interfaces
Disable command echo When enabled, disables command echo for the TransIP port. When disabled, all commands issued are echoed back to the TransIP TCP socket.
Escape char c The ASCII character to use as the escape character. The default character is +. Entering this escape character three times followed by a pause of at least the Escape delay parameter and an AT command causes the router to switch back to command mode from online mode. This is equivalent to the S2 register setting.
Escape delay s milliseconds The delay required between entering the escape sequence (default +++) and the AT command for the router to drop back into command mode. This is equivalent to the S12 register setting. 3. Click Apply.
Command line
Command transip transip transip transip transip transip transip transip
Instance n n n n n n n n
Parameter port
host
remport
keepact
staycon
cmd_echo_ off escchar esctime
Values
Equivalent web parameter
Valid port number 0- Listen on port 65535
Valid IP address a.b.c.d Connect to IPaddress
or hostname
a.b.c.d or Hostname
Valid port number 0- Port 65535
0-255
Send TCP Keep-Alives every s seconds
on, off
Enable Stay Connected mode
on, off
Disable command echo
Valid ASCII character 0-255
Escape char c
Escape delay s milliseconds
Digi TransPort® Routers User Guide
319
Configuring network interfaces
Configure serial interfaces
Configure port redirection using RealPort
Digi devices use the patented RealPort COM/TTY port redirection for Microsoft Windows.
RealPort software provides a virtual connection to serial devices, no matter where they reside on the network. The software is installed directly on the host PC and allows applications to talk to devices across a network as though the devices were directly attached to the host. Actually, the devices are connected to a Digi device somewhere on the network. RealPort is unique among COM port redirectors because it is the only implementation that allows multiple connections to multiple ports over a single TCP/IP connection. Other implementations require a separate TCP/IP connection for each serial port. Unique features also include full hardware and software flow control, as well as tunable latency and throughput. Access to RealPort services can be enabled or disabled.
Encrypted RealPort
Digi devices also support RealPort software with encryption. Encrypted RealPort offers a secure Ethernet connection between the COM or TTY port and a device server or terminal server.
Encryption prevents internal and external snooping of data across the network by encapsulating the TCP/IP packets in a Secure Sockets Layer (SSL) connection and encrypting the data using Advanced Encryption Standard (AES), one of the latest, most efficient security algorithms. Access to Encrypted RealPort services can be enabled or disabled. Digi's RealPort with encryption driver has earned Microsoft's Windows Hardware Quality Lab (WHQL) certification. Drivers are available for a wide range of operating systems, including Microsoft Windows Server 2003, Windows XP, Windows 2000, Windows NT, Windows 98, Windows ME; SCO Open Server; Linux; AIX; Sun Solaris SPARC; Intel; and HP-UX. It is ideal for financial, retail/point-of-sale, government or any application requiring enhanced security to protect sensitive information.
Digi TransPort® Routers User Guide
320
Configuring network interfaces
Configure serial interfaces
Web
1. Go to Configuration > Network > Interfaces > Serial > RealPort.
2. Configure RealPort parameters:
Enable RealPort Enables RealPort on the router.
Listen on port n The TCP port on which the router will listen for RealPort connections.
Maximum number of sockets The maximum number of RealPort connections that the router will support.
Enable encrypted RealPort Selecting this option enables encrypted RealPort on the router.
Encryption mode to listen on port n The TCP port on which the router will listen for encrypted RealPort connections.
Maximum number of encryption sockets The maximum number of encrypted RealPort connections that the router will support.
Enable Device Initiated RealPort Selecting this option enables router to make a RealPort connection to a host PC.
Digi TransPort® Routers User Guide
321
Configuring network interfaces
Configure serial interfaces
Connect to host a.b.c.d Port n The IP address or hostname and TCP port that the router should use when making a device initiated connection.
Allow s seconds between connection attempts The interval, in seconds, between device initiated connection attempts.
Send TCP Keep-Alives every s seconds The interval at which TCP Keep-Alives are sent over the RealPort connection. A value of 0 means that Keep-Alives are not sent.
Send RealPort Keep-Alives every s seconds The interval at which RealPort Keep-Alives are sent over the RealPort connection. A value of 0 means that Keep-Alives are not sent.
Enable exclusive mode Enables exclusive mode. Exclusive mode allows a single connection from any one RealPort client ID to be connected only. If this setting is enabled and a subsequent connection occurs that has the same source IP as an existing connection, the old existing connection is forcibly reset under the assumption that it is stale.
Enable authentication Enables RealPort authentication.
Authentication secret Configures the RealPort authentication secret. 3. Click Apply.
Command line
Command rport rport rport rport rport
rport
rport rport
Instance 0 0 0 0 0
Parameter enabled ipport maxnbsocks encryption encport
0
maxnbencsocks
0
initiate
0
IPaddr
Values
Equivalent web parameter
off, on
Enable RealPort
0-65535
Listen on port n
0-255
Maximum number of sockets
off, on
Enable encrypted RealPort
0-65535
Encryption mode to listen on port
0-255
Maximum number of encryption sockets
off, on
Enable Device Initiated RealPort
Valid IP address Connect to host a.b.c.d Port n a.b.c.d
Digi TransPort® Routers User Guide
322
Configuring network interfaces
Configure serial interfaces
Command rport rport
Instance 0 0
Parameter initiateport initiatebackoff
Values 0-65535 0-255
rport
0
tcpkeepalives
0-255
rport
0
rportkeepalives 0-255
rport
0
exclusive
off, on
rport
0
auth
off, on
rport
0
secret
Up to 30 characters
Equivalent web parameter Connect to host a.b.c.d Port n
Allow s seconds between connection attempts
Send TCP Keep-Alives every s seconds
Send RealPort Keep-Alives every s seconds
Enable exclusive mode
Enable authentication
Authentication secret
Digi TransPort® Routers User Guide
323
Configuring network interfaces
Configure serial interfaces
Configure sending serial data to multiple serial ports
Web
1. Go to Configuration > Network > Interfaces > Serial > MultiTX > MultiTX Serial Port n. The MultiTX page is for enabling and setting the MultiTX parameters. This page supports sending serial data to multiple (up to 5) TCP or UDP destinations. When enabled, the configured ASY port is opened and serial data from the port is sent to all configured destinations.
2. Configure MultiTX settings:
Enable Multitx When enabled, displays the MultiTX settings in the web interface and enables the MultiTX function on the router.
Serial Port The serial interface to use. Data received on this serial will be forwarded to all configured remote hosts.
Protocol Selects the transport method: either TCP or UDP.
Socket Inactivity Timeout If there is no data transmitted for the specified number of seconds, the socket will be closed. 0=no timeout.
Source port The source port number.
Digi TransPort® Routers User Guide
324
Configuring network interfaces
Configure serial interfaces
Send Socket ID When enabled, the text entered into the Socket ID field is transmitted to the remote host when the socket connects.
Reopen Closed Socket Enables an always-on mode. If the socket is closed for any reason, the router attempts to reconnect to the remote host.
Socket ID Used in conjunction with Send Socket ID. The text entered is transmitted when the socket connects. You can use \r for CR and \n r NL. To specify hexadecimal, use \xhh where hh is the hexadecimal code. For example \x04 defines binary character 04.
Send serial data only when the match string is present Enables or disables the match string function.
Match String When enabled, forwards serial data to remote hosts only when the Match String text is present.
Strip match string before sending When enabled, the text in the Match String field is removed before forwarding the data to the remote host.
Remote host Up to five remote hosts can be specified in these fields.
Host Enter the hostname or IP address of the remote host in this field.
Port Enter the TCP or UDP port number that the remote host is listening on.
Add Click this button to add the remote host. 3. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
multitx 0
enabled
off, on
Enable MultiTX
multitx 0
srcport
off, on (default: Serial Port off)
multitx 0
prot1
off, on (default: protocol off)
Digi TransPort® Routers User Guide
325
Configuring network interfaces
Configure serial interfaces
Command Instance Parameter Values
Equivalent web parameter
multitx 0
send_ sockid
0-255 (default: Send Socket ID 0)
multitx 0
keepopen off, on
Reopen Closed Socket
multitx 0
sockid
Socket ID
multitx 0
fwd_match 0-65535
Send serial data only when the match string is present
multitx 0
matchstring 0-255
Match String
multitx 0
Strip_ match
off, on
Strip match string before sending
Digi TransPort® Routers User Guide
326
Configuring network interfaces
Configure IPv6 addressing support
Configure IPv6 addressing support
IPv6 is an updated version of the Internet Protocol (IP). Until recently, the Internet has used a previous version, IPv4. IPv4 addresses are 32 bits long. Over 4 billion addresses are available through IPv4, though not all the addresses are usable. IPv6 addresses are 128 bits long. Taking into account the structure of the IPv6 address, there are 4.6x1018 globally routable addresses available. This equates to approximately 650 million IP addresses for each person in the world. Since every device can have a globally routable IPv6 address, there is no need for NAT with IPv6. This means it is very important to properly configure IP filters and firewall rules to prevent direct attacks on hosts on the LAN networks. By default, IPv6 is disabled on TransPort routers. TransPort devices do not support static configuration of IPv6 addresses. Instead, it relies on learning prefixes, routes, and DNS addresses from an upstream router.
IPv6 support is for Ethernet interfaces only
You can configure IPv6 addressing on Ethernet interfaces eth 0, eth 1, eth 2, and eth 3 only. There is no IPv6 support on other Ethernet interfaces, or other interfaces, such as PPP, GRE tunnel, or OpenVPN.
IPv6 modes
You can configure Ethernet interfaces to operate in one of two IPv6 modes: WAN mode or LAN mode.
WAN mode
In WAN mode, the interface listens for Router Advertisement (RA) messages, if enabled. The interface assigns itself an IPv6 address from any suitable prefixes it sees in the RA messages (for example, 64bit, on-link, auto-config bit set). Learned prefixes and routes are added to the IPv6 routing table. Advertised DNS addresses are added to the list of learned DNS addresses. By default, if DHCPv6 is enabled, the interface attempts to obtain an IPv6 address using DHCPv6. The router also attempts to learn prefixes from the upstream router for prefix delegation. DNS addresses learned through DHCPv6 are added to the list of learned DNS addresses. Default routes are added into the IPv6 routing table when the router sees RA messages from an upstream router. If RA learning is disabled, no default routes are added to the routing table. For this reason, Digi recommends you enable RA learning.
LAN mode
In LAN mode, the interface subnets delegated prefixes, assigns itself addresses from these subnetted prefixes, advertises the subnetted prefixes in RA messages, and assigns downstream hosts an address from this prefix via DHCPv6. RA messages include the subnet prefix in them, so downstream hosts can use SLAAC to assign itself an address from this prefix. The DHCPv6 server advertises addresses in the DNS address list, provided the addresses are not linklocal addresses.
Typical IPv6 configuration
A typical IPv6 configuration includes:
Digi TransPort® Routers User Guide
327
Configuring network interfaces
Configure IPv6 addressing support
n Configure an interface in WAN mode to allow the device to learn addresses. n Configure several interfaces in LAN mode to allow downstream hosts to learn addresses.
Digi TransPort® Routers User Guide
328
Configuring network interfaces
Configure IPv6 addressing support
IPv6 support in the web interface
Web
Support for IPv6 addressing in the web interface is limited to configuring Ethernet interfaces, WANs, and LANs to use IPv6 addressing. The command-line interface provides more functionality for managing and displaying IPv6 address information. See IPv6 support in the command-line interface.
Configuration > Network > Interfaces > IPv6
IPv6-enabled interfaces IPv6 is enabled on the following interfaces:
Interface ETH 0 (ETH 0-27 dropdown)
IPv6 WAN/LAN Instance Action
IPv6 WAN 0
Delete
(IPv6 WAN 0-1, IPv6 LAN 0-5 Add dropdown)
IPv6 WAN
n IPv6 WAN 0 l Enable router learning on this interface l Enable DHCPv6 client on this interface
n IPv6 WAN 1
IPv6 LAN
n IPv6 LAN 0 l Mode: (SLAAC/DHCPv6/SLAAC+DHCPv6 dropdown) l Subnet ID: l Subnet ID Length:
n DHCPv6 Server (visible only if DHCPv6 or SLAAC+DHCPv6 is selected) l Preference Value:
Digi TransPort® Routers User Guide
329
Configuring network interfaces
Configure IPv6 addressing support
n Router Advertisements l Enable router advertisements on this interface l The following parameters are visible only if the Enable router advertisements on this interface checkbox is checked: o Maximum Router Advertisements Interval: o Minimum Router Advertisements Interval: o Include link MTU o Reachable Time: o Retransmission Timer: o Hop Limit: o Default Lifetime:
n IPv6 LAN 1 n IPv6 LAN 2 n IPv6 LAN 3 n IPv6 LAN 4 n IPv6 LAN 5
IPv6 Source IP Address Selection Policy table The IPv6 Source IP Address Selection Policy table sets the preference when selecting an IPv6 address to use as the source IP when connecting to an IPv6 destination. Normally, the values in this table do not need to be changed from their defaults. For example:
Digi TransPort® Routers User Guide
330
Configuring network interfaces
Configure IPv6 addressing support
IPv6 support in the command-line interface
Command line
The TransPort router command-line interface provides support for IPv6 addressing in these areas:
"eth" command
The eth command has several new parameters to support IPv6 addressing on Ethernet interfaces:
ipv6_mode (off, wan, lan) The operating mode of the Ethernet interface.
ipv6_wan (0, <number of ipv6_wan parameter instances> - 1) Determines which ipv6_wan parameter group instance will be used by the interface if ipv6_mode is set to wan.
ipv6_lan (0, <number of ipv6_lan parameter instances> - 1) Determines which ipv6_lan parameter group instance will be used by the interface if ipv6_mode is set to lan.
eth x status Shows IPv6 addresses currently assigned to the interface after the existing IPv4 information.
"ipv6_wan" command
ipv6_wan configures a WAN to use IPv6 addressing. There are two instances of this parameter group. Parameters include:
ra_learn (OFF, ON) Enables learning of prefixes, routes and DNS addresses from an upstream router (supports up to 2 upstream routers on a first-come, first-served basis).
"dhcpv6_client" command
dhcpv6_client enables the DHCPv6 client on the WAN interface. If enabled, the device will attempt to learn IPv6 addresses, delegated prefixes, and DNS server addresses from an upstream router. The allowed values for this command are OFF and ON.
"ipv6_lan" command
ipv6_lan configures a LAN to use IPv6 addressing. There are 6 instances of this parameter group. Parameters include:
mode (slaac, dhcpv6, slaac_dhcpv6) Determines the operating mode for the LAN interface.
n slaac: The device sends RA messages. The managed and other config flags are both clear. Prefix options will have the autonomous config flag set.
Digi TransPort® Routers User Guide
331
Configuring network interfaces
Configure IPv6 addressing support
n dhcpv6: The DHCPv6 server is enabled. It will assign addresses from any prefixes the LAN interface has assigned to it to DHCPv6 clients on downstream hosts. RA messages will have the managed and other config flags set. Prefix options will have the autonomous config flag clear.
n slaac_dhcpv6: Both the RA server and the DHCPv6 server are enabled. RA messages will have the managed flag clear. The other config flag will be set. Prefix options will have the autonomous config flag set.
subnet_id: (hex string up to 32 characters in length, default value matches the ipv6_lan instance number) This value is appended to delegated prefixes and then assigned to the LAN interface.
subnet_id_length: (0-128, default: 8) Indicates the length, in bits, of the subnet_id. This length is added to delegated prefixes when creating the subnetted prefix. Note that current behavior is to extend the subnet prefix length to 64 bits if the combined length of the delegated prefix and the subnet_id length is less than 64 bits.
"dhcpv6_server" command
dhcpv6_server configures the DHCPv6 server instances associated with the ipv6_lan instance of the same value. There are the same number of instances as there are ipv6_lan instances. Parameters include:
preference: (0-255) Indicates the preference value that will be advertised by the DHCPv6 server.
"ra_server" command
ra_server configures the RA server instances associated with the ipv6_lan instance of the same value. There are the same number of instances as there are ipv6_lan instances. Parameters include:
enabled (OFF, ON) Enables the RA server.
max_ra_interval (4-1800, default value: 600) The maximum interval (in seconds) between RA messages.
min_ra_interval (3-1350), default value: 200) The minimum interval (in seconds) between RA messages. Note that the minimum interval is further limited to 3/4 of the maximum interval.
link_mtu: (OFF, ON) RA messages will include the link MTU option when set to ON. The MTU value is set to the configured interface MTU.
reachable_time: (0-3600000) The advertised "reachable" time (in milliseconds) in RA messages.
Digi TransPort® Routers User Guide
332
Configuring network interfaces
Configure IPv6 addressing support
retrans_time: (0-2147483647) The advertised "retransmit" time (in milliseconds) in RA messages.
hop_limit: (0-255, default value: 64) The advertised hop limit in RA messages.
default_lifetime: (0-9000, default value: 1800) The advertised default lifetime (in seconds) in RA messages.
"ipv6ippolicy" command
The ipv6ippolicy command displays and modifies the IPv6 source IP address policy table as described in RFC6724. This table is interrogated when selecting the source IP address to use on outgoing packets generated by the device. It would be a bit unusual to use anything but the default values.
"ipv6ippolicy print": Prints the current policy table. Other ipv6ippolicy parameters include
prefix (IPv6 prefix, default depends on instance) Destination IPv6 addresses are matched against the prefixes to find the entry with matching label.
label: The label associated with the prefix configured into the same instance.
"dhcpv6_client" command
dhcpv6_client status Shows the status of the DHCPv6 clients.
dhcpv6_client solicit|renew|release <entity> <instance> Instructs the DHCPv6 client to perform the requested action.
"dhcpv6_server" command
dhcpv6_server status Shows the status of the DHCPv6 servers.
"ndp" command
Shows the Neighbor Discovery Protocol (NDP) cache. ndp -a <entity> <instance> If the entity and instance are omitted, shows NDP caches for all interfaces.
ndp -d <entity> <instance> Deletes the NDP cache. If the entity and instance are omitted, deletes NDP caches for all interfaces.
Digi TransPort® Routers User Guide
333
Configuring network interfaces
Configure IPv6 addressing support
"route6" command
route6 print The route6 command shows the IPv6 routing table.
Note Some of the displayed routes may point to unfamiliar interfaces. For example, the interface TCP 0 refers to the "loopback" interface. The routing table will contain entries that point to this interface for any address that is owned by the device. NULL 0 refers to the "blackhole" interface. Packets that are routed to this interface are dropped.
"ipv6 show" command
ipv6 show shows IPv6-related information.
ipv6 show <entity> <instance>
If entity and instance are omitted, shows information for all interfaces. Information displayed includes: n Information learned from RA messages, including routes, prefixes and DNS server addresses. n A list of multicast groups the interface is listening on. n A list of all learned DNS server addresses. n A list of all delegated prefixes learned from upstream routers. n All subnet prefixes assigned to LAN interfaces.
Digi TransPort® Routers User Guide
334
Configuring network interfaces
Configure IPv6 addressing support
Configure a WAN for IPv6
Configuring a WAN to support IPv6 addressing involves these settings: n Enabling learning of prefixes, routes, and DNS addresses from an upstream router. The device supports up to 2 upstream routers, on a first-come, first-served basis. n Enabling the DHCPv6 client on the WAN interface. If enabled, the device attempts to learn IPv6 addresses, delegated prefixes, and DNS server addresses from an upstream router.
Web
1. Go to Configuration - Network - Interfaces - IPv6 > IPv6 WAN. 2. Enable IPv6 for the Ethernet interface: in the list of Ethernet interfaces, select the interface,
the IPv6 WAN instance, and click Add. 3. Click IPv6 WAN. 4. Select the IPv6 WAN instance associated with the Ethernet interface and set parameters for
the instance: n Select Enable router learning on this interface to enable learning of prefixes, routes and DNS addresses from an upstream router. n Select Enable DHCPv6 client on this interface to enable the DHCPv6 client on the WAN interface.
5. Click Apply.
Command line
1. Set the operating mode of the Ethernet interface to wan.
eth 1 ipv6_mode wan
2. Assign the desired IPv6 WAN instance to the Ethernet interface.
eth 1 ipv6_wan 1
3. Enable learning of prefixes, routes and DNS addresses from an upstream router.
ipv6_wan 1 ra_learn on
4. Enable the DHCPv6 client on the WAN interface.
dhcpv6_client on
5. Save your configuration changes.
config 0 save
Digi TransPort® Routers User Guide
335
Configuring network interfaces
Configure IPv6 addressing support
Configure a LAN for IPv6
The router supports IPv6 addressing on Ethernet interfaces eth 0, eth 1, eth 2, and eth 3 only. The default for IPv6 support on these interfaces is disabled.
Web
1. Go to Configuration - Network - Interfaces - IPv6 > IPv6 LAN. 2. Enable IPv6 for the Ethernet interface: In the list of Ethernet interfaces, select the interface
instance, the IPv6 LAN instance, and click Add. 3. Click IPv6 LAN. Select the IPv6 LAN instance associated with the Ethernet interface and set
parameters for the instance: 4. Select the operating mode for the LAN interface in the Mode field.
n SLAAC: The device sends Router Advertisement (RA) messages. In these messages, the managed and other config flags are both clear. Prefix options will have the autonomous config flag set.
n DHCPv6: Enables the DHCPv6 server. The DHCPv6 server assigns addresses from any prefixes the LAN interface has assigned to it to DHCPv6 clients on downstream hosts. RA messages will have the managed and other config flags set. Prefix options will have the autonomous config flag clear.
n SLAAC + DHCPv6: Both the RA server and the DHCPv6 server are enabled. RA messages will have the managed flag clear. The other config flag will be set. Prefix options will have the autonomous config flag set.
5. (Optional) Enter the subnet ID in the Subnet ID field, This value is appended to delegated prefixes and then assigned to the LAN interface. The default is the IPv6 LAN instance number.
6. (Optional) Enter the length of the subnet ID in the Subnet ID Length field: This length is added to delegated prefixes when creating the subnetted prefix. The default is 8.
7. Click DHCPv6 Server. Enter the preference value that the DHCPv6 server will advertise. 8. Click Router Advertisements and configure parameters for the Routing Advertisements (RA)
server. n Enable router advertisements on this interface: Enables or disables the RA server. n Maximum Router Advertisements Interval: The maximum interval, in seconds, between RA messages. n Minimum Router Advertisements Interval: The minimum interval (in seconds) between RA messages. Note that the minimum interval is further limited to 3/4 of the maximum interval. n Include link MTU: When enabled, RA messages include the link MTU option . The MTU value is set to the MTU of the configured interface . n Reachable Time: The advertised "reachable" time, in milliseconds, in RA messages. n Retransmission Timer: The advertised "retransmit" time, in milliseconds, in RA messages. n Hop Limit: The advertised hop limit in RA messages. n Default Lifetime: The advertised default lifetime, in seconds, in RA messages.
Digi TransPort® Routers User Guide
336
Configuring network interfaces
Configure IPv6 addressing support
9. (Optional) As needed, view and change the IPv6 source IP address selection policy. See Show and update the IPv6 source IP address policy table.
10. Click Apply.
Command line
1. Set the operating mode of the Ethernet interface to lan.
eth 1 ipv6_mode lan
2. Assign the desired IPv6 LAN instance to the Ethernet interface.
eth 1 ipv6_lan 1
3. Select the operating mode for the LAN interface: n slaac: The LAN interface uses the RA server to send RA messages. n dhcpv6: The LAN interface uses the DHCPv6 server. n slaac_dhcpv6: The LAN interface uses both the RA server and the DHCPv6 server.
ipv6_lan 1 mode slaac_dhcpv6
4. (Optional) Specify the subnet ID. This value is appended to delegated prefixes and then assigned to the LAN interface. The default is the IPv6 LAN instance number.
ipv6_lan 1 subnet_id 00
5. (Optional) Enter the length of the subnet ID. This length is added to delegated prefixes when creating the subnetted prefix. The default is 8.
ipv6_lan n subnet_id_length 8
6. (Optional) If you set the LAN interface operating mode to dhcpv6 or slaac_dhcpv6, configure the preference value to advertise to DHCPv6 server instances associated with the ipv6_lan instance. The instance number (in this example, 2) should be the same as the ipv6_lan instance number.
dhcpv6_server 2 preference 1
Digi TransPort® Routers User Guide
337
Configuring network interfaces
Configure IPv6 addressing support
7. (Optional) If you set the LAN interface operating mode to dhcpv6 or slaac_dhcpv6, configure parameters for the Routing Advertisements (RA) server, as needed. In all of these, the ra_ server instance number x must be the same as the IPv6 LAN instance number: n ra_server x enabled (OFF, ON): Enables or disables the RA server. n ra_server x max_ra_interval (4-1800, default value: 600): The maximum interval, in seconds, between RA messages. n ra_server x min_ra_interval (3-1350, default value: 200): The minimum interval, in seconds, between RA messages. Note that the minimum interval is further limited to 3/4 of the maximum interval. n ra_server x link_mtu(OFF, ON): When enabled, RA messages include the link MTU option and the MTU value is set to the MTU of the configured interface. n ra_server x reachable_time: (0-3600000): The advertised reachable time, in milliseconds, in RA messages. n ra_server retrans_time: (0-2147483647): The advertised retransmit time, in milliseconds, in RA messages. n ra_server x hop_limit: (0-255, default value: 64): The advertised hop limit, in number of hops, allowed in RA messages. n ra_server x default_lifetime: (0-9000, default value: 1800): The advertised default lifetime, in seconds, in RA messages. For example:
ra_server 2 enabled on ra_server 2 link_mtu on
8. (Optional) As needed, view and change the IPv6 source IP address selection policy. See Show and update the IPv6 source IP address policy table.
9. Save your configuration changes.
config 0 save
Digi TransPort® Routers User Guide
338
Configuring network interfaces
Configure IPv6 addressing support
Show and update the IPv6 source IP address policy table
The IPv6 address policy table defines the IPv6 source IP address to use on outgoing packets generated by the device. It allows you to select the best type of IP address (such as global, link local, and so on) for a particular type of connection. In most cases, the default values set in this table are sufficient and do not need to be changed. For more information about the IPv6 source IP address policy table, see the IETF document RFC6724, Default Address Selection for Internet Protocol Version 6 (IPv6). Normally the default values that exist in this table do not need to be changed.
Web
Go to Configuration > Network > Interfaces > IPv6 > IPv6 Source IP Address Selection Policy.
Add an entry in the table
1. Enter the IPv6 address prefix in the IPv6 Prefix field. 2. Enter a label for the IPv6 prefix in the Label field. 3. Click Add.
Delete an entry in the table In the entry for the IPv6 prefix, click Delete.
Command line
1. Show the IPv6 source address selection policy table.
eth 1 ipv6_lan 2 ipv6policy print
2. (Optional) To modify the IPv6 source address selection policy table, use the ipv6ippolicy command, specifying these parameters: n prefix: The IPv6 prefix. The default depends on the instance. Destination IPv6 addresses are matched against the prefixes to find the entry with matching label. n label: The label associated with the prefix configured into the same instance.
ipv6ippolicy 0 label 3
3. If you changed the policy table, save your configuration changes.
config 0 save
Digi TransPort® Routers User Guide
339
Configuring network interfaces
Show DHCPv6 server status
Command line
Use the command dhcpv6_server status. dhcpv6_server status ETH 1 DHCPv6 server status: Server DUID: 00-03-00-01-00-04-2d-f3-e7-32 Preference value: 0 OK
Configure IPv6 addressing support
Digi TransPort® Routers User Guide
340
Configuring network interfaces
Configure IPv6 addressing support
Show DHCPv6 client status
Command line
Use the command dhcpv6_client status. For example:
dhcpv6_client status
ETH 0 DHCPv6 client status: Client DUID: 00-03-00-01-00-04-2d-05-ed-00 DNS server: 2620:21:6000:800:8::1 DNS server: 2620:21:6000:800:8::2 SOL_MAX_RT: default INF_MAX_RT: default Server DUID: 00-01-00-00-55-e1-3c-f5-00-50-56-89-16-65 Reconfigure accept: false
- IA for Non-temporary Addresses IAID: 0d000000 T1: 8102 T2: 21062
- IA Address IPv6 address: 2620:21:6000:1400:7468:6843:a5c9:57a6 Preferred lifetime: 29702 Valid lifetime: 72902
- IA for Prefix Delegation IAID: 0d000000 T1: 0 T2: 0
OK
Digi TransPort® Routers User Guide
341
Configuring network interfaces
Configure IPv6 addressing support
Use DHCPv6 to learn IPv6 addresses
You can configure the router to use DHCPv6 to learn an IPv6 address, DNS addresses, and delegated prefixes from a DHCPv6 server. There are several options for learning IPv6 addresses from a DHCPv6 server:
n Solicit:The DHCPv6 client sends a Solicit message to the DHCPv6 servers to obtain the address of a neighboring DHCP Agent, and to obtain one or more addresses for DHCP servers which the DHCP Agent is configured to advertise.
n Renew: The DHCPv6 client sends a Renew message to the DHCPv6 server that originally provided the client's addresses and configuration parameters, to renew the addresses for DHCPv6 servers.
n Release: The DHCPv6 client sends a Release message to the DHCPv6 server that assigned addresses to the client, indicating that the DHCPv6 client will no longer use one or more of the assigned IPv6 addresses.
Command line
Use the command dhcpv6_client, specifying the requested action for the DHCPv6 client to perform.
dhcpv6_client solicit|renew|release <entity> <instance>
where solicit, renew, and release perform the IP address learning actions described above. For example,
dhcpv6_client renew eth 0
Digi TransPort® Routers User Guide
342
Configuring network interfaces
Configure IPv6 addressing support
Use the Neighbor Discovery Protocol (NDP) cache
Command line
The ndp -a <entity> <instance> command. Omitting the <entity> and <instance> parameters displays NDP caches for all interfaces.
ndp -a
ETH 0 NDP cache Cache size: 50 entries IP address fe80::5:73ff:fea0:e fe80::567f:eeff:fe5b:efbc fe80::567f:eeff:fe5b:ed3c fe80::c32:cb81:3f16:6305
MAC address 00:05:73:a0:00:0e 54:7f:ee:5b:ef:bc 54:7f:ee:5b:ed:3c 64:31:50:99:fe:a9
State Stale Stale Stale Stale
ETH 1 NDP cache Cache size: 50 entries IP address
MAC address
State
ETH 2 NDP cache Cache size: 50 entries IP address
MAC address
State
ETH 3 NDP cache Cache size: 50 entries IP address OK
MAC address
State
Digi TransPort® Routers User Guide
343
Configuring network interfaces
Configure IPv6 addressing support
Delete a Neighbor Discovery Protocol (NDP) cache
Command line
Use the command ndp -d <entity> <instance>. Omitting the <entity> and <instance> parameters deletes all NDP caches for all interfaces.
ndp -d eth 0
Digi TransPort® Routers User Guide
344
Configuring network interfaces
Configure IPv6 addressing support
Show the IPv6 routing table
IPv6 routing table information may display unfamiliar interface names that have a special meaning and handling. For example:
n TCP 0 refers to the loopback interface. The routing table contains entries that point to this interface for any address that is owned by the device.
n NULL 0 refers to the blackhole interface. Packets routed to this interface are dropped. The router adds a route pointing to the blackhole interface when a prefix is delegated to a WAN interface using DHCPv6. This means that the router drops all packets to that prefix. When the delegated prefix is subnetted to LAN interfaces, routes to those subnets are also added to the routing table. As the subnetted routes will have longer prefixes, matching packets will find those routes before the blackhole route. As a result, any packets to the delegated prefix that do not match packets to subnets assigned to LAN interfaces are dropped. Without the blackhole route, packets to unassigned subnets would probably be routed to the default route.
Command line
Use the route6 print command.
route6 print
Destination
Next Hop
Interface Ref Count
---------------------------------------------------------------------------------------
::1/128
::
TCP 0
1
2620:21:6000:1400:7468:6843:a5c9:57a6/128 ::
TCP 0
1
fe80::204:2dff:fe05:ed00/128
::
TCP 0
1
fe80::204:2dff:fef5:ed00/128
::
TCP 0
1
fe80::/64
::
ETH 0
1
fe80::/64
::
ETH 1
1
2620:21:6000:1400::/56
::
ETH 0
1
ff00::/8
::
ETH 0
1
ff00::/8
::
ETH 1
1
::/0
fe80::5:73ff:fea0:e
ETH 0
1
OK
Digi TransPort® Routers User Guide
345
Configuring network interfaces
Configure IPv6 addressing support
Show IPv6 routing and address information
You can display IPv6 routing and address information for an interface or all interfaces, including:
n Information learned from RA messages, including routes, prefixes and DNS server addresses. n A list of multicast groups the interface is listening on. n A list of all learned DNS server addresses. n A list of all delegated prefixes learned from upstream routers. n All subnet prefixes assigned to LAN interfaces.
Command line
Use the command ipv6 show <entity> <instance>. Omitting the <entity> and <instance> parameters displays IPv6 routing and address information for all interfaces. For example:
ipv6 show
ETH 0
Default routers:
----------------
Default router: fe80::5:73ff:fea0:e
Lifetime
: 1770
Hop limit
: 64
MTU
: 1500
Managed configuration: Yes
Other Configuration : No
Reachable time
: Unspecified
Retransmit interval : Unspecified
Prefix: 2620:21:6000:1400::/56
Valid lifetime : 2591970
Preferred lifetime: 604800
On-link
: Yes
Auto config
: Yes
Multicast groups: ----------------ff02::1:ff05:ed00 ff02::1 ff02::1:ffc9:57a6
DNS servers: -----------2620:21:6000:800:8::1 2620:21:6000:800:8::2
ETH 1
Multicast groups: ----------------ff02::1:fff5:ed00 ff02::1 ff02::2 ff02::1:2 OK
Digi TransPort® Routers User Guide
346
Configuring network interfaces
Configure IPv6 addressing support
Show the IPv6 addresses assigned to an interface
Command line
Use the command eth n status to display status for the specified Ethernet interface instance. In the output, the IPv6 addresses currently assigned to the interface are listed after the existing IPv4 information.
eth 0 status
Activation Status:
Active
Connection Status:
Connected
Link:
100Base-T Full-Duplex
Physical Port:
ETH 0
MAC:
00 04 2D 05 ED 00
IP Address:
10.10.14.17
Mask:
255.255.255.0
DNS Server:
10.10.8.62
Secondary DNS Server: 10.10.8.64
Gateway:
10.10.14.1
DHCP Server:
10.10.8.15
Lease Remaining (mins): 577
Assigned addresses:
2620:21:6000:1400:7468:6843:a5c9:57a6
fe80::204:2dff:fe05:ed00
OK
Digi TransPort® Routers User Guide
347
Configuring network interfaces
Configure IPv6 addressing support
Support for IPv6 packets in firewall rules
There are several areas in the firewall rules syntax for handling IPv6 packets. For more information on these changes and detailed parameter descriptions, see Firewall.
n Firewall rules can now specify IPv6 addresses. You can specify an IPv6 address anywhere you can specify an IPv4 address. However, you cannot use IPv4 and IPv6 addresses together in a single rule.
n Address/port translation is not supported with IPv6 packets. In rules, avoid mixing address translation with IPv6-specific keywords. See Specifying IP addresses and ranges in firewall rules.
n In the [action] firewall script field: l In the block action, the optional field return-icmpv6 causes an ICMPv6 packet to be returned from the interface from which that packet was received. l If a rule specifies action dscp, the traffic class portion of the IPv6 header is modified with the DSCP value.
n Several [options] keywords are allowed with rules for IPv4 packets: oneroute, onvlan, onvrf, routeto, and oosed. Using these keywords implies that the rule should only match on IPv4 packets.
n In the [version] firewall script field, you can specify IP version to which the rule applies: IPv4 or IPv6.
n In the [tos] firewall script field, for IPv6 packets, the traffic class field in the IPv6 header is checked.
n The [proto] firewall script field has an icmpv6 option. n For the [inspect-state] firewall script field that performs stateful inspection:
l None of the oos options are supported for IPv6 packets. l You can use the inspect-state option with the following ICMPv6 packet types:
ICMPv6 type Echo
Matching ICMPv6 type Echo reply
n You can filter packets based on ICMPv6 codes, using the [icmpv6] field. See Set filters in firewall rules.
Digi TransPort® Routers User Guide
348
Configuring network interfaces
Configure PPP and external modems
Configure PPP and external modems
Point-to-Point Protocol (PPP) is a standard protocol for transporting data from point to multipoint networks (such as IP) across point-to-point links (such as a serial or ISDN connection). This functionality is essential for dial-up Internet access. As data is transferred across IP networks in synchronous format, the router supports asynchronous to synchronous PPP conversion. This allows asynchronous terminals connected to the routers to communicate with remote synchronous PPP devices. Normally, this is carried out using a single ISDN B-channel so that data can be transferred at speeds up to 64 Kbps. This is known as ASYNC to SYNC PPP operation and is supported as standard by most terminal adapters. To use ASYNC to SYNC PPP operation all that is necessary is to ensure that the PPP protocol is bound to the ASY port to which the terminal or PC is connected. (see Configuration > Network > Interfaces > Serial).
Note To use ASYNC to SYNC PPP, the attached terminal must also support PPP (Windows dial-up networking supports PPP).
In addition to ASYNC to SYNC operation (where the router only converts the PPP from one form to another) the router can initiate its own PPP sessions. For example, the router uses this operation when:
n The router is configured as a router to connect an Ethernet network to the Internet via ISDN or W-WAN.
n The router is answering an incoming ISDN call with PPP either for remote management or remote access to the Ethernet network to which the router is connected.
n The router is accessed locally through the serial port for configuration purposes by setting up a Windows Dial-Up-Networking connection to the phone number 123.
Note Except for MLPPP, the parameters in this section are only relevant when the router is generating the PPP. They are not relevant for ASYNC to SYNC PPP operation.
The router also supports Multi-link PPP (MLPPP). MLPPP uses both ISDN B-channels simultaneously (and two PPP instances), to provide data transfer speeds up to 128 Kbps for applications such as email or establishing a point-to-point connection between two routers.
Web
Go to Configuration > Network > Interfaces > Advanced. The Configuration > Network > Interfaces > Advanced menu has the following sub-menu options:
n External Modems n PPP Mappings n PPP n
Digi TransPort® Routers User Guide
349
Configuring network interfaces
Configure PPP and external modems
Configure external modem support
Note The PPP use_modem field has been altered so the value indicates which modem type to use. Value 1 indicates use of the GPRS modem. Value 2 indicates use of the external modem. By including enough modem call control instances, you can perform multilink PPP over multiple external modems.
Web
1. Go to Configuration > Network > Interfaces > Advanced > External Modems. The External Modems page contains external modem parameters. External modem support added to GPRS builds. It is now possible to have a GPRS build that can also make outgoing PPP connections via an external modem. It is also possible to answer incoming calls via an external modem.
2. Configure external modem parameters:
ASY Port The physical ASY port for the external modem.
W-WAN mode Enables W-WAN mode. Initialisation string n These parameters (Initialisation string 1, Initialisation string 2, Initialisation string 3) allow you to specify a number of command strings that are sent to the wireless module each time a wireless connection is attempted. You can use these parameters to set non-standard wireless operating modes. Each string is prefixed with the characters AT before being sent to the wireless module and they are sent to the wireless module in the order specified until an empty string is encountered. For example, Initialisation string 3 will not be sent unless Initialisation string 1 and Initialisation string 2 are both specified. Initialization strings are not normally required for most applications as the router will normally be preconfigured for correct operation with most networks.
Digi TransPort® Routers User Guide
350
Configuring network interfaces
Configure PPP and external modems
Hang-up string In a typical wireless application the connection to the network is always on and under normal circumstances it is not necessary to hang-up the wireless module. Under certain circumstances however, the router may use the ATH command to try and disconnect the wireless module from the network, such as if an incorrect APN has been specified and the module is unable to attach to the network correctly. This parameter allows you to specify an alternative hang-up string that is sent to the wireless module when disconnecting a call. As with the Initialization strings, it is not necessary to include the AT as this is inserted automatically by the router.
Post hang-up string Additional AT commands that are sent to the wireless module after it has been disconnected. As with the Initialization strings, it is not necessary to include the AT as this is inserted automatically by the router.
Listening init string The listening initialization string parameter for external modems.
Listening init interval (secs) The listening init string is sent at intervals specified by a listening init interval parameter.
Maximum RING count before answering incoming call The count of the maximum number of rings before answering incoming call can be set in this field. The default value is 0.
Minimum RING count before answering incoming call The count of the minimum number of rings before answering incoming call can be set in this field. The default value is 0. 3. Click Apply.
Command line
Command modemcc modemcc modemcc modemcc modemcc modemcc modemcc modemcc
Instance n n n n n n 0 0
Parameter asyport init_str init_str1 init_str2 hang_str posthang_str linit_str linit_int
Values 0-255 (Default: 255) Free text field Free text field Free text field Free text field Free text field Free text field 0-2147483647
Equivalent web parameter
Initialisation string 1 Initialisation string 2 Initialisation string 3 Hang-up string Post Hang-up string Listening init string Listening init interval (secs)
Digi TransPort® Routers User Guide
351
Configuring network interfaces
Configure PPP and external modems
Configure PPP mappings
Web
1. Go to Configuration > Network > Interfaces > Advanced > PPP Mappings. 2. Associate functions with PPP interfaces. The PPP Mappings page contains two columns of as
many interfaces as are supported by the router (this varies between models). Each row in the column contains a drop-down list box for selecting functions to associate with each PPP instance. The PPP instance number is the left-most column. For example, to assign a W-WAN interface to PPP instance 3, select Mobile SIM1 or SIM2 from the drop-down box to the right of instance 3. If a W-WAN interface is fitted to the router, this is the default mapping. 3. Click Apply.
4. Click Apply.
Digi TransPort® Routers User Guide
352
Configuring network interfaces
Configure PPP and external modems
Multilink PPP parameters
Some TransPort routers support multilink PPP. This section describes the configuration of MLPP functionality. The PPP interface must be configured with Always On mode enabled and an AODI NUA.
Desired local ACCM c The Asynchronous Control Character Map (ACCM). The default value of 0x00000000 should work in most cases. Changing this value is for advanced users only.
Desired remote ACCM c The ACCM for the remote peer. As above, the default value of 0xffffffff should work in most cases and should only be changed if you know you need to use other characters.
Username The username for logging on to the remote system.
Password The password for authentication with the remote system when using MLPP. This password is for both B-channel PPP connections.
Confirm password When changing the password, type the new password into this text box. The router checks that both fields are the same before changing the value.
Enable remote CHAP authentication When enabled, causes the router to authenticate itself with the remote system using CHAP. If this parameter is set, the connection will fail if authentication fails. Generally, this setting should be left disabled.
Enable short sequence numbers When enabled, enables the use of 12-bit data packet sequence numbers, rather than the more usual 16-bit data packet sequence numbers.
Bring up the second ISDN B-channel Never When selected, causes the router not to activate the second B-channel.
When the data rate is greater than n bytes/sec for s seconds When selected, the two associated text boxes become enabled and allow the user to enter the desired data rate (default 2000 bytes/second) that will trigger activation of the second B-channel and the period for which the data rate exceeds that value, before the channel is activated.
Drop the second ISDN B-channel When the connection is terminated When selected, the second B-channel is only deactivated when the connection is terminated.
When the data rate is less than n bytes/sec for s seconds When selected, the above two text boxes are enabled. The value in the left-hand one specifies the data rate below which the traffic must fall before the secondary B-channel will be deactivated. The
Digi TransPort® Routers User Guide
353
Configuring network interfaces
Configure PPP and external modems
second box contains the time in seconds for which the data rate must be below threshold before the second B-channel is deactivated.
Note The following parameters are for use with Always On Dynamic ISDN.
Bring up the first ISDN B-channel When the data rate is greater than n bytes/sec for s seconds When Always On mode is enabled, these two settings specify the data rate and duration for which the data rate must be sustained before the B-channel is activated.
Drop the first ISDN B-channel When the data rate is less than n bytes/sec for s seconds When Always On mode is enabled, these two settings specify the data rate below the traffic must fall and the duration for which it is below the threshold before the B-channel is deactivated.
Command line
Command mlppp
Instance 0
Parameter l_accm
mlppp
0
r_accm
mlppp
0
mlppp
0
mlppp
0
username password epassword
mlppp
0
r_chap
mlppp
0
l_shortseq
mlppp
0
up_rate
mlppp
0
up_delay
mlppp
0
down_rate
mlppp
0
down_delay
mlppp
0
dup_rate
Values
0x000000000xFFFFFFFF
0x000000000xFFFFFFFF
Valid username
Valid password
Encrypted password
on, off
on, off Default off
0-2147483648 Default 2000
0-2147483648 Default 10
0-2147483648 Default 1000
0-2147483648 Default 10
0-2147483648 Default 500
Equivalent web parameter Desired local ACCM
Desired remote ACCM
username password None-this parameter is not configurable Enable remote CHAP authentication Enable short sequence numbers When the data rate is greater than n bytes/sec for s seconds
When data rate is less than n bytes/sec for s seconds
When data rate is greater than n bytes/sec
Digi TransPort® Routers User Guide
354
Configuring network interfaces
Command mlppp
Instance 0
Parameter dup_delay
mlppp
0
ddown_rate
mlppp
0
ddown_delay
Configure PPP and external modems
Values
0-2147483648 Default 5
0-2147483648 Default 500
0-2147483648 Default 5
Equivalent web parameter for s seconds
When data rate is less than n bytes/sec for s seconds
Digi TransPort® Routers User Guide
355
Configuring network interfaces
Configure PPP and external modems
Configure PPP parameters
When setting up a Point-to-Point Protocol (PPP) connection, you may need to adjust the PPP configuration parameters. Generally, however, you can leave these parameters at their default values.
Web
1. Go to Configuration > Network > Interfaces > Advanced > PPP 0 - 9. 2. Configure PPP configuration parameters as needed:
Load answering defaults Clicking this button causes the router to read the default PPP answering default parameters from a default configuration stored in memory.
Load dialing defaults Clicking this button causes the router to read the PPP dialing parameters from a default configuration stored in memory.
Description A description of the PPP instance that may make it easier to refer to. For example, the PPP instance to connect to an ISP could be named MyISP.
This PPP interface will use If the PPP mappings have been set up previously using the PPP mappings page, this box will contain the name of the protocol that has been assigned to this PPP instance. If the mapping has not been set up previously and if no default mappings apply, the value for this setting should be Not Assigned. Select the required the required physical interface from the dropdown selection box.
Dial out using numbers
To allow the router to automatically make outgoing calls, the ISDN number must be specified. The four text boxes allow four telephone numbers to be entered. The first one is required, the others are optional, and the router uses the others in rotation. These numbers can be the number of the Internet Service Provider (ISP) or another router.
Digi TransPort® Routers User Guide
356
Configuring network interfaces
Configure PPP and external modems
Prefix n to the dial out number When making outgoing PPP calls, the value specified in this text box is inserted before the actual number being called. This may be required if a PABX system is in use which requires a prefix to use to get an outside line. For example, when using AODI or BACP, the remote peer may provide a number to use for raising an additional B-channel to increase the bandwidth. However, such a number will not normally include the digits needed to connect to an outside line via a PABX.
Username The username to use for MLPPP login.
Password The password to use for MLPPP login. This password is for both B-channel PPP connections.
Confirm password Type the password in this text box to confirm that the password has been correctly typed in.
Note The following three radio buttons control how the IP address for the router is assigned.
Allow the remote device to assign a local IP address to this router When this radio button is selected, the remote peer will assign this PPP interface an IP address.
Try to negotiate a.b.c.d as the local IP address for this router If it would be useful, but not essential, to have a predefined IP address for the interface, the second radio button should be selected and the desired IP address entered into the text box to the right.
Use a.b.c.d as the local IP address for this router If it is essential that the PPP interface has a specific IP address, this radio button should be selected and the IP address entered into the text box.
Digi TransPort® Routers User Guide
357
Configuring network interfaces
Configure PPP and external modems
Use mask a.b.c.d for this interface
The default value in this text box will normally work, and should only be changed if it is known that the default is not appropriate. Since PPP is a peer-to-peer protocol, this value is appropriate in most situations.
Use the following DNS servers if not negotiated Sets primary and DNS servers to use if a DNS server is not assigned as part of the PPP negotiation and connection process.
Primary DNS server The IP address of the primary DNS server to use if a DNS server is not assigned as part of the PPP negotiation and connection process. It is fairly common practice for the DNS server to be assigned automatically by the ISP when making a connection.
Secondary DNS server The IP address of the secondary DNS server to use if one is not automatically assigned by the remote peer.
DNS Port The network port number of the DNS server.
Attempt to assign the following IP configuration to remote devices When enabled, displays following four configuration parameters, which control how the PPP instance assigns an IP address to a connecting remote peer. The primary and secondary DNS server addresses will also be sent to the remote peer
Assign remote IP addresses from a.b.c.d to a.b.c.d The IP addresses in these text boxes define the pool of IP addresses to assign to remote peers during the IP protocol configuration phase of the PPP negotiation process.
Primary DNS server The IP address of the primary DNS server that the remote peer should use when making DNS requests over the link.
Digi TransPort® Routers User Guide
358
Configuring network interfaces
Configure PPP and external modems
Secondary DNS server The IP address of the secondary DNS server that the remote peer should use when making DNS requests, should the primary server be unavailable.
Request packet data connection When enabled, causes the PPP instances to request a connection for sending a data packet.
Allow the PPP interface to answer incoming calls When enabled, causes the PPP instance to answer an incoming call.
Only allow calling numbers ending with n When set to answer calls, this setting provides a filter for ISDN sub-addresses. This value is blank by default but when the PPP instance is set to answer calls, only numbers having trailing digits that match the sub-address value in this test will be answered. So for example, if this value is set to 123, only calls from numbers with trailing digits that match this value will be answered, for example, 01942 605123.
Close the PPP connection after s seconds The maximum time that the link will remain active in any one session. After this time, the link will be deactivated.
if it has been up for m minutes in a day The router deactivates the PPP instance after it has been active for the value specified in this text box.
Digi TransPort® Routers User Guide
359
Configuring network interfaces
Configure PPP and external modems
if it has been idle for h hrs m mins s secs The router deactivates the PPP instance after the time specified in these text boxes if it detects that the link has not seen traffic.
Alternative idle timer for static routes s seconds An alternative inactivity timeout for use in conjunction with the Make PPP n interface use the alternative idle timeout when this route becomes available parameter on the Configuration > Network > IP Routing/Forwarding > Static Routes > Routes n > Advanced web page. The router uses this timeout until the PPP instance next deactivates only. After that, it uses the normal timeout value.
If the link has not received any packets for s seconds The amount of time the router waits without receiving any PPP packets before disconnecting. The timer is reset with each received PPP packet.
if the negotiation is not complete in s seconds The maximum time, in seconds, allowed for the PPP negotiation to complete. If negotiations have not completed within this period, the interface is deactivated.
Enable NAT on this interface When enabled, causes the router to apply Network Address Translation (NAT) to IP packets on this interface. When enabled, the following additional parameters appear:
IP address/IP address and Port These radio buttons select whether IP address translation only should be applied or whether port number translation should also be applied to IP packets.
NAT Source IP address a.b.c.d The IP address of the interface to use as the source address in IP packets crossing the NAT interface.
Enable IPsec on this interface
When enabled, causes the router to use the IPsec protocol to secure the connection. Enabling this setting displays the following additional parameters:
Keep Security Associations (SAs) when this PSTN interface is disconnected When enabled, causes the router to maintain (such as not flush) the SA when the interface becomes disconnected. The normal behavior is to remove the SAs when the interface becomes disconnected.
Use interface x,y for the source IP address of IPsec packets If it is required to use another interface (such as not the interface currently being configured) as the source address for IPsec packets, this may be achieved by selecting the desired interface from the drop-down list and typing the desired interface instance number into the adjacent text box.
Enable the firewall on this interface Enabling this setting causes the router to apply the firewall settings to traffic using this interface. When debugging connections issues it is often helpful to make sure this setting is
Digi TransPort® Routers User Guide
360
Configuring network interfaces
Configure PPP and external modems
disabled, because incorrect firewall rules prevent a connection from passing network traffic. If the connection works when the firewall is turned off but fails when turned on, a good place to start checking parameters would be in the firewall settings page, Configuration > Security > Firewall.
Remote management access Can be set to No restrictions, Disable management, Disable return RST, Disable management and return RST.
n When set to No restrictions, users on this interface can access the router's Telnet, FTP, and web services for the purpose of managing the router.
n When set to Disable management, users on this interface are prevented from managing the router via Telnet, FTP, or the web interface.
n For Disable return RST, whenever a router receives a TCP SYN packet for one of its own IP addresses with the destination port set to an unexpected value, such as a port that the router would normally expect to receive TCP traffic on, it will reply with a TCP RST packet. This is normal behavior. However, the nature of internet traffic is such that whenever an internet connection is established, TCYP SYN packets are to be expected. As the router's PPP inactivity timer is restarted each time the router transmits data (but not when it receives data), the standard response of the router to SYN packets, such as transmitting an RST packet, will restart the inactivity timer and prevent the router from disconnecting the link even when there is no genuine traffic. This effect can be prevented by using the appropriate commands and options within the firewall script. However, on Digi 1000 series routers, or where you are not using a firewall, the same result can be achieved by selecting this option, such as when this option is selected the normal behavior of the router in responding to SYN packets with RST packets is disabled. The option will also prevent the router from responding to unsolicited UDP packets with the normal ICMP destination unreachable responses.
n The Disable management an return RST option prevents users from managing the router via the Telnet, FTP, and web interfaces and also disables the transmission of TCP RST packets as above.
3. Click Apply.
Command line
Command ppp ppp
Instance Parameter
n
name
n
l1iface
ppp
n
l1nb
Values
Equivalent web parameter
Free text field
Description
The layer 1
This PPP interface will
interface, such as use
Async Port, PPTP, W-
WAN
Layer 1 Interface number Default: 0
This PPP interface will use value
Digi TransPort® Routers User Guide
361
Configuring network interfaces
Command ppp
Instance Parameter
n
l2face
ppp
n
l2nb
ppp
n
aodinua
ppp
n
phonenum
ppp
n
ph2
ppp
n
ph3
ppp
n
ph4
ppp
n
prefix
ppp
n
username
ppp
n
password
ppp
n
epassword
ppp
n
r_addr
ppp
n
IPaddr
ppp
n
l_addr
ppp
n
mask
ppp
n
DNSserver
ppp
n
secDNS
ppp
n
DNSport
ppp
n
IPmin
Configure PPP and external modems
Values
The lower layer interface, such as. LAPB, LAPD, XOT
Lower layer interface number. Default: 0
Equivalent web parameter
This PPP interface will use
up to 25 digits up to 25 digits up to 25 digits up to 25 digits 0-9999999999
Valid username Valid password The encrypted password Default 0.0.0.0 set automatically
Valid IP address a.b.c.d
Valid IP address Default 1.2.3.4 Valid IP address Default 255.255.255.255 Valid IP address Valid IP address Valid IP address Default 53 Valid IP address Default 10.10.10.10
Dial out using numbers
Dial out using numbers
Dial out using numbers
Dial out using numbers
Prefix n to the dial out number
Username
Password
None-this parameter is not configurable
Allow the remote device to assign a local IP address to this router
Try to negotiate a.b.c.d as the local IP address for this router
Use a.b.c.d as the local IP address for this router
Use mask a.b.c.d for this interface
Primary DNS server
Secondary DNS server
DNS Port
Assign remote IP addresses from a.b.c.d to a.b.c.d
Digi TransPort® Routers User Guide
362
Configuring network interfaces
Command ppp
Instance Parameter
n
IPrange
ppp
n
transDNS
ppp
n
sectransDNS
ppp
n
cingnb
ppp
n
msn
ppp
n
sub
cli
ppp
n
maxup
ppp
n
maxuptime
ppp
n
timeout
ppp
n
timeout2
ppp
n
rxtimeout
ppp
n
maxneg
ppp
n
do_nat
ppp
n
natip
ppp
n
ipsec
Configure PPP and external modems
Values 0-255 Default 5
Valid IP address Valid IP address up to 25 digits up to 9 digits up to 17 digits
Equivalent web parameter
Assign remote IP addresses from a.b.c.d to a.b.c.d Note that these are not directly equivalent. This address is obtained by adding the range value to the minimum.
Primary DNS server
Secondary DNS server
Only allow numbers ending with n
with ISDN MSN ending with n
with ISDN sub-address ending with n
0-2147483648
0-2147483647
Default 300s (5 minutes) 0-2147483648
0-2147483648
0-2147483648
0, 1 0=Off 1=On Valid IP address a.b.c.d 0, 1 0=Off 1=On
Close the PPP connection after s seconds
if it has been up for m minutes in a day
if it has been idle for h, m, s
Alternative idle timer for static routes s seconds
if the link has not received any packets for s seconds
if the negotiation is not complete in s seconds
Enable NAT on this interface
NAT Source IP address a.b.c.d
Enable IPsec on this interface
Digi TransPort® Routers User Guide
363
Configuring network interfaces
Command ppp
Instance Parameter n
ppp
n
ipsecent
ppp
n
ipsecadd
ppp
n
firewall
ppp
n
qos
ppp
n
use_modem
ppp
n
cdma_backoff
ppp
n
ndis
ppp
nocfg
ppp
n
igmp
ppp
n
ifspeed
ppp
n
vrf
ppp
n
vrfexport
Configure PPP and external modems
Values
Default PPP Ethernet Valid interface number off, on off, on 0, 1 0, 1 Default: 1 off, on 0, 1, 2, 3
off, on 64000 bps
integer integer
Equivalent web parameter
Keep Security Associations (SAs) when this PPP interface is disconnected
Use interface x,y for the source address of IPsec packets
Use interface x,y for the source address of IPsec packets
Enable the firewall on this interface
Enable QoS on this interface
This PPP interface will use
None
Request packet data connection
Remote management access 0=No restrictions 1=Disable management 2=Disable return RST 3=Disable management and return RST
Enable IGMP
None. CLI command only. The ppp command allows configuring the interface speed for reporting in SNMP.
None. CLI command only.
None. CLI command only.
Digi TransPort® Routers User Guide
364
Configuring network interfaces
Configure PPP and external modems
Configure mobile PPP parameters
Mobile telephone modules fitted into the router use PPP to connect to the network and send and receive traffic. This section describes parameters relevant to setting up a mobile telephone module.
Web
1. Go to Configuration > Network > Interfaces > Advanced > PPP 0 - 9 > PPP n > Mobile. 2. Configure mobile PPP parameters as needed:
Use SIM Any, SIM1, SIM2 Select which of the installed SIM cards the module should use.
Detach W-WAN if the link fails When enabled, causes the router to issue the command to detach the mobile telephone module from the wireless network if it detects that the link has failed. Link failure is detected by a PPP ping response timer or by a firewall request.
Detach W-WAN between connection attempts Controls whether the module stays attached to the network if multiple connection attempts are required to establish a connection. This functionality may be useful if the connection to the mobile telephone network is not very reliable. Connecting to the mobile telephone network to send and receive data is a two-stage process. The first stage is where the module signals its wish to join the network and is accepted by the local cell. The second stage involves negotiating the link parameters and transferring data. Sometimes it may be necessary to cleanly detach from the network in order to start the process from the ground up. 3. Click Apply.
Command line
Command ppp
Instance n
Parameter gprs_sim
ppp
n
ppp
n
detach_on_fail detach
Values
0-2 0=Any 1=SIM1 2=SIM2
off, on
off, on
Equivalent web parameter Use SIM, Any, SIM 1, SIM 2
Detach W-WAN if the link fails Detach W-WAN between connection attempts
Digi TransPort® Routers User Guide
365
Configuring network interfaces
Configure PPP and external modems
Configure advanced PPP parameters
Normally, advanced PPP parameters to do not need to be changed from their defaults.
Web
1. Go to Configuration > Network > Interfaces > Advanced > PPP 0 - 9 > PPP n > Advanced. 2. Configure advanced PPP parameters as needed:
Metric The connected metric of the interface. The default metric of a connected interface is 1. By allowing the interface to have a higher value (lower priority), static routes can take precedence over interfaces. For normal operation, leave this setting unchanged.
Allow this PP interface to settle for s x 100 milliseconds On wireless links, it is possible that the initial packets sent to the interface by the TCP layer may be dropped by the network if they are sent too quickly after PPP negotiation has completed. This setting defines the delay in notification sent to the TCP layer that PPP negotiation has completed.
Enable "Always On" mode of this interface If the Always on option is available on the interface, enabling this setting reveals the following two radio buttons. When this functionality is enabled, the router will automatically try to reconnect after about 10 seconds if the link becomes disconnected. This parameter should be enabled when using AODI or W-WAN.
On Default action, the interface will always try and raise this PPP link.
On and return to service immediately These two radio buttons enable the Always on functionality and additionally the facility to return to the in-service state after a disconnect event.
Put this interface "Out of Service" when an always-on connection attempt fails Normally, always-on interfaces will not go out of service unless they have connected at least once. When enabled, this setting causes the router to put the interface out of service even if the first connection attempt fails.
Attempt to re-connect after s seconds The length of time, in seconds, the router should wait after an Always on PPP connection has been terminated before trying to re-establish the link.
If a PPP interface that would be inhibited by this PPP is connected, attempt reconnection after s seconds The value in this setting takes precedence over the previous parameter when another PPP instance that is usually inhibited by this one is connected. You can use this parameter to reduce the connection retry rate when a lower priority PPP instance is connected.
Digi TransPort® Routers User Guide
366
Configuring network interfaces
Configure PPP and external modems
Wait s seconds after power-up before activating this interface The initial delay the router applies before activating the PPP instance after power-up. After the initial power-up delay the normal always-on activation timers apply. If set to 0, no delay is applied.
Keep this interface up for at least s seconds The minimum period that the PPP interface should remain available. This means that even if the link becomes inactive before this period expires, the connection will remain open.
Enable Multilink PPP on this interface When enabled, enables the multilink PPP capability of the router. (See above for configuration details).
Click here to assign a timeband to this interface Clicking this link redirects the browser to the timeband configuration page Configuration > Network > Timebands.
Add a route to a.b.c.d if the peer's IP address is not negotiated Normally, the IP address for a device connecting to a remote peer is assigned by the remote peer. If this is not the case then the router will need a route to the remote peer. This setting is set to the IP address of the remote peer so that it can be added to the routing table.
Enable DNS inbound blocking Enables or disables blocking DNS requests on the PPP interface, to prevent the router from responding to DNS requests over this interface.
Forward IP broadcasts over this interface if the interface is on the same IP network as an Ethernet interface When enabled, causes the router to route broadcast packets to and from Ethernet interfaces. This will only occur if the PPP instance has issued an address which is part of the Ethernet interface network.
Send LCP echo request packet to the remote peer When enabled, displays the configuration parameters that cause the router to send Link Control Protocol (LCP) packets to the remote peer at specified intervals. This feature can be useful for keeping a link active (W-WAN, for example).
Send LCP echo requests every s seconds The value in this text box sets the interval at which to send the packets. When set to 0, transmission of LCP packets is disabled.
Disconnect the link after n failed echo requests The number of consecutive failed echo requests allowed before the router terminates the link. When set to 0, this functionality is disabled, such as the router will not terminate the link if the LCP echo requests do not elicit a response from the remote.
Generate Heartbeats on this interface When enabled, displays the configuration options controlling how the router sends heartbeat packets. Generating a valid configuration enables the router to send heartbeat packets to the
Digi TransPort® Routers User Guide
367
Configuring network interfaces
Configure PPP and external modems
specified destination. Heartbeat packets are UDP packets containing information about the router and which may include status information for locating its current dynamic IP address. Heartbeats can also contain GPS position information and mobile telephone module information.
Send Heartbeat messages to IP address a.b.c.d every h hrs, m minutes, s secs The left-hand text box contains the IP address of the destination for the heartbeat packets. The remaining text boxes specify the desired interval between sending heartbeat packets.
Use interface x,y for the source IP address Select of the source interface for the UDP heartbeats. Selecting an Ethernet source allows the packets to follow the routing table instead of being sent out from the PPP interface on which they are set.
Select transmit interface using the routing table When enabled, causes the router to choose the best route from the routing table. If unchecked, the exit interface will be the interface on which the heartbeat is configured.
Include IMSI information in the Heartbeat message When enabled, causes the router to include the IMSI of the wireless modem module in the heartbeat packet.
Include GPS information in the Heartbeat message When enabled, causes the router to include the GPS co-ordinates in the heartbeat packet.
Generate Ping packets on this interface When enabled, this setting causes the router to reveal the configuration parameters that enable the sending of ICMP echo request (ping) packets. You can use this feature as part of a backup interface strategy.
Send n byte pings to IP host a.b.c.d every h hrs, m mins, s secs Controls how the ICMP echo requests are generated. The value in the left-hand text box specifies the number of data bytes in the echo request. Typical values are 32 or 64 octets. The IP host text box specifies the IP address of the host to which the ping packets are sent. The remaining parameters specify how often the ping should be sent.
Send pings every h hrs, m mins, s seconds if ping responses are not being received These three text boxes specify the interval at which to send pings when more than one ping request is outstanding. When left at the default of 0, this function is disabled.
Switch to sending pings to IP host a.b.c.d after n failures These parameters allow for more reliable problem detection before failover occurs. If the value in the first text box is a valid IP address, and the value in the second text box is greater than 0, when a ping failure is detected on the primary host address, this secondary host is tried. This is to ensure that should the primary host become unavailable for any reason and stops responding to the ICMP echo requests, the router will check an alternative IP address before initiating the failover procedure. The value in the second text box is the number of pings that should be allowed to fail before checking the secondary IP address.
Digi TransPort® Routers User Guide
368
Configuring network interfaces
Configure PPP and external modems
Ping responses are expected within s seconds When the value in this text box is set to a non-zero value, the router will wait for that specified interval for a response from a ping request before applying the timeout specified in the Send pings every ... if ping responses are not being received setting above. If the value is set to 0 (the default) then the router applies the timeout without modification.
Only send Pings when this interface is "In Service" When enabled, causes the router to only send ICMP requests when the PPP instance is in service. The default setting is unchecked which means that ICMP requests are sent when the interface is in service and out of service.
New connections to resume with previous Ping interval When enabled, causes the router to use the ping interval that was in force when the PPP interface last disconnected.
Reset the link if no response is received within s seconds The period for which the router should wait before terminating the PPP connection if no response to the auto-pings has been received. This behavior is useful in the attempt to reestablish communications, since the router will automatically attempt to restart an always-on link that has been terminated. The router uses function primarily when IP traffic is being carried over a W-WAN link and when the associated PPP instance is configured into the alwayson mode.
Use ETH 0 IP address as the source IP address When enabled, causes the router to use the IP address of interface ETH 0 as the source address for ICMP echo requests instead of the current IP address of the PPP interface.
Defer sending pings if IP traffic is being received One of the uses for sending ICMP echo requests is as a keepalive mechanism. When this setting is enabled, the router defers sending the ping packets out if IP traffic is being received, since in this case, separate keepalives are not needed.
Limit the data transmitted over this interface Some service providers impose a (usually monthly) limit on the amount of data sent over a link and levy additional charges if the limit is exceeded. This is fairly common practice for W-WAN links. When enabled, this setting causes the router to stop sending data on the interface when the preset data limit has been exceeded. The interface is unlocked manually by clicking the Clear Total Data Transferred button on the Management > Network Status > Interfaces > Advanced > PPP > PPP n page. Alternatively, it can be reset automatically on a certain day of the month.
Issue a warning event after n Kbytes/Mbytes/GBytes The value in this text box is the amount of traffic which will cause a warning event to be generated in the event log stating that the specified amount of data has been transferred. The units are specified by a drop-down list, having the following options; KBytes, MBytes, GBytes. For example, if the monthly tariff includes up to 5 MB of data before excess usage charges are levied, it would be useful to set this threshold to 4 MB. This would cause the router to create a warning entry in the event log once 4 MB of data had been transferred. You could use this event to trigger an email alert, SNMP trap or SMS alert message.
Digi TransPort® Routers User Guide
369
Configuring network interfaces
Configure PPP and external modems
Stop data from being transmitted after n Kbytes/Mbytes/GBytes The value in this text box specifies the total amount of data that may be transmitted by this PPP instance before the link is blocked for further traffic, and the value in the drop-down list specifies the units which are; KBytes, MBytes, GBytes.
Reset the data limit on the n day of the month The day of the month on which the data limit is reset to 0.
When the link disconnects, indicate that the connection failed if no IP packets were received
Reset this interface if n packets are transmitted and the connection has been up for at least s seconds The values in these text boxes control the circumstances under which the link can be reset. If the number of packets text box has a value greater than 0, the router will reset the link if that many IP packets have been transmitted but none have been received, and the link has been active for at least the value specified in the second text box.
Reboot the router after n consecutive resets If the value in this text box is non-zero, the router reboots if the PPP link has been reset the specified number of times as a consequence of the value n packets (described above) being exceeded.
Reboot the router after n consecutive connection failures If the value in this text box is non-zero, the router will reboot if it fails to establish a connection over this PPP instance after the specified number of consecutive attempts.
Use RADIUS for authentication when acting as a server Use RADIUS instance
Allow this PPP interface to attempt to connect n times before allowing other PPP interfaces inhibited by this interface to connect The number of connection attempts this PPP instance is allowed to make before other PPP instances that are inhibited by this instance may make connection attempts.
If this PPP interface gets disconnected, allow it to attempt to reconnect n times before allowing other PPP interfaces inhibited by this interface to connect On W-WAN routers, this setting specifies the number of times that a PPP instance which was connected and is then disconnected, is allowed to attempt to reconnect before other PPP instances that were inhibited by this PPP instance will be allowed to connect.
Digi TransPort® Routers User Guide
370
Configuring network interfaces
Configure PPP and external modems
Inhibit this PPP interface if the following PPP instances n are Active | Active and not out of service | Not out of service | Connected and not out of service Inhibition of this PPP interface may be controlled by the state of other PPP instances. This behavior is controlled by the options in this drop-down menu box.
If this PPP interface is inhibited and data needs to be sent The options in this drop-down selection box control the behavior of the router in the situation where the PPP instance is in its inhibited state but there is data waiting to be sent over the interface. The options are:
Do not bring up interface Leaves the situation as it is with the interface remaining inhibited. Bring up interface and use normal idle period Removes the inhibit state from the interface and uses the normal idle time associated with it to control when it deactivates.
Bring up interface and use idle period of s seconds Causes the interface to become activated but rather than using the idle timer associated with the interface, specify the idle timeout.
Inhibit other PPP interface if this PPP interface is disconnected but operational When enabled, enables this PPP instance to inhibit other PPP instances if it is operational but not currently active.
Attempt to negotiate DEFLATE compression on this interface When enabled, causes the router to compress the data transferred over this link. When unchecked, compression is disabled. The effectiveness of data compression varies with the type of data but a typical ratio achieved for a mix of data such as web pages, spreadsheets, databases, text files and (uncompressed) image files would be between 2:1 and 3:1. Using compression has the effect of increasing the effective throughput. Using compression may offer cost savings on a network where charges are based upon the amount of data transferred (such as W-WAN networks). If the data is already compressed (such as .zip files or .jpg images) then the compression algorithm detects this and sends the data without attempting further compression.
Attempt to negotiate MPPE encryption on this interface When enabled, causes the router to attempt to negotiate Microsoft Point-to-Point Encryption (MPPE) with the remote peer. If the remote peer is unable to negotiate MPPE, negotiations will fail. When negotiated, the PPP instance will encrypt the PPP frames as per the MPPE specification.
MPPE key size The values in this drop-down list select the length (in bits) of the encryption key. The options are:
n Auto n 40 bits n 56 bits n 128 bits
Digi TransPort® Routers User Guide
371
Configuring network interfaces
Configure PPP and external modems
Auto indicates that the router will accept whatever the remote suggests. For the other values, the remote must accept and request the key size specified, else the PPP negotiations will fail.
Enable MPPE stateless mode When this setting is enabled, the router negotiates stateless mode in which the session key is changed after the transmission of each packet. Stateless mode may be useful for lossy links.
Note MPPE does not provide authentication, only encryption. This is because the encryption keys are determined by the PPP engines themselves on start-up.
Use PPP m for processing CHAP
TCP transmit buffer size n bytes When the value in this text box is set to a non-zero value, the router uses the value to set the size of the TCP buffer for transmitted packets. This is useful for slow and/or lossy connections such as satellite links. Setting this buffer to a low value will prevent the amount of unacknowledged data from getting too high. If retransmits are required, a smaller transmit buffer helps prevent retransmits flooding the connection. 3. Click Apply.
Command line
Command Instance Parameter
ppp
n
metric
ppp
n
settledly
ppp
n
aodion
ppp
n
autoassert
Values
Equivalent web parameter
0-255
Metric
0-200
Allow this PPP interface to settle for s seconds after the connection has come up
0, 1, 2 0=disabled 1=enabled 2=On and return to service immediately
Enable "Always On" mode of this interface, On, On and return to service immediately
0, 1, 2 0=no autoassert 1=autoassert with route up delay 2=autoassert with no route up delay
Digi TransPort® Routers User Guide
372
Configuring network interfaces
Configure PPP and external modems
Command Instance Parameter
Values
Equivalent web parameter
ppp
n
immoos
on, off
Put this interface "Out of Service" when an always-on connection attempt fails
ppp
n
rdoosdly
on, off
remote disconnect
ppp
n
aodi_dly
0-
Attempt to reconnect after s
2147483647 seconds
ppp
n
aodi_dly2
02147483647
If a PPP interface that would be inhibited by this PPP is connected, attempt to re-connect after s seconds
ppp
n
pwr_dly
0-
Wait s seconds after power-up
2147483647 before activating this interface
ppp
n
minup
0-
Keep this interface up for at least s
2147483647 seconds
ppp
n
multi
off, on
Enable Multilink PPP on this interface
ppp
n
netip
Valid IP address a.b.c.d
Add a route to a.b.c.d if the peer's IP address is not negotiated
ppp
n
block_dns
on, off
Enable DNS inbound blocking
ppp
n
rbcast
off, on
Forward IP broadcasts over this interface if this interface is on the same IP network as an Ethernet interface
ppp
n
There is no explicit parameter to enable or disable this setting; it is disabled by disabling the ppp n echo n and ppp n echodropcnt n parameters.
off, on
Send LCP echo request packet to the remote peer
ppp
n
echo
0-
Send LCP echo requests every s
2147483648 seconds
ppp
n
echodropcnt
0-
Disconnect the link after n failed
2147483648 echo requests
ppp
None
Generate Heartbeats on this interface
ppp
n
hrtbeatip
Valid IP address a.b.c.d
Send Heartbeat messages to IP address a.b.c.d every h hrs, m mins, s secs
Digi TransPort® Routers User Guide
373
Configuring network interfaces
Command Instance Parameter
ppp
n
hrtbeatint
ppp
n
hbipent
ppp
n
hbipadd
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
ppp
n
hbiproute hbimsi hbgps None pingsiz pingip
pingint pingint2
pingip2
ip2count pingresp pingis
Configure PPP and external modems
Values
Equivalent web parameter
0-
Send Heartbeat messages to IP
2147483648 address a.b.c.d every h hrs, m mins,
s secs
Blank, PPP, ETH Blank is default
Use interface x,y for the source IP address
Valid interface number 02147483648
Use interface x,y for the source IP address
off, on
Select transmit interface using the routing table
off, on
Include IMSI information in the Heartbeat message
off, on
Include GPS information in the Heartbeat message
off, on
Generate Ping packets on this interface
0-
Send n byte pings to IP host a.b.c.d
2147483648 every h hrs, m mins, s secs
Valid IP address a.b.c.d
Send n byte ping to IP host a.b.c.d every h hrs, m mins, s secs
0-
Send n byte ping to IP host a.b.c.d
2147483648 every h hrs, m mins, s secs
0-
Send pings every h hrs, m mins, s
2147483648 seconds if ping responses are not
being received
Valid IP address a.b.c.d
Switch to sending pings to IP host a.b.c.d after n failures
0-
Switch to sending pings to IP host
2147483648 a.b.c.d after n failures
0-
Ping responses are expected
2147483648 within s seconds
off, on
Only send Pings when this interface is "In Service"
Digi TransPort® Routers User Guide
374
Configuring network interfaces
Configure PPP and external modems
Command Instance Parameter
ppp
n
ping2cont
ppp
n
pingdeact
ppp
n
pingfreth0
ppp
n
pingresetint
ppp
n
ppp
n
None - See dlwarnkb, dlstopkb, dlrstday parameters.
dlwarnkb
ppp
n
dlstopkb
ppp
n
dlrstday
ppp
n
ppp
n
sscnt
ppp
n
sssecs
ppp
n
ppp
n
ppp
n
ppp
n
lscnt rebootfails radius radiuscfg
Values
Equivalent web parameter
off, on
New connections to resume with previous Ping interval
0-
Reset the link if no response is
2147483648 received within s seconds
off, on
Use ETH 0 IP address as the source IP address
off, on
Defer sending pings if IP traffic is being received
off, on
Limit the data transmitted over this interface
0-
Issue a warning event after n
2147483647 XBytes
0-
Stop Data from being transmitted
2147483647 after n XBytes
0-255
Reset the data limit on the n day of the month
When the link disconnects, indicate that the connection failed if no IP packets were received
02147483648
Reset this interface if n packets are transmitted and the connection has been up for at least s seconds
02147483648
Reset this interface if n packets are transmitted and the connection has been up for at least s seconds
0-
Reboot the router after n
2147483648 consecutive resets
0-
Reboot the router after n
2147483648 consecutive connection failures
off, on
Use RADIUS for authentication when acting as a server
Use RADIUS instance
Digi TransPort® Routers User Guide
375
Configuring network interfaces
Configure PPP and external modems
Command Instance Parameter
Values
Equivalent web parameter
ppp
n
acttries
0-255
Allow this PPP interface to attempt to connect n times before allowing other PPP interfaces inhibited by this interface to connect
ppp
n
pdacttries
0-255
If this PPP interface gets disconnected, allow it to attempt to reconnect n times before allowing other PPP interfaces inhibited by this interface to connect
ppp
n
inhibitno
02147483648
Inhibit this PPP interface if the following PPP instances n are Active, Active and not out of service, not out of service, Connected and not out of service
ppp
n
inhmode
0-3
Inhibit this PPP interface if the
following PPP instances n are
Active, Active and not out of
service, not out of service,
Connected and not out of service
ppp
n
actmode
off, on
Inhibit other PPP interface if this PPP is interface is disconnected but operational
ppp
n
trafficto
02147483648
If this PPP interface is inhibited and data needs to be sent do not bring up the interface, bring up interface and use normal idle period, bring up interface and use idle period of s seconds
ppp
n
deflate
0, 1 0=Off 1=On
Attempt to negotiate DEFLATE compression on this interface
ppp
n
mppe
off, on
Attempt to negotiate MPPE encryption on this interface
ppp
n
mppebits
0, 40, 56, 128 MPPE key size 0=Auto
ppp
n
mppeless
off, on
Enable MPPE stateless mode
ppp
n
other_local_PPP_mode off, on
Use PPP for processing CHAP
ppp
n
other_local_PPP_inst
Use PPP n for processing CHAP
ppp
n
tcptxbuf
0-
TCP transmit buffer size n bytes
2147483648
Digi TransPort® Routers User Guide
376
Configuring network interfaces
Command Instance Parameter
ppp
n
pppdebug
ppp
n
norxrst
ppp
n
noremaddr
Values off, On off, on
off, on
Configure PPP and external modems
Equivalent web parameter
None. This parameter can be used when a cellular module is connected to a network and has successfully negotiated an IP address, but cannot route any data. If set to on, the TransPort device will detect this condition and power cycle the cellular module. Default: off.
Digi TransPort® Routers User Guide
377
Configuring network interfaces
Configure PPP and external modems
Configure PPP negotiation
When PPP starts up, the devices at both ends of the link negotiate the link parameters to find a common subset that both devices can use. The negotiation may be summarized by saying that both ends send negotiation packets with the following message: These are the values that I wish to use, and these are the values that I wish you to use.
Web
1. Go to Configuration > Network > Interfaces > Advanced > PPP 0 - 9 > PPP n > PPP Negotiation.
2. Configure PPP negotiation parameters as needed:
Restrict the negotiation time to s seconds The maximum time allowed for a PPP negotiation to complete. If negotiations have not completed in this time, the PPP instance is disconnected.
Disconnect if the remote requests an IP address Disconnects the PPP link if the remote host requests an IP address from the router.
Desired local ACCM The local Asynchronous Control Character Map which has the default value 0x00000000. Changing this value is for advanced users.
Desired remote ACCM The remote ACCM which has the default value 0xffffffff. As above, the default will work in nearly all circumstances and should be changed only where really necessary.
Digi TransPort® Routers User Guide
378
Configuring network interfaces
Configure PPP and external modems
Desired local MRU n bytes The desired local Maximum Receive Unit (MRU), the default value of 1500 octets will work fine in most cases.
Desired remote MRU n bytes The value in this text box is the desired MRU for the remote end of the link. The default value of 1500 octets will be fine in most cases.
Request local ACFC When enabled, causes the router to request Address Control Field Compression (ACFC). When negotiated, the address/control fields are removed from the start of the PPP header.
Remote ACFC When enabled, this setting causes the router to ask the remote device to request ACFC.
Request local PAP authentication When enabled, causes the router to use the Password Authentication Protocol (PAP) before allowing a connection to be made. Generally, this parameter is enabled for incoming connections and disabled for outgoing connections.
Request remote PAP authentication When enabled, causes the router to authenticate itself with the remote device using PAP. If this parameter is set, the connection will fail if authentication is not successful. Generally, this parameter is disabled.
Request local CHAP authentication When enabled, causes the router to use the Challenge Handshake Authentication Protocol (CHAP) for local authentication. As with PAP, this parameter is generally enabled for incoming connections and disabled for outgoing connections.
Request remote CHAP authentication As with PAP above, this setting controls whether or not the router should authenticate itself with the remote device using CHAP. The connection will fail if authentication fails. Generally, this parameter is enabled for outgoing connection and disabled for inbound connections.
Request local (VJ) compression When enabled, causes the router to request the use of Van Jacobson compression which compresses TCP/IP headers to about 3 octets, rather than the standard 40 octets. Use this setting to improve efficiency on slow links.
Request remote (VJ) compression When enabled, causes the router to send a negotiation packet that requests that the remote device requests VJ compression.
Request local PFC When enabled, causes the router to request Protocol Field Compression (PFC) which compresses PPP protocol fields from 2 octets to 1 octet.
Digi TransPort® Routers User Guide
379
Configuring network interfaces
Configure PPP and external modems
Remote PFC When enabled, causes the router to ask the remote device to request Protocol Field Compression.
Request BACP When enabled, the router will use the Bandwidth Allocation Control Protocol (BACP) to determine the ISDN number to dial for the seconds or third multi-link connection.
Allow remote end to request callback When enabled, requests a callback when it dials into a remote device. The answering PPP instance of the remote router must also be configured with the telephone number of the calling router and a suitable username, password combination.
Allow remote end to request callback Controls whether or not the router will respond to incoming callback requests. The options are:
n Off n Desired n Required
Allow this unit to authenticate using
CHAP-MD5 Selecting enabled from the drop-down menu allows the router to authenticate logins using the CHAP MD-5 algorithm.
MS-CHAP Selecting enabled from the drop-down menu allows the router to authenticate logins using Microsoft's proprietary MS-CHAP algorithm.
MS-CHAPv2 Selecting enabled from the drop-down menu allows the router to authenticate logins using version 2 of Microsoft's proprietary MS-CHAP algorithm.
Allow a remote unit to authenticate using
CHAP-MD5 When enabled, allows the router to authenticate with a remote unit using the CHAP-MD5 algorithm.
MS-CHAP When enabled, allows the router to authenticate with a remote unit using Microsoft's MS-CHAP algorithm.
MS-CHAPv2 When enabled, allows the router to authenticate with a remote unit using version 2 of Microsoft's MS-CHAP algorithm. 3. Click Apply.
Digi TransPort® Routers User Guide
380
Configuring network interfaces
Configure PPP and external modems
Command line
Command ppp
Instance Parameter Values
n
maxneg
0-2147483648
ppp
n
noremaddr off, on
ppp
n
l_accm
0x00000000-
0xFFFFFFFF
Default 0x00000000
ppp
n
r_accm
0x00000000-
0xFFFFFFFF
Default 0xFFFFFFFF
ppp
n
l_mru
0-n
Default 1500
ppp
n
r_mru
0-n
Default 1500
ppp
n
l_acfc
off, on
ppp
n
r_acfc
off, on
ppp
n
l_pap
off, on
ppp
n
r_pap
off, on
ppp
n
l_chap
off, on
ppp
n
r_chap
off, on
ppp
n
l_comp
off, on
ppp
n
r_comp
off, on
ppp
n
l_pfc
off, on
ppp
n
r_pfc
off, on
ppp
n
l_bacp
off, on
ppp
n
l_callb
off, on
Equivalent web parameter Restrict the negotiation time to s seconds Disconnect if the remote request an IP address Desired local ACCM
Desired remote ACCM
Desired local MRU
Desired remote MRU
Request local ACFC Request remote ACFC Request local PAP authentication Request remote PAP authentication Request local CHAP authentication Request remote CHAP authentication Request local (VJ) compression Request remote (VJ) compression Request local PFC Remote PFC Request BACP Request callback
Digi TransPort® Routers User Guide
381
Configuring network interfaces
Configure PPP and external modems
Command ppp
ppp
ppp
ppp
ppp
ppp
ppp
ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp
Instance Parameter Values
Equivalent web parameter
n
r_callb
0-2
0=Off
1=Desired
2=Required
Allow remote end to request callback
n
l_md5
0-2
0=Disabled
1=Enabled
2=Preferred
Allow this unit to authenticate using CHAP-MD5
n
r_md5
0, 1
0=Off
1=On
Allow remote unit to authenticate using CHAP-MD5
n
l_ms1
0, 1
0=Disabled
1=Enabled
2=Preferred
Allow this unit to authenticate using MS-CHAP
n
r_ms1
0, 1
0=On
1=Off
Allow remote unit to authenticate using MS-CHAP
n
l_ms2
0-2
0=Disabled
1=Enabled
2=Preferred
Allow this unit to authenticate using MS-CHAPv2
n
r_ms2
0, 1
0=Off
1=On
Allow remote unit to authenticate using MS-CHAPv2
n
lcn
0-4096
LCN
n
lcnup
1=up,
0=down
LCN direction
n
defpak
16,32,64,128,256,512 or Default X.25 packet size
1024
n
cingnua
text (valid NUA)
Use NUA
n
ipmode
0=XOT, 1=raw TCP
Use TPAD over interface
n
baklcn
1-4095
(Backup) LCN
n
baklcnup 1=up, 0=down
(Backup) LCN direction
n
bakl2iface lapb, lapd, tcp, ssl, vxn Use backup interface
n
bakl2nb
0-255
Use backup interface
n
bakcingnua
n
baknum
n
dmnr_reg
Digi TransPort® Routers User Guide
382
Configuring network interfaces
Configure PPP and external modems
Command ppp
Instance Parameter
n
dmnrtun_
add
Values
Equivalent web parameter
PPP QoS parameters
The parameters on this page control the Quality of Service management facility. Each PPP instance has an associated QoS instance, where PPP 0 maps to QoS 0, PPP 1 maps to QoS 1, and so on. These QoS instances include ten QoS queues into which packets may be placed when using QoS. Each of these queues must be assigned a queue profile from the twelve available.
To configure the PPP QoS parameters, set the following values:
Enable QoS on this interface When enabled, displays the following QoS configuration parameters:-
n Link speed n Kbps: The value in this text entry box should be set to the maximum data rate that this PPP link is capable of sustaining. The router uses this setting when calculating whether the data rate from a queue exceeds its minimum Kbps setting, as determined by the profile assigned to it and send at a higher rate, up to the maximum Kbps setting.
n Queue n: Below this column heading, is a list of ten queue instances. Each instance is associated with the profile and priority on the same row.
n Profile n: This column contains the profile to be associated with the queue. There are twelve available, 0-11, selected from the drop-down list boxes.
n Priority: Assigns a priority to the selected queue. Available priorities are: Very High, High, Medium, Low, and Very Low.
Digi TransPort® Routers User Guide
383
Configuring network interfaces
Configure PPP and external modems
Related CLI commands
Entity qos qos qos
Instance n n n
Parameter linkkbps q0prof q0prio
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
qos
n
q1prof q1prio q2prof q2prio q3prof q3prio q4prof q4prio q5prof q5prio q6prof q6prio q7prof q7prio q8prof q8prio q9prof q9prio
Values 00-11 0-4 0=Very high 1=High 2=Medium 3=Low 4=Very Low 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4 0-11 0-4
Equivalent web parameter Link speed n kbps Queue 0 Profile Queue 0 Priority
Queue 1 Profile Queue 1 Priority Queue 2 Profile Queue 2 Priority Queue 3 Profile Queue 3 Priority Queue 4 Profile Queue 4 Priority Queue 5 Profile Queue 5 Priority Queue 6 Profile Queue 6 Priority Queue 7 Profile Queue 7 Priority Queue 8 Profile Queue 8 Priority Queue 9 Profile Queue 9 Priority
Digi TransPort® Routers User Guide
384
Configuring network interfaces
Configure PPP and external modems
Configure PPP sub-configurations
Using PPP sub-configurations is an alternative to using an entire PPP instance, if only a few parameters are different to those in an existing PPP instance. Using PPP sub-configurations, you can define up to 50 sub-configurations and save them in system memory.
Web
1. Go to Configuration > Network > Interfaces > Advanced > PPP Sub-Configs. 2. Set the following parameters:
Nb The instance number for a sub-config.
Description The name to easily identify the sub-config.
Username The username for authenticating with the remote system. Usually required for outgoing PPP calls only.
Password The password for authentication with the remote system.
Confirm When changing the password, enter it into this text box also to allow the router to check for simple typing errors.
Dialout Number The ISDN number to make outgoing calls. This must be a valid number in order to allow the router to make outgoing calls. This number could be the number of the Internet Service Provider (ISP) or another router.
Add button Adds the PPP sub-config to the PPP configuration. 3. Click Apply.
Digi TransPort® Routers User Guide
385
Configuring network interfaces
Configure PPP and external modems
Command line
Command Instance Parameter
pppcfg
1-50
name
pppcfg
1-50
username
pppcfg
1-50
password
pppcfg
1-50
phonenum
Values
Up to 25 characters
Valid username up to 60 characters
Valid password up to 40 characters
Up to 25 digits
Equivalent web parameter Description Username
Password
Dialout Number
Digi TransPort® Routers User Guide
386
Configuring network interfaces
Configure PPP and external modems
Configure PPP over Ethernet
PPP over Ethernet (PPPoE) is a means of establishing a PPP connection over the top of an Ethernet connection. The implementation provided is compliant with RFC 2516, "A Method for Transmitting PPP Over Ethernet". A typical application would be to allow non-PPPoE enabled devices to access Internet services where the connection to the Internet is provided by an ADSL bridge device.
Web
There is no dedicated web page for configuring the router to use PPPoE. Instead, there are several parameters on other web pages you must use together to establish a PPPoE connection over the appropriate Ethernet interface. In particular, the following configuration pages and parameters are important.
1. Go to the Configuration > Network > Interfaces > Advanced > PPP n-n > PPP n pages for the PPP connections that require PPPoE.
2. Set the following parameters: n As a minimum requirement, set the Username and Password parameters. n The setting This PPP interface will use x,y defines the physical Ethernet interface over which the PPPoE session will operate. In most cases, this physical interface is PPPoE 0 (for Ethernet 0). The fact that you have selected PPPoE 0 as the physical interface for operation with PPP automatically enables PPPoE mode. If the router uses another Ethernet instance, for example, Eth 1, you must select PPPoE 1 to ensure the router uses the correct MAC address. This parameter value is in the format 0 or blank for port 0, 1 for port 1, 2 for port 2 etc. n If necessary, go to the page Configuration > Network > Interfaces > Advanced > PPP n-n > PPP n > Advanced and set the Enable "Always On" mode of this interface parameter to On to configure the router so that it will attempt to renegotiate the PPP link should it go down for any reason. n PPP negotiation: Initialize the advanced PPP options on this page as required by your ISP. n Desired Local MRU and Desired Remote MRU: Set to 1492. n Request Local ACFC and Request Remote ACFC: Set to No. n Request Local PFC and Request Remote PFC: Set to No. n Desired Local ACCM and Desired Remote ACCM: Set to 0xffffffff.
3. Click Apply on each PPP settings page when done.
Command line
There are no specific PPPoE commands available to the user via the text command interface. Use the appropriate ppp commands to set the required options.
Digi TransPort® Routers User Guide
387
Configuring DHCP servers
About DHCP servers
389
Configure DHCP server for Ethernet interfaces
390
Configure advanced DHCP parameters
393
Configure advanced DHCP options
394
Configure DHCP options
396
Configure static lease reservations
398
Digi TransPort® Routers User Guide
388
Configuring DHCP servers
About DHCP servers
About DHCP servers
Digi routers incorporate one or more Dynamic Host Configuration Protocol (DHCP) servers, one for each Ethernet port. DHCP is a standard Internet protocol that allows a DHCP server to dynamically distribute IP addressing and configuration information to network clients.
Web
Go to Configuration > Network > DHCP server. These pages include a web page for configuring each of the DHCP servers. Additionally, there is a separate page for mapping MAC addresses to fixed IP addresses.
Digi TransPort® Routers User Guide
389
Configuring DHCP servers
Configure DHCP server for Ethernet interfaces
Configure DHCP server for Ethernet interfaces Web
1. Go to Configuration > Network > DHCP Server > DHCP Server for Ethernet n.
2. Configure DHCP server parameters:
Enable DHCP Server
When enabled, displays the following parameters:
IP Addresses a.b.c.d to a.b.c.d
There are six text boxes in this part of the page; three rows of two. The values in these specify the starting and ending addresses for the range of IP addresses that will be handed out by the DHCP server. You can use each of the three rows to specify a different IP address pool; all pools should be within the same subnet. When the minimum IP address text box is clear, the DHCP service will be disabled. In other words, in order to enable the DHCP service, there must be at least one minimum IP address and a range. Using the CLI, this is specified slightly differently, a starting address and a range are specified instead.
Digi TransPort® Routers User Guide
390
Configuring DHCP servers
Configure DHCP server for Ethernet interfaces
Mask
The subnet mask on the network to which the router is connected.
Gateway
A gateway is required in order to route data to IP addresses that are not on the local subnet. The value in this text box specifies the IP address of the gateway (which is usually the IP address of the router itself as configured by the IP address of the Ethernet interface associated with this DHCP instance). Alternatively, this may be set to the IP address of another router on the LAN.
DNS Server
The IP address of the primary DNS server to use by clients on the LAN. This is usually the IP address of the route itself. Alternatively, this may be set to the IP address of an alternative DNS server on the LAN.
Secondary DNS Server
The IP address of a secondary DNS server (if available) that DHCP clients on the LAN use.
Domain Name
The domain name returned to clients.
Lease Duration d days h hrs m mins
How long a DHCP client can use the assigned IP address before it must renew its configuration with the DHCP server. When configuring this value using the command line interface be aware that this parameter is specified in minutes. The three boxes here are for convenience when using long lease durations.
Wait for s milliseconds before sending DHCP offer reply
When this setting is enabled, the router uses the value in the text box as the delay to use prior to sending out the DHCP_OFFER message. Enabling this functionality and setting the delay to a non-zero value will allow other DHCP servers on the network to respond first.
Duplicate Address Detection
If enabled, causes the router to detect duplicate addresses.
Only send offers to Wi-Fi clients
When enabled, causes the router to only send DHCP offers to Wi-Fi clients. This is useful if the router serves as an access point and there is a separate DHCP server on the Ethernet LAN.
DHCP Relay
Forward DHCP requests to a.b.c.d
The values in these two text boxes specify the IP addresses of the two supported DHCP relay agents. If the DHCP server is on a different subnet, specifying the IP address of the server in this text box will cause the router to forward DHCP requests to the IP address specified. The DHCP server must be within 4 hops.
Digi TransPort® Routers User Guide
391
Configuring DHCP servers
Configure DHCP server for Ethernet interfaces
3. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
dhcp
n
IPmin
Valid IP address a.b.c.d
IP Addresses a.b.c.d
dhcp
n
IPrange
0-2147483647 Default 20
to a.b.c.d
dhcp
n
IPmin2
Valid IP address a.b.c.d
IP Addresses a.b.c.d
dhcp
n
IPrange2 0-2147483647 Default 0
to a.b.c.d
dhcp
n
IPmin3
Valid IP address a.b.c.d
IP Addresses a.b.c.d
dhcp
n
IPrange3 0-2147483647 Default 0
to a.b.c.d
dhcp
n
mask
Valid IP address a.b.c.d
Mask
dhcp
n
gateway Valid IP address a.b.c.d
Gateway
dhcp
n
DNS
Valid IP address
DNS Server
a.b.c.d
dhcp
n
DNS2
Valid IP address a.b.c.d
Secondary DNS Server
dhcp
n
domain Up to 64 characters Domain Name
dhcp
n
lease
0-2147483648 minutes Default 20160 minutes (14 days)
Lease Duration d days, h hrs, m mins
dhcp
n
respdelms 0-2147483647
Wait for s milliseconds before sending DHCP offer reply
dhcp
n
wifionly off, on
Only send offers to Wi-Fi clients
dhcp
n
fwdip
Valid IP address a.b.c.d
Forward DHCP requests to a.b.c.d
dhcp
n
fwdip2
Valid IP address a.b.c.d
Forward DHCP requests to a.b.c.d
Digi TransPort® Routers User Guide
392
Configuring DHCP servers
Configure advanced DHCP parameters
Configure advanced DHCP parameters Web
1. Go to Configuration > Network > DHCP Server > DHCP Server for Ethernet n > Advanced. 2. Set advanced DHCP parameters:
Next Bootstrap Server a.b.c.d
The IP address of a secondary configuration server. This server does not have to be on the same logical subnet as the client.
Server Hostname
The name of a host that the DHCP client can make contact with in order to download a boot file.
Boot file
The name of the boot file the client can download from the host specified in the Server Hostname text box.
Send unicast responses
If enabled, sends unicast responses to DHCP clients from the DHCP server. 3. Click Apply.
Command line
Command dhcp dhcp dhcp
Instance n n n
Parameter nxtsvr sname file
Values Valid IP address a.b.c.d Up to 64 characters Up to 64 characters
Equivalent web parameter Next Bootstrap Server Server Hostname Boot file
Digi TransPort® Routers User Guide
393
Configuring DHCP servers
Configure advanced DHCP options
Configure advanced DHCP options
Web
1. Go to Configuration > Network > DHCP Server > DHCP Server for Ethernet n > Advanced DHCP Options.
2. Set advanced DHCP options:
NetBIOS Name Server a.b.c.d
The IP address of the primary WINS server address.
Secondary NetBIOS Name Server a.b.c.d
The IP address of the secondary WINS server address.
TFTP Server Address a.b.c.d
The IP address of a TFTP server. Boot images mainly use this address.
FTP Server Address a.b.c.d (for WYSE Terminals)
The IP address of an FTP server and is a custom option for use with WYSE terminals.
FTP Root Dir (for WYSE Terminals)
The root directory for FTP transfers. This is also a custom option for use with WYSE terminals. 3. Click Apply.
Command line
Command Instance Parameter Values
dhcp
n
NBNS
Valid IP address a.b.c.d
dhcp
n
NBNS2
Valid IP address a.b.c.d
Equivalent web parameter NetBIOS Name Server a.b.c.d
Secondary NetBIOS Name Server a.b.c.d
Digi TransPort® Routers User Guide
394
Configuring DHCP servers
Configure advanced DHCP options
Command Instance Parameter Values
dhcp
n
tftp
Valid IP address
a.b.c.d
dhcp
n
ftp
Valid IP address
a.b.c.d
dhcp
n
ftproot Up to 64 characters
Equivalent web parameter TFTP Server Address a.b.c.d FTP Server Address a.b.c.d FTP Root Dir
Digi TransPort® Routers User Guide
395
Configuring DHCP servers
Configure DHCP options
Configure DHCP options
Web
1. Go to Configuration > Network > DHCP Server > DHCP Options. The DHCP Options pages allow custom (or non-standard) DHCP options to be configured and sent to the DHCP client when requesting an IP address and other DHCP parameters. This is useful for devices such as IP telephones that use specific strings. On the web page, these (up to ten) options are configured using a table.
2. Enter DHCP options in the table:
Option
The DHCP option number.
Data type
The data type for the option and can be any one of the following; 1, 2, or 4 byte value, IPv4 address, text string, or hexadecimal data.
Value
The actual data that will be sent in the DHCP option message. 3. Click Apply.
Command line
Command Instance Parameter
dhcpopt n
optnb
Values
0-2147483647 Default 0
Equivalent web parameter Option
Digi TransPort® Routers User Guide
396
Configuring DHCP servers
Configure DHCP options
Command Instance Parameter
dhcpopt n
type
dhcpopt n
value
Values
i1=1 byte value i2=2 byte value i4=4 byte value ipv4=IPv4 address string=string hex=hexadecimal
Up to 127 octets
Equivalent web parameter Data type
Value
For example, to set the option number to 9 for the LPR Server, the command is: dhcpopt 0 optnb 9
Digi TransPort® Routers User Guide
397
Configuring DHCP servers
Configure static lease reservations
Configure static lease reservations
The Static Lease Reservations settings control the configuration of MAC address to IP address mappings. These settings assign a specific IP address to a particular Ethernet MAC address. They are particularly useful for mobile applications, such as W-WAN where a particular item of mobile equipment should be issued with the same IP address regardless of when it was last connected to the network. Up to ten MAC to IP address reservations may be specified.
Web
1. Go to Configuration > Network > DHCP Server > Static Lease Reservations.
Note Any IP addresses specified on this page must not be in the range of IP address specified in the DHCP Server page.
2. Enter static lease reservation parameters:
IP Address a.b.c.d
The IP address to be assigned.
MAC Address aa.bb.cc.dd.ee.ff
The MAC address which is to be given the above IP address.
Add button
Adds the specified static lease reservation to the DHCP configuration.
Delete button
Removes an existing static lease reservation from the DHCP configuration. 3. Click Apply.
Digi TransPort® Routers User Guide
398
Configuring DHCP servers
Configure static lease reservations
Command line
Command Instance mac2ip n mac2ip n
Parameter IPaddr mac
Values
Equivalent web parameter
Valid IP address a.b.c.d IP Address a.b.c.d
Valid MAC address aa.bb.cc.dd.ee.ff
MAC Address aa.bb.cc.dd.ee.ff
Two commands are required to set up a mapping:
mac2ip <instance> mac <MAC address> mac2ip <instance> IPaddr <IP address>
where <instance> can be 0-9.
Digi TransPort® Routers User Guide
399
Configuring network services
Configure network services
401
Digi TransPort® Routers User Guide
400
Configuring network services
Configure network services
Configure network services
The Network Services Settings page configures a set of common network services that are available for the router, and the network port on which the service is running. You can enable and disable common network services and configure the TCP/UDP port on which the network service listens. You can disable services as needed for security purposes. That is, you can disable certain services so the device runs only those services specifically needed. To improve device security, you can disable nonsecure services such as Telnet.
Web
1. Go to Configuration > Network > Network Services. On the Network Services page, you can quickly enable or disable network services without having to navigate to multiple sections of the menu. Some network services have additional configuration settings.
Digi TransPort® Routers User Guide
401
Configuring network services
Configure network services
2. Enable or disable network services as needed:
Enable Device Discovery Protocol (ADDP)
When enabled, the router uses Advanced Digi Discovery Protocol (ADDP), a Digi-proprietary protocol for discovering devices on a network.
Digi TransPort® Routers User Guide
402
Configuring network services
Configure network services
Enable Realport
When enabled, the router uses RealPort, patented RealPort COM/TTY port redirection software for Microsoft Windows.
Enable Encrypted Realport
When enabled, the router uses RealPort software with encryption. Encrypted RealPort offers a secure Ethernet connection between the COM or TTY port and a device server or terminal server. Encryption prevents internal and external snooping of data across the network by encapsulating the TCP/IP packets in a Secure Sockets Layer (SSL) connection and encrypting the data using Advanced Encryption Standard (AES).
Enable Network Management Protocol (SNMP)
Enables and disables remote management of the router using SNMP. This setting does not actually directly control the SNMP functionality, but enables or disables the remaining SNMP controls on this page. To perform detailed configuration, including setting up command filters, users and SNMP traps, go to Configuration > Remote Management > SNMP.
Note Simply clicking on this setting may not be sufficient to allow this service to start working. Depending upon the SNMP version selected below, additional configuration may be required.
UDP Port n
The standard UDP port for SNMP is 161, the default. If you require a different port, enter the port number into the text entry box.
Enable SNMP v1
When enabled, the router uses SNMP version 1.
Enable SNMP v2c
When enabled, the router uses SNMP version 2c.
Enable SNMP v3
When enabled, the router uses SNMP version 3.
Enable Simple Network Timer Server (SNTP)
When enabled, the router acts as a Simple Network Time Protocol (SNTP) time server.
Source
This drop-down selection menu selects the source that supplies time data for the SNTP server. The usual options are:
n Internal real time clock (RTC) device n A GPS module (if supported) n An NTP client (if supported)
Digi TransPort® Routers User Guide
403
Configuring network services
Configure network services
Enable Secure Shell Server (SSH / SFTP)
When enabled, the router uses Secure Shell Server (SSH) and Secure File Transfer Protocol (SFTP) for entering commands and transferring files. The simplest way to check the status or configuration of the router or to upload new firmware is to use the command-line interface over a directly connected ASY port or via a telnet session. Both of these options have security implications. If you want to gain access to the command line interface of the router but using a more secure protocol, enabling this setting enables a secure shell to start. This option also enables support for SFTP for secure file transfers.
Enable FTP Server
When enabled, the router uses File Transfer Protocol (FTP) for file transfers.
Enable HTTP Server
When enabled, the router uses HTTP, or insecure web server. You can perform most router configuration using the HTTP web server as described here. However, HTTP is an insecure protocol. For security reasons, you can disable this service by deselecting this radio button, which enables the following secure web server (HTTPS). If security is not as much of an issue, selecting this option allows using the simpler and slightly more convenient web server.
Enable HTTPS Server ()
When enabled, the router uses HTTPS, or secure web server. Selecting this option also disables the insecure HTTP protocol.
Enable Telnet Server
Selects between a simple Telnet server or a Telnet over SSL server. When this option is selected, the simple, insecure version of telnet is enabled.
Enable Telnet over SSL Server
When enabled, enables telnet over the Secure Sockets Layer (SSL) protocol. Select this option if security is an issue. Selecting this option disables the simple version in addition to enabling telnet over SSL.
Enable ASY Port Server
When enabled, the router uses the asynchronous (ASY) port server.
Enable ZING
When enabled, the router uses the ZING protocol. ZING is a Digi-proprietary protocol for configuring devices that do not have an IP address. ZING is no longer used.
Enable RCI over HTTP
When enabled, the router supports sending/receiving of Remote Command Interface (RCI) requests over HTTP, through the embedded web server. The web server provides the initialization, receiving, sending, and security for requests.
ASY O-n Listening Port
For the specified ASY port, sets the network port number on which to listen.
Digi TransPort® Routers User Guide
404
Configuring network services
3. Click Apply.
Command line
Command Instance Parameter
addp
0
enable
rport
0
enabled
rport
0
encryption
snmp
n
v1enable
snmp
n
snmp
n
port v2cenable
snmp
n
v3enable
sntp
0
sntp
0
srvr_mode time_src
services services services services services services tcpperm
0 0 0 0 0 0 ASY 0-9
services 0
cmd
0
SSH ftp http telnet telnets asytcp -l<listening port> zing rcihttp
Configure network services
Values on, off on, off on, off 0, 1 0=Off 1=On Default 161
0, 1 0=Off 1=On 0, 1 0=Off 1=On on, off
0=RTC 1=GPS 2=NTP Client on, off on, off on, off on, off on, off on, off <listening port> on, off on, off
Equivalent web parameter Enable Device Discovery (ADDP) Enable RealPort Enable Encrypted RealPort Enable Network Management Protocol > Enable SNMP v1
Enable Network Management Protocol > UDP Port n Enable Network Management Protocol > SNMP v2c
Enable Network Management Protocol > Enable SNMP v3
Enable Simple Network Time Server (SNTP) Enable Simple Network Time Server (SNTP) > Source
Enable Secure Shell Server (SSH/SFTP) Enable FTP Server Enable HTTP Server Enable Telnet Server Enable Telnet over SSL Server Enable ASY Port Server ASY 0-9 Listening Port
Enable ZING Enable RCI over HTTP
Digi TransPort® Routers User Guide
405
Configuring DNS
Configure DNS servers
407
DNS Server Update parameters
408
Configure Dynamic DNS (DynDNS)
412
Digi TransPort® Routers User Guide
406
Configuring DNS
Configure DNS servers
Configure DNS servers
The Domain Name Server (DNS) selection parameters configure a DNS server based on the DNS query. For example, you can direct DNS lookups for internal servers to an internal DNS server and send all other DNS requests directly to an external DNS server managed by you Internet service provider.
DNS Server n parameters
Web
1. Go to Configuration > Network > DNS Servers > DNS Server n.
2. Configure DNS server parameters:
For DNS requests matching pattern, send the request to
The hostname pattern to match for the specified DNS server. This parameter needs a wildcard to prefix the domain name. For example, to match DNS queries for all digi.com servers, enter *.digi.com. When using this feature, set the last DNS server selection hostname pattern to * to match all other DNS lookups. This ensures all the DNS lookup configuration is kept together for ease of troubleshooting. Otherwise, the lookups will use the DNS server configured on the interface of the default route.
DNS Server a.b.c.d
The IP address of the DNS server to use when a DNS request matches the hostname pattern.
Secondary DNS Server a.b.c.d
In the event of the primary DNS server not being available, the IP address in this text box specifies the destination for DNS queries matching the hostname pattern.
Digi TransPort® Routers User Guide
407
Configuring DNS
DNS Server Update parameters
Route using Routing table / Interface x,y
Control whether the router should look up the route to the DNS server by using the routing table or should send the DNS query out of a specific interface. Selecting the Interface radio button enables the drop-down box and interface instance text box. Available options for the interface are PPP and Ethernet. Fill in the adjacent text box with the number of a valid instance of the interface, such as Ethernet 3. (Different router models support different numbers of interfaces).
Use source IP Address of Sending interface / Interface x,y
Control whether the DNS query should go out having the source address of the sending interface or a different interface. This will be required for routing if the route to the DNS server is via an IPsec tunnel, to ensure the local and remote subnet selectors match. 3. Click Apply.
Command line
Command Instance Parameter Values
dnssel
n
pattern
*.domain.com
dnssel
n
dnssel
n
dnssel
n
dnssel
n
dnssel
n
dnssel
n
svr secsvr ent add ipent ipadd
Valid IP address Valid IP address PPP, Ethernet Valid interface number PPP, Ethernet Valid interface number
Equivalent web parameter For DNS requests matching pattern, send the request to DNS Server a.b.c.d Secondary DNS Server a.b.c.d Interface x,y Interface x,y Interface x,y Interface x,y
DNS Server Update parameters
Dynamic DNS is supported in accordance with RFC2136 and RFC2485. This allows routers to update specified DNS servers with their IP addresses when they first connect to the Internet and at regular intervals thereafter. The parameters in this section control how the router updates a specified DNS server with its IP address when it first connects to the Internet and at regular intervals thereafter. The parameters set here are not to be confused with the popular dynamic DNS service dyndns.com; there is a separate page for configuring the router to work with dyndns.com. See Configure Dynamic DNS (DynDNS).
Web
Go to Configuration > Network > DNS Servers > DNS Server Update.
Digi TransPort® Routers User Guide
408
Configuring DNS
DNS Server Update parameters
Send an update to DNS Server a.b.c.d for
The IP address in this text box specifies the DNS server that should be sent the updated information. The server must support DNS Update messages. Dynamic DNS is generally offered as a subscriptionbased service by ISPs, but for a large number of deployed routers, it may be more appropriate to set up a dedicated DNS server locally.
Name
The member of the DNS zone to update. Along with the zone parameter, uniquely identifies the router. For example, if the router has a name of epos33, the full address of the router is epos33.mycompany.com.
Zone
The DNS zone to update. When using Dynamic DNS, you must have a domain name. This domain name can be purchased from an appropriate vendor. Enter this domain name, such as mycompany.com, in the Zone field.
When the default route changes Interface x,y becomes active
These settings determine when the update is sent, such as when the default route changes or when the specified interface becomes active. The drop-down list offers the options of PPP or Ethernet. In the text box, enter the instance number for the specified interface.
Also send an update every h hrs, m mins, s secs
The interval at which the router issues update messages to the DNS server.
Digi TransPort® Routers User Guide
409
Configuring DNS
DNS Server Update parameters
The DNS server should delete all previous records
When enabled, causes the DNS server to delete all records of previous addresses served to the router.
DNS Server Username
The username allocated by the Dynamic DNS service provider.
DNS Server Password
The password allocated by the Dynamic DNS service provider.
Password is Base64 encoded
Some Dynamic DNS servers issue passwords that are Base64 encoded, such as Linux Base servers. If this is the case, check this check box to switch on the Base64 decoding of the password before transmission. The password is not actually transmitted as part of the message; it appears in a signature appended to the message. If the password is issued as a hexadecimal string and not straight text, you must use the prefix 0x in the password text box.
Confirm DNS Server Password
Enter the password in this text box to confirm it.
Local time offset from GMT
Auto detect
These two radio buttons control whether the offset of the local time from GMT should be autodetected or specified. This feature is required since a GMT timestamp must be included as part of the authentication message. When set to Auto detect, the router automatically applies the correction. When Auto detect is not selected, select the correct offset from the drop-down list.
Required Time Accuracy
The permitted variance between the router's time and that of the DNS server. If the time difference exceeds this limit, the DNS update will fail.
Allow DNS clients to cache this entry for s seconds
How long a router that resolved the address is allowed to cache that address.
Command line
Command Instance Parameter Values
dnsupd 0
server
Valid IP address a.b.c.d
dnsupd 0 dnsupd 0 dnsupd 0
name zone ifent
up to 20 characters up to 64 characters PPP,ETH
Equivalent web parameter Send an update to DNS Server a.b.c.d
Name
Zone
when interface x,y becomes active
Digi TransPort® Routers User Guide
410
Configuring DNS
DNS Server Update parameters
Command Instance Parameter
dnsupd 0
ifadd
dnsupd 0
upd_int
dnsupd 0
delprevrr
dnsupd 0
username
dnsupd 0
password
dnsupd 0 dnsupd 0
b64pwd autozone
dnsupd 0
tzone
dnsupd 0
fudge
dnsupd 0
ttl
Values
Equivalent web parameter
Valid instance number
when interface x,y becomes active
0 2147483648 (seconds) Also send an update every h hrs, m mins s secs
off, on
The DNS server should delete all previous records
Valid username (up to 20 characters)
DNS Server Username
Valid password (up to 100 DNS Server Password characters)
off, on
Password is Base64 encoded
off, on
Local time offset from GMT auto detect
2147483648 -2147483647 Local time offset from GMT n (hours)
0 2157483648 (seconds) Required Time Accuracy s seconds
0 2157483648 (seconds) Allow DNS clients to cache this entry for s seconds
Digi TransPort® Routers User Guide
411
Configuring DNS
Configure Dynamic DNS (DynDNS)
Configure Dynamic DNS (DynDNS)
The Dynamic DNS client (DynDNS) updates DNS hostnames with the current IP address of a particular interface. Dynamic DNS operates under the specification supplied by DynDNS (go to http://dyn.com), referred to in the web interface as Dynamic DNS. When an interface connects, the client checks the current IP address of that interface. If the IP address differs from that obtained from the previous connection, the Dynamic DNS service is contacted, and the hostnames specified in the Hostname parameters are updated with the new address.
Dynamic DNS parameters
Web
1. Go to Configuration > Network > Dynamic DNS.
2. Configure Dynamic DNS parameters:
Digi TransPort® Routers User Guide
412
Configuring DNS
Configure Dynamic DNS (DynDNS)
Service Provider
Selects the Dynamic DNS service provider. Dynamic TransPort routers support the Dynamic DNS services Dynamic DNS (at dyn.com) No-IP (at noip.com). TransPort routers may be compatible with other Dynamic DNS services, which can be selected by setting the Service Provider setting to Other. For more information about Dynamic DNS services, including other service providers, see this article: https://en.wikipedia.org/wiki/Dynamic_DNS.
Service Provider Hostname
The hostname for the Dynamic DNS service provider.
Host and Domain Name(s)
Up to five host/domain names that are to be updated using the service.
Destination port #
The IP port to use as the destination port. The default value is 0 which causes the router to use the default port number which is port 80.
DynDNS User Name
The username to use when updating the hostnames. This will have been supplied by the service provider.
DynDNS Password
The password to use when updating the hostnames. This will have been supplied by the service provider.
Confirm DynDNS Password
Enter the password into this text box to confirm it.
DynDNS DDNS System
The value selected from this drop-down list the dynamic DNS system containing the hostnames to be updated. The available options are:
n Dynamic DNS n Static DNS n Custom DNS
When default route/interface x,y becomes active, send DDNS update
The radio buttons select whether or not the router should use the default interface or the interface specified from the drop-down list. If the specified interface option is selected, the required interface is selected from the drop-down list and the interface instance is entered into the adjacent text box. If the default interface is selected, the client will keep track of and use the current default route.
Use Wildcards
Selects whether or not wildcard matching on the hostname will be performed. The options are:
Digi TransPort® Routers User Guide
413
Configuring DNS
Configure Dynamic DNS (DynDNS)
n Disable wildcards n Enable wildcards n No change to service settings When enabled, the Dynamic DNS service will match DNS requests of the form *.hostname where * matches any text. For example, if Hostname1 was set to site.dyndns.com and wildcard matching was enabled, then www.site.dyndns.com would resolve to the interface address. 3. Click Apply.
Command line
Command Instance Parameter
dyndns 0
provider
dyndns 0
provider_hostname
dyndns 0
hostname1
dyndns 0
hostname2
dyndns 0
hostname3
dyndns 0
hostname4
dyndns 0
hostname5
dyndns 0 dyndns 0 dyndns 0
port username password
Values
Up to 40 characters
Up to 40 characters
Up to 40 characters
Up to 40 characters
Up to 40 characters
0 - 65535
Up to 20 characters Up to 25 characters
Equivalent web parameter
Service Provider
Service Provider Hostname
Host and Domain Name (s)
Host and Domain Name (s)
Host and Domain Name (s)
Host and Domain Name (s)
Host and Domain Name (s)
Destination port #
DynDNS User Name
DynDNS Password
Digi TransPort® Routers User Guide
414
Configuring DNS
Configure Dynamic DNS (DynDNS)
Command Instance Parameter
dyndns 0
system
dyndns 0
ifent
dyndns 0
ifadd
dyndns 0
wildcard
Values
Equivalent web parameter
Blank, statdns, DynDNS DDNS
custom
System
Blank,ETH,PPP
When default route/interface x,y becomes active, send DDNS update
0 -2147483647
When default route/interface x,y becomes active, send DDNS update
0, 1, 2 0=Disable wildcards 1=Enable wildcards 2=No change to service settings
Use Wildcards
Advanced Dynamic DNS parameters
Typically, the Advanced Dynamic DNS parameters do not require d changing from their defaults.
Note Before configuring dynamic DNS or any of these parameters, it is recommended that you view the information and resources available at the website http://dyn.com.
Web
Go to Configuration > Network > Dynamic DNS> Advanced.
Update interval d days
The number of days between dynamic DNS updates.
Digi TransPort® Routers User Guide
415
Configuring DNS
Configure Dynamic DNS (DynDNS)
Supply the IP address in the update
When enabled (the default), causes the router to supply the IP address as part of the dynamic DNS update. When unchecked, the IP address is not supplied and the DYNDNS server attempts to determine the correct IP address by other means (IP source address in update packet). Use this mode if the router is behind a NAT router only.
Only send update when this router is the VRRP master
When enabled, causes the router to not send DDNS updates unless at least one Ethernet interface is a VRRP master.
Enable debug
When enabled, enables debug tracing of the dynamic DNS transactions.
Command line
Command Instance dyndns 0 dyndns 0 dyndns 0
Parameter updateint noip ifvrrpmaster
Values 0 -255 off, on off, on
dyndns 0
debug
off, on
Equivalent web parameter Update interval d days Supply the IP address in the update Only send update when this router is the VRRP master Enable debug
Digi TransPort® Routers User Guide
416
Configuring IP routing and forwarding
Supported routes
418
View the TransPort routing table
420
Configure route metrics
421
Configure IP routing parameters
422
Configure static routes
425
Configure default IP routes
433
Configure Routing Information Protocol (RIP) settings
439
Configure Open Shortest Path First (OSPF) parameters
445
Configure Border Gateway Protocol (BGP) settings
448
Configure IP port forwarding and static NAT mappings
450
Configure multicast routes
452
Configure Virtual Routing and Forwarding (VRF)
454
Digi TransPort® Routers User Guide
417
Configuring IP routing and forwarding
Supported routes
Supported routes
TransPort routers support three main types of routes:
n Dynamic routes n Static routes n Default routes
Dynamic routes
Dynamic routes are created automatically when an interface is configured or connected. For example configuring an Ethernet 0 interface with an IP address of 192.168.1.1 and mask of 255.255.255.0 will cause a dynamic route to be created automatically. Thus any packet with destination IP address in the range 192.168.1.0 to 192.168.1.255 will automatically be routed through to the Ethernet 0 interface.
Static routes
Web
To add static routes, configure a route in Configuration > Network > IP Routing/Forwarding > Static Routes > Routes 0 9 > Route n, where n is an instance number. The minimum configuration settings required to add a static route are:
n IP Address n Mask n Interface n Interface number
If a static route is pointing at an Ethernet interface, you can optionally add a gateway IP address. If you do not add a gateway IP address, the router automatically uses gateway IP address configured for the Ethernet interface itself.
Default routes
Web
To add default routes, configure a route in Configuration > Network > IP Routing/Forwarding > Static Routes > Default Route n, where n is an instance number. Default routes will match packets with any destination IP address (when in service). If a default route is configured, packets with destination IP addresses that do not match any of the dynamic or static routes will be sent out the interface specified in the first in service default route.
Routing modes
The TransPort has two routing modes available, these are:
n TransPort routing mode: The original routing method provided on existing installations. n CIDR routing mode: Enabled by default on most TransPort routers.
The command to switch between the two modes is:
Digi TransPort® Routers User Guide
418
Configuring IP routing and forwarding
Supported routes
ip 0 cidr [off|on]
TransPort routing mode
When you enable the TransPort routing mode, CIDR routing is disabled. When the router receives an IP packet to route, it uses the routing table to decide through which interface to send the packet. Usually the destination IP address of the IP packet is compared with the IP Address and Mask of each entry in the routing table in index order, regardless of the order in the routing table or length of mask. There may be more than one match, and in this case, the index number of the route is taken into account. The index number is simply the route number in the configuration. That is, Static Route 0 or 1 is index 0 or 1. The router checks static routes first, then dynamic routes, then default routes.
Command line
The command to enable TransPort routing mode is as follows:
ip 0 cidr off
CIDR routing mode
When the router receives an IP packet to route, it uses the routing table to decide through which interface to send the packet. Usually the destination IP address of the IP packet is compared with the IP Address and Mask of each entry in the routing table. There may be more than one match and in this case the router uses the most specific route to route the packet. For example, a the router uses a matching /24 route before a matching /16 route. If multiple routes match the destination and have the same prefix length, the router uses the index number of the routes in the routing table to determine the route.
Command line
The command to enable CICR routing mode is:
ip 0 cidr on
Digi TransPort® Routers User Guide
419
Configuring IP routing and forwarding
View the TransPort routing table
View the TransPort routing table
Web
Go to Management > Network Status > IP Routing Table.
Command line
Use the route print command:
route print
Destination
Gateway Metric Protocol Idx Interface Status
------------------------------------------------------------------------------
10.10.14.0/24
10.10.14.68
1
Local
- ETH 0
UP
10.182.120.188/30 10.182.120.189
1
Local
- PPP 1
UP
0.0.0.0/0
10.10.14.1
2
Static
0 ETH 0
UP
OK
Digi TransPort® Routers User Guide
420
Configuring IP routing and forwarding
Configure route metrics
Configure route metrics
You can set route metric settings to override the order in which the routes are searched. The router always uses routes with lower metric numbers in preference to routes with higher metric numbers, even if the routes with higher metric numbers appear first in the routing table. To configure route metrics, use the following route parameters:
n Connected Metric: The metric for a route when its interface is active. n Disconnected Metric: The metric for a route when its interface is inactive.
Normally, both values should be the same, but in some advanced routing scenarios, it is necessary to use different values. You can alter route metrics automatically according to various circumstances. This allows for automatic backup connection paths. You can put routes and interfaces out of service. Whenever an interface is out of service (OOS), any route pointing at the interface is also out of service. Whenever a route is out of service, the metric value is set to 16 in TransPort routing mode and 17 in CIDR mode.
Digi TransPort® Routers User Guide
421
Configuring IP routing and forwarding
Configure IP routing parameters
Configure IP routing parameters Web
1. Go to Configuration > Network > IP Routing/Forwarding > IP Routing.
2. Configure IP routing parameters:
Enable CIDR routing
When enabled, the following six text boxes are displayed:
Connected Interfaces
The CIDR metric that the router should apply to connected interfaces.
Static Routes
The CIDR metric that the router should use for static routes. The default is 1.
Digi TransPort® Routers User Guide
422
Configuring IP routing and forwarding
Configure IP routing parameters
eBGP Routes
The CIDR metric that the router should use for eBGP routes. The default is 20.
OSPF Routes
The CIDR metric that the router should use for OSPF routes. The default is 110.
RIP Routes
The CIDR metric that the router should use for RIP routing. The default is 120.
iBGP Routes
The CIDR metric that the router should use for iBGP routes. The default is 200.
Maximum static route metric
The maximum value for the routing metric. The default is 16.
Route directed IP broadcasts
When enabled, this setting causes the router to route directed broadcasts. The default state for this parameter is Off. A directed broadcast is an IP packet with a destination address that is a valid broadcast address for a subnet but does not originate from that subnet. A broadcast sent from one interface to the subnet of another uses these directed IP broadcasts.
Wait s seconds before using an alternative route
The value in this text box specifies the latency to apply before passing traffic on an alternative route in the current route becomes unavailable.
If an interface is configured for "dial on demand" and fails to connect,
Mark a static route as "Out Of Service" for s seconds
The value in this text box specifies the default time that a route should be marked as out of service if the interface it uses fails to establish a connection.
When an "Always On" route becomes "In Service", wait s seconds before using it
The value in this text box specifies the delay that the router should apply to a route before passing traffic on it once it has come into service. 3. Click Apply.
Command line
Command Instance Parameter
ip
0
cidr
Values on,off
Equivalent web parameter
Enable CIDR routing
Digi TransPort® Routers User Guide
423
Configuring IP routing and forwarding
Command ip ip ip ip ip ip ip
Instance 0 0 0 0 0 0 0
Parameter admin_connected admin_static admin_ebgp admin_ospf admin_rip admin_ibgp inf_metric
ip
0
route_dbcast
ip
0
route_dly
ip
0
route_dwn
ip
0
routeup_dly
Configure IP routing parameters
Values 0-2147483647 0-2147483647 0-2147483647 0-2147483647 0-2147483647 0-2147483647 0-2147483647 0-255 0-2147483647
0-2147483647
0-2147483647
Equivalent web parameter
Connected Interfaces
Static Routes
eBGP Routes
OSPF Routes
RIP Routes
iBGP Routes
Maximum static route metric
Route directed IP broadcasts
Wait s seconds before using an alternative route
If an interface is configured for "dial on demand" and fails to connect, Mark a static route as Out Of Service for s seconds
When an Always On route becomes In Service, wait s seconds before using it
Digi TransPort® Routers User Guide
424
Configuring IP routing and forwarding
Configure static routes
Configure static routes
The static routing web pages and command line parameters described below control the static routing table the router uses. These settings create static IP routes for particular IP subnets, networks or addresses.
Web
1. Go to Configuration > Network > IP Routing/Forwarding > Static Routes > Routes 0-9. 2. Configure Route n parameters. Each of the static route instances has its own configuration
page. These are described below.
Description
A memorable name for the route to be assigned.
Destination Network a.b.c.d
The IP address of the destination subnet, network or IP address for the route. If the router receives a packet with a destination IP address that matches the Destination Network/Mask combination it will route the packet through the interface specified below.
Mask a.b.c.d
The network mask.
Gateway a.b.c.d
Overrides the default gateway IP address configured for the Ethernet interfaces. Packets matching the route use the gateway address specified in the route rather than the address specified on the Ethernet interface configuration page. This parameter does not apply to routes using PPP interfaces.
Interface x,y
The interface for routing the packets. Select from the drop-down list and enter the interface instance number in the adjacent text box. The available options are:
n None n PPP
Digi TransPort® Routers User Guide
425
Configuring IP routing and forwarding
Configure static routes
n Ethernet n Tunnel
Use PPP sub-configuration
If PPP sub-configurations are defined, this text displays in normal highlighting (such as not disabled out) and text box will accept the number for the desired sub-configuration to use on this route. This parameter will not appear on those models that do not support PPP subconfigurations.
Metric n
The routing metric to use when the interface is connected. This should have a value between 1 and 16. The router uses this metric select which route to use when the subnet for a packet matches more than one of the IP route entries. Each route can be assigned a connected metric and a disconnected metric. The connected metric parameter specifies the metric for a route whose interface is active. The disconnected metric specifies the metric for a route whose interface is inactive. Normally both values should be the same but in some advanced routing scenarios necessary to use different values. If a particular route fails, it automatically has its metric set to 16, which means that it is temporarily deemed as being out of service. The default out of service period is set by the IP route out of service parameter. Note however, that this default period may be overwritten in certain situations such as when a firewall stateful inspection rule specifies a different period. When a route is out of service, the router uses any alternative routes (with matching subnets) first. 3. Click Apply.
Command line
Command route route route route route route route
Instance n n n n n n n
Parameter descr IPaddr mask gateway ll_ent ll_add upmetric
Values Up to 20 characters Valid IP address a.b.c.d Valid netmask a.b.c.d Valid IP address a.b.c.d Blank,PPP,ETH,TUN 0-2147483647 0-2147483647
Equivalent web parameter Description Destination Network a.b.c.d Mask a.b.c.d Gateway Interface x,y Interface x,y Metric
Advanced Static Route parameters
Go to Configuration > Network > IP Routing/Forwarding > Static Routes > Routes 0-9 > Route n > Advanced.
Digi TransPort® Routers User Guide
426
Configuring IP routing and forwarding
Web
Configure static routes
Use metric n when the interface is not active
The routing metric to use when the interface is not active.
Use this route only if the source IP address of the packet matches
When enabled, the following two parameters are enabled.
IP Address a.b.c.d
If necessary, use the IP Address and Mask parameters to further qualify the way in which the router routes packets. If the values in this text box and the Mask parameter are set, the source address of
Digi TransPort® Routers User Guide
427
Configuring IP routing and forwarding
Configure static routes
the packet being routed must match these parameters before the packet will be routed through the specified interface.
Mask a.b.c.d
The netmask specified with the IP address as explained above.
Include this route in RIP advertisements
When enabled, the router includes this static route to be included in RIP advertisements.
Make PPP n interface use the alternative idle timeout when this route becomes available
When enabled, this check box, in conjunction with the PPP interface instance number in the text box, cause the router to use the alternative inactivity timeout specified for that interface when this route comes back into service. This feature is useful when it is preferable to close down a backup route quickly when a primary route comes back into service.
Wait for s seconds after power up before allowing this route to activate the interface
The delay the router should wait after power-up before packets matching this route will initiate a connection of the interface configured in the route. W-WAN routers that have ISDN backup use this setting to prevent unnecessary ISDN connections from being made while a W-WAN connection is first being established.
Mark this route as "Out of Service" in the interface fails to connect after n consecutive attempts
Normally, if an interface is requested to connect by a route and fails to connect, the route metric is set to 16 for the period of time specified by the Mark a static route as Out Of Service for s seconds parameter on the Configuration > Network > IP Routing/Forwarding > IP Routing page. If the value in this text box is non-zero, the route metric will not be set to 16 until the number of connection attempts specified by this parameter have been made.
If the interface fails to connect, try again in s seconds
If an interface is requested to connect by this route (due to IP traffic being present) and it fails to connect, the route will be marked as out of service but the router will continue to attempt to connect at the interval specified by the value in this text box. If the interface does connect, the router will clear the out of service status for the route.
Deactivate the interface after it successfully connects
When enabled, the router deactivates an interface once a successful activation attempt has been made. Specified with the above retry parameter. If the above retry parameter is not set, this setting is disabled.
Do not allow this interface to be activated by this route for s seconds after the last activation attempt
The delay to wait before re-initiating a connection after it has dropped while still required.
Digi TransPort® Routers User Guide
428
Configuring IP routing and forwarding
Configure static routes
Only queue one packet while waiting for the interface to connect
When enabled, the router enqueues only one packet while waiting for the interface to connect. When unchecked, the router will enqueue two packets.
When this route becomes available, deactivate the following interfaces x,y x,y
The interfaces specified by the values in these two pairs of drop-down list and text boxes are deactivated when this route becomes available again after being out of service. The router typically uses this feature to deactivate backup interfaces when the primary interface becomes available after being out of service. Select the required interface from the drop-down list and enter the interface instance number into the text box as usual.
When this route becomes unavailable, remove the "Out of Service" state on x,y
The interface and instance that should be taken out of the Out of Service state when the interface that this route is configured to use is deactivated. Available interface options are None, PPP, Ethernet, and Tunnel)
Keep this route in service for s seconds after OOS state is cleared
When enabled, the following text box is enabled (such as it is no longer disabled), allowing a value to be entered. The value specifies the period that the interface specified above will remain in service even though it is actually unable to pass traffic immediately. This is behavior useful in situations where a PPP interface is activating and traffic should not try the next interface until this one has been allowed a certain amount of time to come up. When this timer expires, if the interface is unable to pass traffic, it will be marked Out of Service and the next interface will be tried.
Assign this route to recovery group n
Assigns the route to a recovery group. This means that if all the routes in a particular recovery group go out of service, the out of service status is cleared for all routes in that group. If one route in a group comes back into service, all routes with a lower priority (metric) also have their out of service status cleared.
Related CLI commands
Command line
Command route
Instance Parameter
n
metric
route
n
srcip
Values 0-2147483647
Valid IP address a.b.c.d
Equivalent web parameter
Use metric n when the interface is not active
IP Address a.b.c.d
Digi TransPort® Routers User Guide
429
Configuring IP routing and forwarding
Command route route
Instance Parameter
n
srcmask
n
inrip
route
n
doinact2
route
n
inact2add
route
n
pwr_dly
route
n
actooslim
route
n
chkoos_int
route
n
chkoos_deact
Values Valid netmask a.b.c.d on,off on,off
0-2147483647
0-255
0-2147483647
0-2147483647 0-255
Configure static routes
Equivalent web parameter
Mask a.b.c.d
Include this route in RIP advertisements
Make PPP n interface use the alternative idle timeout when this route becomes available
Make PPP n interface use the alternative idle timeout when this route becomes available
Wait for s seconds after power up before allowing this route to activate the interface
Mark this route as Out Of Service if the interface fails to connect after n consecutive attempts
If the interface fails to connect, try again in s seconds
Deactivate the interface after it successfully connects
Digi TransPort® Routers User Guide
430
Configuring IP routing and forwarding
Command route
Instance Parameter
n
dial_int
Values
0-255 Default 10
route
n
q1
on,off
route
n
deact_ent
Blank,PPP
route
n
deact_add
0-2147483647
route
n
deact_ent2
Blank,PPP
route
n
deact_add2
0-2147483647
route
n
unoos_secs
0-2147483647
Configure static routes
Equivalent web parameter
Do not allow this interface to be activated by this route for s seconds after the last activation attempt
Only queue one packet whilst waiting for the interface to connect
When this route becomes available, deactivate the following interfaces x,y
When this route becomes available, deactivate the following interfaces x,y
When this route becomes available, deactivate the following interfaces x,y
When this route becomes available, deactivate the following interfaces x,y
Keep this route in service for s seconds after OOS state is cleared
Digi TransPort® Routers User Guide
431
Configuring IP routing and forwarding
Command route
Instance Parameter
n
rgroup
Values 0-255
Configure static routes
Equivalent web parameter
Assign this route to recovery group n
Digi TransPort® Routers User Guide
432
Configuring IP routing and forwarding
Configure default IP routes
Configure default IP routes
The following web pages and associated command line commands set up default IP routes that route non-local IP addresses not specified in a static route. The parameters are identical to those on the static route pages with the exception that there are no IP address or Mask parameters.
Web
1. Go to Configuration > Network > IP Routing/Forwarding > Static Routes > Default Route n.
2. Configure the default route parameters:
Description
Assigns a convenient and memorable description for the route.
Default route via:
Gateway a.b.c.d
Used to override the default gateway IP address configured for the Ethernet interfaces. Packets matching the route will use the gateway address specified in the route rather than the address specified on the Ethernet interface configuration page. This parameter does not apply to routes using PPP interfaces.
Interface x,y
The interface and interface number for routing the packets. Available options are: n None n PPP n Ethernet n Tunnel
Metric n
The routing metric to use when the interface is connected. This should have a value between 1 and 16. It selects which route to use when the subnet for a packet matches more than one of the IP route entries.
Digi TransPort® Routers User Guide
433
Configuring IP routing and forwarding
Configure default IP routes
Each route may be assigned a connected metric and a disconnected metric. The connected metric parameter specifies the metric for a route whose interface is active. The disconnected metric specifies the metric for a route whose interface is inactive. Normally both values should be the same, but in some advanced routing scenarios, it is necessary to use different values.
If a particular route fails, it will automatically have its metric set to 16 which means that it is temporarily deemed as being out of service. The default out of service period is set by the IP route out of service parameter. Note that this default period may be overwritten in certain situations such as when a firewall stateful inspection rule specifies a different period. When a route is out of service, the router uses any alternative routes (with matching subnets) first.
3. Click Apply.
Command line
Command def_route def_route def_route def_route def_route
Instance n n n n n
Parameter descr gateway ll_ent ll_add upmetric
Values Up to 20 characters Valid IP address a.b.c.d Blank,PPP,ETH,TUN 0-2147483647 1-16
Equivalent web parameter Description Gateway a.b.c.d Interface x,y Interface x,y Metric
Advanced Default route parameters
Web
Go to Configuration > Network > IP Routing/Forwarding > Static Routes > Default Route n > Advanced.
Digi TransPort® Routers User Guide
434
Configuring IP routing and forwarding
Configure default IP routes
Use metric n when the interface is not active
The routing metric to use when the interface is not active.
Use this route only if the source IP address of the packet matches
When enabled, the following two parameters are enabled:
IP address a.b.c.d
If necessary, use this parameter IP Address and the Mask parameter to further qualify the way in which the router routes packets. If the values in this text box and the Mask parameter are set, the source address of the packet being routed must match these parameters before the packet will be routed through the specified interface.
Digi TransPort® Routers User Guide
435
Configuring IP routing and forwarding
Configure default IP routes
Mask a.b.c.d
The netmask specified with the IP address as explained above.
Include this route in RIP advertisements
When enabled, the router includes this static route to be included in RIP advertisements.
Make PPP x interface use the alternative idle timeout when this route becomes available
When enabled, this check box, in conjunction with the PPP interface instance number in the text box, cause the router to use the alternative inactivity timeout specified for that interface when this route comes back into service. This feature is useful when it is preferable to close down a backup route quickly when a primary route comes back into service.
Wait for s seconds after power up before allowing this route to activate the interface
The delay that the router should wait after power-up before packets matching this route will initiate a connection of the interface configured in the route. W-WAN routers that have ISDN backup typically use this setting to prevent unnecessary ISDN connections from being made while a W-WAN connection is first being established.
If the interface is configured for "dial on demand"
Mark this route as "Out Of Service" if the interface fails to connect after n consecutive attempts
Normally, if an interface is requested to connect by a route and fails to connect, the route metric is set to 16 for the period of time specified by the Mark a static route as Out Of Service for s seconds parameter on the Configuration > Network > IP Routing/Forwarding > IP Routing page. If the value in this text box is non-zero, the route metric will not be set to 16 until the number of connection attempts specified by this parameter have been made.
If the interface fails to connect, try again in s seconds
If an interface is requested to connect by this route (due to IP traffic being present) and it fails to connect, the route will be marked as out of service but the router will continue to attempt to connect at the interval specified by the value in this text box. If the interface does connect, the router will clear the out of service status for the route.
Deactivate the interface after it successfully connects
When enabled, the router deactivates an interface once a successful activation attempt has been made. The router uses this setting with the above retry parameter. If the above retry parameter is not set, this setting is disabled.
Do not allow this interface to be activated by this route for s seconds after the last activation attempt
The delay to wait before re-initiating a connection after it has dropped while still required.
Digi TransPort® Routers User Guide
436
Configuring IP routing and forwarding
Configure default IP routes
Only queue one packet whilst waiting for the interface to connect
When enabled, the router enqueues only one packet while waiting for the interface to connect. When unchecked, the router enqueues two packets.
When this route becomes available, deactivate the following interfaces x,y x,y
The interfaces specified by the values in these two pairs of drop-down list and text boxes will be deactivated when this route becomes available again after being out of service. The router typically uses this feature to deactivate backup interfaces when the primary interface becomes available after being out of service. Select the required interface from the drop-down list and enter the interface instance number into the text box as usual.
When this route becomes unavailable, remove the "Out Of Service" state on x,y
The interface and instance that should be taken out of the Out of Service state when the interface that this route is configured to use is deactivated. Available interface options are None, PPP, Ethernet, and Tunnel.
Keep this route in service for s seconds after OOS state is cleared
When enabled, the following text box is enabled (such as it is no longer disabled out), allowing a value to be entered. The value specifies the period that the interface specified above will remain in service even though it is actually unable to pass traffic immediately. This is behavior useful in situations where a PPP interface is activating and traffic should not try the next interface until this one has been allowed a certain amount of time to come up. When this timer expires, if the interface is unable to pass traffic, it is marked Out of Service and the next interface is tried.
Assign this route to recovery group n
Used to assign the route to a recovery group. This means that if all the routes in a particular recovery group go out of service, the out of service status is cleared for all routes in that group. If one route in a group comes back into service, all routes with a lower-priority (metric) also have their Out of Service status cleared.
Command line
Command Instance Parameter Values
Equivalent web parameter
def_route n
metric
0-
Use metric n when the interface is not active
2147483647
def_route n
srcip
Valid IP address a.b.c.d
IP Address a.b.c.d
def_route n
srcmask
Valid netmask a.b.c.d
Mask a.b.c.d
def_route n
inrip
on,off
Include this route in RIP advertisements
def_route n
doinact2 on,off
Make PPP n interface use the alternative idle timeout when this route becomes available
Digi TransPort® Routers User Guide
437
Configuring IP routing and forwarding
Configure default IP routes
Command Instance Parameter Values
Equivalent web parameter
def_route n
inact2add 0-
Make PPP n interface use the alternative idle
2147483647 timeout when this route becomes available
def_route n
pwr_dly 0-255
Wait for s seconds after power up before allowing this route to activate the interface
def_route n
actooslim 0-
Mark this route as "Out Of Service" if the
2147483647 interface fails to connect after n consecutive
attempts
def_route n
chkoos_int 0-
If the interface fails to connect, try again in s
2147483647 seconds
def_route n
chkoos_ deact
0-
Deactivate the interface after it successfully
2147483647 connects
def_route n
dial_int
0-255 Default 10
Do not allow this interface to be activated by this route for s seconds after the last activation attempt
def_route n
q1
on,off
Only queue one packet whilst waiting for the interface to connect
def_route n
deact_ent Blank,PPP When this route becomes available, deactivate the following interfaces x,y
def_route n
deact_add 0-
When this route becomes available, deactivate
2147483647 the following interfaces x,y
def_route n
deact_ ent2
Blank,PPP When this route becomes available, deactivate the following interfaces x,y
def_route n
deact_ add2
0-
When this route becomes available, deactivate
2147483647 the following interfaces x,y
def_route n
unoos_ secs
0-
Keep this route in service for s seconds after
2147483647 OOS state is cleared
def_route n
rgroup
0-255
Assign this route to recovery group n
Digi TransPort® Routers User Guide
438
Configuring IP routing and forwarding
Configure Routing Information Protocol (RIP) settings
Configure Routing Information Protocol (RIP) settings
The web pages and command line commands described in this section control the configuration of the Routing Information Protocol (RIP) behavior of the router.
Configure global RIP Settings
Web
1. Go to Configuration > Network > IP Routing/Forwarding > RIP > Global RIP Settings.
2. Configure the RIP parameters:
Enable RIP
When enabled, enables the RIP functionality.
Send RIP advertisements every s seconds
The interval between sending RIP packets. These packets contain the current routes held by the router (such as any active PPP routes), static routes and the default route. A value of 0 disables sending.
Mark routes as unusable if we don't get advertisements for s seconds
The time for which an updated metric will apply when a RIP update is received. If no updates are received within this period, the usual metric will take over.
Delete routes after another s seconds
The length of time that the router will continue to advertise this route when a RIP update timeout occurs and the route metric is 16. This behavior is designed to help propagate the dead route to other routers. The router will no longer use a metric advertised by a RIP update if the route has been set out of service locally.
Allow RIP to update static routes
When enabled, allows an incoming, matching RIP update to change the metric of the static route. This happens when the update matches a configured static route.
Enable Poison Reverse
When enabled, enables poison reverse, to notify when a neighboring router is unavailable. 3. Click Apply.
Digi TransPort® Routers User Guide
439
Configuring IP routing and forwarding
Configure Routing Information Protocol (RIP) settings
Command line
Command Instance Parameter Values
Equivalent web parameter
rip
n
enable
on,off
Enable RIP
rip
n
interval
0-
Send RIP advertisement every s seconds
2147483647
rip
n
ripto
0-
Mark routes as unusable if we don't get
2147483647 advertisement for s seconds
rip
n
riplingerto 0-
Delete routes after another s seconds
2147483647
rip
n
updatestatic on,off
Allow RIP to update static routes
rip
n
poisonreverse on,off
Enable Poison Reverse
Configure access lists
The router can modify route metrics based upon received RIP responses. Static routes and default routes have their metric modified if the route fits within one of the routes found within the RIP packet. For Ethernet routes, the gateway for the route will be set to the source address of the RIP packet. The route modifications will be enforced for 180 seconds, unless another RIP response is received within that time. RIP packets must have a source address that is included in the RIP access list. Adding permitted IP addresses to the access list is controlled using a table with the single parameter described below.
Web
Go to Configuration > Network > IP Routing/Forwarding > RIP > Global RIP Settings > Access Lists.
IP Address a.b.c.d
The IP address to be added to the list of IP addresses that RIP packets must come from if they are to modify route metrics. Up to ten IP addresses may be added. The Add and Delete buttons work in the usual way for configuration tables.
Digi TransPort® Routers User Guide
440
Configuring IP routing and forwarding
Configure Routing Information Protocol (RIP) settings
Command line
Command Instance Parameter Values
riprx
0-9
IPaddr
Valid IP address a.b.c.d
Equivalent web parameter IP Address a.b.c.d
Configure authentication keys
Go to Configuration > Network > IP Routing/Forwarding > RIP > Global RIP Settings > Authentication Keys. The router uses RIP authentication keys with the plain password and MD5 RIP authentication methods.
Web
Key k
The RIP authentication key. Enter a string of up to 16 characters long. A current key will not be displayed.
Confirm Key
Re-enter the new authentication key into this text box to allow the router to check that the two are identical.
Key ID (MD5 only)
The ID for the authentication key. The ID is inserted into the RIP packet when using RIP v2 MD5 authentication in looking up the correct key for received packets. The valid range is 0-255.
Valid from now/dd,mm,yy
These two radio buttons select between having the validity period for the key starting immediately of allowing a start date to be defined. The starting date is specified using a drop down list to select the start day, a drop-down list to select the start month and a text box to enter the start year. Selecting the Disable option from the day and None from the month means to not use this key. To specify the year, enter two or four digits, such as 11 or 2011.
Expires Never/dd,mm,yy
These two radio buttons select between defining the end date using the drop-down lists and text box or by setting the expiration to Never. The key end day is selected from the first drop down list. Selecting Disable means to not use the key. Select the end month from the second drop-down list. Selecting None means that to not use the key should. To specify the year, enter two or four digits, such as 11 or 2011.
Digi TransPort® Routers User Guide
441
Configuring IP routing and forwarding
Configure Routing Information Protocol (RIP) settings
Command line
Command ripauth ripauth ripauth ripauth ripauth ripauth ripauth ripauth
Instance 0-9 0-9 0-9 0-9 0-9 0-9 0-9 0-9
Parameter key keyid sday smon syear eday emon eyear
Values Up to 16 characters 0-255 0-31 0-12 0-65535 0-31 0-12 0-65535
Equivalent web parameter Key k Key ID Valid from d,m,y Valid from d,m,y Valid from d,m,y Expires d,m,y Expires d,m,y Expires d,m,y
Configure RIP advertisements
Web
Go to The configuration in the Interfaces > Ethernet, Interfaces > PPP, and Interfaces > GRE sub-menus is identical. Following are the settings for Ethernet > ETH 0:
Send RIP advertisements on this interface
Check this box to enable RIP and to reveal further configuration parameters below.
Use RIP
RIP version level. Select from the values V1, V2, and V1 Compat (version 1-compatible). When RIP version is set to V1 or V2, the router will transmit RIP version 1 or 2 packets respectively (version 2 packets are sent to the all routers multicast address 224.0.0.9). When RIP Version is set to V1
Digi TransPort® Routers User Guide
442
Configuring IP routing and forwarding
Configure Routing Information Protocol (RIP) settings
Compat, the router will transmit RIP version 2 packets to the subnet broadcast address. This allows V1-capable routers to act upon these packets.
Send RIP advertisements as
n Broadcasts: RIP packets are by default sent out on a broadcast basis or to a multi-cast address. Do not change this parameter unless you intend to alter this behavior.
n Multicasts (Only visible when V2 is selected in the Use RIP option above): This is automatically selected for sending to the default RIP v2 multicast address 224.0.0.9.
n <BLANK BOX>: Forces RIP packets to be sent to a specified IP or multicast address. This setting is particularly useful if you need to route the packets via a VPN tunnel. By default, Broadcasts/multicasts are selected, depending on your RIP version.
Use Authentication:
Selects the authentication method for RIP packets. Only one option is enabled multiple selections are not possible.
None
When set to Off, the interface sends and receives packets without any authentication.
Access list
When set to Access List, the interface sends RIP packets without any authentication. When receiving packets, the interface checks the sender's IP address against the list entered on the Configuration > Network > IP Routing / Forwarding > RIP > Global RIP settings > Access Lists page, and if the IP address is present in the list, the packet is allowed through.
Plain password
When set to Plain password (V1+V2), the interface uses the first valid key it finds (set on the Configuration > Network > IP Routing / Forwarding > RIP > Global RIP settings > Authentication Keys > Authentication Key n pages), and use the plain text RIP authentication method before sending the packet out. If no valid key can be found, the interface will not send any RIP packets. When receiving a RIP packet, a valid plain text key must be present in the packet before it will be accepted. You can use this method with both RIP V1 and RIP V2.
MD5
When set to MD5 (V2 only), the interface uses the first valid key it finds (set on the Configuration > Network > IP Routing / Forwarding > RIP > Global RIP settings > Authentication Keys > Authentication Key n pages), and uses the MD5 authentication algorithm before sending the packet out. If no valid key can be found, the interface will not send any RIP packets. Received RIP packets must be authenticated using the MD5 authentication algorithm before they will be accepted. You can use this method with RIP V2.
Only send RIP advertisements when this interface is in service
Select this parameter for RIP advertisements only to be sent when the interface is in the UP state in the routing table.
Use Triggered RIP on this interface
Enables triggered RIP (RFC2091). When triggered RIP is enabled, RIP timers are disabled.
Digi TransPort® Routers User Guide
443
Configuring IP routing and forwarding
Configure Routing Information Protocol (RIP) settings
Include this interface in RIP advertisements
Select to cause the subnet configured on this interface to not be advertised by RIP.
Command line
Command tun/ ppp tun/ ppp
tun/ ppp tun/ ppp tun/ ppp tun/ ppp
Instance n
Parameter rip
n
ripip
n
ripauth
n
ripis
n
inrip
n
triggeredrip
Values
Equivalent web parameter
0, 1
Enable RIP=1
Disable RIP=0
Valid IP address a.b.c.d
0=None 1=Access List 2=Plain Password 3=MD5 v2 only
0-3
Key number
on,off
Turn on to send updates only when in service
on,off
Include interface subnet in RIP advertisements
on,off
Enable RIP RFC2091
Digi TransPort® Routers User Guide
444
Configuring IP routing and forwarding
Configure Open Shortest Path First (OSPF) parameters
Configure Open Shortest Path First (OSPF) parameters
Open Shortest Path First (OSPF) is an Interior Gateway Protocol (IGP) developed for IP networks based on the shortest path first or link-state algorithm. The router uses link-state algorithms to send routing information to all nodes in a network by calculating the shortest path to each node based on a topography of the network constructed by each node. Each router sends that portion of the routing table that describes the state of its own links and the complete routing structure (network topography). The advantage of the shortest path first algorithms is that they result in smaller, more frequent update everywhere. They converge quickly, thus preventing such problems as routing loops and Count-to-Infinity (where routers continuously increment the hop count to a particular network). This makes for a stable network. To use OSPF on the router, a valid configuration file must exist in the router's filing system.
Web
1. Go to Configuration > Network > IP Routing/Forwarding > OSPF.
2. Configure the OSPF parameters:
Enable OSPF
When enabled, displays the following parameters:
Digi TransPort® Routers User Guide
445
Configuring IP routing and forwarding
Configure Open Shortest Path First (OSPF) parameters
OSPF Configuration Filename
The file that contains the configuration data for OSPF is selected from this drop-down list. The file should have a .conf extension.
Load Config file
When this button is clicked, the router attempts to load the file specified in the file selection list box into the edit window below the button. The text in the window can be edited as required.
Save Config File
Saves the text in the edit window to the filename specified in the drop-down list above. These three controls allow loading, editing, an saving an OSPF configuration file.
Restart OSPF after configuration file is saved
When enabled, restarts the OSPF functions once the edited configuration file has been saved.
Restart OSPF if a fatal error occurs
When enabled, restarts OSPF functioning after a delay of 5 seconds if a fatal error occurs.
OSPF Tracing
In common with some of the other functionality of the router, OSPF supports some debug functionality. The amount of information in the debug traces is controlled from this drop-down list. The available levels are Off, Low, Med, and High. Selecting Off disables debug tracing.
Ignore MTU indications
All OSPF routers must have the same Maximum Transmitted Unit (MTU) and this value is advertised in the OSPF packets. When checked, the router ignores received packets that have a MTU that differs from that of the router itself.
Use Interface IPsec source IP
When enabled, OSPF functions use the source IP address of the interface specified in Configuration > Network > Interfaces > Advanced > PPP n: Use interface x,y for the source IP address of IPsec packets on the interface being used. When unchecked, OSPF uses the source IP address of the interface in use for its source address. 3. Click Apply.
Command line
Command ospf ospf
Instance 0 0
Parameter Enable conffile
Values on,off filename
Equivalent web parameter
Enable OSPF
OSPF Configuration Filename
Digi TransPort® Routers User Guide
446
Configuring IP routing and forwarding
Configure Open Shortest Path First (OSPF) parameters
Command ospf
Instance 0
Parameter new_cfg_rest
ospf
0
fatal_rest
ospf
0
debug
ospf
0
ospf
0
ignore_mtu useipsecent
Values on,off
on,off
0-3 0=Off 1=Low 2=Med 3=High on,off on,off
Equivalent web parameter Restart OSPF after a configuration file is saved Restart OSPF if a fatal error occurs OSPF Tracing
Ignore MTU indications Use Interface IPsec source IP
Digi TransPort® Routers User Guide
447
Configuring IP routing and forwarding
Configure Border Gateway Protocol (BGP) settings
Configure Border Gateway Protocol (BGP) settings
The Border Gateway Protocol (BGP) routing protocol is supported by TransPort routers. This page contains the configuration parameters controlling the behavior of BGP. Most of the configuration is controlled by a configuration file (raw text) named bgp.cnf. This file would normally be created in a text editor on a computer and loaded onto the router. The router contains a simple editor for modifying the bgp.cnf file. The configuration parameters described here mainly define what action is to be taken when errors occur, and specify the configuration file to use.
Web
1. Go to Configuration > Network > IP Routing/Forwarding > BGP.
2. Configure the BGP parameters:
Enable BGP
When enabled, enables BGP routing.
BGP Configuration Filename
The configuration file to use is selected from this drop-down list. The default filename is bgp.cnf. An error message will be displayed if the specified file cannot be found.
Load Config file
Click this button to load the file specified from the drop-down list. The contents of the file will be visible in the edit window which appears below the button.
Digi TransPort® Routers User Guide
448
Configuring IP routing and forwarding
Configure Border Gateway Protocol (BGP) settings
Save Config File
Saves the bgp.cnf file back to the filing system. Use if you have edited the file.
Restart BGP after configuration file is saved
When enabled, the router restarts routing using BGP after the file has been saved using the above Save button.
Restart BGP if a fatal error occurs
When enabled, the router restarts routing using BGP if a fatal error occurs.
Advertise non-connected networks
When enabled, BGP advertises networks that exist in the BGP configuration file but that are not actually a connected network or interface.
BGP Tracing
As with OSPF, the level of debug tracing information is selected from this drop-down list. The available levels are; Off, Low, Med, and High. 3. Click Apply.
Command line
Command Instance Parameter
Values Equivalent web parameter
bgp
0
enable
on,off
Enable BGP
bgp
0
conffile
BGP Configuration Filename
bgp
0
new_cfg_rest on,off
Restart BGP after configuration file is saved
bgp
0
fatal_rest
on,off
Restart BGP if a fatal error occurs
bgp
0
allow_non_nets on,off
Advertise non-connected networks
Default on
bgp
0
debug
0-3
BGP Tracing
Digi TransPort® Routers User Guide
449
Configuring IP routing and forwarding
Configure IP port forwarding and static NAT mappings
Configure IP port forwarding and static NAT mappings
The router supports Network Address Translation (NAT) and Network Address and Port Translation (NAPT). NAT or NAPT may be enabled on a particular interface such as a PPP instance. When operating with NAT enabled, this interface has a single externally visible IP address. When sending IP packets, the local IP addresses (for example on a local area network) are replaced by the single IP address of the interface. The router keeps track of the local IP addresses and port numbers so that if a matching reply packet is received, it is directed to the correct local IP address. With only one externally visible IP address, NAT effectively prevents external computers from addressing specific local hosts, thus providing a very basic level of "firewall" security.
Static NAT mappings allow received packets destined for particular ports to be directed to specific local IP addresses. For example, to have a server, running on a local network, externally accessible, a static NAT mapping would be set up using the local IP address of the server and the port number for accessing the required service.
Web
1. Go to Configuration > Network > IP Routing/Forwarding > IP Port Forwarding/Static NAT Mappings.
2. Enter the following configuration values into the table
External Min Port
The lowest port number to be redirected.
External Max Port
The highest port number to be redirected.
Forward to Internal IP Address a.b.c.d
The IP address to which packets containing the specified destination port number are to be redirected.
Digi TransPort® Routers User Guide
450
Configuring IP routing and forwarding
Configure IP port forwarding and static NAT mappings
Forward to Internal Port
The IP port number to which packets containing the specified port number are to be redirected. When set to 0, no port remapping occurs and the router uses the original port number. The NAT mode parameter of the appropriate interface must be set to NAPT rather than NAT or OFF for this parameter to take effect.
Add button
Adds the port forwarding rule to the IP routing configuration. 3. Click Add to add each NAT mapping into the NAT configuration for the router. 4. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
nat
0-29
minport 0-65535
External Min Port
nat
0-29
maxport 0-65535
External Max Port
nat
0-29
IPaddr
Valid IP address a.b.c.d Forward to Internal IP Address a.b.c.d
nat
0-29
mapport 0-65535
Forward to Internal Port
Command format
The format for nat commands is: nat <entry> <parameter> <value>
Example commands
To set the IP address for entry 0 in the table to 10.1.2.10, enter the command: nat 0 IPaddr 10.1.2.10
Digi TransPort® Routers User Guide
451
Configuring IP routing and forwarding
Configure multicast routes
Configure multicast routes
Digi TransPort routers support multicast routes, allowing them to route packets to multicast group addresses. You can configure up to 20 different static multicast routes. Use static multicast routes in conjunction with the IGMP parameter on the outbound interface. For example, after configuring a static multicast route for multicast traffic via PPP 1, the IGMP parameter in Configuration > Network > Interfaces > IGMP must be set to On.
Web
1. Go to Configuration > Network > IP Routing/Forwarding > Multicast Routes. 2. Configure the multicast routing table by entering the following parameters.
Multicast Address a.b.c.d
Specified with the Mask parameter below, to identify the destination multicast group address for packets that will match this route. Therefore, if a router receives a packet with a destination multicast group address that matches the specified Multicast Address/Mask combination, it routes that packet through the interface specified by the Interface parameters below.
Mask a.b.c.d
The address mask specified with the Multicast Address parameter as described above.
Interface x,y
These two parameters in the drop-down list and adjacent text box specify the interface and interface instance for routing packets matching the Multicast Address/Mask combination. The options available in the drop-down list are; PPP, Ethernet, Tunnel.
Enable multicast source path checking
If enabled, the router checks the source address of any multicast packets received to determine whether the packet has arrived from the most direct path. The router performs this check by doing a route look-up on the source address, and comparing the lookup results with the interface on which the packet arrived. If the interfaces are the same, the router accepts
Digi TransPort® Routers User Guide
452
Configuring IP routing and forwarding
Configure multicast routes
this multicast packet. Otherwise, the router drops the packet, as the packet is likely to be a copy, and the router has already received the original.
Add button
Adds the multicast route to the IP configuration. 3. Click Add to add each multicast route to the multicast routing table. 4. Click Apply.
Command line
Command Instance Parameter Values
mcast
0-19
IPaddr
Valid IP address a.b.c.d
mcast
0-19
mask
Valid IP address a.b.c.d
mcast
0-19
ll_ent
PPP,ETH,TUN
mcast
0-19
ll_add
Valid interface number 0-
2147483647
mcast
0
mult_spc ON, OFF
Equivalent web parameter Multicast Address a.b.c.d Mask a.b.c.d Interface x,y Interface x,y
Enable multicast source path checking
Digi TransPort® Routers User Guide
453
Configuring IP routing and forwarding
Configure Virtual Routing and Forwarding (VRF)
Configure Virtual Routing and Forwarding (VRF)
Virtual Routing and Forwarding (VRF) is used to allow multiple instances of a routing table on the same router at the same time. Using VRF, you can create multiple routing tables and assign each interface to a different VRF. Because the routing instances are independent, you can use the same or overlapping IP addresses without conflict. VRF also refers to a routing table instance that can exist in one or multiple instances per each VPN on a Provider Edge (PE) router. A licensing file is available upon request, free of charge, to enable VRF.
Support for Virtual Routing and Forwarding in the web and command-line interfaces
TransPort routers support Virtual Routing and Forwarding on Ethernet, GRE, and PPP interfaces. Configuration support for PPP interfaces is command-line only.
Web
In the web interface, TransPort routers that have VRF support have additional configuration parameters for Ethernet and GRE tunnel interfaces.
Configure VRF for Ethernet interfaces
For Ethernet interfaces, these parameters are on Configuration > Network > Interfaces > Ethernet > ETH n:
VRF
Associates the interface with a particular Virtual Routing and Forwarding (VRF) instance.
VRFexport
Adds routes from this VRF to interfaces on other VRFs.
Configure VRF for GRE tunnel interfaces
For GRE tunnel interfaces, these parameters are on Configuration > Network > Interfaces > GRE> Tunnel n:
VRF
Associates the interface with a particular VRF.
Destination VRF
Associates the interface with a particular destination VRF.
Digi TransPort® Routers User Guide
454
Configuring IP routing and forwarding
Configure Virtual Routing and Forwarding (VRF)
Command line
Command eth eth tun tun ppp ppp
Instance n n n n n n
Parameter vrf vrfexport vrf vrfdest vrf vrfexport
Values integer integer integer integer integer integer
Equivalent web parameter VRF VRFexport VRF Destination VRF VRF VRFexport
Digi TransPort® Routers User Guide
455
Configuring Virtual Private Networking (VPN)
Virtual Private Networks (VPNs)
457
Configure Internet Protocol security (IPsec)
458
Configure Point-to-Point Tunneling Protocol (PPTP)
513
Configure OpenVPN
515
Digi TransPort® Routers User Guide
456
Configuring Virtual Private Networking (VPN)
Virtual Private Networks (VPNs)
Virtual Private Networks (VPNs)
Virtual Private Networks (VPNs) securely connect two private networks together so that devices may connect from one network to the other network using secure channels. VPN uses IP Security (IPSec) technology to protect the transferring of data over the Internet. This section covers concepts and settings for configuring VPNs.
VPNs (Virtual Private Networks) are networks that use the IPSec protocols to provide one or more secure routes, or tunnels, between endpoints. Users are issued either a shared secret key or public/ private key pair that is associated with their identity. When a message is sent from one user to another, it is automatically signed with the user's key. The receiver uses the secret key or the sender's public key to decrypt the message. The router uses these keys during IKE exchanges along with other information to create session keys that only apply for the lifetime of that IKE exchange.
Digi TransPort® Routers User Guide
457
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure Internet Protocol security (IPsec)
IPsec (Internet Protocol security) is a group of protocols and standards for protecting data during transmission over the internet (which is inherently insecure). Various levels of support for IPsec can be provided on the router depending on the model. The web pages located under the Configuration > Network > Virtual Private Networking (VPN) > IPsec set the various parameters and options that are available. You should note however that this is a complex area and you should have a good understanding of user authentication and data encryption techniques before you commence. For further information refer to the IPsec and VPNs section in this manual. Also check the Technical Notes section of the Digi International web site at www.digi.com for the latest IPsec application notes.
The first stage in establishing a secure link between two endpoints on an IP network is for those two points to securely exchange a little information about each other. This enables the endpoint responding to the request to decide whether it wishes to enter a secure dialogue with the endpoint requesting it. To achieve this, the two endpoints commonly identify themselves and verify the identity of the other party. They must do this in a secure manner so that the process cannot be listened in to by any third party. The IKE protocol performs this checking and if everything matches up it creates a Security Association (SA) between the two endpoints, normally one for data being sent to the remote end and one for data being received from it.
Once this initial association exists the two devices can talk securely about and exchange information on what kind of security protocols they would like to use to establish a secure data link, such as what sort of encryption and/or authentication they can use and what sources/destinations they will accept. When this second stage is complete (and provided that both systems have agreed what they will do), IPSec will have set up its own Security Associations which it uses to test incoming and outgoing data packets for eligibility and perform security operations on before passing them down or relaying them from the tunnel.
Digi TransPort® Routers User Guide
458
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
About Internet Protocol Security (IPSec)
An inherent problem with the TCP protocol for carrying data over the vast majority of LANs and the Internet is that it provides virtually no security features. This lack of security, and publicity about hackers and viruses, prevent many people from even considering using the Internet for any sensitive business application. IPSec provides a remedy for these weaknesses adding a comprehensive security layer to protect data carried over IP links. IPSec (Internet Protocol Security) is a framework for a series of IETF standards designed to authenticate users and data, and to secure data by encrypting it during transit.
Benefits of IPSec
IPSec is provides confidentiality, integrity, and authentication in the transport of data across inherently insecure channels. When properly configured, IPSec provides a highly secure virtual channel across cheap, globally available networks such as the Internet, or creates a "network within a network" for applications such as passing confidential information between two users across a private network.
Protocols defined within IPSec
The protocols defined within IPSec include:
n IKE: Internet Key Exchange protocol n ISAKMP: Internet Security Association and Key Management Protocol n AH: Authentication Header protocol n ESP: Encapsulating Security Payload protocol n HMAC: Hash Message Authentication Code n MD5: Message Digest 5 n SHA-1: Security Hash Algorithm
Cryptographic (encryption) techniques include:
n DES: Data Encryption Standard n 3DES: Triple DES n AES: Advanced Encryption Standard (also known as Rijndael)
Two key protocols within the framework are AH and ESP. AH authenticates users, and ESP applies cryptographic protection. The combination of these techniques is designed to ensure the integrity and confidentiality of the data transmission. Put simply, IPSec is about ensuring that:
n Only authorized users can access a service. n No one else can see what data passes between one point and another.
IPsec operation modes
There are two modes of operation for IPSec, transport mode and tunnel mode.
n In transport mode, only the payload (such as the data content), of the message is encrypted. n In tunnel mode, the payload and the header and routing information are all encrypted thereby
by providing a higher degree of protection.
Digi TransPort® Routers User Guide
459
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Data Encryption Methods in IPSec
There are several different algorithms available for use in securing data whilst in transit over IP links. Each encryption technique has its own strengths and weaknesses and this is really, a personal selection made with regard to the sensitivity of the data you are trying to protect. Some general statements may be made about the relative merits but users should satisfy themselves as to suitability for any particular purpose.
DES (64-bit key) The banking and financial world tends to use this well-known and established protocol. It is relatively processor-intensive; to run efficiently at high data rates, a powerful processor is required. It is generally considered very difficult for casual hackers to attack, but may be susceptible to determined attack by well-equipped and knowledgeable parties.
3-DES (192-bit key) Again, this is a well-established and accepted protocol but as it involves encrypting the data three times using DES with a different key each time, it has a very high processor overhead. This also renders it almost impossible for casual hackers to attack and very difficult to break in any meaningful time frame, even for well-equipped and knowledgeable parties.
AES (128-bit key) Also known as Rijndael encryption, AES is a standard adopted by many USA and European organizations for sensitive applications. It has a relatively low processor overhead compared to DES and it is therefore possible to encrypt at higher data rates. As with 3-DES, it is almost impossible for casual hackers to attack and is very difficult to break in any meaningful time frame, even for wellequipped and knowledgeable parties. To put these into perspective, common encryption programs that are considered "secure" (such as PGP) and on-line credit authorization services (such as Web-based credit card ordering) generally use 128-bit encryption.
Note Data rates are the maximum that could be achieved, but may be lower if other applications are running at the same time or using small IP packet sizes.
Digi TransPort® Routers User Guide
460
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure IPsec tunnels
Once the IKE parameters have been set-up, the next stage is to define the characteristics of the IPsec tunnels, or encrypted routes. This includes items such as what source and destination addresses will be connected by the tunnel and what type of encryption and authentication procedures will be applied to the packets being tunneled. For obvious reasons it is essential that parameters such as encryption and authentication are the same at each end of the tunnel. If they are not, then the two systems cannot agree on which set of rules or policy to adopt for the IPsec tunnel, and communication cannot occur.
Web
1. Go to Configuration > Network > Virtual Private Networking > IPsec > IPsec Tunnels > IPsec n.
Digi TransPort® Routers User Guide
461
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
2. Configure basic IPSec tunnel parameters:
Description A name for IPsec tunnel, to make it easier to identify the tunnel.
The IP address or hostname of the remote unit The IP address or hostname of the remote IPsec peer that a VPN will be initiated to.
Digi TransPort® Routers User Guide
462
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Use a.b.c.d as a backup unit The IP address or hostname of a backup peer. If the router cannot open a connection to the primary peer, it uses this configuration. The backup peer device must have an identical IPsec tunnel configuration as the primary peer.
Local LAN Use these settings for the local LAN The local LAN subnet settings on the IPsec tunnel.
IP Address Use this IP address for the local LAN subnet. This is usually the IP address of the router's Ethernet interface or that of a specific device on the local subnet (such as a PC running a client or host application).
Mask Use this IP mask for the local LAN subnet. The mask sets the range of IP addresses that will be allowed to use the IPsec tunnel.
Use interface x,y Use the IP address and mask of the specified interface.
Remote LAN Use these settings for the remote LAN These define the remote LAN subnet settings on the IPsec tunnel.
IP Address Use this IP address for the remote LAN subnet. This is usually the IP address of the peer's Ethernet interface or that of a specific device on the local subnet (such as a PC running a client or host application).
Mask Use this IP mask for the remote LAN subnet. The mask sets the range of IP addresses that will be allowed to use the IPsec tunnel.
Remote Subnet ID L2TP/IPsec VPNs normally use this setting. When the router is in server mode and negotiating IPsec from behind a NAT box, this parameter should be configured to the ID sent by the remote Windows client (this is usually the computer name).
Use the following security on this tunnel The security identities on the IPsec tunnel.
Digi TransPort® Routers User Guide
463
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Security type Preshared Keys
XAUTH Init Preshared Keys RSA Signatures XAUTH Init RSA
Description
Requires that both IPsec peers share a secret key, or password, that can be matched by and verified by both peers. To configure the PSK, a user will need configuring that matches the inbound ID of the remote peer and the PSK is configured using the password parameter. This is done via Configuration > Security > Users. The User configuration serves a dual purpose, in that it may contain entries for normal login access (such as HTTP, FTP or Telnet), and entries for IPsec tunnels.
Used when the remote peer is a Cisco device using XAUTH and PSK authentication.
Select this option when the IPsec authentication will use X.509 certificates.
Used when the remote peer is a Cisco device using XAUTH and X.509 certificates for authentication.
Our ID When Aggressive mode is On, this parameter is a string of up to 20 characters. It is sent to the remote peer to identify the initiator (such as the router). You can use the variable %s on this parameter, which causes the router's serial number to be sent. You can prefix this value with other text if required. When using certificates, configure this parameter with the Altname field in a valid certificate held on the router.
Our ID type Defines how the remote peer is to process the Our ID configuration.
ID type IKE ID FQDN
User FQDN
IPv4 Address
Description The Our ID parameter is a simple key ID (such as vpnclient1).
The Our ID parameter is a Fully Qualified Domain Name (such as vpnclient1.anycompany.com)
The Our ID parameter is a Fully Qualified Domain Name with a user element (such as joe.bloggs@anycompany.com)
An IPv4 Address in dotted decimal notation.
Remote ID
When Aggressive mode is On, this parameter is a string of up to 20 characters that identifies the remote peer. This setting should use the same text as the Our ID parameter in the remote peer's configuration. When Aggressive mode is Off, this parameter must be the IP address of the remote peer.
Digi TransPort® Routers User Guide
464
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
RSA Key File Overrides the private key filename in the IKE configuration. Use only when the authentication stage of the IKE negotiation uses RSA Signatures (Certificates).
Use enc encryption on this tunnel The ESP encryption protocol to use with this IPsec tunnel. The options are:
n None n Null n DES n 3DES n AES (128 bit keys) n AES (192 bit keys) n AES (256 bit keys) If the dropdown options only display None and Null, the router requires encryption enabling. See your Digi sales contact regarding enabling encryption.
Use auth authentication on this tunnel The ESP authentication algorithm to use with this IPsec tunnel. The options are:
n None n MD5 n SHA1
Use Diffie Hellman group The Diffie Hellman (DH) group to use when negotiating new IPsec SAs. If enabled, the IPsec SA keys cannot be predicted from any of the previous keys generated. The options are No PFS, 1, 2, or 3. The larger values result in stronger keys, but they take longer to generate.
Use IKE n to negotiate this tunnel The IKE version to use to negotiate this IPsec tunnel.
Use IKE configuration The IKE configuration instance to use with this Eroute when the router is configured as an Initiator.
Bring this tunnel up Controls how the IPsec tunnel is brought up. The options are:
n All the time n Whenever a route to the destination is available n On demand
If the tunnel is down and a packet is ready to be sent Defines the action that is performed when the IPsec tunnel is down and a packet needs to be sent. The options are:
Digi TransPort® Routers User Guide
465
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
n Bring the tunnel up n Drop the packet n Send the packet without encryption and authentication
Bring this tunnel down if it is idle for h hrs m mins s secs Used when the IPsec tunnel is configured to come up on demand and defines how long the IPsec tunnel should remain up if there is no traffic is being sent on the tunnel.
Renew the tunnel after Defines the constraints of when the IPsec tunnel SA has to be renewed.
h hrs m mins s secs Renew the IPsec SA after the specified amount of time.
n units of traffic Renew the IPsec SA after the specified amount of traffic has been passed over the tunnel. The traffic units can be specified as Kbytes, Mbytes or Gbytes. A value of 0 disables this parameter. SAs will expire and be renewed based on time, rather than amount of traffic. 3. Click Tunnel Negotiation and configure IPsec tunnel negotiation parameters:
Enable IKE tracing Enables the router to write IKE negotiation information in the analyser trace.
Negotiate a different IP address and Mask Configures the IPsec tunnel to negotiate a different local LAN IP address and mask. You can then use the firewall to translate the source addresses of the packets to a value that lies within the negotiated range. This allows a packet to match more than one IPsec tunnel, but use a different source address (from the peer's perspective) depending on which IPsec tunnel is in use.
IP Address The alternative IP address to negotiate.
Mask The alternative IP mask to negotiate.
Negotiate a virtual IP address using MODECFG Used when the remote peer is a Cisco device using MODECFG to assign a specific IP address to this router during SA setup negotiations. This is commonly seen in Remote Access (RA) type VPNs and EasyVPN solutions.
Digi TransPort® Routers User Guide
466
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
XAuth ID Extended Authentication ID for use with Cisco XAUTH.
4. Click Advanced and configure advanced IPsec tunnel parameters as needed:
IPsec mode Selects the IPsec encapsulation type to use on the IPsec tunnel. In Tunnel mode, the entire IP packet (header and payload) is encrypted. In Transport mode, only the IP payload is encrypted.
Use algorithm AH authentication on this tunnel The AH authentication algorithm to use with this IPsec tunnel. The options are:
Digi TransPort® Routers User Guide
467
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
n None n MD5 n SHA1
Use algorithm compression on this tunnel The compression algorithm to use with this IPsec tunnel. The options are:
n None n DEFLATE
Delete SAs when this tunnel is down When selected, all SAs associated with the IPsec tunnel are deleted when the tunnel goes out of service.
Replay detection window The size of the replay detection window. When set to 0 (default), replay detection is disabled. Maximum replay window size is 32.
Delete SAs when router is not a VRRP master When selected, at least one Ethernet interface must be set as VRRP Master before the router can create SAs. If the router switches away from VRRP Master state, the SAs will be deleted. When the router switches back to VRRP Master state, the SAs will be created automatically.
Go out of service if automatic establishment fails The router will take the IPsec tunnel out of service if the automatic establishment fails rather than continually retrying.
Disconnect the configured interface after n consecutive auto-negotiation failures The router will take the IPsec tunnel out of service if the auto-negotiation fails for the specified consecutive number of times rather than continually retrying.
This tunnel can only use apn When enabled, this parameter allows you to choose between using the main APN or the backup APN, as defined in the Configuration > Network > Serial > W-WAN Port page.
Link tunnel with interface with x,y When enabled, this parameter can be set so that the IPsec tunnel will only match packets using the specified interface. When this parameter is enabled, the route will take outgoing packets going through this IPsec tunnel and recheck to see if the resultant packet also goes through a tunnel. If the inner tunnel is an IPsec tunnel (such as needs IKE), you can get the inner IKE to use the correct source address (matching the outer tunnel selectors) by enabling the Use secondary IP address parameter and the inner IKE will use the IP address configured in the Secondary IP address parameter on the Configuration > Network > Advanced Network Settings page.
Inhibit this IPsec tunnel when IPsec tunnels n are up A list of IPsec tunnels that can inhibit using this IPsec tunnel as long as they are up. If this IPsec tunnel has been allowed to come up, and the IPsec tunnel that inhibits it comes back up, this IPsec is taken down and any SAs that may have existed are removed. As soon as an inhibiting
Digi TransPort® Routers User Guide
468
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
IPsec tunnel goes down, the router will check to see if the inhibited IPsec tunnel can now create SAs.
Inhibit this IPsec tunnel unless IPsec tunnel n is up This IPsec tunnel will be inhibited unless specified IPsec tunnel is also up.
IKE negotiation source IP address is taken from the Defines which IP address IKE uses as the source IP address during the negotiation.
Interface Use the IP address of the interface over which the IKE packets will be transmitted.
Secondary IP address Use the IP address configured in the Secondary IP address parameter on the Configuration > Network > Advanced Network Settings page.
Interface x,y Use the IP address of the specified interface.
Tunnel this IPsec tunnel inside another IPsec tunnel It is possible to tunnel packets from an IPsec tunnel within a second (or more) tunnel. When this parameter is enabled.
NAT-Traversal Keepalive timer s seconds Sets the interval period, in seconds, that the router will use to send regular packets to a NAT device in order to prevent the NAT table entry from expiring.
Allow protocol IP protocol(s) in this tunnel This restricts the type of IP packets that will be tunneled through the IPsec tunnel. The options are:
n All n TCP n UDP n GRE
IP packets with ToS values n must use this tunnel Packets with matching ToS fields will only be tunneled through this IPsec tunnel and no others. The usual traffic selector matching still takes place as normal. Packets that don't have matching ToS values will get tunneled as normal. Enter the ToS values as a comma-separated list, such as 2,4.
Only tunnel IP packets with Restricts the IP packets that will be tunneled to those with matching TCP/UDP port numbers.
local TCP/UDP port n Allow IP packets with matching source TCP/UDP ports to be tunneled.
Digi TransPort® Routers User Guide
469
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
remote TCP/UDP port n Allow IP packets with matching destination TCP/UDP ports to be tunneled.
local TCP/UDP port in the range of n1 to n2 Allow IP packets with source TCP/UDP ports in the specified range to be tunneled. This is only available when IKEv2 is in use.
remote TCP/UDP port in the range of n1 to n2 Allow IP packets with destination TCP/UDP ports in the specified range to be tunneled. This is only available when IKEv2 is in use. 5. Click Apply.
Command line
Set basic IPsec tunnel parameters
Command Instance Parameter Values
eroute n
descr
String
eroute n
peerip
IP address or hostname
eroute n eroute n eroute n eroute n
bakpeerip IP address or hostname
locip
IP address
locmsk IP Mask
locipifent blank, ETH, PPP
eroute n
locipifadd Integer
eroute n eroute n eroute n eroute n
eroute n eroute n
eroute n
remip
IP address
remmsk IP Mask
remnetid String
authmeth Off, Preshared, xauthinitpre, rsa, xauthinitrsa
ourid
String
ouridtype
0=IKE ID 1=FQDN 2=User FQDN 3=IPv4 Address
peerid
String
Equivalent web parameter Description The IP address or hostname of the remote unit. Use n as a backup unit. IP Address (for Local LAN) IP Mask (for Local LAN) Use interface x,y x=Interface type Use interface x,y y=interface number IP Address (for Remote LAN). IP Mask (for Remote LAN). Remote Subnet ID. Use the following security on this tunnel.
Our ID. Our ID type.
Remote ID.
Digi TransPort® Routers User Guide
470
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Command Instance Parameter Values
eroute n
privkey Filename
eroute n
espenc off, null, des, 3des, aes
eroute n
enckeybits 128, 192, 256
eroute n
espauth off, md5, sha1
eroute n eroute n
dhgroup ikever
0, 1, 2, 3 1, 2
eroute n eroute n
eroute n
ikecfg autosa
nosa
0, 1
0=On Demand 1=When a route to the destination is available 2=All the time
drop, pass, try
eroute n
inact_to Integer
eroute n
ltime
Integer
eroute n
lkbytes Integer
Equivalent web parameter RSA Key File.
Use enc encryption on this tunnel.
Use enc encryption on this tunnel.
Use auth authentication on this tunnel.
Use Diffie Hellman group.
Use IKE n to negotiate this tunnel.
Use IKE configuration.
Bring this tunnel up.
If the tunnel is down and a packet is ready to be sent.
Bring this tunnel down if it is idle for h hrs m mins s secs. This CLI value is entered in seconds only.
Renew the tunnel after h hrs m mins s secs. This CLI value is entered in seconds only.
Renew the tunnel after n units of traffic. This CLI value is entered in Kbytes only.
Configure IPsec tunnel negotiation parameters
Entity Instance Parameter Values
Equivalent web parameter
eroute n
debug
on, off
Enable IKE tracing
eroute n
neglocip IP Address Negotiate a different IP address and Mask
eroute n
neglocmsk IP Mask Negotiate a different IP address and Mask
eroute n
vip
on, off
Negotiate a virtual IP address using MODECFG
eroute n
xauthid
String
XAuth ID
Digi TransPort® Routers User Guide
471
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure advanced IPsec tunnel parameters
Command line
Command eroute eroute eroute eroute eroute eroute eroute
eroute eroute eroute eroute eroute
eroute eroute
eroute
Instance n n n n n n n
n n n n n
n n
n
Parameter mode ahauth ipcompalg oosdelsa ifvrrpmaster nosaoos nosadeactcnt
check_apnbu apnbu ifent ifadd inhibitno
requireno usesecip
ipent
Values
Equivalent web parameter
tunnel, transport
IPsec Mode.
off, md5, sha1 Use a AH authentication on this tunnel.
off, deflate
Use c compression on this tunnel.
on, off
Delete SAs when this tunnel is down.
on, off
Delete SAs when router is not a VRRP master.
on, off
Go out of service if automatic establishment fails.
Integer
Go out of service after n consecutive auto-negotiation failures.
on, off
This tunnel can only use apn.
0=Main APN This tunnel can only use apn. 1=Backup APN
blank, ETH, PPP
Link tunnel with interface with x,y. x=Interface type
Integer
Link tunnel with interface with x,y. y=Interface number
Commaseparated list of Integers
Inhibit this IPsec tunnel when IPsec tunnels n are up.
Integer
Inhibit this IPsec tunnel unless IPsec tunnel n is up.
on, off
IKE negotiation source IP address is taken from the Secondary IP Address.
blank, ETH, PPP
IKE negotiation source IP address is taken from the Interface x,y. x=Interface type
Digi TransPort® Routers User Guide
472
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Command eroute
eroute eroute eroute eroute
eroute eroute eroute
eroute
eroute
eroute
Instance Parameter
n
ipadd
n
intunnel
n
natkaint
n
proto
n
toslist
n
locport
n
remport
n
locfirstport
n
loclastport
n
remfirstport
n
remlastport
Values Integer
on, off Integer off, tcp, udp, gre Commaseparated list of Integers 0-65535 0-65535 0-65535
0-65535
0-65535
0-65535
Equivalent web parameter
IKE negotiation source IP address is taken from the Interface x,y. y=Interface number
Tunnel this IPsec tunnel inside another IPsec tunnel.
NAT-Traversal Keepalive timer s seconds.
Allow protocol IP protocol(s) in this tunnel.
IP packets with ToS values n must use this tunnel.
Only tunnel IP packets with local TCP/UDP port.
Only tunnel IP packets with remote TCP/UDP port.
Only tunnel IP packets with local TCP/UDP port in the range of n1 to n2.
Only tunnel IP packets with local TCP/UDP port in the range of n1 to n2.
Only tunnel IP packets with remote TCP/UDP port in the range of n1 to n2.
Only tunnel IP packets with remote TCP/UDP port in the range of n1 to n2.
Set up IPsec tunnels for multiple users
For small numbers of users it is usual to set up an individual eroute for each user. However, to ease configuration where large numbers of users are required, you can use the * character as a wildcard to match multiple user IDs. For example, setting the Peer ID parameter to Digi* would match all remote units having an Our ID parameter starting with Digi, such as Digi01, Digi02, etc.
Example
To set up multiple users in this way, first set up the Our ID parameter on the host unit to a suitable name, such as Host1. Then set the Peer ID parameter to Remote* for example. In addition, an entry would be made in the user table with Remote* for the Username and a suitable Password value, such as mysecret.
Each of the remote units that required access to the host would then have to be configured with an Our ID parameter of Remote01, Remote02, etc., and each would have to have an entry in their user table for User Host1 along with its password, such as the pre-shared key.
Digi TransPort® Routers User Guide
473
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Parameter Peer ID Our ID Username Password
Host Router Remote* Host1 Remote* mysecret
Remote Router1 Host1 Remote01 Host1 mysecret
Remote Router2 Host1 Remote02 Host1 mysecret
Remote Router1 Host1 Remote03 Host1 mysecret
Digi TransPort® Routers User Guide
474
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure IPsec tunnel default action
Like a normal IP routing set-up, IPSec Tunnels have a default configuration that is applied if no specific tunnel can be found. This is useful when, for example, you want to have a number of remote users connect via a secure channel, for example, to access company financial information, but also still allow general remote access to other specific servers on your network or the Internet.
Web
1. Go to Configuration > Network > Virtual Private Networking > IPsec Tunnels > IPsec Default Action.
2. Configure the IPsec tunnel default action parameters:
When a packet is received which does not match any IPsec tunnel How the router responds if a packet is received when there is no SA.
n Drop the packet: Routes only packets that match a specified IPsec tunnel and discards all other data. This has the effect of enforcing a secure connection to all devices behind the router.
n Pass the packet: Decrypts and authenticates all packets that match an IPsec tunnel, depending on the IPsec tunnel's configuration. Data that does not match is also allowed to pass.
When a packet is to be transmitted which does not match any IPsec tunnel How the router will respond if a packet is transmitted when there is no SA.
n Drop the packet: Routes only packets that match a specified IPsec tunnel and discards all other data.
n IPass the packet: Decrypts and authenticates all packets that match an IPsec tunnel, depending on the IPsec tunnel's configuration. Data that does not match is also allowed to pass.
3. Click Apply.
Digi TransPort® Routers User Guide
475
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Command line
Command def_eroute
def_eroute
Instance 0
0
Parameter nosain
nosaout
Values
drop, pass
drop, pass
Equivalent web parameter
When a packet is received which does not match any IPsec tunnel.
When a packet is to be transmitted which does not match any IPsec tunnel.
Digi TransPort® Routers User Guide
476
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure IPsec groups
IPsec groups are supported on TransPort WR44v2 models only. You can use IPsec groups when the router is terminating tunnels to a large number of remote devices, such as using the router as a VPN Concentrator. To keep the size of the configuration file in the router small and also to maintain ease of configuration, only the information for all tunnels is stored on the router. All other information that is site specific is stored in a MySQL database. This means the number of sites that can be configured is limited only by the SQL database size and performance. This will be literally millions of sites, depending upon the operating system and hardware of the MySQL PC. The number of sites that can be connected to concurrently are much smaller and limited by the model of the router.
n The router with the IPsec Group/MySQL configuration is the VPN Concentrator. n The remote sites normally do not require an IPsec group configuration, as they normally need
to connect to a single peer only, the VPN Concentrator. n The VPN Concentrator normally need a single IPsec group configured only. n The local and remote subnet parameters must be set up wide enough to encompass all the
local and remote networks. n The VPN Concentrator can act as an initiator and/or a responder. In situations where there are
more remote sites than the router can support concurrent sessions, it is normally necessary for the VPN Concentrator and the remote sites to be both an initiator and a responder. This is so both the remote sites and the head-end can initiate the IPsec session when required. n It is also important to configure the IPsec tunnels to time out on inactivity to free up sessions for other sites. In the case of the VPN Concentrator acting as an initiator, when it receives a packet that matches the main IPsec tunnel, if no Security Associations already exist, it looks up the required parameters in the database. n The router then creates a dynamic IP tunnel containing all the settings from the base IPsec tunnel and all the information retrieved from the database. n At this point, IKE creates the tunnel (IPsec security associations) as normal. n The dynamic IPsec tunnel continues to exist until all the IPsec Security Associations are removed. n When the maximum supported (or licensed) number of tunnels has been reached by the router, the oldest Dynamic IPsec tunnels (those not in use for the longest period of time) and their associated IPsec Security Associations are dropped, to allow new inbound VPNs to connect.
Logic flow for creating IPSec SAs
VPN Concentrator acting as initiator The VPN Concentrator normally acts as an initiator when it receives an IP packet for routing with a source address matching the IPsec tunnel local subnet address & mask and a destination address matching the remote subnet address & mask, provided an IPsec SA does not already exist for this site.
1. 1If an IPsec group is configured to use the matching IPsec tunnel, the router uses a MySQL query to obtain the site specific information in order to create the SAs.
Digi TransPort® Routers User Guide
477
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
2. The VPN Concentrator creates a SELECT query using the destination IP address of the packet and the mask configured in the IPsec group configuration to determine the remote subnet address. This means that the remote subnet mask must be the same on all sites using the current IPsec group.
3. Once the site-specific information is retrieved, the router creates a dynamic IPsec Tunnel which is based upon the base IPSec tunnel configuration plus the site specific information from the MySQL database.
4. The router then uses the completed IPsec tunnel configuration and IKE to create the IPsec SAs.
5. For the pre-shared key, IKE uses the password returned from the MySQL database rather than doing a local look up in the user configuration.
6. Once created, the SAs are linked with the dynamic IPsec tunnel. Replacement SAs are created as the lifetimes start to get low and traffic is still flowing.
7. When all SAs to this remote router are removed, the dynamic IPsec tunnel is removed, allowing reuse of the IPsec tunnel to create tunnels to other remote sites.
8. When processing outgoing packets, dynamic IPsec Tunnels are searched before base IPsec tunnels. If a matching dynamic IPsec tunnel is found, the router uses that tunnel, and the base IPsec tunnel is only matched if no dynamic IPsec tunnel exists.
9. Once the dynamic IPsec tunnel is removed, further outgoing packets will match the base IPsec tunnel and the process is repeated.
VPN Concentrator acting as a responder to a session initiated from the remote site
1. When a remote site needs to create an IPsec SA with the VPN Concentrator it sends an IKE request to the VPN Concentrator.
2. The VPN Concentrator needs to be able to confirm that the remote device is authorized to create an IPsec tunnel. The remote site supplies its ID to the host during the IKE negotiations. The VPN Concentrator uses this ID in a search of the IPsec tunnels configured and dynamic IPsec tunnels to see if the supplied ID matches the configured Peer ID (peerid). If a match is found, the MYSQL database is queried to retrieve the information required to complete the negotiation (such as pre-shared key/password). If no matching base IPsec tunnel is found, router uses the local user configuration to locate the password, and a normally configured IPsec tunnel must also exist.
3. Once the information is retrieved from the MySQL database, IKE negotiations continue, and the created IPsec SAs will be associated with the dynamic IPsec tunnel.
4. As long as the dynamic IPsec tunnel exists, it behaves just like a normal IPsec tunnel. such as SAs being replaced/removed as required.
5. If errors are received from the MySQL database, or not enough fields are returned, the dynamic IPsec tunnel is removed, and IKE negotiations in progress are terminated.
Digi TransPort® Routers User Guide
478
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
6. There are a limited number of dynamic IPsec tunnels. If the number of free dynamic IPsec tunnel is less than 10 percent of the total number of dynamic IPsec tunnel, the router periodically removes the oldest dynamic IPsec tunnel. This is done to ensure that there will always be some free dynamic IPsec tunnel available for incoming connections from remote routers. To view the current dynamic tunnels that exist using the WEB server, browse to Management > Connections > Virtual Private Networking (VPN) > IPsec. The table indicates the base IPsec tunnel and the Remote Peer ID in the status display, to help identify which remote sites are currently connected.
Preliminary IP Tunnel configuration
The IPsec tunnel configuration Configuration > Network > Virtual Private Networking (VPN) > IPsec > IPsec Tunnels > IPsec n differs from a normal configuration in the following ways:
n Peer IP/hostname: Because the peer IP address to each peer is unknown and is retrieved from the database, this field is left empty.
n Bakpeerip (CLI only): Because the peer IP address to each peer is unknown and is retrieved from the database, this field is left empty.
n Peer ID: When the host Digi is acting as a responder during IKE negotiations, the router uses the ID supplied by the remote to decide whether or not the MySQL database should be interrogated. So that the router can make this decision, the remote router must supply an ID that matches the peerid configured into the IPsec tunnel. Wildcard matching is supported which means that the peerid may contain * and ? characters. If only one IPsec tunnel is configured, the peerid field may contain a *, indicating that all remote IDs result in a MySQL look up.
n Local subnet IP address / Local subnet mask: Configured as usual.
n Remote subnet IP address / Remote subnet mask: These fields should be configured in such a way that packets to ALL remote sites fall within the configured subnet. such as if there are two sites with remote subnets 192.168.0.0/24, and 192.168.1.0/24 respectively, a valid configuration for the host would be 192.168.0.0/23 so that packets to both remote sites match.
All other fields should be configured as usual. It is possible to set up other IPsec groups linked with other IPsec tunnels. This would be done if there is a second group of remote sites that have a different set of local and remote subnets, or perhaps different encryption requirements. The only real requirement is that this second group uses peer IDs that do not match up with those in use by the first IPsec group.
IPsec Group configuration
This configuration holds information relating to the MySQL database, and the names of the fields where the information is held. This configuration also identifies which IPsec tunnels create dynamic IPsec tunnels.
Example MySQL schema
mysql> describe eroutes;
+-----------+-------------+------+-----+---------+-------+
| Field
| Type
| Null | Key | Default | Extra |
+-----------+-------------+------+-----+---------+-------+
| peerip | varchar(20) | YES |
| NULL |
|
| bakpeerip | varchar(20) | YES |
| NULL |
|
| peerid | varchar(20) | NO | PRI |
|
|
Digi TransPort® Routers User Guide
479
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
| password | varchar(20) | YES |
| NULL |
|
| ourid
| varchar(20) | YES |
| NULL |
|
| remip
| varchar(20) | YES | UNI | NULL |
|
| remmsk | varchar(20) | YES |
| NULL |
|
+-----------+-------------+------+-----+---------+-------+
7 rows in set (0.01 sec)
Configuration parameters
The IPsec group configuration parameters are as follows:
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IPsec Groups > IPsec Group n.
2. Configure IPsec group parameters as needed.
Digi TransPort® Routers User Guide
480
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Link this IPsec group with IPsec Tunnel The base IPsec tunnel number. This parameter allows the router to see that an IPsec tunnel should use the group configuration to retrieve dynamic information from the database.
Remote mask to use for tunnels Used in the SQL SELECT query in conjunction with the destination IP address of packets to be tunneled from the host to the remote peer to identify the correct record to select from the MySQL database.
MySQL Server IP Address or Hostname The IP address or hostname of the MySQL Server.
MySQL Server Port The port that the MySQL Server is listening on.
Username The username to use when logging into the MySQL Server.
Password / Confirm Password The password to use when logging into the MySQL Server.
Database name The name of the database to connect to.
Database table The name of the table when the remote site information is stored.
Remote subnet IP The name of the field in the table where the `remip' data is stored.
Remote subnet Mask The name of the field in the table where the remmsk data is stored.
Peer IP Address The name of the field in the table where the peerip data is stored.
Backup Peer IP Address The name of the field in the table where the bakpeerip data is stored.
Peer ID The name of the field in the table where the peerid data is stored.
Our ID The name of the field in the table where the ourid data is stored.
Password The name of the field in the table where the password to use in IKE negotiations is stored.
Digi TransPort® Routers User Guide
481
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Note The default MySQL field names match the matching IPsec tunnel configuration parameter name. The default field name for the password field is password.
3. Click Apply.
Command line
Command Instance Parameter Values
egroup n
eroute
Integer
egroup n egroup n
egroup n egroup n egroup n egroup n egroup n egroup n egroup n egroup n egroup n egroup n egroup n egroup n
remmsk IP Mask
dbhost
IP Address or Hostname
dbport
0-65535
dbuser
String
dbpwd
String
dbname String
dbtable String
fremip
String
fremmsk String
fpeerip String
fbakpeerip IP Address
fpeerid String
fourid
String
fpwd
String
Equivalent web parameter Link this IPsec group with IPsec Tunnel Remote mask to use for tunnels MySQL Server IP Address or Hostname MySQL Server Port Username Password / Confirm Password Database name Database table Remote subnet IP Remote subnet Mask Peer IP Address Backup Peer IP Address Peer ID Our ID Password
Use IPSec Egroups with an SQL database
When the router uses IPSec Egroups with a SQL database for dynamic Eroute configuration, several commands can help you configure and troubleshoot the router.
Local Database commands As well as using an external SQL database, the router can cache the SQL table entries it learns from the SQL server in RAM so if the SQL server goes offline for any reason, the database entries are still available to renew existing IPSec SAs. To configure the caching options the command is: sql 0 <parameter> <value>. The following parameters are available to configure the caching of database entries:
Digi TransPort® Routers User Guide
482
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Command line
dbsrvmem <n> The amount of memory (RAM) the MySQL server cache should use. <n> is specified in multiples of 1k, such as 10Mb=10240. To calculate the amount of memory to specify in this parameter:
n Note the size of the database file (.csv) that will be loaded into the router memory. n Double this value and add 100Kb, for example, if the .csv file is 200Kb, this would make a value
of 500Kb for the memory allocation. Use this command: sql 0 dbsrvmem 500. n Load the database file into memory and check the memory allocated and free using the smem
command. This will show the memory allocated and left available. Increase the memory in the dbsrvmem command if required.
dbfile <name> The name of the .csv file that the router will use to store the table definitions (1st line) and data records. This file is stored in flash. The router uses it to populate the database stored in RAM on power-up or when a new file matching this name has just been stored. The dbfile can be populated with records or be empty except for the definitions line. The dbfile stored in RAM will be populated from both the dbfile stored in flash and (if configured) via caching items learned from the main SQL server. The dbfile in flash can then be updated from the dbfile in RAM and saved.
dbname <name> The name of the backup database in case the main database goes offline. This name must match the database name in use on the SQL server.
learn <off|on> When enabled, the router will cache entries learned via the main SQL database in a file stored in RAM. You can use this file as a backup if the main SQL database going offline. To use learning mode, at least one column in the .csv dbfile must be marked as a unique key, with the U prefix. For example, remip is marked as the unique key: peerip[IP],bakpeerid[IP],peerid[K20],password[20],ourid[20],remip [UKIP],remmsk[IP]
Learning mode: saving entries When using learning mode, the dynamic backup database is stored in RAM. This database is lost if the router is power-cycled. You can save the database in RAM to flash to over-write the dbfile with the one in RAM that includes the learned entries or it can be saved to a new file. To save the dbfile to flash from RAM, use the following command:
sqlsave 0 <filename>
Where <filename> is the name of the destination file. For example, to save the learned database entries to a file called backup.csv:
sqlsave 0 backup.csv
If there are no learned entries, this command will not create a file. To view the number to learned entries, use the command sql 0 ?, and in the output, see the section headed Learning info:
Digi TransPort® Routers User Guide
483
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Learning info. items learned:0 matched retrievals:0 OK
Configure a TransPort to use a backup database Once the router has been configured to run a SQL csv database locally, you can use this backup csv database if the main SQL database goes offline. Required configuration parameters are:
1. Configure the IP address of the SQL server to use.
egroup 0 dbhost "192.168.0.50"
2. Configure the IP address of the SQL server that will have a backup database. If a socket connection fails to this IP address, the router will use the backup IP address.
ipbu 0 IPaddr "192.168.0.50"
3. Configure the backup database IP address; that is, the loopback address of the router or an alternative SQL server, this example shows the loopback IP address of the router.
ipbu 0 BUIPaddr "127.0.0.1"
4. Set the amount of time in seconds that the connection to the main SQL server will be retried.
ipbu 0 retrysec 30
5. Set the router to use the backup IP address if the main database is unavailable.
ipbu 0 donext ON
For example, to configure and use a local backup database when the main SQL database at 192.168.0.50 is offline, the configuration may look similar to this:
egroup 0 dbhost "192.168.0.50" sql 0 dbsrvmem 200 sql 0 dbfile "sardb.csv" sql 0 dbname "sarvpns" sql 0 learn ON sqlsave 0 backup.csv ipbu 0 IPaddr "192.168.0.50" ipbu 0 BUIPaddr "127.0.0.1" ipbu 0 retrysec 30 ipbu 0 donext ON
smem command: Display memory information
smem
Displays the amount of memory allocated, in use and available for use by the MySQL server on the router.
Transact SQL commands To query a SQL database manually using transact SQL statements, use the following commands:
Digi TransPort® Routers User Guide
484
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Connect to the SQL server and database sqlcon <host> <user> <pwd> <database> For example: sqlcon 192.168.0.50 sqluser sqlpass eroute-db
Issue transact SQL statements sqldo <"cmd"> For example: sqldo "select * from site where subnet='10.110.100.0' limit 3"
Limit the sqldo command to only act on specified fields sqlfields "<field1> <field2> <field3>" After issuing the sqlfields command, all further sqldo commands will apply to these fields only. For example: sqlfields "remmsk password peerip"
Close the SQL server connection correctly sqlclose
Use the SQL "debug" command If the database being queried is held locally on the router, you can precede these transact SQL commands with the SQL debug command to get extra feedback on any commands issued.
n To enable the SQL debug: sql 0 debug_opts 3
n To view the debug data via the ASY 0 port: debug 0
n To view the SQL debug data via Telnet: debug t
n To disable the SQL debug: >sql 0 debug_opts 0 debug off
Digi TransPort® Routers User Guide
485
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure Dead Peer Detection (DPD)
When Dead Peer Detection (DPD) is enabled on an IPsec tunnel, the router will send an IKE DPD request at regular intervals. If no response is received to the DPD request, the IPsec tunnel is considered as suspect and the requests are sent at a shorter interval until either the maximum number of outstanding requests allowed is reached or a response is received. If no response is received to the configured maximum requests, the IPSec tunnels are closed.
Note IKE DPD requests require that an IKE SA is present. If one is not present, the DPD request will fail.
To help ensure that an IKE SA exists with a lifetime at least as great as the IPsec lifetime, the router creates new IKE SAs whenever the IPsec SA lifetime exceeds the lifetime of an existing IKE SA and attempts to negotiate a lifetime for the IKE SA that is 60 seconds longer than the desired lifetime of the IPsec SA.
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > Dead Peer Detection (DPD).
2. Configure Dead Peer Detection parameters:
Mark the IPsec tunnel as suspect if there is no traffic for n seconds The period of time of inactivity on a tunnel before it is deemed to be suspect, such as if there is no activity on a healthy link for the time period defined, then the tunnel is them deemed to be suspect.
Send a DPD request on a healthy link every n seconds The interval at which DPD requests are sent on an IPsec tunnel that is deemed to be healthy. A healthy link is one with traffic.
Send a DPD request on a suspect link every n seconds The interval at which DPD requests are sent on an IPsec tunnel that is deemed to be suspect. A suspect link is one where there has been no traffic for a specified period of time.
Digi TransPort® Routers User Guide
486
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Close the IPsec tunnels after no response for n DPD requests The maximum number of DPD requests that will be sent without receiving a response before the IPsec tunnels are closed. 3. Click Apply.
Command line
Command Instance Parameter Values Equivalent web parameter
dpd
0
inact
Integer Mark the IPsec tunnel as suspect if there is no traffic for n seconds
dpd
0
okint
Integer Send a DPD request on a healthy link every n seconds
dpd
0
failint
Integer Send a DPD request on a suspect link every n seconds
dpd
0
maxfail
Integer Close the IPsec tunnels after no response for n DPD requests
Digi TransPort® Routers User Guide
487
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure Internet Key Exchange (IKE)
IKE Debug parameters
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IKE. The Configuration > Network > Virtual Private Networking (VPN) > IPsec > IKE page displays configuration pages for Internet Key Exchange (IKE) instances IKE 0 and IKE 1, with a separate page for IKE Responder. The IKE 0 instance can serve as an IKE initiator or as an IKE responder, while IKE 1 can serve as an initiator. Use the IKE 0 and IKE 1 pages to set up the IKE 0 and IKE 1 initiator parameters as required. The IKE Responder page configures the responder parameters for IKE 0.
2. Configure IKE parameters:
Enable IKE Debug Enables IKE debugging to be displayed on the debug port.
Debug Level Sets the level of IKE debugging. The options are:
n Low n Medium n High n Very High
Debug IP Address Filter Used to filter out IKE packets with particular source or destination IP addresses. The format of this parameter is a comma-separated list of IP addresses. For example, to exclude the capture of IKE traffic from IP hosts 10.1.2.3 and 10.2.2.2, enter 10.1.2.3,10.2.2.2 for this parameter. Conversely, you may wish to only capture traffic to and from particular IP hosts. To do this, use a tilde () symbol before the list of IP addresses. For example, to only capture packets to and from IP host 192.168.47.1, enter ~192.168.47.1 for this parameter.
Digi TransPort® Routers User Guide
488
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Forward debug to port When enabled, the IKE debug is sent to debug serial port. 3. Click Apply.
Command line
Command Instance Parameter Values
ike
0
deblevel 0=Off
1=Low
2=Medium
3=High
4=Very High
ike
0
ipaddfilt Comma-separated list of IP
addresses
ike
0
debug
on, off
Equivalent web parameter Debug Level
Debug IP Address Filter Forward debug to port
Configure IKE n parameters
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IKE n.
2. Configure the parameters for the IKE instance:
Use the following settings for negotiation The IKE negotiation settings.
Encryption The encryption algorithm. The options are:
n None n DES n 3DES n AES (128 bit keys) n AES (192 bit keys) n AES (256 bit keys)
Digi TransPort® Routers User Guide
489
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Authentication The authentication algorithm. The options are:
n None
n MD5
n SHA1
n SHA256
Mode The negotiation mode. The options are:
n Main
n Aggressive Historically, setting up IPSec tunnel have involved fixed IP addresses. Today it is more common, particularly with Internet ISPs, to dynamically allocate the user a temporary IP address as part of the process of connecting to the Internet. In this case, the source IP address of the party trying to initiate the tunnel is variable and cannot be preconfigured. In Main mode, such as non-aggressive, the source IP address must be known so that the router can use this mode over the Internet if the ISP provides a fixed IP address to the user, or you are using X.509 certificates. Aggressive mode was developed to allow the host to identify a remote unit (initiator) from an ID string rather than from its IP address. This means that the router can use this mode over the Internet via an ISP that dynamically allocates IP addresses. It also has two other noticeable differences from main mode. Firstly, it uses fewer messages to complete the phase 1 exchange (3 compared to 5) and so will execute a little more quickly, particularly on networks with large turn-around delays such as GPRS. Secondly, as more information is sent unencrypted during the exchange, it is potentially less secure than a normal mode exchange.
Note When using certificates, you can use Main mode without knowing the remote unit's IP address when using certificates. This is because the ID of the remote unit (its public key) can be retrieved from the certificate file.
MODP Group for Phase 1 The key length in the IKE Diffie-Hellman exchange to 768 bits (group 1) or 1024 bits (group 2). Normally this option is set to group 1; this is sufficient for normal use. For particularly sensitive applications, you can improve security by selecting group 2 to enable a 1024 bit key length. Note, however, that this will slow down the process of generating the phase 1 session keys (typically from 1-2 seconds for group 1), to 4-5 seconds.
MODP Group for Phase 2 The minimum width of the numeric field in the calculations for phase 2 of the security exchange. With No PFS (Perfect Forwarding Security) selected, the data transferred during phase 1 can be reused to generate the keys for the phase 2 SAs, hence speeding up connections. However, in doing this it is possible (though very unlikely), that if the phase 1 keys were compromised (such as discovered by a third party), the phase 2 keys might be more easily compromised. Enabling group 1 (768) or 2 (1024) or 3 (1536), IPSec MODP forces the key calculation for phase 2 to use new data that has no relationship to the phase 1 data and initiates a second Diffie-Hellman exchange. This provides an even greater level of security, but can take longer to complete.
Digi TransPort® Routers User Guide
490
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Renegotiate after h hrs m mins s secs How long the initial IKE Security Association stays in force. When this time expires, any attempt to send packets to the remote system results in IKE attempting to establish a new SA. 3. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
ike
n
encalg
des, 3des, aes Encryption
ike
n
keybits
0, 128, 192, 256 Encryption (AES Key length)
ike
n
authalg
md5, sha1
Authentication
ike
n
rauthalgs sha256
PRF Algorithm
ike
n
aggressive on, off
Mode
ike
n
ikegroup 1, 2, 5
MODP Group for Phase 1
ike
n
ipsecgroup 1, 2, 5
MODP Group for Phase 2
ike
n
ltime
1-28800
Renegotiate after h hrs m mins s secs
This CLI value is entered in seconds only.
Configure advanced IKE parameters
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IKE n > Advanced.
2. Configure the advanced IKE parameters as needed:
Digi TransPort® Routers User Guide
491
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Retransmit a frame if no response after n seconds The amount of time, in seconds, that IKE will wait for a response from the remote unit before transmitting the negotiation frame.
Stop IKE negotiation after n retransmissions The maximum number of times that IKE will retransmit a negotiation frame as part of the exchange before failing.
Stop IKE negotiation if no packet received for n seconds The period of time, in seconds, after which the router will stop the IKE negotiation when no response to a negotiation packet has been received.
Enable Dead Peer Detection Enables Dead Peer Detection. For more information, refer to the Configuration > Network > IPsec > Dead Peer Detection (DPD) page.
NAT Traversal Mode Selects the NAT traversal mode for IKE/IPsec: Auto, Disabled, or Force. When one end of an IPsec tunnel is behind a NAT box, some form of NAT traversal may be required before the IPsec tunnel can pass packets. Turning NAT Traversal on enables the IKE protocol to discover whether or not one or both ends of a tunnel is behind a NAT box, and implements a standard NAT traversal protocol if NAT is not being performed. The version of NAT traversal supported is that described in the IETF draft document Negotiation of NATTraversal in the IKE.
Send INITIAL-CONTACT notifications Enables INITIAL-CONTACT notifications to be sent.
Retain phase 1 SA after failed phase 2 negotiation Normally IKE functionality is to remove the phase 1 SA if the phase 2 negotiation fails. Enabling this parameter will cause the router to retain the existing phase 1 SA and retry the phase 2 again.
RSA private key file The name of a X.509 certificate file holding the router's private part of the public/private key pair in certificate exchanges. See Use X.509 certificates with IPsec tunnels section for further explanation.
SA Removal Mode Determines how IPsec and IKE SAs are removed.
n Normal operation does not delete the IKE SA when all the IPsec SAs that were created by it are removed and does not remove IPsec SAs when the IKE SA that created them is deleted.
n Remove IKE SA when last IPSec SA removed deletes the IKE SA when all the IPsec SAs that it created to a particular peer are removed.
n Remove IPSec SAs when IKE SA removed deletes all IPSec SAs that have been created by the IKE SA that has been removed.
Digi TransPort® Routers User Guide
492
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
n Both removes IPSec SAs when their IKE SA is deleted, and deletes IKE SAs when their IPSec SAs are removed.
3. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
ike
n
retranint
0-255
Retransmit a frame if no response after n seconds
ike
n
retran
0-9
Stop IKE negotiation after n retransmissions
ike
n
inactto
0-255
Stop IKE negotiation if no packet received for n seconds
ike
n
dpd
on, off
Enable Dead Peer Detection
ike
n
natt
on, off
Enable NAT-Traversal
ike
n
initialcontact on, off
Send INITIAL-CONTACT notifications
ike
n
keepph1
on, off
Retain phase 1 SA after failed phase 2 negotiation
ike
n
privrsakey Filename
RSA private key file
ike
n
delmode
0=Normal
SA Removal Mode
1=Remove IKE SA when
last IPsec SA removed
2=Remove IPsec SAs
when IKE SA remove
3=Both
ike
n
openswan on, off
None. This enables support for Openswan IKE implementations.
IKE Responder command
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IKE > IKE Responder. The IKE Responder page displays the various parameters for IKE 0 in Responder mode.
Digi TransPort® Routers User Guide
493
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
2. Configure IKE responder parameters as needed:
Enable IKE Responder Allows the router to respond to incoming IKE requests.
Accept IKE Requests with Defines the settings that the router will accept during the negotiation
Encryption The acceptable encryption algorithms.
Authentication The acceptable authentication algorithms.
MODP Group between x and y The acceptable range for MODP group.
Renegotiate after h hrs m mins s secs How long the initial IKE Security Association will stay in force. When the IKE Security Association expires, any attempt to send packets to the remote system will result in IKE attempting to establish a new SA. 3. Click Apply.
Command line
Command Instance Parameter
ike
0
noresp
ike
0
rencalgs
ike
0
keybits
ike
0
rauthalgs
Values
Equivalent web parameter
on, off
Enable IKE Responder
des, 3des, aes
Encryption
Multiple algorithms can specified in
a comma-separated list
0, 128, 192, 256
Encryption (Minimum AES Key length)
md5, sha1
Authentication
Multiple algorithms can specified in
a comma-separated list
Digi TransPort® Routers User Guide
494
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Command Instance Parameter Values
ike
0
rdhmingroup 1, 2, 5
ike
0
rdhmaxgroup 1, 2, 5
ike
0
ltime
1-28800
Equivalent web parameter
MODP Group between x and y
MODP Group between x and y
Renegotiate after h hrs m mins s secs This CLI value is entered in seconds only.
Configure advanced IKE Responder parameters
Web
1. Go to Configuration> Network > Virtual Private Networking (VPN) > IPsec > IKE > IKE Responder > Advanced.
2. Configure advanced IKE responder parameters as needed:
Stop IKE negotiation if no packet received for n seconds The period of time in seconds after which the router will stop the IKE negotiation when no response to a negotiation packet has been received.
Enable NAT-Traversal Enables support for NAT Traversal within IKE/IPsec. When one end of an IPsec tunnel is behind a NAT box, some form of NAT traversal may be required before the IPsec tunnel can pass packets. Turning NAT Traversal on enables the IKE protocol to discover whether or not one or both ends of a tunnel is behind a NAT box, and implements a standard NAT traversal protocol if NAT is not being performed. The version of NAT traversal supported is that described in the IETF draft document draft-ietf-ipsec-nat-t-ike-03.txt.
Send INITIAL-CONTACT notifications Enables INITIAL-CONTACT notifications to be sent.
Digi TransPort® Routers User Guide
495
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Send RESPONDER-LIFETIME notifications Enables RESPONDER-LIFETIME notifications sent to the initiator. If an initiator requests an IKE lifetime that is greater than the responder, a notification will be sent and the initiator should reduce its lifetime value accordingly.
Retain phase 1 SA after failed phase 2 negotiation The name of a X.509 certificate file holding the router's private part of the public/private key pair in certificate exchanges. See Use X.509 certificates with IPsec tunnels for further explanation.
RSA private key file The name of a X.509 certificate file holding the router's private part of the public/private key pair in certificate exchanges. See Use X.509 certificates with IPsec tunnels for further explanation.
SA Removal Mode Determines how IPsec and IKE SAs are removed.
n Normal operation will not delete the IKE SA when all the IPsec SAs that were created by it are removed and will not remove IPsec SAs when the IKE SA that created them is deleted.
n Remove IKE SA when last IPSec SA removed deletes the IKE SA when all the IPsec SAs that it created to a particular peer are removed.
n Remove IPSec SAs when IKE SA removed deletes all IPSec SAs that have been created by the IKE SA that has been removed.
n Both removes IPSec SAs when their IKE SA is deleted, and delete IKE SAs when their IPSec SAs are removed.
Delete SAs when invalid SPI notifications are received Deletes IKE SAs when the router receives invalid SPI notifications. 3. Click Apply.
Command line
Command Instance Parameter
ike
0
inactto
Values 0-255
ike
0
natt
on, off
ike
0
initialcontact on, off
ike
0
respltime on, off
ike
0
keepph1
on, off
Equivalent web parameter
Stop IKE negotiation if no packet received for n seconds
Enable NAT-Traversal
Send INITIAL-CONTACT notifications
Send RESPONDER-LIFETIME notifications
Retain phase 1 SA after failed phase 2 negotiation
Digi TransPort® Routers User Guide
496
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Command Instance Parameter
ike
0
privrsakey
ike
0
delmode
Values
Equivalent web parameter
Filename
RSA private key file
0=Normal
SA Removal Mode
1=Remove IKE SA when
last IPsec SA removed
2=Remove IPsec SAs when
IKE SA remove
3=Both
MODECFG Static NAT mappings parameters
MODECFG is an extra stage built into IKE negotiations that fits between IKE phase 1 and IKE phase 2. It performs operations such as extended authentication (XAUTH) and requesting an IP address from the host. This IP address becomes the source address to use when sending packets through the tunnel from the remote to the host. This mode of operation, receiving one IP address from the remote host, is called client mode. Another mode, network mode, allows the router to send packets with a range of source addresses through the tunnel.
If the router receives packets from a local interface that need to be routed through the tunnel, it performs address translation so the source address matches the assigned IP address before encrypting using the negotiated SA. Some state information is retained so that packets coming in the opposite direction with matching addresses/ports can have their destination address set to the source address of the original packet, in the same way as standard NAT.
If the remote end of the tunnel can access units connected to the local interface, the unit that has been assigned the virtual IP address needs to have some static NAT entries set up. When a packet is received through the tunnel, the router first looks up existing NAT entries, followed by static NAT entries to determine whether the destination address/port should be modified, and forwards the packet to the new address. If a static NAT mapping is found, the router creates a dynamic NAT entry it uses for the duration of the connection. If no dynamic or stateful entry is found, the packet is directed to the local protocol handlers.
Web
External Port The lowest destination port number to be matched if the packet is redirected.
Digi TransPort® Routers User Guide
497
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Forward to Internal IP Address An IP address to which packets containing the specified destination port number are redirected.
Forward to Internal Port A port number to which packets containing the specified destination port number are redirected.
Port Range Count The number of ports to be matched.
Add button Adds the static NAT mapping to the IPsec tunnel configuration.
Command line
Command tunsnat tunsnat tunsnat tunsnat
Instance n n n n
Parameter minport maxport ipaddr mapport
Values 0-65535 0-65535 IP Address 0-65535
Equivalent web parameter External Port Port Range Count Forward to Internal IP Address Forward to Internal Port
Digi TransPort® Routers User Guide
498
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure IKEv2
When IKE Version 2 is supported, you can specify whether to use IKEv1 or IKEv2 protocol to negotiate IKE SAs. The default is to use IKEv1. Routers the have been upgraded to support IKEv2 do not require any changes to their configuration to continue working with IKEv1.
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IKEv2 > IKEv2 n.
2. Configure the IKEv2 parameters:
Use the following settings for negotiation The settings for the IKEv2 negotiation.
Encryption The encryption algorithm. The options are None, DES, 3DES, AES (128 bit keys), AES (192 bit keys), AES (256 bit keys).
Authentication The authentication algorithm. The options are None, MD5, SHA1, SHA256.
PRF Algorithm The PRF (Pseudo Random Function) algorithm. The options are MD5 and SHA1.
MODP Group for Phase 1 Sets the key length for the IKE Diffie-Hellman exchange to 768 bits (group 1) or 1024 bits (group 2). Normally, this option is set to group 1 and this is sufficient for normal use. For particularly sensitive applications, you can improve security by selecting group 2 to enable a 1024 bit key length. Note however that this will slow down the process of generating the phase 1 session keys (typically from 1-2 seconds for group 1), to 4-5 seconds.
Renegotiate after h hrs m mins s secs How long the initial IKEv2 Security Association will stay in force. When it expires any attempt to send packets to the remote system will result in IKE attempting to establish a new SA.
Digi TransPort® Routers User Guide
499
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Rekey after h hrs m mins s secs When the time left until expiry for this SA reaches the value specified by this parameter, the IKEv2 SA will be renegotiated, such as a new IKEv2 SA is negotiated and the old SA is removed. Any IPSec child SAs that were created are retained and become children of the new SA. 3. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
ike2
n
iencalg
des, 3des, aes
Encryption
ike2
n
ienkeybits 128, 192, 256
Encryption (AES Key length)
ike2
n
iauthalg md5, sha1, sha256 Authentication
ike
n
rauthalgs sha256
PRF Algorithm
ike2
n
iprfalg
md5, sha1
PRF Algorithm
ike2
n
idhgroup 1, 2, 5
MODP Group for Phase 1
ike2
n
ltime
1-28800
Renegotiate after h hrs m mins s secs This CLI value is entered in seconds only.
ike2
n
rekeyltime 1-28800
Rekey after h hrs m mins s secs This CLI value is entered in seconds only.
Configure advanced IKEv2 n parameters
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IKEv2 > IKEv2 n > Advanced.
2. Configure the IKEv2 advanced parameters as needed:
Retransmit a frame if no response after n seconds The amount of time in seconds that IKEv2 will wait for a response from the remote unit before transmitting the negotiation frame.
Digi TransPort® Routers User Guide
500
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Stop IKE negotiation after n retransmissions The maximum number of times that IKEv2 will retransmit a negotiation frame as part of the exchange before failing.
Stop IKE negotiation if no packet received for n seconds The period of time, in seconds, after which the router will stop the IKE v2 negotiation when no response to a negotiation packet has been received.
Enable NAT-Traversal Enables support for NAT Traversal within IKE/IPsec. When one end of an IPsec tunnel is behind a NAT box, some form of NAT traversal may be required before the IPsec tunnel can pass packets. Turning NAT Traversal on enables the IKE protocol to discover whether or not one or both ends of a tunnel is behind a NAT box, and implements a standard NAT traversal protocol if NAT is not being performed. The version of NAT traversal supported is that described in the IETF draft document draft-ietf-ipsec-nat-t-ike-03.
NAT traversal keep-alive interval n seconds The interval, in seconds, in which the NAT Traversal keepalive packets are sent to a NAT device in order to prevent NAT table entry from expiring.
RSA private key file The name of a X.509 certificate file holding the router's private part of the public/private key pair in certificate exchanges. See Use X.509 certificates with IPsec tunnels for further explanation. 3. Click Apply.
Command line
Command Instance Parameter Values Equivalent web parameter
ike2
n
retranint 0-255 Retransmit a frame if no response after n seconds
ike2
n
retran
0-9
Stop IKE negotiation after n retransmissions
ike2
n
inactto
0-255
Stop IKE negotiation if no packet received for n seconds
ike2
n
natt
on, off Enable NAT-Traversal
ike2
n
natkaint Integer NAT traversal keep-alive interval n seconds
ike2
n
privrsakey Filename RSA private key file
Configure IKEv2 Responder parameters
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IKEv2 > IKEv2 Responder.
Digi TransPort® Routers User Guide
501
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
The IKEv2 Responder page displays the various parameters for IKEv2 0 when in Responder mode.
2. Configure the IKEv2 Responder parameters as needed:
Enable IKEv2 Responder Allows the router to respond to incoming IKE requests.
Accept IKEv2 Requests with The settings that the router will accept during the negotiation
Encryption The acceptable encryption algorithms.
Authentication The acceptable authentication algorithms.
PRF Algorithm The acceptable PRF (Pseudo Random Function) algorithms.
MODP Group between x and y The acceptable range for MODP group.
Renegotiate after h hrs m mins s secs How long the initial IKE Security Association will stay in force. When it expires any attempt to send packets to the remote system will result in IKE attempting to establish a new SA.
Rekey after h hrs m mins s secs When the time left until expiry for this SA reaches the value specified by this parameter, the IKEv2 SA will be renegotiated, such as a new IKEv2 SA is negotiated and the old SA is removed. Any IPSec child SAs that were created are retained and become children of the new SA. 3. Click Apply.
Digi TransPort® Routers User Guide
502
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Command line
Command Instance Parameter Values
Equivalent web parameter
ike2
0
rencalgs
des, 3des, aes Encryption
ike2
0
renckeybits 128, 192, 256 Encryption (Minimum AES key length)
ike2
0
rauthalgs
md5, sha1
Authentication
ike2
0
rprfalgs
md5, sha1
PRF Algorithm
ike2
0
rdhmingroup 1, 2, 5
MODP Group between x and y
ike2
0
rdhmaxgroup 1, 2, 5
MODP Group between x and y
ike2
0
ltime
1-28800
Renegotiate after h hrs m mins s secs This CLI value is entered in seconds only.
ike2
0
rekeyltime 1-28800
Rekey after h hrs m mins s secs This CLI value is entered in seconds only.
Configure advanced IKEv2 Responder parameters
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IKEv2 > IKEv2 Responder > Advanced.
2. Configure the advanced IKEv2 Responder parameters as needed:
Stop IKE negotiation if no packet received for n seconds The period of time, in seconds, after which the router will stop the IKEv2 negotiation when no response to a negotiation packet has been received.
Enable NAT-Traversal Enables support for NAT Traversal within IKE/IPsec. When one end of an IPsec tunnel is behind a NAT box, some form of NAT traversal may be required before the IPsec tunnel can pass packets. Turning NAT Traversal on enables the IKE protocol to discover whether or not one or both ends of a tunnel is behind a NAT box, and implements a standard NAT traversal protocol if NAT is not being performed. The version of NAT traversal supported is that described in the IETF draft document draft-ietfipsec-nat-t-ike-03.
Digi TransPort® Routers User Guide
503
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
NAT traversal keep-alive interval n seconds The interval, in seconds, in which the NAT Traversal keepalive packets are sent to a NAT device in order to prevent NAT table entry from expiring.
RSA private key file The name of a X.509 certificate file holding the router's private part of the public/private key pair in certificate exchanges. See Use X.509 certificates with IPsec tunnels for more information. 3. Click Apply.
Command line
Command Instance Parameter Values Equivalent web parameter
ike2
0
inactto
0-255
Stop IKE negotiation if no packet received for n seconds
ike2
0
natt
on, off Enable NAT-Traversal
ike2
0
natkaint Integer NAT traversal keep-alive interval n seconds
ike2
0
privrsakey Filename RSA private key file
Digi TransPort® Routers User Guide
504
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure Layer 2 Tunneling Protocol (L2TP)
The Layer 2 Tunneling Protocol (L2TP) provides a means for terminating a logical PPP connection on a device other than the one which terminates the physical connection. Typically, both the physical layer and logical layer PPP connections would be terminated on the same device, for example, a TransPort router.
With L2TP answering the call, the router terminates the layer 2 connection only and the PPP frames are passed in an L2TP tunnel to another device which terminates the PPP connection. This device is sometimes referred to as a Network Access Server (NAS).
Digi TransPort® Routers User Guide
505
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
L2TP n parameters
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > L2TP > L2TP n.
2. Configure the L2TP parameters:
Act as a listener only When enabled, the router doesnot actively attempt to establish an L2TP tunnel. In this mode, it will only use L2TP if the remote host requests it. When unchecked, the router will actively try to establish an L2TP connection with the remote host.
Enable Server mode When enabled, the router acts as an L2TP server.
Initiate connections to a.b.c.d The IP address of the remote host, such as the device that will terminate the L2TP connection.
Use a.b.c.d as a backup It is possible to specify a backup remote L2TP host server using this parameter. The text box contains the IP address of the remote server to use.
Bring this tunnel up All the time/On demand This parameter only applies to tunnels initiated from this router.
Bring this tunnel down if it is idle for h hrs, m mins, s secs These radio buttons select whether or not the tunnel is permanently available or not. When set to On demand, the tunnel will not activate automatically but will wait until it is triggered by PPP. When set to On demand the values in the text boxes determine the timeout after which the L2TP tunnel will closed down after the last L2TP call on that tunnel.
Digi TransPort® Routers User Guide
506
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
L2TP Window Size The L2TP window size is selected from this drop down list. Available values are from 1 to 7.
Route UDP packets over interface x,y These two text boxes specify the interface and its instance number for L2TP UDP sockets. Specifying these parameters allow the router to raise the interface should it be disconnected.
Source Port Normal/Variable These radio buttons select the source port for the L2TP tunnel. Setting this setting to Normal uses the default port number, 1701. If set to Variable, this setting uses a random source port value.
Name The name that identifies the router during the negotiation phase when establishing an L2TP tunnel.
Authentication Off/Secret The radio buttons select whether or not to use authentication. This is normally set to Off as most host systems require using IPsec over L2TP tunnels. If Authentication is set to On, authentication is enabled and the Secret parameter becomes relevant. The value in the text box contains a passphrase shared with the host. The router uses this passphrase if the remote host requests authentication and Authentication is set to Off here. 3. Configure the advanced L2TP parameters as needed:
Retransmit interval s milliseconds The amount of time, in milliseconds, the router waits before retransmitting a Start Control Connection Request (SCCRQ) frame. The default value of 250ms should be changed to a higher value (say 4000ms) if L2TP is running over a GPRS link.
Retransmit count n When using L2TP over GPRS or satellite networks, the first few packets are sometimes lost. Setting the retransmit count in the text box to a higher value than the default of 5 will increase reliability of the tunnel.
Layer 1 Interface Sync port n/ISDN These radio buttons select the layer 1 (physical) interface to use to terminate the L2TP connection. The available options are ISDN or one of the router's synchronous serial ports. When Sync port n is selected, the sync port number is selected from the drop-down list.
Allow this L2TP tunnel to answer incoming ISDN calls When enabled, the L2TP entity answers incoming ISDN calls.
MSN The filter for the ISDN Multiple Subscriber Numbering (MSN). It is blank by default but when the answering facility (above) is enabled, the router only answers ISDN calls where the trailing digits match this MSN value. For example, setting the MSN value to 123 prevents the router from answering calls from any calling number that does not end in 123. Not applicable when answering is off.
Digi TransPort® Routers User Guide
507
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Sub-address The ISDN sub-address filter to use in conjunction with the ISDN answering function. When answering is set to On and there is a valid sub-address in this text box, the router only answers calls where the trailing digits of the calling sub-address match this sub-address. For example, setting the sub-address value to 123 prevents the router from answering calls where the subaddress does not end in 123. 4. Click Apply.
Command line
Configure L2TP parameters
Command Instance Parameter Values
Equivalent web parameter
l2tp
n
listen
off, on
Act as a listener only
l2tp
n
swap_io
off, on
Enable server mode
l2tp
n
remhost
Valid IP address Initiate connections to a.b.c.d a.b.c.d
l2tp
n
backremhost Valid IP address Use a.b.c.d as a backup a.b.c.d
l2tp
n
aot
off, on
Bring this tunnel up All the time/On demand
l2tp
n
nocallto
0-4294967296 Bring this tunnel down if it is idle for h hrs, m mins, s secs
l2tp
n
window
1-7 Default=4
L2TP Window Size
l2tp
n
ll_ent
<blank>, PPP, ETH
Route UDP packets over interface x,y
l2tp
n
ll_add
0-2147483647 Route UDP packets over interface x,y
l2tp
n
rnd_srcport off, on
Source Port
l2tp
n
name
Up to 30 characters
Name
l2tp
n
auth
off, on
Authentication Off/Secret
l2tp
n
secret
Up to 80 characters
Authentication Off/Secret
Digi TransPort® Routers User Guide
508
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Configure advanced L2TP parameters
Command Instance Parameter Values
Equivalent web parameter
l2tp
n
retxto
0-
Retransmit interval s milliseconds.
4294967296
l2tp
n
retxcnt
0-
Retransmit count
4294967296
l2tp
n
l1iface
0-255
Layer 1 Interface
l2tp
n
ans
off, on
Allow this L2TP tunnel to answer incoming ISDN
calls.
l2tp
n
msn
Up to 9
MSN
digits
l2tp
n
sub
Up to 17
Sub-address
digits
Digi TransPort® Routers User Guide
509
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
Use X.509 certificates with IPsec tunnels
The previous discussion of IPsec tunnel configuration implemented security between two points of the tunnel by using a "pre-shared secret" or password. Certificates provide this sort of mechanism, but without the need to manually enter or distribute secret keys. To summarize, a user's certificate is similar to a passport, providing proof that the user is who they say they are and enclosing details of how to use that certificate to decrypt data encoded with it. However, passports can be forged, so there also needs to be proof that the passport has been properly issued and hasn't been changed since it was. On a paper passport, this is achieved by covering the photograph with a coating that shows if it has been tampered with, embedding the user's name in code in a long string of numbers, etc. In the same way, for a Security Certificate to be genuine, it must be protected from alteration as well. Like a passport, you also have to trust that the issuer is authorized and competent to create the certificate. Certificates use something called a "Public/Private Key Pair." This a complex area but the principle is that you can create an encryption key made up from two parts, one private (known only to the user), the other public (known to everyone). Messages encrypted with someone's public key can only be recovered by the person with the Public AND Private key but as encrypting the message to someone in the first place only requires that you know their public key, anyone who knows that can send them an encrypted message, so you can send a secure message to someone knowing only their publicly available key. You can also prove who you are by including in the message your "identity" whereupon they can look up the certified public key for that identity and send a message back that only you can understand. The important principles are:
n Your private key cannot be determined from your public key.
n You both need to be able to look up the other's certified ID.
Once you have established a two-way secure link, you can use it to establish some rules for further communication. Before this gets any more complicated, let us assume Digi International is a competent authority to issue certificates, and examine how certificates work. Generally, the issuing and management of certificates will be provided as a managed service by Digi or its partners, but some general information is provided here for system administrators. Certificates are held in non-volatile files on the router. Any private files are named privxxxx.xxx and cannot be copied, moved, renamed, uploaded or typed. This is to protect the contents. They can be overwritten by another file, or deleted. Two file formats for certificates are supported:
n PEM: Privacy Enhanced MIME
n DER: Distinguished Encoding Rules
Certificate and key files should be in one of these two formats, and should have an extension of.pem or .der respectively.
Note The equivalent filename extension for .pem files in Microsoft Windows is .cer. By renaming.pem certificate files to .cer, it is possible to view their makeup under Windows.
The router maintains two lists of certificate files.
Digi TransPort® Routers User Guide
510
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
n The first is a list of "Certificate Authorities" or CAs. The router uses the files in this list to validate public certificates sent by remote users. Public certificates must be signed by one of the certificates in the CA list before the router can validate them. Certificates with the filename ca*.pem and ca*.der are loaded into this list at start-up time. In the absence of any CA certificates, a public certificate cannot be validated.
n The second list is a list of public certificates that the router can use to obtain public keys for decrypting signatures sent during IKE exchanges. Certificates with a filename cert*.pem and cert*.der are loaded into this list when the router is powered on or rebooted. The router uses certificates in this list when the remote router does not send a certificate during IKE exchanges. If the list does not contain a valid certificate communication with the remote unit cannot take place.
Both the host and remote units must have a copy of a file called casar.pem. This file is required to validate the certificates of the remote units. In addition, the host unit should have copies of the files cert02.pem (which allows it to send this certificate to remote units) and privrsa.pem. Note that before it can send this certificate, the Remote ID parameter in the Configuration > Network > Virtual Private Networking (VPN) > IPsec > IPsec Tunnels > IPsec n - n > IPsec n page must be set to host@Digi.co.uk. The remote unit must have copies of cert01.pem and privrsa.pem. For more information on X.509 certificates, see Manage X.509 certificates and host key pairs.
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > IPsec > IPsec Tunnels > IPsec n.
2. Configure any IPsec tunnels that will use X.509 certificates for authentication as follows:
Our ID Set to info@Digi.co.uk. This is the same as the subject Altname in certificate cert01.pem, which makes it possible for the router to locate the correct certificate to send to the host.
Authentication Method Should be set to RSA Signatures. This indicates to IKE to use RSA signatures (certificates) for authentication. When IKE receives a signature from a remote unit, it must be able to retrieve the correct public key so that it can decrypt the signature, and confirm that the signature is correct. The certificate must either be on the FLASH file system, or be provided by the remote unit as part of the IKE negotiation. The router uses the ID provided by the remote unit to find the correct certificate to use. If the correct certificate is found, the code then checks that it has been signed by one of the certificate authority certificates (ca*.pem) that exist on the unit. The code first checks the local certificates, and then the certificate provided by the remote (if any). IKE will send a certificate during negotiations if it is able to find one that has subject AltName that matches the ID in use. If it cannot locate the certificate, the remote router must have local access to the file to retrieve the public key. A typical setup may be that the host unit has a copy of all certificates. This means that the remote units only require the private key, and the certificate authority certificate. This eases administration as any changes to certificates need only be made on the host. Because they do not have a copy of their certificate, remote units rely on the host having a copy of the certificate. An alternative is that the remote units all have a copy of the certificate, as well as the private key and certificate authority certificate, and the host only has its own certificate.
Digi TransPort® Routers User Guide
511
Configuring Virtual Private Networking (VPN)
Configure Internet Protocol security (IPsec)
This scenario requires that the remote unit send its certificate during negotiations. It can validate the certificate because it has the certificate authority certificate. 3. Click Apply.
Command line
Command eroute eroute
Instance n n
Parameter authmeth ourid
Values rsa ID string
Equivalent web parameter Use the following security on this tunnel Our ID
Digi TransPort® Routers User Guide
512
Configuring Virtual Private Networking (VPN)
Configure Point-to-Point Tunneling Protocol (PPTP)
Configure Point-to-Point Tunneling Protocol (PPTP)
The Point-to-Point tunneling protocol (PPTP) is a common way of creating a VPN tunnel to a Microsoft WindowsTM server. PPTP works by ending a regular PPP session to the peer encapsulated by the Generic Routing Encapsulation (GRE) protocol. The router uses a second session on TCP port 1723 to initiate and manage the GRE session. PPTP connections are authenticated with Microsoft MSCHAP-v2 or EAP-TLS. VPN traffic is protected by MPPE encryption. PPTP does not work with GPRS/HSDPA mobile operators that assign a private IP address and then apply NAT to the traffic before it leaves their network. This because the server tries to build a tunnel back to the router on port 1723 but fails when the traffic is blocked by the mobile operator's firewall.
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > PPTP > PPTP n.
2. Configure PPTP parameters:
Description
An identifier for the router.
Remote Host a.b.c.d
The IP address of the remote host, such as the device that will terminate the PPTP connection.
Use Interface x,y
The interface name and instance to use for the PPTP tunnel. Specifying these parameters allow the router to raise the interface should it be disconnected. The interface options are:
n Auto n PPP n Ethernet
Digi TransPort® Routers User Guide
513
Configuring Virtual Private Networking (VPN)
Configure Point-to-Point Tunneling Protocol (PPTP)
Accept incoming PPTP connections
When enabled, the router acts as a PPTP server and accepts incoming VPN connections.
Enable Server mode
When enabled, the router sends call_out call requests to the remote device. In the default state which is unchecked, the router sends a call_in request to the remote device.
Enable Socket mode
When enabled, enables the use of a Digi proprietary mode whereby PPP packets are sent via the PPTP control socket rather than in GRE packets.
Encrypt control data using SSL version n
When enabled, the router encrypts the control data using SSL. This is a Digi proprietary function and is not part of standard PPTP. The drop-down list allows the SSL version to be selected. The available options are:
n Use default n TLSv1 only n SSLv2 only
Enable PPTP debug
Enables debug tracing. 3. Click Apply.
Command line
Command pptp pptp pptp
pptp pptp
pptp pptp pptp
pptp
Instance 0-9 0-9 0-9
0-9 0-9
0-9 0-9 0-9
0-9
Parameter name remhost ll_ent
ll_add listen
swap_io usesock sslver
debug
Values
Equivalent web parameter
Up to 30 characters
Description
Valid IP address a.b.c.d Remote Host a.b.c.d
Blank, PPP, ETH Blank means Auto
Use Interface x,y
0-4294967296
Use Interface x,y
off, on
Accept incoming PPTP connections
off, on
Enable Server mode
off, on
Enable Socket mode
Blank,SSL,TLS1,SSL2 Blank is disabled (default) SSL means use default.
Encrypt control data using SSL version n
off, on
Enable PPTP debug
Digi TransPort® Routers User Guide
514
Configuring Virtual Private Networking (VPN)
Configure OpenVPN
Configure OpenVPN
You can use OpenVPN to connect to the router for secure management and access services on the LAN side of the TransPort router, such as corporate messaging services, file servers and print servers for example. OpenVPN is a full-featured SSL VPN which implements OSI layer 2 or 3 secure network extension using the industry standard SSL/TLS protocol, supports flexible client authentication methods based on certificates, smart cards, and/or username/password credentials, and allows user or group-specific access control policies using firewall rules applied to the VPN virtual interface. OpenVPN is not a web application proxy and does not operate through a web browser.
You can configure a Digi TransPort as an OpenVPN server, shown above, or as an OpenVPN client, connecting to an OpenVPN server. On TransPort firmware, OpenVPN has been implemented as an interface. That means when an OpenVPN tunnel connects, an interface is added to the routing table. Static routes can be configured to point to an OpenVPN instance, and additionally, OpenVPN may learn routes from the tunnel peer and add these routes to the routing table for the duration of the OpenVPN tunnel. As each tunnel appears just like an interface, support for features like the firewall, NAT, IGMP, etc are the same as for other interfaces like PPP and ETH.
Additional information on OpenVPN configuration
See these application notes for further details and steps on setting up your router as an OpenVPN server:
n Application Note 46: Configuring a TransPort WR as an OpenVPN server for Windows OpenVPN clients
n Application Note 47: Configuring a Windows OpenVPN server and a TransPort WR as an OpenVPN client
n Application Note 76: How to configure an Ubuntu OpenVPN server and a Digi TransPort WR as an OpenVPN client
n Quick Note 64: How to Troubleshoot OpenVPN On TransPort WR Routers
Digi TransPort® Routers User Guide
515
Configuring Virtual Private Networking (VPN)
Configure OpenVPN
Web
1. Go to Configuration > Network > Virtual Private Networking (VPN) > OpenVPN > OpenVPN n.
2. Configure OpenVPN parameters:
Description
The text string is a friendly name to help identify this OpenVPN instance.
Use IP address a.b.c.d
This must be specified correctly. OpenVPN interfaces use a 30-bit mask. The first address is the network address, the second address is the server address, the third address is the client address, and the fourth address is the broadcast address. This address must be configured as
Digi TransPort® Routers User Guide
516
Configuring Virtual Private Networking (VPN)
Configure OpenVPN
the second IP address in the block of four. For example, the IP address 192.168.0.1, if configured as a server, or 192.168.0.2, if configured as a client.
Destination host a.b.c.d
Required only when the router is configured as an OpenVPN client. This is the IP address of the OpenVPN server.
Link socket interface x,y
If configured, OpenVPN sockets are only allowed to/from this interface and the routing table will be ignored. When set to Auto, the OpenVPN sockets use the routing table to identify the best interface to use.
Get link socket source address from this interface x,y
The values in these two text boxes define the interface (Auto, PPP, ETH) and the instance number of the interface to use as a source address for IP sockets when not using the interface that the socket was created on. Even when this parameter is not configured, the router uses the IP address from the interface on which the socket was created. It uses the source address specified in this parameter only if it will cause the traffic to match an Eroute and therefore be sent using IPsec or GRE.
MTU
Used to set the Maximum Transmit Unit for the OpenVPN instance, in bytes. The default setting is 1400.
Metric
The connected metric, changing this value will alter the metric of dynamic routes created automatically for this interface.
NAT mode
Selects whether to use IP Network Address Translation (NAT) or Network Address and Port Translation (NAPT) at the Ethernet interface. When the parameter is set to disabled, no NAT will occur.
IP analysis
When enabled, the un-encapsulated IP traffic will be captured into the analyser trace.
Firewall
Enables or disables Firewall script processing for this interface.
IGMP
Enables or disables the transmission and reception of IGMP packets on this interface. IGMP advertises members of multicast groups. If IGMP is enabled, and a member of a multicast group is discovered on this interface, multicast packets for this group received on other interfaces are sent out this interface.
Digi TransPort® Routers User Guide
517
Configuring Virtual Private Networking (VPN)
Configure OpenVPN
Include in RIP advertisements
When enabled, the router includes this static route in RIP advertisements.
Automatically connect interface
If enabled, this OpenVPN instance will be considered as an Always On interface.
Server mode (listener)
Configures the OpenVPN instance to listen for inbound OpenVPN sockets.
Link socket port
The default port for OpenVPN is 1194. If you use a different or non-standard port number, specify it here.
Link socket protocol
OpenVPN can use TCP or UDP as the transport protocol. Select the required protocol here.
TLS auth password / Confirm TLS auth password
Allows the OpenVPN instance to use an extra level of security by having a TLS password configured.
Push IP address #1/#2/#3
When configured as an OpenVPN server, use these parameters to push subnets to the client that need to be routed via the OpenVPN server. Used in conjunction with the Push Mask parameter below.
Push mask #1/#2/#3
Use with the Push IP address parameter above to define subnets that should be routed via the OpenVPN server.
Push DNS server address #1/#2
When configured as an OpenVPN server, use these parameters to push DNS server settings to the OpenVPN client.
Pull interface IP address
When configured as an OpenVPN client, this option must be enabled for the router to obtain and use the local IP address supplied from the OpenVPN server.
Pull routes
When configured as an OpenVPN client, this option must be enabled for the router to use routes sent from the OpenVPN server.
Pull DNS server addresses
When configured as an OpenVPN client, this option must be enabled for the router to use DNS servers sent from the OpenVPN server.
Digi TransPort® Routers User Guide
518
Configuring Virtual Private Networking (VPN)
Configure OpenVPN
Packet replay ID window
When set to a non-zero value, this enables sequence number replay detection. It indicates the number of packet IDs lower than the current highest ID to allow out of sequence.
Packet replay time window (seconds)
Set to a non-zero value to enable time tracking of incoming packets.
OpenVPN TX ping interval (seconds)
Interval between OpenVPN ping transmissions. These are required to detect the operational state of the VPN connection.
OpenVPN RX ping timeout (seconds)
The number of seconds, after which no OpenVPN ping has been received, the VPN will be marked as down.
Include IV
Enabling this option on includes an IV at the head of an encrypted packet. If one peer prepends this IV and the other isn't expecting it, packet decryption will fail.
Key negotiation timeout (seconds)
Maximum time, in seconds, to allow for a data channel key negotiation.
Key renegotiation interval (seconds)
Interval between key re-negotiations.
Key renegotiation bytes
If non-zero, a key renegotiation will take place after this many bytes have traveled through the data channel in either direction.
Key renegotiation packets
If non-zero, a key renegotiation will take place after this many packets have traveled through the data channel.
Inactivity timeout (seconds)
The tunnel is disconnected after the tunnel becomes inactive (that is, no IP traffic) for this many seconds. Note that the timer is only restarted with RX traffic, not TX traffic.
Data channel cipher
Sets the cipher for data channel encryption/decryption. Select from the dropdown list.
Data channel digest
Sets the digest algorithm for data channel authentication. Select from the dropdown list.
Digi TransPort® Routers User Guide
519
Configuring Virtual Private Networking (VPN)
Configure OpenVPN
Debug
Enables output of OVPN related debug. 3. (Optional) Click Advanced OpenVPN parameters and configure advanced settings as needed. 4. Click Apply.
Command line
Command Instance Parameter
ovpn
n
descr
ovpn
n
IPaddr
ovpn
n
dest
ovpn
n
ll_ent
ovpn
n
ll_add
ovpn
n
ip_ent
ovpn
n
ip_add
ovpn
n
ovpn
n
ovpn
n
mtu metric do_nat
ovpn
n
ovpn
n
ovpn
n
ovpn
n
ipanon firewall igmp inrip
Values
Equivalent web parameter
Up to 30 characters
Description
Valid IP address a.b.c.d
IP address a.b.c.d
Valid IP address a.b.c.d
Destination host a.b.c.d
<blank>, PPP, ETH Link socket interface x,y x= interface type
0-2147483647
Link socket interface x,y y= interface number
<blank>, PPP, ETH
Get link socket source address from this interface x,y x= interface type
0-2147483647
Get link socket source address from this interface x,y y= interface number
0-2147483647
MTU
0-2147483647
Metric
0, 1, 2 0=Off 1=Address only 2= Address and port
NAT mode
off, on
IP analysis
off, on
Firewall
off, on
IGMP
off, on
Include in RIP advertisements
Digi TransPort® Routers User Guide
520
Configuring Virtual Private Networking (VPN)
Command Instance Parameter
ovpn
n
autoup
ovpn
n
ovpn
n
ovpn
n
ovpn
n
server port proto tls_auth_key
ovpn
n
etls_auth_key
ovpn
n
ovpn
n
puship pushmask
ovpn
n
ovpn
n
puship2 pushmask2
ovpn
n
ovpn
n
puship3 pushmask3
ovpn
n
pushdns
ovpn
n
pushdns2
ovpn
n
ovpn
n
ovpn
n
ovpn
n
ovpn
n
pullip pullroute pulldns sreplay treplay
ovpn
n
pingint
ovpn
n
pingto
ovpn
n
inciv
Configure OpenVPN
Values
Equivalent web parameter
off, on
Automatically connect interface
off, on
Server mode (listener)
0-65535
Link socket port
TCP,UDP
Link socket protocol
Up to 30 characters
TLS auth password
Enciphered version TLS auth password
Valid subnet a.b.c.d Push IP address #1 a.b.c.d
Valid netmask a.b.c.d
Push mask #1 a.b.c.d
Valid subnet a.b.c.d Push IP address #2 a.b.c.d
Valid netmask a.b.c.d
Push mask #2 a.b.c.d
Valid subnet a.b.c.d Push IP address #3 a.b.c.d
Valid netmask a.b.c.d
Push mask #3 a.b.c.d
Valid IP address a.b.c.d
Push DNS server address #1 a.b.c.d
Valid IP address a.b.c.d
Push DNS server address #2 a.b.c.d
off, on
Pull interface IP address
off, on
Pull routes
off, on
Pull DNS server addresses
0-2147483647
Packet replay ID window
0-2147483647
Packet replay time window (seconds)
0-2147483647
OpenVPN TX ping interval (seconds)
0-2147483647
OpenVPN RX ping timeout (seconds)
off, on
Include IV
Digi TransPort® Routers User Guide
521
Configuring Virtual Private Networking (VPN)
Configure OpenVPN
Command Instance Parameter
ovpn
n
neg_timeout
ovpn
n
reneg_int
ovpn
n
ovpn
n
reneg_bytes reneg_packets
ovpn
n
inact_timeout
ovpn
n
cipher
ovpn
n
digest
ovpn
n
debug
Values 0-2147483647
0-2147483647
0-2147483647 0-2147483647
0-2147483647
See cipher values in the following table. See digest values in the following table. off, on
Equivalent web parameter Key negotiation timeout (seconds) Key renegotiation interval (seconds) Key renegotiation bytes Key renegotiation packets Inactivity timeout (seconds) Data channel cipher
Data channel digest
Debug
Supported Cipher and Digest values for OpenVPN
Cipher values DES-EDE-CBC AES128 DES DES-CBC AES-128-CBC AES192 AES-192-CBC DES-EDE3-CBC AES-256-CBC AES-256 DES3
Digest values md2WithRSAEncryption ssl2-md5 MD5 sha1WithRSAEncryption ssl3-sha1 ssl3-md5 SHA1 MD2 RSA-MD2 md5WithRSAEncryption RSA-SHA1 RSA-SHA1-2 RSA-MD5
Digi TransPort® Routers User Guide
522
Configuring Secure Sockets Layer (SSL)
About the Secure Sockets Layer (SSL)
524
Configure the SSL server
525
Configure SSL clients
527
Digi TransPort® Routers User Guide
523
Configuring Secure Sockets Layer (SSL)
About the Secure Sockets Layer (SSL)
About the Secure Sockets Layer (SSL)
The secure socket layer (SSL) provides a secure transport mechanism is supported by Digi's TransPort routers.
Some sites require client side authentication when connecting to them. The router's SSL client handles the authentication for SSL connections using certificates signed by a Certificate Authority (CA). For more information regarding certificates and certificate requests, see the web interface certificates page Administration > X.509 Certificate Management > Certificate Authorities (CAs) and Manage X.509 certificates and host key pairs.
Digi TransPort® Routers User Guide
524
Configuring Secure Sockets Layer (SSL)
Configure the SSL server
Configure the SSL server
Web
1. Go to Configuration > Network > SSL. The SSL Server section of the page describes the parameters needed to configure the SSL server.
2. Configure the SSL server parameters:
Server Certificate Filename
The file containing the server certificate is selected from this drop-down list.
Client Private Key Filename
The file containing the private key that matches the above certificate is selected from this drop-down list.
SSL Version
The version of the SSL protocol to use, is selected from this drop-down list. Selecting Any allows the use of any version. The available options are:
n Any n TLSv1 only n SSLv2 only
Allow Insecure Ciphers
Allows use of 'insecure' Cipher-Block Chaining (CBC)-based ciphers. The default value is On.
Cipher List
The list of ciphers is the same as described above for the client-side configuration table.
Verify Certificate
Sets whether and how the SSL server verifies peer certificates. n No: The SSL server does not verify peer certificates. n Yes: The SSL server should verify the peer certificate if one is supplied. n Also verify date: The SSL server checks certificate dates (not before, not after).
Certificate Required
When checked, sets that negotiation should fail if the peer does not supply a certificate.
Digi TransPort® Routers User Guide
525
Configuring Secure Sockets Layer (SSL)
Configure the SSL server
Reject Self-Signed Certificates
When checked, sets that the SSL server rejects zero-depth, self-signed certificates. 3. Click Apply.
Command line
Command Instance Parameter Values
sslsvr
0
certfile Up to 12 characters (DOS 8.3 format)
Equivalent web parameter
Server Certificate Filename
sslsvr
0
keyfile
Up to 12 characters (DOS 8.3 format)
Server Private Key Filename
sslsvr
0
ver
Blank, TLS1, SSL2
SSL Version
sslsvr
0
sslsvr
0
insecure verify
off, on
Allow Insecure Ciphers
integer This value sets several bits in the definition for the SSL server. Bit 0 (value 1) indicates that the server should verify the peer certificate if one is supplied. Bit 1 (value 2) indicates that the certificate dates (not before, not after) are also checked. Bit 2 (value 4) indicates that the negotiation should fail if the peer doesn't supply a certificate. Bit 3 (value 8) indicates that zero-depth, self-signed certificates should be rejected. Default is 0.
Verify Certificate, Certificate Required, and Reject Self-Signed Certificates
sslsvr
0
cipherlist Colon-separated list
Cipher List
sslsvr
0
debug
off, on
n/a
Digi TransPort® Routers User Guide
526
Configuring Secure Sockets Layer (SSL)
Configure SSL clients
Configure SSL clients
Web
1. Go to Configuration > Network > SSL. The SSL Clients section of the page has a table with columns and parameters as follows:
2. Configure the SSL client parameters:
SSL Client
A list of the SSL client numbers supported by the router.
Client Certificate Filename
The name of the required certificate file is selected from those available on the router's filing system from this drop-down list.
Allow Insecure Ciphers
Allows use of 'insecure' Cipher-Block Chaining (CBC)-based ciphers. The default value is On.
Client Private Key Filename
The name of the file that contains the private key that matches the public key stored in the above parameter, is selected from this drop-down list.
Cipher List
The cipher list in this text box is a list of one or more cipher strings separated by colons. Commas or spaces are also accepted as separators but colons are normally specified. The actual cipher string can take several different forms. It can consist of a single cipher suite such as RC4-SHA. It can represent a list of cipher suites containing a certain algorithm or cipher suites of a certain type. For example, SHA1 represents all cipher suites using the SHA1 digest algorithm. Lists of cipher suites can be combined in a single cipher string using the + character. This forms the logical AND operation. For example, SHA1+DES represents all cipher suites containing SHA1 and DES algorithms. If left empty, router does not use the cipher list. For more information see https://www.openssl.org /docs/man1.0.2/apps/ciphers.html.
Digi TransPort® Routers User Guide
527
Configuring Secure Sockets Layer (SSL)
Configure SSL clients
Apply to Destination IP Address
Allows the configuration of multiple SSL destinations, each having a different certificate/key pair. When set, this parameter will lock the SSL client settings to a specific IP address. If this parameter is left blank, the router uses the configured SSL client settings for any connection that requires SSL. As is usual with the tables on the configuration web pages, the relevant and appropriate parameters are selected and the Add button on the right-hand side is clicked to add the entry into the table. Once an entry has been added, it can be removed by clicking the Delete button in the right-hand column.
Reject Self-Signed Certificates
If enabled, a self-signed certificate delivered from the remote peer will be rejected unless a copy of the certificate exists on the router's local flash memory. The file must be named as per usual CA certificate convention for Digi TransPort routers, which is to prefix the name with ca, and use the extension .pem or .der. If disabled, the router accepts self-signed certificates whether or not a local copy of it exists.
3. Click Apply.
Command line
Command sslcli
sslcli
sslcli
sslcli sslcli
Instance 0-4
0-4
0-4
0-4 0-4
Parameter certfile
keyfile
cipherlist
insecure IPaddr
Values
Up to 12 characters (DOS 8.3 format)
Up to 12 characters (DOS 8.3 format)
Colon-separated list of ciphers
on, off Valid IP address
Equivalent web parameter Client Certificate Filename
Client Private Key Filename
Cipher List
Allow Insecure Ciphers Apply to Destination IP Address
Digi TransPort® Routers User Guide
528
Configuring Secure Shell (SSH) server and client
About the Secure Shell (SSH) server
530
Configure SSH servers
531
Configure the SSH client
536
Generate SSH private keys
541
Perform SSH authentication with a public/private key pair
543
Digi TransPort® Routers User Guide
529
Configuring Secure Shell (SSH) server and client
About the Secure Shell (SSH) server
About the Secure Shell (SSH) server
The Secure Shell (SSH) server allows remote peers to access the router over a secure TCP connection using a suitable SSH client. The SSH server provides a Telnet-like interface and secure file transfer capability.
SSH uses a number of keys during a session. The router uses the host keys for authentication purposes. Keys unique to each SSH session are also generated and the router uses these keys for encryption/authentication purposes.
The router supports SSH v1.5 and SSH v2. The host key file format differs for each version but there would normally only be one host key for each version. For this reason the router allows the user to configure two host key files. These keys may be changed from time to time, specifically if it suspected that the key has become compromised. Because the host keys need to be secure, it is highly recommended to store the files on the router's FLASH filing system using filenames prefixed with priv which makes it impossible to read the files using any of the normal methods (such as FTP). It is possible (using the genkey command) to create host keys in either format for use with SSH. Using this utility it is not necessary to have the host key files present on any other storage device (thus providing an additional level of security). For details on generating a private key file, see Generate SSH private keys.
Unlike the Telnet server, you can configure the number of SSH server sockets that listen for new SSH connections.
Multiple SSH server instances can be configured, each instance can be configured to listen on a separate port number and can use different keys and encryption methods.
You can configure which authentication methods the router uses in an SSH session and the preferred selection order. The router currently supports MD5, SHA1, MD5-96 and SHA1-96. If required, you can specify a public/private key pair for authentication.
The router currently supports 3DES, 3DES-CBC, and AES cipher methods.
DEFLATE compression is also supported. If DEFLATE compression is enabled and negotiated, SSH packets are first compressed before being encrypted, and delivered to the remote unit via the TCP socket.
Note The SSH server supports the SCP file copy protocol but does not support filename wildcards.
Digi TransPort® Routers User Guide
530
Configuring Secure Shell (SSH) server and client
Configure SSH servers
Configure SSH servers
TransPort routers support eight SSH servers, configured independently.
Web
1. Go to Configuration > Network > SSH Servers. 2. Click Enable SSH Servers to enable use of SSH for the router. The SSH server parameters
display:
3. Configure the SSH Server n parameters
Enable SSH Server
Enables the SSH server.
Digi TransPort® Routers User Guide
531
Configuring Secure Shell (SSH) server and client
Configure SSH servers
Use TCP port p
The TCP port number (default 22) that the SSH server will use to listen for incoming connections. (Port 22 is the standard SSH port).
Allow up to n connections
The number of sockets listening for new SSH connections (default 1).
Host Key 1 Filename
The filename of either an SSH V1 or V2 host key. It is highly recommended that the filename be prefixed with priv to ensure that the key cannot be easily accessed and compromised. This key may be generated using the facilities described in the Certificates section of this manual.
Host Key 2 Filename
The filename of either an SSH V1 or V2 key as above.
Note The maximum length for these filenames is 12characters and they must use the DOS 8.3 file naming convention.
Maximum login time s seconds
The maximum length of time, in seconds, a user can successfully complete the login procedure once the SSH socket has been opened. The socket is closed if the user has not completed a successful login within this period.
Maximum login attempts n
The maximum number of login attempts allowed in any one session before the SSH socket will be closed.
Use Deflate compression No/Yes, level n
Sets use of DEFLATE compression. If compression is selected, the compression level is chosen from the drop-down list.
Enable Port Forwarding
When enabled, the router accepts traffic on ports other than 23. This functionality is for use with SSH client applications, such as PuTTY, that have port forwarding capability. For example, one the SSH connection is active, traffic for the HTTP port 80 can be sent to the router securely.
Command Session IP Address a.b.c.d Port p
The values in these two text boxes specify the host IP address and port number that the router uses to handle incoming requests for a command session from SSH clients. This is instead of the router's normal command interpreter. For example, if the values are IP address 127.0.0.1, port 4000, the SSH client will make a direct connection to ASY 0 and the device attached to ASY 0 will receive and process the commands from the SSH client.
Digi TransPort® Routers User Guide
532
Configuring Secure Shell (SSH) server and client
Configure SSH servers
Enable support for SSH v1.5
When enabled, the server negotiates SSH V1.5. The router must also have a SSH V1 key present and the filename entered into the SSG configuration.
Server key size
This option applies to V1 SSH. During initialization of an SSH session, the server sends its host key and a server key (which should be of a different size to the host key). The router generates this key automatically but the length of the server key is determined by this parameter. If when this value is set it is too similar to the length of the host key, the router will automatically adjust the selected value so that the key sizes are significantly different.
Enable support for SSH v2.0
When enabled, the server negotiates SSH V2. The router must also have a SSH V2 key present and the filename entered into the SSG configuration.
Actively start key exchange
This option applies to V2 SSH. Some SSH clients wait for the server to initiate the key exchange process when a new SSH session is started unless they have data to send to the server, in which case they will initiate the key exchange themselves. When enabled, this setting causes the router to automatically initiate a key exchange without waiting for the client.
Rekey Never/After n units of data have been transferred
With SSH V2, it is possible to negotiate new encryption keys after using the current ones to encrypt a specified amount of data. The radio buttons enable or disable this feature. If enabled, enter the amount of data into the text box and select the applicable units (Kbytes, Mbytes, Gbytes) from the drop-down list.
Encryption Preferences
The following configuration options allocate preferences to the encryption method to encrypt data on the link. A lower value indicates greater preference. A value of 0 disables the option.
3DES
The preference level for the Triple-DES algorithm.
AES (128 bits)
The preference level for the 128-bit AES algorithm.
AES (192 bits)
The preference level for the AES algorithm using 192 bits.
AES (256 bits)
The preference level for the AES algorithm using 256 bits.
Digi TransPort® Routers User Guide
533
Configuring Secure Shell (SSH) server and client
Configure SSH servers
Authentication Preferences
The following configuration options allocate preferences for the authentication methods. As above, a value of 0 disables the particular authentication method, and lower values indicated greater preference than higher values. For example, if MAC SHA1-96 was the preferred method for authentication, this option would be given the value 1 and the other options given a value of 2 or greater. If all these parameters are set to the same value, the router automatically uses them in the following order:
n SHA1, n SHA1-96 n MD5 n MD5-96
MAC MD5
The preference level for MAC MD5.
MAC MD5-96
The preference level for MAC MD5-96.
MAC SHA1
The preference level for MAC SHA1.
MAC SHA1-96
The preference level for MAC SHA1-96.
Enable Debug
The router supports logging and output of debugging information for situations where there are problems establishing a SSH connection. When enabled, this setting causes the router to trace and output information that should be helpful in diagnosing and resolving the problem. 4. Click Apply.
Command line
Command Instance Parameter
ssh
0-7
port
ssh
0-7
nb_listen
ssh
0-7
hostkey1
ssh
0-7
hostkey2
ssh
0-7
loginsecs
Values 0-65535
0-2147483647
Up to 12 characters (8.3 format)
Up to 12 characters (8.3 format)
0-2147483647
Equivalent web parameter Use TCP port p Allow up to n connections Host Key 1 Filename
Host Key 2 Filename
Maximum login time s seconds
Digi TransPort® Routers User Guide
534
Configuring Secure Shell (SSH) server and client
Configure SSH servers
Command Instance Parameter Values
Equivalent web parameter
ssh
0-7
logintries
0-2147483647
Maximum login attempts n
ssh
0-7
comp
0=disabled
Use Deflate compression, level
ssh
0-7
fwd
0-2147483647
Enable port forwarding
ssh
0-7
cmdhost
Valid IP address a.b.c.d Command session IP address
a.b.c.d
ssh
0-7
cmdport
0-2147483647
Command session port p
ssh
0-7
svrkeybits 0-2147483647
Server key size
ssh
0-7
initkex
off, on
Actively start key exchange
ssh
0-7
rekeybytes 0-2147483647
Rekey After n units of data have
0=Do not rekey
been transferred
ssh
0-7
enc3descbc 0-2147483647
0=Disabled
3DES
ssh
0-7
encaes128cbc 0-2147483647
AES (128 bits)
ssh
0-7
encaes192cbc 0-2147483647
AES (192 bits)
ssh
0-7
encaes256cbc 0-2147483647
AES (256 bits)
ssh
0-7
macmd5
0-2147483647
MAC MD5
ssh
0-7
macmd596 0-2147483647
MAC MD5-96
ssh
0-7
macsha1
0-2147483647
MAC SHA1
ssh
0-7
macsha196 0-2147483647
MAC SHA1-96
ssh
0-7
debug
0, 1 0=Off 1=On
Enable Debug
Digi TransPort® Routers User Guide
535
Configuring Secure Shell (SSH) server and client
Configure the SSH client Web
1. Go to Configuration > Network > SSH Client.
Configure the SSH client
2. Configure the SSH client parameters:
Maximum handshake time
The time, in seconds, to wait for the server to begin the banner exchange part of the protocol after the socket connects.
`known_hosts' Filename
The name of file to use the regular SSH client.
Digi TransPort® Routers User Guide
536
Configuring Secure Shell (SSH) server and client
Configure the SSH client
`identity' Filename
The name of file to use as the regular SSH client.
`id_rsa' Filename
The name of an SSH V1 or V2 host key. There are two id_rsa files to allow the user to configure a SSHv1 private key into one field, and a SSHv2 private key into the other.
`_id rsa' Filename #2
The name of an SSH V1 or V2 host key.
Use Deflate compression No/Yes, level n
The radio buttons select whether or not to use DEFLATE compression. If enabled, select the compression level from the drop-down list.
Enable Public Key Authentication
When enabled, enables SSH public-key authentication to connect to OpenSSH.
Enable Password Authentication
When enabled, enables SSH password authentication to connect to OpenSSH.
Note No other authentication methods are supported.
Encryption preferences
The following configuration options allocate preferences to the encryption method for encrypting data on the link. A lower value indicates greater preference. A value of 0 disables the option.
3DES
The preference level for the Triple-DES algorithm.
AES (128 bits)
The preference level for the 128-bit AES algorithm.
AES (192 bits)
The preference level for the AES algorithm using 192 bits.
AES (256 bits)
The preference level for the AES algorithm using 256 bits.
Authentication Preferences
The following configuration options allocate preferences to the selected authentication methods. As above, a value of 0 disables the particular authentication method and lower values indicated greater preference than higher values. So, for example if MAC SHA1-96 is the preferred method for authentication, this option is given the value 1 and the other options
Digi TransPort® Routers User Guide
537
Configuring Secure Shell (SSH) server and client
Configure the SSH client
given a value of 2 or greater. If all these parameters are set to the same value, the router automatically uses them in the following order: SHA1, SHA1-96, MD5, MD5-96.
MAC MD5
The preference level for MAC MD5.
MAC MD5-96
The preference level for MAC MD5-96.
MAC SHA1
The preference level for MAC SHA1.
MAC SHA1-96
The preference level for MAC SHA1-96.
Enable Server Keepalives
When enabled, enables server keepalives to use the same tcp connection for HTTP conversation instead of opening new one with each new request.
Enable Debug
The router supports logging and output of debugging information for situations where there are problems establishing a SSH connection. When enabled, this setting causes the router to trace and output information that should be helpful in diagnosing and resolving the problem. 3. Click Apply.
Command line
Command Instance Parameter
sshcli
0-7
conn_to
sshcli
0-7
hostsfile
Values 0-10 seconds
Up to 12 characters (8.3 format)
Equivalent web parameter
Time in seconds to wait for the server to begin the banner exchange part of the protocol after the socket connects.
Key file to use as the regular SSH client.
Digi TransPort® Routers User Guide
538
Configuring Secure Shell (SSH) server and client
Command Instance Parameter
sshcli
0-7
idfile
sshcli
0-7
idrsafile
sshcli
0-7
idrsafile1
sshcli
0-7
comp
sshcli
0-7
pubkeyauth
sshcli
0-7
pwdauth
sshcli
0-7
sshcli
0-7
sshcli
0-7
sshcli
0-7
sshcli
0-7
sshcli
0-7
sshcli
0-7
sshcli
0-7
enc3descbc
encaes128cbc encaes192cbc encaes256cbc macmd5 macmd596 macsha1 macsha196
Configure the SSH client
Values Up to 12 characters (8.3 format) Up to 12 characters (8.3 format)
Up to 12 characters (8.3 format)
0=disabled
0=disabled
0=disabled
0-2147483647 0=Disabled 0-2147483647 0-2147483647 0-2147483647 0-2147483647 0-2147483647 0-2147483647 0-2147483647
Equivalent web parameter
Key file to use as the regular SSH client.
Name of either an SSH V1 or SSH V2 host key.
Name of either an SSH V1 or SSH V2 host key.
Use Deflate compression, level.
Enables SSH public-key authentication to connect to OpenSSH.
Enables SSH password authentication to connect to OpenSSH.
3DES.
AES (128 bits).
AES (192 bits).
AES (256 bits).
MAC MD5.
MAC MD5-96.
MAC SHA1.
MAC SHA1-96.
Digi TransPort® Routers User Guide
539
Configuring Secure Shell (SSH) server and client
Command Instance Parameter
sshcli
0-7
svrlaliveint
sshcli
0-7
svralivemax
sshcli
0-7
debug
Values 0-2147483647
number
0, 1 0=Off 1=On
Configure the SSH client
Equivalent web parameter
Interval in seconds to send the server a keepalive packet.
Maximum number of keepalives to send without response before the connection is killed
Enable Debug
Digi TransPort® Routers User Guide
540
Configuring Secure Shell (SSH) server and client
Generate SSH private keys
Generate SSH private keys
To fully configure SSH, you must generate a version1 SSH key and a version 2 SSH key and configure the router to use them, described in the following topics.
Note SSH version 2 is more secure than version 1 and so is the recommended version to use. However, some SSH clients may only support version 1 keys and so the router supports both version 1 and version 2 SSH.
Web
1. Go to Administration > X.509 Certificate Management > Key Generation. 2. Select the size of the key file from the drop-down list. The larger the key file, the more secure it
will be. 3. In the Key filename setting, enter the name for the key file, or select one of any existing key
files. The filename should have a prefix of priv and a file extension of .pem, such as privssh1.pem. The 8.3 file name convention applies to key files. 4. Check the checkbox marked Save in SSHv1 format to generate a version 1 SSH key. Click the Generate Key button to generate the private key file. The key file is then stored in the router's FLASH filing system. 5. To generate the second key, repeat steps 1 through 3. This time, make sure that the Save in SSHv1 format checkbox is unchecked. Give this key file a different name than the version 1 file previously generated. 6. On the Configuration > Network > SSH Server > SSH Server n page, enter the filename generated in step 3 into the Host Key 1 Filename text box and the filename generated in step 4 into the Host Key 2 Filename text box. 7. Click the Apply button at the bottom of the page to apply changes. When the Configuration successfully applied message is displayed, click on the highlighted link to save the configuration.
Command line
1. Generate the SSH V1 private key using the genkey command as follows:
genkey <keybits> <filename> -ssh1
where:
<keybits>
Is one of the following values; 384, 512, 768, 1024, 1536 or 2048.
<filename>
Is the name for the file, such as privssh1.pem, as described for the web version of this procedure.
Digi TransPort® Routers User Guide
541
Configuring Secure Shell (SSH) server and client
Generate SSH private keys
2. Generate the SSH V2 private key using the genkey command as in step 1, but this time, omit the ssh1 switch. For example: genkey 1024 privssh2.pem.
3. Set the first private key as the SSH Host key 1 using the following command: ssh 0 hostkey1 privssh1.pem
4. Set the second private key as SSH Host Key 2 using the following command: ssh 0 hostkey2 privssh2.pem
5. Save the configuration: config 0 save
Digi TransPort® Routers User Guide
542
Configuring Secure Shell (SSH) server and client
Perform SSH authentication with a public/private key pair
Perform SSH authentication with a public/private key pair
Once SSH access has been configured and confirmed to be working, you can add RSA key pair authentication and use it to replace password authentication.
This process involves using PuTTYgen to create public and private keys. For full details on how to perform this operation, see Quick Note 10 SSH Access using RSA Key Authentication.
Digi TransPort® Routers User Guide
543
Configuring FTP Relay
Configure FTP Relay
545
Digi TransPort® Routers User Guide
544
Configuring FTP Relay
Configure FTP Relay
Configure FTP Relay
FTP Relay agents allow any files to be transferred onto the router by a specified user, using the File Transfer Protocol (FTP). The files are temporarily stored in memory and then relayed to a specific FTP host. This is useful when using the router to collect data files from a locally attached device such as a webcam, which must then be to a host system over a slower data connection such as W-WAN. In effect, the routers acts as a temporary data buffer for the files. You can configure the FTP relay agent to email as an attachment any file it could not transfer to the FTP server.
Configure FTP Relay agents
Web
1. Go to Configuration > Network > FTP Relay. There are two FTP Relay Agents available, with a separate web page for each.
2. Configure the FTP relay parameters:
Digi TransPort® Routers User Guide
545
Configuring FTP Relay
Configure FTP Relay
Relay files for user locuser to FTP Server ftphost
The value in the left-hand text box is the name of the local user and should be one of the usernames assigned in the Configuration > Security > Users web page. This name then serves as the FTP login username when the local device needs to relay a file. The value in the right-hand text box is the name of the FTP host to which the files from the locally attached device are relayed.
Server Username
The username required to log in to the specified FTP host.
Server Password
The password to use to log in to the host.
Confirm Server Password
The password should be retyped into this text box in order to confirm that it has been entered correctly, given that it is not echoed in clear text.
Remote directory
The full name of the directory on the FTP host to which the file is to be saved.
Rename file
When enabled, the router stores the uploaded files internally with a filename in the form relnnnn, where nnnn is a number that is incremented for each new file received. When the file is relayed to the FTP host, the router uses the original filename. When unchecked, the file is stored internally using its original filename. This parameter should be set if it a file having a filename longer than 12 characters is to be uploaded. This is because the internal file system uses the 8.3 filename format, such as autoexec.bat.
Transfer Mode ASCII / Binary
These two radio buttons select between the two possible file transfer modes, binary data or ASCII data.
Transfer Command STORE / APPEND
These two radio buttons select between the two possible storage methods, either append to or replace existing file.
Attempt to connect to the FTP Server n times
The number of connection attempts that the router should make if the first attempt is not successful.
Wait s seconds between attempts
The interval, in seconds, the router should wait in between successive connections attempts.
Digi TransPort® Routers User Guide
546
Configuring FTP Relay
Configure FTP Relay
Remain connected for s seconds after a file has been transferred
How long, in seconds, the router maintains the connection to the FTP host after transferring a file.
If unable to relay file Delete File / Retain file
These two radio buttons select the behavior with respect to storing the file if the router fails to connect to the FTP host (after retrying for the specified number of attempts). Select Delete File if the file should not be stored permanently. If the file is retained, manual intervention is required to recover it at a later stage.
Note If the file is not retained, it will be lost if the power is removed from the router.
Email the file before storing or deleting it
The configuration options following setting are normally disabled (they should appear disabled in the browser). When this setting is enabled, the parameters are enabled and you can enter data in the text boxes.
Use Email Template File
The name of the template file that forms the basis of any email messages generated by the FTP Relay Agent. This would normally be the standard EVENT.EML template provided with the router but alternative templates may be created if necessary (see Configure sending email alert messages when events occur).
To
The email address of the recipient of email messages generated by the FTP Relay Agent.
From
The email address of the router. In order for this to work, an email account must be in place with the Internet Service Provider.
Subject
A brief description of the content of the email. 3. Click Apply.
Command line
There are two FTP Relay Agents available. On frelay commands, the instance number can be 0 or 1.
Command Instance Parameter Values
frelay
n
locuser
Up to 15 characters
frelay
n
ftphost
Up to 64 characters
Equivalent web parameter Relay files for user locuser
to FTP Server ftphost
Digi TransPort® Routers User Guide
547
Configuring FTP Relay
Configure FTP Relay
Command Instance Parameter Values
frelay
n
ftpuser
Up to 20 characters
frelay
n
ftppwd
Up to 20 characters
frelay
n
ftpdir
Up to 40 characters
frelay
n
norename off, on
frelay
n
ascii
off, on
frelay
n
appe
off, on
frelay
n
retries
0-2147483647
frelay
n
frelay
n
frelay
n
frelay
n
frelay
n
frelay
n
frelay
n
retryint
0-2147483647
timeout
0-2147483647
savemode off, on
smtp_temp Up to 40 characters
smtp_to
Up to 100 characters
smtp_from Up to 40 characters
smtp_ subject
Up to 40 characters
Equivalent web parameter Server Username
Server Password
Remote directory
Rename file Transfer Mode Transfer Command Attempt to connect to the FTP Server n times Wait s seconds between attempts Remain connected Delete/Retain file Use Email Template File
To
From
Subject
Configure Advanced FTP Relay parameters
Web
Go to Configuration > Network > FTP Relay > Advanced.
Tx Buffer Size n bytes
The value in this text box specifies the size of the Tx socket buffer.
Command line
Command ftpcli
Instance n
Parameter txbuf
Values 0-2147483647
Equivalent web parameter Tx Buffer Size
Digi TransPort® Routers User Guide
548
Configuring FTP Relay
Configure FTP Relay
Configure an SMTP client, as needed
If you choose to have FTP relay agent to email as an attachment any file it could not transfer to the FTP server, configure the FTP Relay settings Email Template, To, From, and Subject. Then, configure a Simple Mail Transfer Protocol (SMTP) client. Go to Configuration > Alarms > SMTP Accountor use the smtp command. See Configure an SMTP email account to send alarms for configuration instructions.
Digi TransPort® Routers User Guide
549
Configuring IP passthrough
Configure IP passthrough
551
Digi TransPort® Routers User Guide
550
Configuring IP passthrough
Configure IP passthrough
Configure IP passthrough
IP passthrough is a useful feature if a host computer or server on the local area network needs to have access to it from the Internet with a public IP address. With IP passthrough configured, all IP traffic, not just TCP/UDP is forwarded back to the host computer. This feature can be useful for applications that do not function reliably through network address translation. In this configuration, the local PC shares the public IP addressing information with the WAN side of the router.
Web
1. Go to Configuration - Network > IP Passthrough.
2. Configure IP passthrough parameters:
Enable IP Pass-through
Enables IP passthrough mode.
Local interface
The local interface to which the local PC is connected, either an Ethernet or PPP connection.
WAN PPP interface
The PPP interface that will share its WAN address with the local PC.
Ethernet DHCP Mode
Selects the mode of operation for the passthrough functionality. The available options are Normal/24 bit mask and Fixed IP Address/32 bit mask. The default is Normal/24 bit mask.
Digi TransPort® Routers User Guide
551
Configuring IP passthrough
Configure IP passthrough
When Fixed IP/32 bit mask mode of operation is selected, the DHCP server provides a 32-bit subnet mask to the client and sets the address/subnet mask for the Ethernet interface to 192.168.1.1/32.
DHCP Lease Time
The length, in minutes, of the leases issued by this DHCP server.
Pinhole Configuration
These parameters exclude specific protocols from the IP passthrough feature. An excluded protocol terminates at the router instead of being forwarded to the local PC.
HTTP
Excludes HTTP from passthrough.
HTTPS
Excludes HTTPS from passthrough.
Telnet
Excludes Telnet from passthrough.
Telnet over SSL
Excludes SSL from passthrough.
SSH/SFTP
Excludes SSH/SFTP from passthrough.
SNMP
Excludes SNMP from passthrough.
GRE
Excludes GRE from passthrough.
Ping
Excludes the ICMP echo request from passthrough.
Other Ports
The list of TCP and UDP port numbers in this text box are added to the list of port numbers that are not forwarded to the local PC. Separate port numbers by commas.
Other Protocols
The list of protocol numbers in this text box are added to the list of port numbers that are not forwarded on to the local PC. Separate port numbers by commas. 3. Click Apply.
Digi TransPort® Routers User Guide
552
Configuring IP passthrough
Configure IP passthrough
Command line
Command Instance Parameter Values
passthru 0
enabled off, on
passthru 0
ethadd 0-2147483647
passthru 0
pppadd 0-2147483647
passthru 0
mode
0, 1 0=Normal 1=32-bit mask
passthru 0
http
off, on
passthru 0
https
off, on
passthru 0
telnet
off, on
passthru 0
telnets off, on
passthru 0
ssh
off, on
passthru 0
snmp
off, on
passthru 0
gre
off, on
passthru 0
ping
off, on
passthru 0
ports
Comma-separated list of ports
passthru 0
protos
Comma-separated list of protocols
Equivalent web parameter Enable IP Pass-through Ethernet interface PPP interface Mode
HTTP HTTPS Telnet Telnet over SSL SSH/SFTP SNMP GRE Ping Other Ports Other Protocols
Digi TransPort® Routers User Guide
553
Configuring UDP echo
Configure a UDP echo client
555
Digi TransPort® Routers User Guide
554
Configuring UDP echo
Configure a UDP echo client
Configure a UDP echo client
When enabled, the UDP echo client generates UDP packets that contain the router's serial number and ID and transmits them to the IP address specified by the configuration. When the remote router receives a UDP packet on a local port and UDP echo server is configured, it will echo the packet back to the sender. There may be more than one UDP echo instance available on the router. When specifying the local port to listen on, the router uses Instance 0.
Web
1. Go to Configuration > Network > UDP Echo. Depending on your router model, there may be instances of the UDP echo task supported by the router. Each has its own configuration web page, described below. For the command line configuration, valid instance numbers start at 0.
2. Configure the UDP echo parameters:
Enable UDP Echo
This setting is disabled by default. When enabled, the configuration parameters associated with send UDP echo packets are displayed.
Send a UDP packet to IP address a.b.c.d port n every s seconds
The values in these three text boxes define the destination IP address for the UDP packets, the port number to which they should be sent and the sending interval. If the destination IP address is left blank, the router will not attempt to send any packets.
Use local port n
The local port the router should listen on for UDP packets. If any UDP packets are sent to this port, the router will send a copy back to the IP address and port they were sent from.
Route via Routing table / Interface x,y
These two radio buttons select whether the router should use its routing table to determine how to send the UDP packets or whether it should use the specified interface. If the specific interface is selected, the interface is selected from the drop-down list. The options available are PPP and Ethernet. The interface instance is specified in the adjacent text box.
Digi TransPort® Routers User Guide
555
Configuring UDP echo
Configure a UDP echo client
Only send packet when the interface is "In Service"
When checked, and the router is using the specified interface, this setting prevents the router from sending UDP packets if the interface is out of service.
Do not send any data with the UDP packet
When checked, causes the router to send only a single null data byte. This is useful to minimize packet size when the interface has high data charges, such as W-WAN. When unchecked, the router sends packets containing the router's serial number and ID as text. 3. Click Apply.
Command line
Depending on your router model, there may be instances of the UDP echo task supported by the router. Valid instance numbers begin at 0.
Entity Instance udpecho n udpecho n udpecho n udpecho n udpecho n udpecho n udpecho n
udpecho n udpecho n
Parameter Values
dstip
Valid hostname
dstport
0-65535
interval
0-2147483647
locport userouting ifent ifadd
onlyis
0-65535
off, on
PPP,ETH
Valid interface instance 0-4294967296
off, on
nodata
off, on
Equivalent web parameter Send a UDP packet to IP address a.b.c.d port n every s seconds Send a UDP packet to IP address a.b.c.d port n every s seconds Send a UDP packet to IP address a.b.c.d port n every s seconds Use local port n Route via Routing table Interface x,y Interface x,y
Only send packet when the interface is In Service Do not send any data with the UDP packet
Digi TransPort® Routers User Guide
556
Configuring Quality of Service (QoS)
Configure Quality of Service (QoS)
558
Digi TransPort® Routers User Guide
557
Configuring Quality of Service (QoS)
Configure Quality of Service (QoS)
Configure Quality of Service (QoS)
The Quality of Service (QoS) functionality allows prioritizing different types of IP traffic. Generally, networking devices use QoS to ensure that low priority applications do not use most of the available bandwidth to the detriment of those having a higher priority. For example, this might mean that EPOS transactions carried out over XOT are prioritized over HTTP-type traffic for internet access. Without some form of QoS, all IP packets are treated as equal, such as there is no discrimination between applications.
The IP packet Type of Service (TOS) field indicates how to prioritize a packet. Using the top 6 bits of the TOS field, a router that supports QoS will assign a Differentiated Services Code Point (DSCP) code to the packet. This may take place within the router when it receives the packet or another router closer to the packet source may have already assigned it. Based on the DSCP code, the router will assign the packet to a priority queue. There are currently four such queues for each PPP instance within the router. Each queue can be configured to behave a particular way so that packets in that queue are prioritized for routing according to predefined rules.
There are two ways to implement priority:
n Configure a priority queue to allow packets to be routed at a specific data rate (providing that queues of a higher priority are not already using the available bandwidth).
n Have the router use Weighted Random Early Dropping (WRED) of packets as queues become busy, to get the TCP socket generating the packets to back off its transmit timers. This prevents the queue overflow, which results in dropping all subsequent packets.
QoS is a complex subject and can have a significant impact on the performance of the router. For detailed background information on QoS, see the IETF document RFC 2474: Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers.
In Digi TransPort routers, the classification of incoming IP packets for the purposes of QoS takes place within the firewall. The firewall allows the system administrator to assign a DSCP code to a packet with any combination of source/destination IP address/port and protocol. Details of how this is done are given in the section on firewall scripts.
When the routing code within the router receives an incoming packet, it directs it to the interface applicable to that packet at that time (this is the case whether or not QoS is being applied). Just before the packet is sent to the interface, the QoS code intercepts the packet and assigns it to one of the available priority queues (currently 10 per PPP instance) based on its DSCP value.
Each priority queue has a profile assigned to it. This profile specifies parameters such as the minimum transmit rate to attempt, maximum queue length, and WRED parameters.
The packet is then processed by the queue management code, and either dropped or placed in the queue for later transmission.
Web
1. Go to Configuration - Network > QoS page. There are several groups of settings:
n The Configuration > Network > QoS > DSCP Mappings page contains parameters to configure DSCP operation.
n The Configuration > Network > Queue Profiles page contains parameters to manage the queue "profiles."
n In addition, each Configuration > Interfaces > Ethernet and Configuration > Interfaces > PPP instance page contains a QoS page that controls how QoS behaves on that particular interface.
Digi TransPort® Routers User Guide
558
Configuring Quality of Service (QoS)
Configure Quality of Service (QoS)
When configuring QoS, note that the router supports ten queues, numbered from 0 to 9, and that DSCP codes range from 0 to 64.
2. Click DSCP Mappings. This page contains parameters to configure DSCP operation. Each DSCP value must be mapped to a queue.
Default
Selects the default queue. When this is changed, any DSCP codes that are set to use the default will have their queue number changed.
DSCP
A list of valid DSCP codes with an associated drop-down list box to the right.
Queue
Each of the DSCP codes in the left-hand column has a queue associated with it. To change the value from what is shown, select the desired value from the drop-down list.
Digi TransPort® Routers User Guide
559
Configuring Quality of Service (QoS)
Configure Quality of Service (QoS)
3. Click Queue Profiles and configure queue profile parameters. The Configuration > Network > QoS > Queue Profiles page contains parameters to manage the queue profiles. The queue profile determines how QoS queues with that profile assigned to them will behave. Up to 12 queue profiles can be defined using this page. These profiles can then be assigned to QoS queues as needed.
Queue Profile
The queue number that relates to the queues defined in the DCSP mappings page.
Minimum kbps
The minimum data transfer rate in kilobits/second that the router will try to attain for the queue.
Maximum kbps
The maximum data transfer rate in kilobits/second that the router tries to attain for this queue. This means that if the router determines that bandwidth is available to send more packets from a queue that has reached its Minimum kbps setting, it sends more packets from that queue until the Maximum kbps setting is reached. If the bandwidth on a queue should be restricted, setting the Maximum kbps value to the same as, or lower than the Minimum kbps value ensures that only the Minimum kbps setting is achieved.
Maximum Packet Queue Length
The maximum length of a queue in terms of the number of packets in the queue. Any packets received by the router that would cause the maximum length to be exceeded, are dropped.
WRED Minimum Threshold
The minimum queue length threshold for using the WRED algorithm to drop packets. Once the queue length exceeds this value, the WRED algorithm may cause packets to be dropped.
Digi TransPort® Routers User Guide
560
Configuring Quality of Service (QoS)
Configure Quality of Service (QoS)
WRED Maximum Threshold
The maximum queue length threshold for using the WRED algorithm to drop packets. Once the queue length exceeds this value, the WRED algorithm causes all packets to be dropped.
WRED Maximum Drop Probability (%)
The maximum percentage probability the WRED algorithm uses to determine whether or not a packet should be dropped when the queue length is approaching the WRED maximum threshold value.
Note If the length of a queue is less than the WRED Minimum Threshold value, there is a zeropercent chance that a packet will be dropped. When the queue length is between the WRED minimum and maximum values, the percent probability of a packet being dropped increases linearly up to the WRED maximum drop probability.
WRED Queue Length Weight factor
A weighting factor the WRED algorithm uses when calculating the weighted queue length. The weighted queue length is based on the previous queue length and has a weighting factor that may be adjusted to provide different transmit characteristics. The actual formula is:
new_length = (old_length * (1-1/2^n)) + (current_length * 1/2^n)
Small weighting factor values result in a weighted queue length that moves quickly and more closely matches the actual queue length. Larger weighting factor values result in a queue length that adjusts more slowly. If a weighted queue length moves too quickly (small weighting factor), it can result in dropped packets if the transmit rate rises quickly, but will also recover quickly after the transmit rate tails off. If a weighted queue length moves too slowly (large weighting factor), it allows a burst of traffic through without dropping packets, but may result in dropped packets for some time after the actual transmit rate drops off. Therefore, use care in selecting the weighting factor to suit the type of traffic using the queue.
Digi TransPort® Routers User Guide
561
Configuring Quality of Service (QoS)
Configure Quality of Service (QoS)
4. Click DSCP alteration. On this page, you can update the DSCP values on an IP stream (with matching DSCP value) if the measured throughput for that stream goes above a certain value. Other parts of the network will slow the traffic down if necessary. You can also update the DSCP values on traffic inside a GRE tunnel.
Queue Profile
The queue number that relates to the queues defined in the DCSP mappings page.
DSCP change start kbps
The throughput when changing the DSCP value is enabled.
DSCP change stop kbps
The throughput when changing the DSCP value is disabled.
DSCP to set
The value to set the DSCP value to.
Set DSCP in GRE
Enables setting the DSCP of IP packets within GRE tunnels. 5. Click Apply.
Command line
Configure DSCP mappings
Command dscp
Instance n
Parameter q
Values
0-63 Default 4
Equivalent web parameter Queue
Digi TransPort® Routers User Guide
562
Configuring Quality of Service (QoS)
Configure Quality of Service (QoS)
n To display a DSCP mapping from the command line, enter: dscp <code> ? Where <code> is a valid DSCP code from 0 to 63, or 64 (see note below).
n To change the value of a parameter, enter: dscp <code> q <value> Where <code> is a valid DSCP code and <value> is from 0 to 9.
n To set the default mapping value, enter: dscp 64 q <value> Where <value> is the default queue number required and has a value from 0 to 9.
Note DSCP code 64 is not actually a valid code, but is employed here to set up the default priority.
Configure Queue Profiles parameters
Entity qprof qprof qprof qprof qprof qprof qprof
Instance n n n n n n n
Parameter minkbps maxkbps qlen minth maxth mprob wfact
Values 0-2147483647 0-2147483647 0-2147483647 0-2147483647 0-2147483647 0-100 0-2147483647
Equivalent web parameter Minimum kbps Maximum kbps Maximum Packet Queue Length WRED Minimum Threshold WRED Maximum Threshold WRED Maximum Drop Probability (%) WRED Queue Length Weight factor
n To display a queue profile, enter: gqprof <instance> ? Where <instance> is the number of the queue profile to be displayed.
n To change the value of a parameter, enter: qprof <instance> <parameter> <value>
n To set the maximum throughput for queue profile 5 to 10kbps, enter: qprof 5 maxkbps 10
Digi TransPort® Routers User Guide
563
Configuring Quality of Service (QoS)
Configure Quality of Service (QoS)
DSCP alteration
Command qprof
qprof qprof qprof
Instance n
n n n
Parameter
Values
setdscponkbps
Note: If this value is set to 0 (the default), the DSCP value is not changed.
0=off 1=on
setdscpoffkbps
0=off 1=on
setdscpval
integer
setdscpgre
off, on
Equivalent web parameter DSCP change start kbps
DSCP change stop kbps DSCP to set Set DSCP in GRE
Digi TransPort® Routers User Guide
564
Configuring time bands
Configure a time band
566
Enable and disable time bands for a PPP or Wi-Fi interface
568
Digi TransPort® Routers User Guide
565
Configuring time bands
Configure a time band
Configure a time band
Digi TransPort routers support time bands. Time bands determine periods of time during which the router allows activating PPP or Wi-Fi interfaces or prevents them from activating. For example, a router in an office could be configured so that the ADSL PPP interface is only raised on weekdays. You can apply time bands to PPP and Wi-Fi interface instances only. Time bands are specified by a series of transition times. At each of these times, routing is either enabled or disabled. The default state for a time band is On, which means that PPP instances that are associated with unconfigured time bands will operate normally. The router supports four time band configurations. Whenever a time band transition occurs, an entry is made in the event log.
Web
1. Go to Configuration > Network > Timebands.
2. Several Timebands n pages configure one time band instance each. Configuration is controlled by a table, with the following parameters. You can configure up to 10 time band transitions.
Days
A set of checkboxes for selecting the days of the week to which the time band transitions apply. You can select days individually or in groups for convenience. To select all the days of the week, check the All checkbox. To select the weekend only, check the Sat->Sun checkbox. To select weekdays only, check the Mon->Fri checkbox.
Time
The transition time, specified in 24-hour format with a colon separator between hours and minutes.
State
The routing state, which can be On or Off. For convenience, this parameter toggles state for each new addition; if an On transition is configured, the default state for the next addition is Off. Clicking the Add button adds the entry into the table. Once an entry is added to the table, remove it by clicking the associated Delete button. To activate this time band instance, navigate to the associated PPP Timeband configuration page, and click the Enable checkbox, or enter the equivalent command line command. 3. Click Apply.
Digi TransPort® Routers User Guide
566
Configuring time bands
Configure a time band
Command line
Command tband
tband tband
Instance 0-3
0-3 0-3
Parameter days
time state
Values ALL, MF, Mon, Tue, Wed, Thu, Fri, Sat, Sun HH:MM off, on
Equivalent web parameter Days
Time State
Command format
The format for the tband command is:
tband <instance> <days#> <days> tband <instance> <days#> <days> tband <instance> <time#> <time> tband <instance> <state#> <on|off>
To specify multiple days, separate the days with a comma, such as Mon,Wed,Fri. You can use the abbreviation MF to specify Monday through Friday. For example, to allow PPP routing only on weekdays between 9:00 AM and 5:30 PM, enter these commands:
tband 0 days 0 mf tband 0 time0 9 tband 0 state0 on tband 0 days1 mf tband 0 time1 5:30 tband 0 state1 off
Digi TransPort® Routers User Guide
567
Configuring time bands
Enable and disable time bands for a PPP or Wi-Fi interface
Enable and disable time bands for a PPP or Wi-Fi interface
Web
1. Go to Configuration > Network > Timebands. Enabling and disabling time bands for a particular PPP or Wi-Fi interface instance is controlled by the settings in a table with the following columns:
2. Set the time band parameters as needed
Interface
Lists the available PPP instances.
Enable
This column contains checkboxes; each checkbox controls whether or not time bands are enabled for the PPP instance in the left-hand column of the row. Check the checkbox to enable time bands for the associated PPP instance.
Digi TransPort® Routers User Guide
568
Configuring time bands
Enable and disable time bands for a PPP or Wi-Fi interface
Timeband
Selects which of the four available time band instances should be associated with the PPP instance. 3. Click Apply.
Command line
Command Instance
ppp
n
Parameter tband
Values
0-3 The default state of this parameter is blank.
Equivalent web parameter Timeband
Digi TransPort® Routers User Guide
569
Configuring advanced network settings
Configure advanced network settings
571
Digi TransPort® Routers User Guide
570
Configuring advanced network settings
Configure advanced network settings
Configure advanced network settings
Configure first settings group
Web
1. Go to Configuration > Network > Advanced Network Settings.
2. Configure the first group of advanced network parameters as needed:
Secondary IP Address a.b.c.d
An additional IP address to the router that is not associated with any particular interface. The router responds directly to incoming traffic for this address; it does not attempt to onward route any IP packets for this address.
When connected to a Serial interface using TCP
Advertise an MSS of n bytes
The maximum segment size an asynchronous serial port connected to TCP sockets uses or advertises.
Use a Rx Window size of n bytes
The Rx window size an asynchronous serial port connected to TCP sockets uses or advertises.
Default SSL version for outgoing connections
Selects which version of the SSL protocol to use in the tcpdial command. The options are: n Auto, which allows the server to select the version. n TLSv1 only n SSLv2 only n SSLv3 only
Some servers are configured to work with a particular version. Unless this version is specifically requested, the connection attempt will fail.
Digi TransPort® Routers User Guide
571
Configuring advanced network settings 3. Configure socket settings:
Configure advanced network settings
Default source IP address interface x,y
The values in these two text boxes define the interface (None, PPP, ETH) and the instance number of the interface to use as a source address for IP when not using the interface that the socket was created on. The router creates general-purpose sockets automatically when the controlling application requests them, for example, when TPAD calls are made over IP or XOT. Normally, the source address the socket uses is that of the outgoing interface, usually PPP. However, for some applications, such as when setting up a VPN, it may be necessary to specify that the socket uses a different source address such as that of the local Ethernet port. This parameter specifies the interface from which the source address should be derived.
Note Even when this parameter is not configured, the router uses IP address from the interface on which the socket was created. It uses the source address specified in this parameter only if it causes the traffic to match an Eroute and therefore be sent using IPsec or GRE.
HTTPS port
The network port number for the HTTPS network service.
Connect Timeout s seconds
The amount of time after which a TCP socket may remain idle before being closed. If the value is set to 0, the socket may remain open indefinitely.
TCP socket inactivity timer s seconds
The maximum period of inactivity, in seconds, that can occur before and open TCP/IP socket is closed. The default value is 300 seconds (five minutes), and normally should not need to be changed.
TCP socket keep-alive s seconds
The amount of time, in seconds, between sending keep-alive messages over open TCP connections. The purpose of these messages is to prevent a connection from closing even when no data is being transmitted or received. The default value of this parameter is 0, which disables keep-alive messages. 4. Configure advanced network XOT settings:
Digi TransPort® Routers User Guide
572
Configuring advanced network settings
Configure advanced network settings
Default source IP address interface x,y
The values in these two text boxes specify the interface (None, PPP, ETH) and instance number of that interface that IP address that XOT sockets should use instead of the interface that the socket was created on.
Note Even when this parameter is not configured, the router uses the IP address from the interface on which the socket was created. It uses the source address specified in this parameter only if it will cause the traffic to match an Eroute and therefore be sent using IPsec or GRE.
NB of XOT listening sockets
The maximum number of XOT sockets available. Use this setting to reduce the number of XOT sockets in order to free up more general-purpose sockets for other purposes. The default value of 0 enables the maximum number of XOT sockets available.
Maximum ACK time for XOT data
The maximum time allowance for a remote unit to acknowledge TCP data transmitted by a unit's socket. If this timer expires, the socket is aborted. The default value of 0 disables the timer.
Note There is no requirement for the remote unit to acknowledge received data immediately, therefore setting this parameter to too small a value is not recommended. Some stacks delay sending TCP ACKs in order that they can be incorporated with data sent by the application.
Do not deactivate outgoing XOT sockets when interface disconnects
When enabled, this setting sets outgoing XOT sockets not to close when the interface they are using disconnects. 5. Configure backup IP addresses. The Backup IP Addresses section contains a table for specifying alternative IP addresses to use when the router fails when attempting to open a socket. The router uses these addresses only for socket connections that originate from the router. These IP addresses provide back-up for XOT connections, TANS (TPAD answering) connections, or any application in which the router is making outgoing socket connections. When a backup address is in use, the original IP address that failed to open is tested at intervals to check if it has become available again. Additionally, at the end of a session, the router remembers when an IP address has failed, and uses the backup address immediately for future connections. When the original IP address becomes available again, the router automatically detects this, and reverts to using that IP address. The Backup IP Addresses table has the following column headings:
Digi TransPort® Routers User Guide
573
Configuring advanced network settings
Configure advanced network settings
IP Address a.b.c.d
The original IP address to which the back-up address relates.
Backup IP address a.b.c.d
The backup address to try when the router fails to open a connection to the previous IP address.
Retry Time s (seconds)
The length of time, in seconds, the router waits between checks to see if a connection can be made to IP Address.
Try Next
When connection to the primary IP address has just failed, this text box determines whether a connection to the backup IP address should be attempted immediately or when the application next attempts to open a connection. When checked, the socket attempts to connect to the backup IP address immediately after the connection to the primary IP address failed and before reporting this failure to the calling application, such as TPAD. If the backup is successful, the application will not experience any kind of failure, even though the router has connected to the backup IP address. When unchecked, the socket reports the failure to connect back to the calling application immediately after the connection to the primary IP address has failed. The router does not try to connect to the backup IP address at this stage. The next time that the application attempts to connect to the same IP address, the router instead automatically connects to the backup IP address. Use the Add and Delete buttons to add and delete entries to and from the table.
Add button
Adds the backup IP address settings to the network configuration. Send "Backup IP" system messages to IP Address: a.b.c.d The destination IP address to which system messages notifying of the unavailability of an IP address should be sent. This allows the router to send UDP messages to other routers to notify them that an IP address has become available/unavailable. Devices that receive the IP address available/unavailable messages search their own backup IP address tables for the IP addresses indicated, and tag those addresses as available/unavailable as appropriate.
Chaining backup IP addresses
It is possible to chain backup IP addresses by making multiple entries in the table. For example, if the backup IP address for the original IP address appears as the IP address in the next row, along with a new backup IP address for that IP address. When the original IP
Digi TransPort® Routers User Guide
574
Configuring advanced network settings
Configure advanced network settings
address becomes unavailable, the router tries the backup IP address. If that IP address is unavailable, the router tries its backup IP address, and so on. For example, if the original IP address is 192.168.0.1 with a backup IP address of 192.168.0.2, setting the IP address in the next row to 192.168.0.2 with a backup IP address of 192.168.0.3 causes the router to try all these IP addresses in succession.
Note The time that it takes for a connection to an IP address to fail is determined by the Connect Timeout parameter Advanced Network Settings > Socket Settings section.
6. Click Apply.
Command line
Configure first group of advanced network settings
Command cmd sockopt
sockopt sockopt
Instance n n
n n
Parameter sec_ip asymss
asyrxwin sslver
Values
Equivalent web parameter
Valid IP address
Secondary IP address a.b.c.d
0-2147483648 When connected to a serial interface using TCP Advertise an MSS of n bytes
0-2147483648 Use a Rx Window size of n bytes
0-3 0=Auto 1=TLSv1 2=SSLv2
Default SSL version for outgoing connections
Configure socket settings
Command sockopt
sockopt
sockopt sockopt
sockopt
Instance n
Parameter gp_ipent
Values 0,PPP,ETH
n
gp_ipadd
Valid interface
number
n
sock_connto 0-2147483648
n
sock_inact 0-2147483648
n
sock_keepact 0-2147483648
Equivalent web parameter
Default source IP address interface x,y
Default source IP address interface x,y
Connect Timeout s seconds
TCP socket inactivity timer s seconds
TCP socket keep-alive s seconds
Digi TransPort® Routers User Guide
575
Configuring advanced network settings
Configure advanced network settings
Configure advanced network XOT settings
Command sockopt
sockopt
sockopt sockopt
Instance n
n
n n
Parameter xot_ipent
xot_ipadd
xot_listens xot_maxack
Values Valid interface type, ETH, PPP
Valid interface number
0-2147483648
0-2147483648
Equivalent web parameter
Default source IP address interface x,y
Default source IP address interface x,y
NB of XOT listening sockets
Maximum ACK time for XOT data
Configure a backup IP address
Command Instance Parameter Values
ipbu
n
IPaddr
Valid IP address a.b.c.d
ipbu
n
BUIPaddr Valid IP address a.b.c.d
ipbu
n
retrysec 0-2147483648
ipbu
n
donext
off, on
sarsys
0
dest
Valid IP address
a.b.c.d
Equivalent web parameter IP Address a.b.c.d
Backup IP Address a.b.c.d
Retry Time s (seconds) Try Next Send Backup IP system messages to IP address a.b.c.d
Digi TransPort® Routers User Guide
576
Configuring legacy protocols
About legacy protocols
578
Configure Systems Network Architecture over IP (SNAIP)
579
Configure TPAD parameters
587
Configure X.25 parameters
601
Configure a MODBUS gateway
645
Configure Protocol Switch software
649
Digi TransPort® Routers User Guide
577
Configuring legacy protocols
About legacy protocols
About legacy protocols
Older protocols that existed before TCP/IP became dominant are often referred to as legacy protocols. Examples of legacy protocols are X.25, SNA and LAPB.
Digi TransPort routers can connect to legacy networks such as X.25. They can also simulate a legacy network so that equipment that, in the past, would have connected to a legacy network, can connect to the Digi TransPort router instead. This means old equipment can be connected to modern networks such as HSUPA.
Digi TransPort® Routers User Guide
578
Configuring legacy protocols
Configure Systems Network Architecture over IP (SNAIP)
Configure Systems Network Architecture over IP (SNAIP)
Digi TransPort routers can send Systems Network Architecture (SNA) traffic over TCP/IP, using the DLSw protocol, often called SNAIP. They can also can send HDLC traffic over TCP/IP.
SNA uses Synchronous Data Link Control (SDLC), an unbalanced mode in which there is one master station and one or more secondary stations. Each secondary station owns a station address and can only respond when this address has just been polled by the master. A typical scenario is shown in the diagram below:
Web
1. Go to Configuration > Network > Legacy Protocols > SNAIP. 2. Set SNAIP parameters:
Description
A name for this SNAIP instance, to make it easier to identify.
Send SNAIP traffic over interface
The physical interface for carrying SNAIP data. This can be set to either ISDN, Serial Port, or SharedPort.
n If ISDN is selected, SNAIP data is carried over the ISDN BRI physical interface. n If Serial Port is selected, SNAIP data can be routed to either serial Port 0 or serial Port
1 (operating in synchronous mode). To configure Port 0 or Port 1 for synchronous operation go to Configuration > Network > Interfaces > Serial > Serial Port x > Sync Port x.
Digi TransPort® Routers User Guide
579
Configuring legacy protocols
Configure Systems Network Architecture over IP (SNAIP)
n If Shared Port is selected, the drop down list next to Shared Port specifies the SNAIP instance that has sync port configured. When sync port sharing is enabled only one SNAIP instance can currently own the sync port. Other SNAIP instances however can share this sync port in the event that there is more than one terminal residing on a multi-drop sync line. In this situation with multiple terminals, each terminal station will operate a DLSw state independently of all other stations.
The SNAIP parameter Priority is the SNAIP instance to use when more than one is available; the highest number being given preference. For example, consider that 4 SNAIP instances to all share sync port 0. To do this, configure SNAIP 0 in the usual way on PORT 0, then configure SNAIP instances 1, 2, and 3 to use SharedPort and Sync Port from SNAIP0.
Use protocol
The protocol for the interface. Choose LAPB, SNA for SDLC or RAW for raw mode in which all L2 frames are transmitted and received. You can also choose RAW_NOHDR for raw mode with no DLSw headers.
Allow this unit to answer calls
This setting is only relevant when the interface is set to ISDN. If this parameter is set to On, the router answers incoming calls on the relevant LAPB session. To prevent the router from answering incoming calls on this LAPB session set the option to Off.
Only accept calls with MSN ending with
This setting is only relevant when the interface is set to ISDN. This is the filter for the ISDN Multiple Subscriber Numbering facility. By default, this setting is blank. When set to an appropriate value with answering calls parameter above enabled, the router to answer incoming calls only to ISDN numbers where the trailing digits of the called number match the MSN value. For example, setting the MSN parameter to 123 prevents the router from answering any calls to numbers that do not end in 123.
Only accept calls with sub-address ending with
This setting is only relevant when the interface is set to ISDN. This is the filter for the ISDN subaddressing facility. By default, this setting is blank. When set to an appropriate value, with answering calls parameter above enabled, the router answers incoming ISDN calls only where the trailing digits of the sub address called match the sub-address value. For example, setting the Sub-address to 123 prevents the router from answering any calls where the sub-address called does not end in 123.
Assume station exists (Do not send TEST frames)
When this parameter is enabled, TEST frames are not transmitted and the TEST response is not expected. Instead, the router assumes the station exists and proceeds with the protocol as if the DLSw has received the TEST response.
Toggle DCD output each time the DLSw protocol enters the DISCONNECTED state
When this parameter is set to On, the DCD (Data Carrier Detect) output turns off briefly each time the DLSw protocol enters the DISCONNECTED state. Any attached equipment that needs
Digi TransPort® Routers User Guide
580
Configuring legacy protocols
Configure Systems Network Architecture over IP (SNAIP)
to will see signals changing state.
Sync port should not send or receive data when WAN link is down
Causes the Sync port to be deaf and dumb (and have DCD low) while the connection with the WAN is down. This setting is supported to prevent terminals from assuming if L2 is up, the rest of the WAN link should be working, at which point the router could go into a management error state. 3. Configure SNA parameters
Router to be Master on an unbalanced link
Enable this parameter if this router is to be the master in an unbalanced link, or set to Off if the router is to be a secondary station.
Polling Response Time
The poll time, in milliseconds, if the router is the master in an unbalanced link.
Polling Stations Addresses
This parameter is only applicable in SNA mode. Lists the station addresses on the data link as a comma-separated list of hex values, such as c1,d1 for station addresses 0xc1 and 0xd1.
SAPs
A list of SAP values which correspond to the station addresses.
DSAPs(blank=default)
The Destination SAP value, if left blank the router uses the SAP value specified above.
Send Null XID (XID with no Data)
When this parameter is set to On, a null XID SSP message will be sent when the router has just received or sent a REACH ACK SSP message.
Send XID with Data
A hex string to define binary data and defines an XID SSP message that would be sent in response to a XIDFRAME SSP message being received.
Tx Turn Around Time
The time, in milliseconds, between receiving a frame from an outstation and transmission back to the same station. If this parameter is set to 0, this is disabled and the router can respond immediately. The minimum non-zero value is 10ms.
Mode
Defines the mode in balanced links, such as HDLC. In unbalanced links such as SNA/SDLC, the mode is defined by being master or the station.
Digi TransPort® Routers User Guide
581
Configuring legacy protocols
Configure Systems Network Architecture over IP (SNAIP)
N400 counter
A standard LAPB retry counter. The default value is 3. Normally it is not necessary to change this parameter.
RR Timer
A standard LAPB/LAPD Receiver Ready timer. The default value is 10,000ms (10 seconds). Normally it is not necessary to change this parameter.
T1 timer
A standard LAPB timer. The default value is 1000 milliseconds (1 second). Normally it is not necessary to change this parameter.
T200 timer
A standard LAPB re-transmit timer. The default value is 1000 milliseconds (1 second). Normally it is not necessary to change this parameter.
Window Size
The X.25 window size. The value range is from 1 to 7 with the default being 7.
Disconnect link if there has been no activity forx seconds
The length of time, in seconds, before the link is disconnected if there has been no activity. If this parameter is 0 or not specified, the inactivity timer is disabled. When the router uses a LAPB instance over ISDN, it is useful to set this to a short period of time, for example, 120 seconds. You can use this timer as a backup hang-up timer, thereby saving ISDN call charges. When using LAPB on a synchronous port, you should normally set this parameter to 0. 4. Configure SSP (WAN) parameters
Virtual MAC Address
Virtual MAC address. The host uses MAC addresses and SAP values as the addressing values to discriminate between circuits, in much the same way as an IP address & TCP port define an addressing point for a TCP socket. This is the MAC address reported as part of the DLSw protocol.
Virtual MAC Address of Peer
The Virtual MAC address of the peer.
IP address of the Peer DLSw unit
The IP address of the peer DLSw unit.
Listen on Port
The read IP port. The TCP socket SNAIP listens on.
Use Port x if this unit starts the DLSw protocol
The write IP port. This TCP socket will be opened by the router if it needs to start the DLSw protocol.
Digi TransPort® Routers User Guide
582
Configuring legacy protocols
Configure Systems Network Architecture over IP (SNAIP)
Use interface for source IP address
Setting this parameter to a PPP or ETH instance causes the source address for this SNAIP instance to match that of the Ethernet or PPP interface specified.
Close TCP connection if it is idle for x secs
The maximum period of inactivity (in seconds) that may occur before an open TCP/ IP socket is closed. The default value is 300 seconds (5 minutes). Normally it is not necessary to change this parameter.
DLSw Ver
The DLSw version to use. Set to 0 (default) for version 1, set to 2 for version 2.
DLSw Role
When this parameter is set to Active, and the router is in SNA mode, this DLSw switch actively connects to the remote DLSw switch.
DLSw Window
The DLSw window size. The value range is from 10 to 100. The default is 20.
UDP Capable
Controls the UDP transmission of DLSw SSP packets. Reception is always enabled for version 2 support. If set to OFF, the state transitions occur like DLSw version 1, but the router indicates it is version 2-capable.
Use 1 socket
When this parameter is set to On, the router uses only one socket for both read and write data. This is useful if the router is behind a NAT box and incoming connections are not possible. This parameter can also be set to Compatible, in which mode both sockets are open to start with and then after a negotiation one of the sockets is dropped.
Include MAC Exclusivity Capability
On or Off. Set this parameter to On to include the MAC exclusivity value in the capabilities exchange message.
MAC Exclusivity Value
See above.
Ignore unsolicited response frames
When enabled, the router ignores unsolicited response frames.
Wait for Contact before progressing to CONNECT PENDING state
During the DLSw negotiation phase and when XID messages are being exchanged, this parameter controls which end sends the CONTACT message. Normally this would be off in which case this router would send the CONTACT message, but if this parameter is set, we
Digi TransPort® Routers User Guide
583
Configuring legacy protocols
Configure Systems Network Architecture over IP (SNAIP)
would not send this message, but instead wait for it to be sent to us before progressing in the DLSw state machine.
Make immediate connection attempts before backing off
The number of successive connection attempts before backing off for the number of seconds (default 30) defined in the Backoff for x seconds... parameter. This backoff might be necessary when a server is behind a firewalls that detects too many successive connection attempts in a certain time frame.
Backoff for x seconds before attempting to connect again
When backing off because of too many failed consecutive connection attempts, this parameter defines the time, in seconds, the router should remain idle before attempting another connection. 5. Click Apply.
Command line
Command Instance Parameter
snaip
x
l1iface
snaip
x
l1nb
snaip
x
snaip
x
snaip
x
snaip
x
snaip
x
snaip
x
protocol ans msn sub autocontact dcd_toggle
snaip
x
snaip
x
snaip
x
l1oos master pollresp
Values
Equivalent web parameter
ISDN, Port, SharedPort
Send SNAIP traffic over interface.
0255 (Select LAPB, Send SNAIP traffic over interface. Port or SharePort instance)
LAPB, SNA, RAW, RAW_NOHDR
Use the specified protocol.
1=enabled, 0=disabled
Allow this unit to answer calls.
text
Only accept calls with MSN ending
with the specified text.
text
Only accept calls with sub-address
ending with the specified text.
1=enabled, 0=disabled
Assume station exists. (Do not send TEST frames).
1=enabled, 0=disabled
Toggle DCD output each time the DLSw protocol enters the DISCONNECTED state.
1=enabled, 0=disabled
Sync port should not send or receive data when WAN link is down.
1=enabled, 0=disabled
Router to be Master on an unbalanced link.
0-2147483647
Polling Response Time.
Digi TransPort® Routers User Guide
584
Configuring legacy protocols
Configure Systems Network Architecture over IP (SNAIP)
Command Instance Parameter Values
snaip
x
stations
text
snaip
x
saps
text
snaip
x
dsaps
text
snaip
x
send_xid_null 1=enabled, 0=disabled
snaip
x
xid_data
text
snaip
x
turntxtim
0-2147483647
snaip
x
dtemode
1=DTE, 0=DCD
snaip
x
n400
0-255
snaip
x
tnoact
1000-60000
snaip
x
t1time
1-60000
snaip
x
t200
1-60000
snaip
x
window
1-7
snaip
x
tinact
0-3000
snaip
x
snaip
x
snaip
x
snaip
x
snaip
x
vmac peervmac IPaddr r_IPport w_IPport
Text (valid MAC address)
Text (valid MAC address)
Text (valid IP address)
0-65535
0-65535
snaip
X
snaip
x
snaip
x
srcipent srcipadd sock_inact
auto, eth, ppp 0-255 0-2147483647
snaip
x
snaip
x
snaip
x
snaip
x
ver passive
dlswwindow udp_cap
0-2
0= active 1=passive
1-100
1=enabled 0=disabled
Equivalent web parameter Polling Stations Addresses. SAPs. DSAPs(blank=default). Send Null XID (XID with no Data).
Send XID with Data. Tx Turn Around Time. Mode. N400 counter. RR Timer. T1 timer. T200 timer. Window Size. Disconnect link if there has been no activity forxseconds. Virtual MAC Address.
Virtual MAC Address of Peer.
IP address of the Peer DLSw unit.
Listen on Port. Use Port x if this unit starts the DLSw protocol. Use interface for source IP address. Use interface for source IP address. Close TCP connection if it is idle for xsecs. DLSw Ver. DLSw Role.
DLSw Window. UDP Capable.
Digi TransPort® Routers User Guide
585
Configuring legacy protocols
Configure Systems Network Architecture over IP (SNAIP)
Command Instance Parameter Values
snaip
x
use1sock
On, Off, Compatible
snaip
x
inc_mac_exc 1=enabled 0=disabled
snaip
x
mac_exc_val 0-1
snaip
x
iunsolresp
1=enabled 0=disabled
snaip
x
waitforcontact 1=enabled 0=disabled
snaip
x
con_attempts 0-2147483647
snaip
x
con_boff_time 0-2147483647
Equivalent web parameter Use 1 socket. Include MAC Exclusivity Capability.
Mac Exclusivity Value. Ignore unsolicited response frames.
Wait for Contact before progressing to CONNECT PENDING state. Make immediate connection attempts before backing off Backoff for x seconds before attempting to connect again
Forcing SNAIP to use a specific instance
If several SNAIP instances share an ASY port, a switchover to a specific instance can be initiated by issuing snasw x, where x is the SNAIP instance number. This instance must be available to go online, or this command will fail.
To revert back and use the default instance, issue the snadis x command. The router uses normal priorities to determine which SNAIP instance gets to use the SYNC port.
Digi TransPort® Routers User Guide
586
Configuring legacy protocols
Configure TPAD parameters
Configure TPAD parameters
TPAD is a simplified version of the X.25 PAD specification. A common use of TPAD is to conduct creditcard clearance transactions. Digi routers support the use of TPAD over ISDN B and D-channels, TCP, UDP, SSL, and XoT. Automatic back-up between any two of these "layer 2 interfaces" or "transport protocols" is supported.
Web
1. Go to Configuration > Network > Legacy Protocols > TPAD > TPAD n.
2. Set TPAD parameters:
Use TPAD over interface
Selects whether the TPAD instance will use ISDN B-channel X.25, ISDN D-channel X.25, TCP, VXN or SSL as the transport protocol. For ISDN D-channel operation, select LAPD" option. For ISDN B-channel operation or operation through a synchronous port, select LAPB. In the case of LAPB and LAPD an interface number can also be specified. This parameter specifies which LAPB or LAPD instance to use for the relevant TPAD instance. Select 0 or 1 for LAPB. or 0 or 1 for LAPD. When using LAPB with ISDN, this parameter may be set to 255, which means use any free LAPB instance. This is useful when more than 2 POS terminals are connected to the router and the acquirer does not support multiple Switched Virtual Circuits (SVCs) on a single BChannel. A value of 254 uses an available LAPB instance, but will use the same ISDN B channel if two calls are attempted to the same ISDN number at the same time. (All services that the POS terminals may dial must support multiple SVCs if using the setting 254.)
Use backup interface
Specifies a backup interface to use automatically if the call to the primary interface fails. Note that the primary interface will be tried first for every new call attempt. 3. Set ISDN parameters:
Digi TransPort® Routers User Guide
587
Configuring legacy protocols
Configure TPAD parameters
Use number x to make outgoing ISDN calls
Used to specify an ISDN number. Use when no ISDN number is provided with the ATD command when making an outgoing call.
Use prefix x
A dialing code the router places in front of the telephone number that is issued by the terminal in the ATD command. For example, if the Use Prefix setting is set to 0800 and the number specified by the terminal in the ATD command is 123456, the actual number dialed by the router is 0800123456.
Remove prefix x from number in ATD command
A dialing prefix that is normally inserted by the terminal in the ATD command that is removed by the router before dialing takes place. For example, if the Remove prefix setting is set to 0800 and the terminal issued an ATD command containing 0800123456, the actual number dialed by the router is 123456.
Use suffix x
The Suffix # parameter may be set to contain additional numbers that are dialed after the number specified by B-channel ISDN #. For example, if B-channel ISDN # is set to 123456 and Suffix # is set to 789, the actual number dialed is 123456789.
On the main interface Deactivate LAPB session x seconds after TPAD X.25 call has been cleared
Once a TPAD X.25 call has been cleared, the router keeps a LAPB instance active for the length of time set by this parameter. This allows further TPAD transactions to occur without having to make another ISDN call. The default value of 10 seconds is acceptable for most applications. The value of 1 is a special value which means terminate Layer 2 immediately the transaction is finished. (When the X.25 call is cleared.) If you select LAPD as the TPAD Layer-2 interface, this value is automatically be set to 0 to disable Layer-2 deactivation. You can override the 0 setting by entering a new value, but most network service providers prefer that LAPD connections are not repeatedly deactivated.
On the backup interface Deactivate LAPB session x seconds after TPAD X.25 call has been cleared.
Equivalent to the deactivation timer above, but applies only to backup calls.
Digi TransPort® Routers User Guide
588
Configuring legacy protocols 4. Set X.25 parameters:
Configure TPAD parameters
When making an outgoing X.25 call Default X.25 Packet Size
The default X.25 packet size for TPAD transactions.
Use NUA
The X.25 Network User Address for outgoing X.25 calls if no NUA is specified in the call string.
Use NUI
The X.25 Network User Identifier for outgoing X.25 calls if no NUI is specified in the call string.
LCN
The router supports up to eight logical X.25/TPAD channels. In practice, the operational limit is determined by the particular service to which you subscribe (usually 4). Each logical channel must be assigned a valid Logical Channel Number (LCN). The LCN parameter is the value of the first LCN that will be assigned for outgoing X.25 CALLs. The default is 1027. For incoming calls, the router accepts the LCN specified by the caller.
LCN direction
Specifies whether the X.25 LCN for outgoing TPAD calls is incremented or decremented from the starting value when multiple TPAD instances share one layer 2 (LAPB or LAPD), connection. The default is DOWN and LCNs are decremented, such as if the first CALL uses 1024, the next
Digi TransPort® Routers User Guide
589
Configuring legacy protocols
Configure TPAD parameters
will use 1023, etc. Setting the parameter to UP causes the LCN to be incremented from the start value.
On the backup interface Use NUA
Sets the first LCN for the backup interface.
Use NUI
The X.25 Network User Identifier to use for outgoing X.25 calls if no NUI is specified in the call string for the backup interface.
LCN
The first LCN for the backup interface.
LCN direction
Determines whether the LCN for the backup X.25 interface is incremented or decremented from the starting value when multiple X.25 instances share a single Layer 2 connection.
Report our NUA as n to the X.25 network
The NUA that the router will report to the X.25 network as its own NUA when making a call. It is also known as the calling NUA. Often the X.25 network will override this NUA.
Send X.25 RESTART packets
Sends X.25 RESTART packets.
Delay the X.25 RESTART packets by x milliseconds
The time, in milliseconds, to wait before sending the X.25 RESTART packets.
Call User Data
A text string that will be placed in the Call User Data field of an outgoing X.25 call request packet. Whether or not this information is required will depend on the X.25 host that you are connecting to. In most cases the information is not required.
X.25 calls
These setting control how transactions are sent to the host when TPAD is running in direct mode.
One per transaction
Only one transaction is allowed per call.
Allow consecutive transactions
Multiple transactions are allowed per X.25 call, but not until a response has been received from the host.
Digi TransPort® Routers User Guide
590
Configuring legacy protocols
Configure TPAD parameters
Allow concurrent transactions
Multiple transactions per X.25 call are allowed irrespective of whether a response has been received from the host.
Use ASCII character x as the delimiter character
The character for separating a main NUA from a backup NUA, and a main NUI from a backup NUI in an ATD command. The default value is the ASCII ! character (decimal 33).
Forward mode time x milliseconds
If not framed with STX and ETX characters, can still have data formatted after this period.
Create an event when reply from X.25 host matches
Used to generate a data trigger event (code 47) when the reply from the X.25 host contains the string specified in this parameter. You can configure the router to generate an email alert message when this event occurs. See file LOGCODES.TXT for a complete list of events.
XoT/TCP settings
Connect to remote IP address
When the router is configured for XOT or TCP socket mode, this parameter sets the IP address of the host to which the TCP/XOT connection is made. The transport protocol must be set to TCP.
Port
When making a TCP socket connection (such as the transport protocol has been set to TCP not XoT), this parameter sets the TCP port number to use.
IP length header
When making a TCP socket connection (such as the transport protocol has been set to TCP), setting this parameter to On will prepend the data sent to the host with a 2-byte length header. The 2-byte length header is not included in the length calculation. When set to 8583 Ascii 4 byte, the IP length header conforms to the ISO 8583 format. Setting this parameter to On Inclusive prepends a 2-byte length header, and the calculation of the length includes the 2 bytes of the length header.
Digi TransPort® Routers User Guide
591
Configuring legacy protocols
Set TPAD parameters:
Configure TPAD parameters
Use Terminal ID (TID)
Inserts or replaces a Terminal ID in the APACS 30 string.
Replace TID provided by connected terminal with configured TID
When enabled, any Terminal ID provided by a connected terminal is replaced by the ID set in the Use Terminal ID field above.
Digi TransPort® Routers User Guide
592
Configuring legacy protocols
Configure TPAD parameters
The TID will be become inactive in n seconds.
The time, in seconds, before the Terminal ID is considered inactive. Local authorizations may be configured to occur on active TIDs (terminal Ids), so this parameter defines how long a time (without transactions) must pass for a TID to change from active to inactive.
Use TID xxxxxxxxx with incoming APACS 50 polling calls
The terminal ID to associate with this TPAD instance when answering an incoming APACS 50 polling call.
Use merchant Number
Inserts a merchant number into the APACS 30 string when the locally connected equipment does not transmit a merchant number.
Use Connect String
A string sent to the user's terminal when an outgoing TPAD call has been connected, instead of the normal ENQ character. For example, you could use this setting to make a TPAD connection look like a PAD connection by specifying CON COM as the connect string.
The polling character set is c
A string that specifies a character or set of characters to be treated as polling characters. The router responds to any of these characters using ACK. This parameter should normally be left blank.
Enable Message Numbering
When enabled, the router overrides the message numbering of the local equipment and substitute its own message numbering in the APACS 30 data. This is useful when the locally connected equipment does not automatically increment the APACS 30 message number.
Disable Direct Mode
Enabling this setting will prevent the router from automatically using Direct Mode (see below) when it receives an APACS 30 packet without any call set-up.
Boot to Direct Mode
Direct mode is a mode of operation whereby the router automatically routes APACS 30 packets to their destination without the terminal having to perform any call control. If this parameter is set to Yes, the next time the router is rebooted, it operates in direct mode. For direct mode to work you must set up the appropriate addressing information, such as Transport protocol, NUA, NUI, IP address etc. If this parameter is not enabled, the router still tries to use direct mode if it detects that it is required, due to the absence of call control information. Use this parameter when the router cannot automatically determine whether or not to use direct mode.
Use response code n in "unable to authorise" message
This parameter only applies when the router is operating in direct mode. In cases where the router is unable to send the APACS 30 packet to the remote host, it replies to the terminal with an unable to authorize message. By default, this message contains a response code 05, which
Digi TransPort® Routers User Guide
593
Configuring legacy protocols
Configure TPAD parameters
means declined. Entering a number for this parameter causes the router to use that number in place of the default response code. A value of 0 prevents the router from replying.
Clearing time n milliseconds
The clearing time, in milliseconds, that an X.25 call is left open after receiving a response from the host. Each response from the host resets this timer.
Delay transmitting the APACS 30 string for x milliseconds after connecting to X.25 host
Setting this parameter causes the router to pause for the specified number of milliseconds in between successfully connecting to the remote X.25 host and transmitting the APACS 30 string.
Retransmit APACS 30 string if error detected
Enabling this setting causes the router to retransmit the APACS 30 string to the terminal if an error is detected, such as no ACK received from terminal.
STX/ETX removal
Enabling Del STX&ETX causes the router to strip off the STX and ETX characters that normally surround the APACS 30 string before sending it to the host. Enabling Del STX only causes the router to strip the STX character only.
Do not transmit ENQ characters
The TPAD protocol normally uses the ENQ character to indicate that a call has connected and that the TPAD terminal may proceed with the transaction. Enabling this parameter prevents the router from transmitting ENQ characters to the TPAD terminal when a connection is made.
Delay sending ENQ characters to TPAD terminal for x milliseconds when a call has been connected
Set s the delay, in milliseconds, from when the router first connects the call to when it transmits the ENQ to the terminal. By default, there is no delay.
Wait for x milliseconds for an ACK before retransmitting the data
The time the router waits for an ACK character to be received after sending data to the terminal. If an ACK character is not received within this time, the data is retransmitted. A value of 0 sets a delay of 1 second (the default).
Transmit TPAD transactions directly in a Synchronous frame
If enabled, TPAD transactions are transmitted without any outer protocol, such as X.25, such as they are placed directly in a synchronous frame on ISDN. This sometimes referred to as HDLC by certain card acquirers.
Include LRC
The LRC (Longitudinal Redundancy Check) is a form of error checking that may be required by some TPAD terminals. When the Include LRC option is enabled the router will check the LRC sent by the terminal and if it indicates a problem has occurred NAK the message. If this
Digi TransPort® Routers User Guide
594
Configuring legacy protocols
Configure TPAD parameters
parameter is enabled but no LRC is sent by the terminal, the transaction is not forwarded to the host.
Include LRC line
This parameter is normally disabled so that any LRCs received from a TPAD terminal will be removed before the transaction data is transmitted to the remote host. In most cases this is acceptable because the network will provide error correction and so the LRC is redundant. In some circumstances it may be necessary to enable this parameter so that the router transmits the LRC to the remote host along with the transaction data.
Force parity when sending data to the terminal
If enabled, the router always uses even parity when relaying data from a remote host to a locally connected TPAD terminal. To allow data to pass through without the parity being changed, disable this setting.
Strip parity when sending data to the host
Enabling this parameter causes the router to remove any parity before sending the data to the host.
Force parity when sending data to the host
If enabled, the router always uses EVEN parity when relaying data from the locally connected TPAD terminal to the remote host. To allow data to pass through without the parity being changed disable this setting.
Strip Trailing Spaces
If enabled, the TPAD instance looks at responses coming from the host and remove any trailing space characters from the end of the packet before relaying the data to the terminal. This may be necessary if the host system pads out responses with unnecessary spaces which can cause abnormal behavior in some terminals.
Acknowledge TPAD data packets
Causes the router to acknowledge TPAD data packets from the terminal. This parameter should normally be enabled. Use only if no polling characters (see above) are defined.
Convert leading STX character to SOH
If enabled, the router converts the leading STX character in a transaction to an SOH character.
Terminate TPAD call is EOT only
A TPAD call is normally terminated with a DLE EOT sequence. Some terminals only require the EOT character on its own. If this is the case then enable this parameter.
Clear TPAD call if there is no response to a TPAD transaction request for x seconds
The length of time, in seconds, the router waits for a response to a TPAD transaction request before clearing the TPAD call.
Digi TransPort® Routers User Guide
595
Configuring legacy protocols
Configure TPAD parameters
Generate an event when a TPAD transaction takes longer than x seconds
Setting this parameter to a non-zero value causes the router to generate an Excessive Transaction Time event (code 56) each time a TPAD transaction takes longer that the specified number of seconds. You can use this setting with an appropriate Event Handler configuration to generate email alert messages or SNMP traps when TPAD transactions take longer than expected. See Configuration > Alarms > Event Logcodes for a complete list of events.
When the transaction time exceeds x milliseconds, increment the "SLA Exceptions" statistic
When the total transaction time exceeds the value (in ms) set in this parameter, the NB SLA exceptions statistic on the Diagnostics - Statistics > TPAD page is incremented. This statistic can be viewed on the CLI interface by entering the at\mibs=tpad.n.stats command, where n is the TPAD instance.
Clear the call x seconds after receiving a response
The time period for which the socket closing or the X.25 call clearing is delayed by after the TPAD session has finished. For example, if this parameter is set to 10, then 10 seconds after the TPAD session is finished (NO CARRIER is seen on the ASY TPAD port) the network call (X25 or TCP socket) is cleared. The number 1 is a special value. If set to the number 1, the call is cleared immediately, instead of after 1 second.
If the terminal dial command specifies V.120 use PANS context x
This parameter is for advanced users only. It enables TPAD transactions to be carried out using the V.120 protocol (ATDV command). Use this parameter with the Polling Answering Service (PANS). It identifies which PANS instance to use for an outgoing V.120 call. For this to work, the PANS instance must be bound to a Rate Adaption instance. 5. Click Apply.
Command line
Command tpad tpad tpad tpad tpad tpad
tpad
Instance Parameter
n
l2iface
n
l2nb
n
ipmode
n
bakl2iface
n
bakl2nb
n
bnumber
Values lapb, lapd, tcp, ssl, vxn 0-255
lapb, lapd, tcp, ssl, vxn 0-255 text (valid ISDN number)
n
prefix
text (numeric)
Equivalent web parameter Use TPAD over interface. Use TPAD over interface. Use TPAD over interface. Use backup interface. Use backup interface. Use number x to make outgoing ISDN calls. Use prefix x
Digi TransPort® Routers User Guide
596
Configuring legacy protocols
Configure TPAD parameters
Command tpad
tpad tpad
tpad
tpad tpad tpad tpad tpad tpad tpad tpad tpad tpad
tpad tpad tpad
tpad
tpad
tpad
tpad
Instance Parameter
n
prefix_rem
n
suffix
n
tl2deact
n
baktl2deact
n
defpak
n
nua
n
nui
n
lcn
n
lcnup
n
baknua
n
baknui
n
baklcn
n
baklcnup
n
cingnua
n
cud
n
samecall
n
samecall
n
samecall
n
delimchar
n
ftime
n
trig_str
Values text (numeric)
text (numeric) 0-10000
0-10000
16,32,64,128,256,512,1024 text text 1-4095 1=up, 0=down text numeric text 1-4095 1=up, 0=down numeric text
text 0 1
2
32-127
0-20000
text
Equivalent web parameter
Remove prefix x from number in ATD command.
Use suffix x.
On the main interface Deactivate LAPB session x seconds after TPAD X.25 call has been cleared.
On the backup interface Deactivate LAPB session x seconds after TPAD X.25 call has been cleared.
Default X.25 Packet Size.
Use NUA.
Use NUI.
LCN.
LCN direction.
(Backup) Use NUA.
(Backup) Use NUI.
(Backup) LCN.
(Backup) LCN direction
Report our NUA as n to the X.25 network.
Call User Data.
One per transaction.
Allow consecutive transactions.
Allow concurrent transactions.
Use ASCII character x as the delimiter character.
Forward mode time x milliseconds.
Create an event when reply from X.25 host matches.
Digi TransPort® Routers User Guide
597
Configuring legacy protocols
Configure TPAD parameters
Command tpad tpad
tpad tpad
tpad
tpad tpad tpad tpad tpad tpad tpad tpad
tpad tpad
tpad tpad tpad
Instance Parameter Values
n
IPaddr
IP address
n
iphdr
0=Off
1=On
2=8583 Ascii 4 byte
n
termid
text
n
dotermid 1=enabled, 0=disabled
n
tid
text
n
merchnum text
n
useconstr 1=enabled, 0=disabled
n
constr
text
n
pollchars text
n
domsgnb 1=enabled, 0=disabled
n
disdir
1=enabled, 0=disabled
n
bdir
1=enabled, 0=disabled
n
uaarc
0-99
n
clear_
0-60000
dirtime
n
trandel
0-5000
n
teretran
1=enabled, 0=disabled
n
delstx
1=enabled, 0=disabled
n
no_enq
1=enabled, 0=disabled
Equivalent web parameter
Connect to remote IP address.
IP length header.
Use Terminal ID (TID).
Replace TID provided by connected terminal with configured TID.
Use TID xxxxxxxxx with incoming APACS 50 polling calls.
Use merchant Number.
Use Connect String.
Use Connect String.
The polling character set is c.
Enable Message Numbering
Disable Direct Mode.
Boot to Direct Mode.
Use response code n in unable to authorise message.
Clearing time n milliseconds.
Delay transmitting the APACS 30 string for x milliseconds after connecting to X.25 host.
Retransmit APACS 30 string if error detected.
STX/ETX removal.
Do not transmit ENQ characters.
Digi TransPort® Routers User Guide
598
Configuring legacy protocols
Configure TPAD parameters
Command tpad
tpad
tpad
tpad tpad tpad
tpad tpad tpad tpad tpad tpad tpad
tpad
Instance Parameter Values
n
tenqdel
0-5000
n
tackdel
0-10000
n
dsync
1=enabled, 0=disabled
n
inclrc
1=enabled, 0=disabled
n
incllrc
1=enabled, 0=disabled
n
fpar
1=enabled, 0=disabled
n
lrpar
1=enabled, 0=disabled
n
lfpar
1=enabled, 0=disabled
n
strip_
1=enabled, 0=disabled
tspaces
n
ackdat
1=enabled, 0=disabled
n
stx_2_soh 1=enabled, 0=disabled
n
eot_only 1=enabled, 0=disabled
n
tresp
01000
n
texcess
0100
Equivalent web parameter
Delay sending ENQ characters to TPAD terminal for x milliseconds when a call has been connected.
Wait for x milliseconds for an ACK before retransmitting the data.
Transmit TPAD transactions directly in a Synchronous frame.
Include LRC.
Include LRC line.
Force parity when sending data to the terminal.
Strip parity when sending data to the host.
Force parity when sending data to the host.
Strip Trailing Spaces.
Acknowledge TPAD data packets.
Convert leading STX character to SOH.
Terminate TPAD call is EOT only.
Clear TPAD call if there is no response to a TPAD transaction request for x seconds.
Generate an event when a TPAD transaction takes longer than x seconds
Digi TransPort® Routers User Guide
599
Configuring legacy protocols
Command tpad
Instance Parameter Values
n
tsla
03000
tpad
n
clear_time 0-2147483647
tpad
n
dialctx
0-255
Configure TPAD parameters
Equivalent web parameter
When the transaction time exceeds x milliseconds, increment the SLA Exceptionsstatistic.
Clear the call x seconds after receiving a response
If the terminal dial command specifies V.120 use PANS context x.
Digi TransPort® Routers User Guide
600
Configuring legacy protocols
Configure X.25 parameters
Configure X.25 parameters
Web
Go to Configuration > Network > Legacy Protocol > X.25 There are several groups of configuration parameters:
n General n LAPB n NUI Mappings n NUA / NUI Interface Mappings n Calls Macros n IP to X.25 Calls n PADS n n X.25 Settings n IP Settings n PADs n X.25 PVCs
Digi TransPort® Routers User Guide
601
Configuring legacy protocols
Configure X.25 parameters
Configure general X.25 parameters
Web
1. Go to Configuration > Network > Legacy Protocol > X.25 > General.
2. Configures global X.25 parameters:
When answering a X.25 call, use the addresses from CALL packet in the CALL CNF packet If enabled, when answering a call, the X.25 CALL CNF (call confirm packet) that the router sends to answer the call use the called and calling addresses from the CALL packet. You can enable this setting on a per-interface type basis, (LAPD, LAPB, or XoT).
Reset XOT PVC if the router is the Initiator If enabled, the router is responsible for resetting the links when an XOT PVC comes up. This parameter should only be set to Off when it is known that the responder will reset the links.
Reset XOT PVC if the router is the Responder If set to On, the router is responsible for resetting the links on XOT PVC links when it is the responder. The default for this parameter is Off.
Include length of header in IP length header For all X.25 calls that include an IP header length indication, such as IP Length Header is set to On a TPAD or PAD, etc, this parameter specifies whether the length indicated includes or excludes the length of the header itself. By default this setting is Off, in which case the length of the header is NOT included in the value. For example, suppose there is one byte of data of value 67 to encode. Then, 00 01 67 is the encoding if this parameter is set to Off as the length (00 01) is 1, because the length does not include the length of the header. When set to On, the length of the IP header is included in the value, such as 00 03 67 is the encoding as the header bytes are included. 3. Click Apply.
Digi TransPort® Routers User Guide
602
Configuring legacy protocols
Configure X.25 parameters
Command line
Command Instance Parameter Values Equivalent web parameter
x25gen 0
lapd_cnf_ addr
1=enabled When answering a X.25 call, use the addresses 0=disabled from CALL packet in the CALL CNF packet.
LAPD setting
x25gen 0
lapd_cnf_ addr
1=enabled When answering a X.25 call, use the addresses 0=disabled from CALL packet in the CALL CNF packet
LAPB setting
x25gen 0
xot_cnf_ addr
1=enabled When answering a X.25 call, use the addresses 0=disabled from CALL packet in the CALL CNF packet
XoT setting
x25gen 0
reset_
1=enabled Reset XOT PVC if the router is the Initiator
xotpvc_ini 0=disabled
x25gen 0
reset_ xotpvc_ resp
1=enabled Reset XOT PVC if the router is the Responder 0=disabled
x25gen 0
en_incl_ iphdr
1=enabled Include length of header in IP length header 0=disabled
Digi TransPort® Routers User Guide
603
Configuring legacy protocols
Configure X.25 parameters
Configure X.25 LAPB parameters
Link Access Procedure Balanced (LAPB) is a standard subset of the High-Level Data Link Control (HDLC) protocol. It is a bit-oriented, synchronous, link-layer protocol that provides data framing, flow control and error detection and correction. LAPB is the link layer that X.25 applications use. On Digi TransPort routers, you can use LAPB over ISDN or over a synchronous serial port.
Web
1. Go to Configuration > Network > Legacy Protocol > X.25 > LAPB.
2. Configure LAPB parameters:
Use: Serial port Port x (in Synchronous Mode) To use the LAPB instance over a synchronous serial port enable this setting and select a serial port number. To configure settings of the synchronous port such as speed and clock source navigate to Configuration > Network > Interfaces > Serial > Serial Port n > Sync Port n.
Use: ISDN Enable this setting to use LAPB over ISDN.
Digi TransPort® Routers User Guide
604
Configuring legacy protocols
Configure X.25 parameters
Mode DTE or DCE Determines whether LAPB will behave as DTE (Data Terminal Equipment) or DCE (Data Circuitterminating Equipment) in an X.25 protocol sense. Physical DTE vs. DCE wiring cannot be changed by configuration.
N400 Counter x This is the standard LAPB retry counter. The default value is 3 and it should not normally need to be changed.
RR Timer x milliseconds A standard LAPB Receiver Ready timer. The default value is 10,000 milliseconds (10 seconds) and it should not normally be necessary to change this.
T1 Timer x milliseconds A standard LAPB timer. The default value is 1000 milliseconds (1 second) and under normal circumstances, it should not be necessary to change it.
T200 Timer x milliseconds The standard LAPB re-transmit timer. The default value is 1000 milliseconds (1 second) and under normal circumstances, it should not be necessary to change it.
X.25 Window Size The X.25 window size. The value range is from 1 to 7 with the default being 7.
Disconnect link if there has been no X.25 activity for x seconds The length of time, in seconds, before the link is disconnected if there has been no X.25 activity. If this parameter is 0 or not specified, then the inactivity timer is disabled.
Disconnect link if there has been no activity for x seconds The length of time, in seconds, before the link is disconnected if there has been no activity. If this parameter is 0 or not specified, then the inactivity timer is disabled. It is useful to set this to a short period of time, for example, 120 seconds, when using a LAPB instance over ISDN; for example, with TPAD. Should the POS device fail to instruct TPAD to hang up you can use this timer as a backup hang-up timer thus saving ISDN call charges. When using LAPB on a synchronous port, set this parameter to 0.
Send X.25 Restart packet on receipt of SABM frame This parameter can be set to No or Immediate.
n When set to Immediate, the LAPB instance sends an X.25 restart packet immediately on receipt of an SABM (Set Asynchronous Balanced Mode) frame.
n If the parameter is set to No, no X.25 restart is sent.
ISDN Parameters
Allow this unit to answer calls If enabled, this instance of LAPB answers incoming ISDN calls.
Digi TransPort® Routers User Guide
605
Configuring legacy protocols
Configure X.25 parameters
Only accept calls from calling number ending with The filter for the ISDN Multiple Subscriber Numbering facility. It is blank by default. When set to an appropriate value with Allow this unit to answer calls enabled, the router answers incoming calls only to ISDN numbers where the trailing digits match the MSN value. For example, setting the MSN parameter to 123 prevents the router from answering any calls to numbers that do not end in 123.
Only accept calls with sub-address ending with The filter for the ISDN sub-addressing facility. It is blank by default but when set to an appropriate value, with Allow this unit to answer calls enabled, the router answers incoming ISDN calls only where the trailing digits of the sub address called match the Sub-address value. For example, setting the Sub-address to 123 prevents the router from answering any calls where the sub-address called does not end in 123.
Keep ISDN LAPB link activated when user sends a DISC or X.25 PAD session terminated When this parameter is enabled, the following setting is enabled:
Wait x milliseconds before attempting to establish the LAPB link after B-channel becoming active This parameter sets the length of time (in milliseconds), that the LAPB instance will wait from an ISDN B-channel becoming active before attempting to establish a LAPB connection, such as the length of time for which the LAPB instance stays passive. The default is 0, as most ISDN networks allow CPE devices to initiate a LAPB link. If your ISDN network does not permit CPE devices to initiate the LAPB link you should set this parameter to a value that allows the network sufficient time to establish the LAPB link.
Use as x a calling party number when making ISDN calls This is Calling Line Identification. The router will only answer calls from numbers whose trailing digits match what is entered in this field. The line the router is connected to must have CLI enabled by the telecoms provider, and the calling number cannot be withheld.
Async Mux 0710 Parameters Certain W-WAN modules use LAPB to perform multiplexing of serial channels. If using LAPB for X.25 over ISDN or serial, you can ignore these settings. Do not change these settings unless under the instruction of Digi Technical Support.
Mux 0710 mode If enabled, configures the LAPB instance use for multiplexing of serial channels instead of X.25.
Mux mode Controls the multiplexing mode.
DLC # The data link channel number to use for this virtual ASY port.
ASY port The physical ASY port over which to multiplex.
Digi TransPort® Routers User Guide
606
Configuring legacy protocols
Configure X.25 parameters
Virtual ASY port The virtual ASY port number that this LAPB instance will multiplex over the physical port. 3. Click Apply.
Command line
Command lapb
lapb
lapb
lapb
lapb lapb lapb lapb lapb lapb lapb lapb lapb lapb lapb
Instance Parameter Values
Equivalent web parameter
n
l1iface
port, isdn
Use: Serial port Port x (in Synchronous
(use port for Mode)
sync port)
n
l1nb
0, 1
Use: Serial port Port x (in Synchronous Mode) 0 for Port 0, 1 for Port 1
n
l1iface
port, isdn
Use: ISDN
(use isdn for
ISDN)
n
dtemode DTE/DCE
Mode DTE or DCE
mode:
0=DTE
1=DCE
n
N400
1-255
N400 Counter x
n
tnoact
1000-60000 RR Timer x milliseconds
n
t1time
1-60000
T1 Timer x milliseconds
n
t200
1-60000
T200 Timer x milliseconds
n
Window
1-7
X.25 Window Size
n
tinactx25 0-3000
Disconnect link if there has been no X.25
activity for x seconds
n
tinact
0-3000
Disconnect link if there has been no
activity for x seconds
n
restartact 1=enabled Send X.25 Restart packet on receipt of
0=disabled SABM frame
n
ans
1=enabled Allow this unit to answer calls
0=disabled
n
msn
text
Only accept calls from calling number ending with
n
sub
text
Only accept calls with sub-address ending with
Digi TransPort® Routers User Guide
607
Configuring legacy protocols
Configure X.25 parameters
Command lapb
lapb lapb lapb
lapb lapb lapb
Instance Parameter Values
n
ptime
0-60000
n
cli
text
n
mux_0710 1=enabled
0=disabled
n
mux_mode 0=Basic
1=Error
Recovery
n
dlc
0-63
n
asyport
0-255
n
virt_async 0-255
Equivalent web parameter Wait x milliseconds before attempting to establish the LAPB link after B-channel becoming active Only answer calls from numbers whose trailing digits match Mux 0710 mode
Mux mode
DLC # ASY port Virtual ASY port
Digi TransPort® Routers User Guide
608
Configuring legacy protocols
Configure X.25 parameters
Configure NUI mappings
When a TPAD call is taking place, the attached terminal sometimes only specifies a NUI (Network User ID) to call. If the X.25 network requires an NUA instead of an NUI to determine the destination of a call, you can use the NUI Mappings table to convert an NUI to an NUA. If a TPAD call specifies a call in which the NUI matches an entry the call actually placed on the network will contain the respective NUA and no NUI.
Web
1. Go to Configuration > Network > Legacy Protocol > X.25 > NUI Mappings.
2. Enter the NUI mappings. 3. Click Apply.
Command line
Command nuimap nuimap
Instance n n
Parameter nua nui
Values text text
Equivalent web parameter
Maps to NUA
NUI
Digi TransPort® Routers User Guide
609
Configuring legacy protocols
Configure X.25 parameters
Configure NUA / NUI interface mappings
For PAD and TPAD instances, use the NUA/NUI Interface Mappings table to override the following:
n Interface n Backup interface n IP address n TCP/UDP port number
Based upon data in the call request matching the following comparison fields:
n NUA called n NUI called n X.25 Call Data n PID
You can use the wildcard matching characters ? and * in the comparison fields, NUA, NUI, Call Data, and PID.
Web
1. Go to Configuration > Network > Legacy Protocol > X.25 > NUA/NUI Interface Mappings.
Note The Configuration > Network > Protocol Switch > NUA to Interface Mappings section duplicates this table, as the Protocol Switch can also use it. Not all of the fields are visible in the Protocol Switch section, as they do not all apply to the Protocol Switch.
2. Enter NUA/NUI interface mappings:
NUA The Network User Address.
NUI The Network User Identifier.
Call Data The X.25 Call Data.
PID The Protocol Identifier.
Digi TransPort® Routers User Guide
610
Configuring legacy protocols
Configure X.25 parameters
IP address The IP address.
IP Port The IP port number.
Interface The Primary interface name.
Backup Interface The Backup interface name. 3. Click Apply.
Command line
Command nuaip nuaip nuaip nuaip nuaip nuaip nuaip nuaip
Instance N N N n n n n n
Parameter nua nui cud pid IPaddr ip_port swto buswto
Values text text text text IP address 0-65535 0 -15 0 -15
Equivalent web parameter NUA NUI Call Data PID IP Address IP Port Interface Backup Interface
The interface and backup interface values are as follows:
Parameter value 0 1 2 3 4 5 6 7
Interface type Default LAPD LAPB 0 LAPB 1 XOT LAPD x (instance determined by NUA) LAPB 0 PVC LAPB 1 PVC
Digi TransPort® Routers User Guide
611
Configuring legacy protocols
Parameter value 8 9 10 12 13 14 15
Interface type XOT PVC TCP Stream UDP Stream LAPB 2 LAPB 2 PVC VXN SSL
Configure X.25 parameters
Digi TransPort® Routers User Guide
612
Configuring legacy protocols
Configure X.25 parameters
Configure X.25 call macros
You can to define up to 64 X.25 CALL macros for initiating ISDN and/or X.25 layer 3 calls. These simple English-like names are mapped to full command strings. For example, you could give the following call string the name X25test:
0800123456=789012Dtest data
Then you could execute this call string by entering:
CALL X25test
Web
1. Go to Configuration > Network > Legacy Protocol > X.25 > Call Macros.
2. To create a call macro, enter a name for the macro in the left column of the Call Macros table and in the right column enter the appropriate command string (excluding the ATD).
Macro The name of the macro, this can be any text.
Command The X.25 call command.
Add button Adds the X.25 call macro to the X.25 configuration. 3. Click Add. 4. Click Apply.
Digi TransPort® Routers User Guide
613
Configuring legacy protocols
Command line
Command macro macro
Instance n n
Configure X.25 parameters
Parameter name cmd
Values text text
Equivalent web parameter
Macro
Command
Digi TransPort® Routers User Guide
614
Configuring legacy protocols
Configure X.25 parameters
Configure IP to X.25 call strings
Web
1. Go to Configuration > Network > Legacy Protocol > X.25 > IP to X.25 Calls.
The IP to X.25 Calls page contains a table that allows you to enter a series of IP Port numbers and X.25 Call strings as shown below. These settings configure the router so that IP data can be switched over X.25. For example data that is received on a TCP connection can be answered by a PAD as if it is an X.25 call. This table is duplicated in theConfigure Protocol Switch software,as the protocol switch feature also uses this table. It is included at this point in the web user interface as a convenience if you need to use it for PAD instead of the protocol switch. 2. Enter the IP to X.25 calls parameters:
Total sockets Sockets available These display fields show the total number of sockets available and the number currently free is shown. Take care to not to allocate too many of the free sockets, unless you are confident other applications need them.
Port Used to set up the port numbers for those IP ports that will listen for incoming connections that are to be switched over X.25 or other protocol. In the case of switching to X.25, when such a connection is made the router will make an X.25 Call to the address specified in the X.25 Call field. Once this call has been connected, data from the port will be switched over the X.25 session.
Number of Sockets Selects how many IP sockets should simultaneously listen for data on the specified port. The number of available IP sockets will depend on the model you are using and how many are already in use (see note below).
X25 Call The X.25 call field may contain an X.25 NUA or NUI or one of the X.25 Call Macros defined on the Configuration > Advanced applications > X25 > Macros page.
Digi TransPort® Routers User Guide
615
Configuring legacy protocols
Configure X.25 parameters
PID The protocol ID (PID) to use when the router switches an IP connection to X.25. The PID field takes the format of four hexadecimal digits separated by commas, such as 1,0,0,0, at the start of the Call User Data field in the X.25 call.
Confirm Mode When confirm mode is set to On, then the incoming TCP socket is not successfully connected until the corresponding outgoing call has been connected. The incoming TCP socket triggers the corresponding outgoing call either to a local PAD instance or to whatever is configured. The effect of this mode is that the socket will fail if the outbound call fails and so may be useful in backup scenarios. In addition it will ensure no data is sent into a "black hole". (When this setting is not enabled, data that is sent on the inbound TCP connection before the outbound connection has been successful can be lost.)
RFC 1086 Mode: RFC 1086 specifies a mode of operation in which the IP socket answers and then with a simple protocol in the socket identifies the X.25 address and other X.25 call setup parameters to use. Then when the X.25 call parameters have been identified the X.25 call is made and if successful then data is then switched between the X.25 call and the IP socket. The protocol selects whether incoming or outgoing support is required.
IP Length Header When IP length header is On, the IP length indicator field is inserted at the start of each packet. When set to 8583 Ascii 4 byte, the IP length header conforms to the ISO 8583 format. In the example above, 3 IP sockets will listen for an incoming connection on IP Port 2004. Once connected each socket makes an X.25 Call to jollyroger. The router recognizes that jollyroger is a pre-defined macro (as illustrated below), and translates it into an X.25 Call to address 32423 with the string x25 data included as data in the call. The outgoing X.25 call(s) are made over whichever interface is specified by the Switch from XOT(TCP) to parameter on the Configuration > Network > Protocol Switchpage.
Add button Adds the IP to X.25 call mapping to the X.25 configuration. 3. Click Add to add each call mapping. 4. Click Apply.
Command line
Command Instance Parameter
ipx25
n
ip_port
ipx25
n
nb_listens
ipx25
n
x25call
ipx25
n
pid
Values
Equivalent web parameter
0-65535
IP Port
0-software-dependent max Number of Sockets
NUA, NUI or X.25 macro name
X25 Call
hex numbers
PID
Digi TransPort® Routers User Guide
616
Configuring legacy protocols
Command Instance Parameter Values
ipx25
n
cnf_mode
1=enabled, 0=disabled
ipx25
n
rfc1086_mode 1=enabled, 0=disabled
ipx25
n
iphdr
0=Off 1=On 2=8583 Ascii 4 byte
Configure X.25 parameters
Equivalent web parameter Confirm Mode RFC 1086 Mode IP length header
Digi TransPort® Routers User Guide
617
Configuring legacy protocols
Configure X.25 parameters
Configure Packet Assembler Dissassembler (PADS)
Packet Assembler Disassembler (PADS) provides an interface between a character based serial connection and an X.25 synchronous packet switched network. There are two main elements to the configuration procedure for accessing X.25 networks:
n General and service related parameters n PAD parameters (X.3)
TransPort routers have four pre-defined standard PAD profiles numbered 50, 51, 90 and 91. You can also create up to four custom PAD profiles numbered 1 to 4 for each PAD instance.
Web
1. Go to Configuration > Network > Legacy Protocol > X.25 > PADs . Each X.25 PAD configuration page also includes a sub-page detailing the X.3 PAD parameters. Collectively this set of values is known as a PAD profile. Y
Digi TransPort® Routers User Guide
618
Configuring legacy protocols
Configure X.25 parameters
2. Set PAD parameters:
Use PAD over interface Selects whether the PAD instance uses ISDN B-channel X.25, ISDN D-channel X.25, TCP, UDP, VXN, SSL TCP or SSL XoT as the transport protocol.
Digi TransPort® Routers User Guide
619
Configuring legacy protocols
Configure X.25 parameters
n For ISDN D-channel operation, select the LAPD option is selected. n For ISDN B-channel operation or operation through a synchronous port, select LAPB. n For LAPB and LAPD, you can also specify an interface number. This parameter specifies which LAPB or LAPD instance to use for the relevant TPAD instance. Select 0 or 1 for LAPB or 0 or 1 for LAPD.
Use backup interface A backup interface to use automatically if the call to the primary interface fails. The primary interface is tried first for every new call attempt. 3. Set X.25 settings:
Default X.25 packet size The default X.25 packet size. This can be set to 16, 32, 64128, 256, 512 or 1024, but the actual values permitted are normally constrained by your service provider.
Answer incoming calls from NUA The NUA that the router responds to for incoming X.25 calls.
Only answer calls with CUG The PAD will only answer calls with this Call User Group (CUG) specified.
Use X.25 Call Macro macroname to an ATD command The name of an X.25 call macro to use when the router receives an ATD command. The router ignores the ATD command, replacing it with a PAD CALL command using the macro. The purpose of this feature is to allow non-PAD terminals to use an X.25 PAD network connection. To configure X.25 call macros, go to the Configuration > Network > Legacy Protocols > X.25 > Call Macros web page, or use the macro text command.
When making an outgoing call Use NUA The NUA to use as the calling NUA when the router makes an outgoing X.25 call.
LCN The router supports up to 8 logical X.25 channels. In practice, the operational limit is determined by the particular service to which you subscribe (usually 4). Each logical channel must be assigned a valid Logical Channel Number (LCN). The LCN parameter is the value of the first LCN that will be assigned for outgoing X.25 CALLs. The default is 1027. For incoming calls, the router accepts the LCN specified by the caller.
LCN direction Whether the LCN for outgoing X.25 calls is incremented or decremented from the starting value when multiple X.25 instances share one layer 2 (LAPB or LAPD), connection. The default is Down and LCNs are decremented, such as if the first CALL uses 1024, the next will use 1023, etc. Setting the parameter to Up causes the LCN to be incremented from the start value.
NUI/NUA selection If both an NUI and an NUA are included in the call string, this parameter allows the router to filter one of these out of the X.25 call request. This can be extremely useful in backup
Digi TransPort® Routers User Guide
620
Configuring legacy protocols
Configure X.25 parameters
scenarios. Consider the following example; the router is configured to do online authorizations via the ISDN D channel and to fall back to B-channel (if the D-channel host did not respond for any reason). Using this parameter in conjunction with the backup equivalent, it is possible to configure the router to use the supplied NUA to connect over D-channel and the supplied NUI to connect over B channel (for backup).
On the backup interface LCN Sets the first LCN to use for the backup interface.
On the backup interface LCN Direction Whether the LCN for the backup X.25 interface is incremented or decremented from the starting value when multiple X.25 instances share a single layer 2 connection.
On the backup interface NUI/NUA selection If both an NUI and an NUA are included in the call string, this parameter allows the router to filter one of these out of the X.25 call request.
Enable X.25 Restart Packets It is normally possible to make X.25 CALLs immediately following the initial SABM-UA exchange. In some cases however, the X.25 network may require an X.25 Restart before it will accept X.25 CALLs. The correct mode to select depends upon the particular X.25 service to which you subscribe. The default value is On. This means that the router will issue X.25 Restart packets. To prevent the router from issuing Restart packets, set this parameter to Off.
Restart delay When the Restarts parameter is On, the Restart delay value determines the length of time in milliseconds that the router will wait before issuing a Restart packet. The default value is 2000 giving a delay of 2 seconds. 4. Set IP settings parameters:
Remote IP address The destination host that will answer the XOT, TCP, SSL, or UDP call.
Remote IP Address when using the backup interface The destination host that will answer the XOT, TCP, SSL, or UDP call if a connection via the primary interface has failed and the PAD is configured to backup to a secondary interface that is using an IP based protocol.
IP Stream port The TCP or UDP port number to use for IP (but not XoT) connections.
IP length header When set to On, and in IP Stream mode, the length of a data sequence is inserted before the data. For the receive direction, it is assumed the length of the data is in the data stream. When set to 8583 Ascii 4 byte, the IP length header conforms to the ISO 8583 format.
Digi TransPort® Routers User Guide
621
Configuring legacy protocols
Configure X.25 parameters
Set PAD parameters:
PAD prompt Allows you to redefine the standard PAD> prompt. To change the prompt, enter a new string of up to 15 characters into the text box.
PAD mode The PAD Mode parameter can be set to Normal or Prompt Always On. In Prompt Always On mode, the ASY port attached to the PAD behaves as if it were permanently connected at layer 2, such as it always displays a PAD> prompt. AT commands may still be entered but the normal result codes are suppressed. To disable this mode set the parameter to Normal.
Use PAD Profile The PAD profile # allows you to select the PAD profile to use for this PAD instance. There are four pre-defined profiles, numbered 50, 51, 90, and 91. In addition to the pre-defined profiles, you can also create up to four user-defined profiles numbered 1, 2, 3, and 4. To assign a particular profile to the PAD select the appropriate number from the list.
Strip Trailing Spaces If set to On, any spaces received at the end of a sequence of data from the network are removed before being relayed to the PAD port.
Enable Leased Line Mode If set to On, causes the PAD to always attempt to be connected using the Auto macro setting as the call command.
Send ENQ on Connect If set to On, the PAD sends an ENQ character on the ASY link when an outgoing call has been answered.
Enable STX / ETX Filtering If set to On, the PAD ignores data that is not encapsulated between ASCII characters STX (Ctrl+B) and ETX (Ctrl+C). To disable this feature select the Off option.
Delay connect message n x 10 milliseconds Delay the Connect message by the number of milliseconds specified. This is useful when working with equipment previously connected to slower networks that may have difficulty processing the quicker Connect on modern networks.
Delay data transfer after connection by n x 10 milliseconds Delays the data delivered from the X.25 or other type of connection to the terminal upon initial connection.
Terminate the PAD call after x seconds if there has been no data transmission The length of time, in seconds, after which the PAD will terminate an X.25 call if there has been no data transmission.
Digi TransPort® Routers User Guide
622
Configuring legacy protocols
Configure X.25 parameters
Disconnect the layer 2 call if there is no layer 3 call in progress for x seconds The length of time, in seconds, after which the router disconnects a layer 2 link if there are no layer 3 calls in progress. For LAPB sessions, this also terminates the ISDN call.
Create an event when the following data is on the PAD A string, which if it appears in the received data causes a Data Trigger (47) event to be generated and recorded in the event log.
Create an event when there has been no activity on the PAD for x seconds The time, in seconds, in which if there is no activity on the PAD an event in the event log is posted. You can use this parameter to trigger email exceptions. 5. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
pad
n
l2iface
lapb, lapd, TCP, SSL Use PAD over interface
pad
n
l2nb
0-255 (instance of Use PAD over interface
LAPB or LAPD)
pad
n
ip_stream 0=off (for XoT), 1=TCP, 2=UDP
Use PAD over interface
pad
n
defpak
16,32,64,128,256,512 Default X.25 packet size or 1024
pad
n
ansnua text (valid NUA)
Answer incoming calls from NUA
pad
n
anscug text (valid CUG)
Only answer calls with CUG
pad
n
amacro text
Use X.25 Call Macro macroname to an ATD command
pad
n
cingnua text (valid NUA)
Use NUA
pad
n
lcn
1-4095
LCN
pad
n
lcnup
1=up, 0=down
LCN Direction
pad
n
nuaimode 0=NUI and NUA, 1=NUA only, 2=NUI only
NUI/NUA selection
pad
n
dorest
1=enabled, 0=disabled
Enable X.25 Restart Packets
pad
n
restdel 0 -60000 (ms)
Restart delay
pad
n
IPaddr
text
Remote IP address
Digi TransPort® Routers User Guide
623
Configuring legacy protocols
Configure X.25 parameters
Command Instance Parameter Values
Equivalent web parameter
pad
n
buipaddr text
Remote IP Address when using the backup interface
pad
n
ip_port 0-65535
IP Stream port
pad
n
iphdr
0=Off 1=On 2=8583 Ascii 4 byte
IP length header
pad
n
prompt text
PAD prompt
pad
n
padmode 0=Normal
PAD mode
1=Prompt Always On
pad
n
profile
1-4, 50, 51,90,91
Use PAD Profile
pad
n
strip_ tspaces
1=enabled 0=disabled
Strip Trailing Spaces
pad
n
llmode
1=enabled 0=disabled
Enable Leased Line Mode
pad
n
enqcon
1=enabled 0=disabled
Send ENQ on Connect
pad
n
stxmode 1=enabled 0=disabled
Enable STX / ETX Filtering
pad
n
delconmsg 0-10
Delay connect message n x 10 milliseconds
pad
n
data_del 0-2147483647
Delay data transfer after connection by n x 10 milliseconds
pad
n
inacttim 0-1000
Terminate the PAD call after x seconds if there has been no data transmission
pad
n
nocalltim 0-60000
Disconnect the layer 2 call if there is no layer 3 call in progress for x seconds
pad
n
trig_str text
Create an event when the following data is on the PAD
pad
n
inactevent 0-2147483647
Create an event when there has been no activity on the PAD for x seconds
Stopping and starting PADs To stop and start PAD instances, use the following CLI commands:
n stoppads: Stops all PAD instances from accepting and performing any PAD commands. n gopads: Resumes processing of PAD commands.
The stoppads and gopads commands can have the PAD number specified in the syntax to stop and start individual PAD instances. For example:
Digi TransPort® Routers User Guide
624
Configuring legacy protocols
Configure X.25 parameters
n To stop PAD 1 from processing PAD commands:
stoppads 1
n To re-enable PAD 1:
gopads 1
X3 parameters
Each PAD configuration page has an attached sub-page that allows you to edit the X.3 PAD parameters. These pages allow you to load one of the standard profiles or edit the individual parameters to suit your application requirements and save the resulting customized user profile to non-volatile memory.
Loading and saving PAD profiles To create your own PAD profiles, edit the appropriate parameters and then select user profile 1, 2, 3 or 4 as required from the list and click the Save Profile button. Each PAD profile page includes two list boxes for loading and saving PAD profiles. To load a particular profile, select the profile from the list and click the Load Profile button. The parameter table is updated with the values from the selected profile.
Digi TransPort® Routers User Guide
625
Configuring legacy protocols
Configure X.25 parameters
1 PAD recall character
Determines whether PAD recall is enabled. When this facility is enabled, typing the PAD recall character temporarily interrupts the call and returns you to the PAD> prompt where you may enter normal PAD commands as required. To resume the interrupted call, use the CALL command without a parameter. The default PAD recall character is [Ctrl-P]. This may be changed to any ASCII value in the range 32-125 or disabled by setting it to 0. When a call is in progress and you need to actually transmit the character that is currently defined as the PAD recall character, simply enter it twice. The first instance returns you to the PAD> prompt; the second resumes the call and transmits the character to the remote system.
Option 0
Description Disabled
Digi TransPort® Routers User Guide
626
Configuring legacy protocols
Configure X.25 parameters
Option 1 32-126
Description PAD recall character is CTRL-P (ASCII 16, DEL) PAD recall character is user defined as specified
2 Echo
Enables or disables local echo of data transmitted during a call. When echo is enabled, you can use X.3 parameter 20 to inhibit echoing certain characters.
Option 0 1
Description Echo off Echo on
3 Data forwarding characters Defines which characters cause data to be assembled into a packet and forwarded to the network.
Option 0 1 2 4 8 16 32 64
Description No data forwarding character Alphanumeric characters (A-Z, a-z, 0-9) CR ESC, BEL, ENQ, ACK DEL, CAN, DC2 EXT, EOT HT, LF, VT, FF Characters of decimal value less than 32
Combinations of the above sets of characters are possible by adding the respective values together. For example, to define CR, EXT and EOT as data forwarding characters, set this parameter to 18 (2 + 16). If no forwarding characters are defined the Idle timer delay (parameter 4) should be set to a suitable value, typically 0.2 seconds.
4 Idle timer delay Defines a time-out period after which data received from the DTE is assembled into a packet and forwarded to the network. If the forwarding time-out is disabled, one or more characters should be selected as data forwarding characters using parameter 3.
Option 0 1
Description No data forwarding time-out Data forwarding time-out in 20ths of a second.
Digi TransPort® Routers User Guide
627
Configuring legacy protocols
Configure X.25 parameters
5 Ancillary device control
Determines method of flow control the PAD uses to temporarily halt and restart the flow of data from the DTE during a call.
Option 0 1 3
Description No flow control XON/XOFF flow control RTS/CTS flow control (not a standard X.3 parameter)
6 Suppression of PAD service signals Determines whether or not the PAD> prompt and/or Service/Command signals are issued to the DTE.
Option 0 1 4 5
Description PAD prompt and signals disabled PAD prompt disabled, signals enabled PAD prompt enabled, signals disabled PAD prompt enabled, signals disabled
7 Action on break (from DTE) Determines the action taken by the PAD on receipt of a break signal from the DTE.
Option 0 1 2 4 8 16
Description No action Send an X.25 interrupt packet Send an X.25 reset packet to the remote system Send an X.29 indication of break Escape to PAD command state Set PAD parameter 8 to 1 to discard output
Multiple actions on receipt of break are possible, by setting this parameter to the sum of the appropriate values for each action required. For example, when parameter 7 is set to 21 (16 + 4 + 1), an X.25 interrupt packet is sent followed by an X.29 indication of break, and then parameter 8 is set to 1. Do not set this parameter to 16; doing so would mean the remote system would receive no indication that a break had been issued and output to the DTE would therefore remain permanently discarded. If you need to use the discard output option, use it with the X.29 break option. so that on receipt of the X.29 break, the remote system can re-enable output to your DTE using parameter 8.
8 Discard output
Determines whether data received during a call is passed to the DTE or discarded. The remote system can directly set this value only; you can use this setting in a variety of circumstances when the remote
Digi TransPort® Routers User Guide
628
Configuring legacy protocols
Configure X.25 parameters
DTE cannot handle a continuous flow of data at high speed.
Option 0 1
Description Normal data delivery to DTE Output to DTE discarded
9 Padding after CR
Slower terminal devices, such as printers, may require a delay after each Carriage Return before they can continue to process data. This parameter controls the number of pad characters (NUL-ASCII 0) that are sent after each CR to create such a delay.
Option 0 1-255
Description No padding characters after CR Number of padding characters (NUL) sent after CR
10 Line folding
Controls the automatic generation of a [CR],[LF] sequence after a certain line width has been reached.
Option 0 1-255
Description No line folding Width of line before the PAD generates [CR],[LF]
11 Port speed This is a read only parameter, set automatically by the PAD and accessed by the remote system.
Option 15 14 12 3
Description 19,200 bps 9,600 bps 2,400 bps 2,400 bps
12 Flow control of PAD (by DTE) Determines the flow control setting of the PAD by the DTE in the on-line data state.
Option 0 1 3
Description No flow control XON/XOFF flow control RTS/CTS flow control (not a standard X.3 parameter)
Digi TransPort® Routers User Guide
629
Configuring legacy protocols
Configure X.25 parameters
13 LF insertion (after CR) Controls the automatic generation of a Line Feed by the PAD.
Option 0 1 2 4
Description No line feed insertion Line Feeds inserted in data passed TO the DTE Line Feeds inserted in data received FROM the DTE Line Feeds inserted after CRs echoed to DTE
The line feed values can be added together to select Line Feed insertion to any desired combination.
14 LF padding Some terminal devices, such as printers, require a delay after each Line Feed before they can continue to process data. This parameter controls the number of padding characters (NUL-ASCII 0) that are sent after each [LF] to create such a delay.
Option 0 1-255
Description No line feed padding. Number of NUL characters inserted after LF
15 Editing Enables (1) or disables (0) local editing of data input fields by the PAD before data is sent. The three basic editing functions provided are character delete, line delete and line re-display. The editing characters are defined by parameters 16, 17, and 18. In addition, parameter 19 determines which messages are issued to the DTE during editing. When editing is enabled, the idle timer delay (parameter 4) is disabled. You must use parameter 3 to select the desired data forwarding condition.
16 Delete character The edit mode delete character (ASCII 0-127). The default is backspace (ASCII 08).
17 Line delete character The edit mode line buffer delete character (ASCII 0-127). The default is CTRL-X (ASCII 24).
18 Line redisplay character The character that re-displays the current input field when in editing mode (ASCII 0-127). The default is CTRL-R (ASCII 18).
19 Editing PAD service signals The type of service signal sent to the DTE when editing input fields.
Digi TransPort® Routers User Guide
630
Configuring legacy protocols
Configure X.25 parameters
Option 0 1 2
Description No editing PAD service signals. PAD editing service signals for printers. PAD editing service signals for terminals.
20 Echo mask Defines characters that are not echoed when echo mode has been enabled using parameter 2.
Option 0 1 2 4 8 16 32 64 128
Description No echo mask (all characters are echoed) CR LF VT, HT or FF BEL, BS ESC,ENQ ACK,NAK,STX,SOH,EOT,ETB,ETX No echo of characters set by parameters 16, 17 & 18 No echo of characters set by parameters 16, 17 & 18
Combinations of the above sets of characters are possible by adding the respective values together.
21 Parity treatment Sets use of parity generation/checking.
Option 0 1 2 3
Description No parity generation or checking Parity checking on Parity generation on Parity checking and generation on
22 Page wait
Determines how many line feeds are sent to the terminal before output is halted on a page wait condition. In other words, it defines the page length for paged mode output. A page wait condition is cleared when the PAD receives a character from the terminal.
Digi TransPort® Routers User Guide
631
Configuring legacy protocols
Configure X.25 parameters
Option 0 1
Description Page wait feature disabled Number of line feeds sent before halting output
Command line
To edit the X.3 PAD parameters from the command line, use the set command, described in X.25 packet switching.
Digi TransPort® Routers User Guide
632
Configuring legacy protocols
Configure X.25 parameters
Configure an X.25 Permanent Virtual Circuit (PVC)
A Permanent Virtual Circuit (PVC) provides the X.25 equivalent of a leased line service. With a PVC there is no call setup or disconnect process; you can just start sending and receiving X.25 data on a specified LCN. For each X.25 service connection you may setup up multiple PVCs each of which uses a different LCN (or a mixture of PVCs and SVCs). Digi routers support up to four PVCs numbered 0-3.
Web
1. Go to .Configuration > Network > Legacy Protocol > X.25 > X.25 PVCs > X.25 PVC n.
2. Configure X.25 PVC parameters:
Enable this PVC Enables or disables the PVC.
LCN The LCN value use for this PVC. For an XOT PVC, this parameter defines the Responder LCN field in the PVC setup packet, though the XOT PVC connection always uses an LCN of 1. For an XOT PVC, this field should contain the remote connection's LCN.
PVC Mode The lower layer interface use for the PVC. This setting can be set to LAPB, LAPD or TCP, for XOT mode.
Connect this PVC to PAD x What type of upper layer interface is connected to this PVC and can be set to PAD for an X.25 PAD, TPAD for a TPAD instance, or XSW for X.25 switching. If set to XSW for the X.25 switch, the
Digi TransPort® Routers User Guide
633
Configuring legacy protocols
Configure X.25 parameters
X.25 switch must also be configured regarding the interfaces to switch this PVC to/from. For example, if this is an incoming XOT PVC we are configuring, the Switch from XOT PVC parameter must be set to the desired destination interface.
Use packet size The packet size for the PVC. Select the appropriate value from the drop down list.
Use window size The layer 3 window size for the PVC. Select the appropriate value from the drop down list.
Remote IP address The IP address for outgoing XOT calls.
Use the source IP address from interface x,y Which Ethernet or PPP interface to use for the source IP address.
Initiator interface The name of the interface from which the PVC was initiated, such as Serial 1. The initiator and responder strings identify the circuit when PVCs are being set up. They must match the names in the remote router that terminates the XOT PVC connection. If the unit terminating the PVC XOT connection is not another Digi router, you must refer to the documentation or the configuration files of the other unit to determine the names of the interfaces.
Responder interface The name of the interface to which a PVC initiator is connected, such as Serial 2. 3. Click Apply.
Command line
Command Instance Parameter Values
pvc
n
l2iface
Blank or lapb, lapd, tcp
pvc
n
lcn
0-4096
pvc
n
uliface
pad, tpad, xsw
pvc
n
psize
0=default 4=16 5=32 6=64 7=128 8=256 9=512 10=1024
pvc
n
window 1-7
pvc
n
ipaddr
IP address
Equivalent web parameter Enable this PVC LCN Connect this PVC to PAD x Use packet size
Use window size Remote IP address
Digi TransPort® Routers User Guide
634
Configuring legacy protocols
Command Instance Parameter Values
pvc
n
srcipent auto, eth, ppp
pvc
n
srcipadd 0-255
pvc
n
pvc
n
iniface
text
respiface text
Configure X.25 parameters
Equivalent web parameter Use the source IP address from interface x,y Use the source IP address from interface x,y Initiator interface Responder interface
Digi TransPort® Routers User Guide
635
Configuring legacy protocols
Configure X.25 parameters
X.25 packet switching
X.25 is a data communications protocol employed throughout the world for wide area networking across Packet Switched Data Networks (PSDNs). The X.25 standard defines the way in which terminal equipment establishes, maintains and clears Switched Virtual Circuits (SVCs), across X.25 networks to other devices operating in packet mode on these networks. The protocols involved in X.25 operate at the lower three layers of the ISO model:
n At the lowest level the Physical layer defines the electrical and physical interfaces between the DTE and DCE.
n Layer 2 is the Data Link Layer that defines the unit of data transfer as a "frame" and includes the error control and flow control mechanisms.
n Layer 3 is the Network layer. This defines the data and control packet structure and the procedures for accessing services that are available on PSDNs.
Another standard, X.31, defines the procedures for accessing X.25 networks via the ISDN B and Dchannels. Digi ISDN products include support for allowing connected terminals to access X.25 over ISDN B channels, the ISDN D-channel or over TCP. They can also be configured so if there is a network failure, the router automatically switches to using an alternative service. The Packet Assembler/Disassembler (PAD) interface conforms to the X.3, X.28, and X.29 standards. Up to 6 PAD instances, from an available pool of 8, can be created and dynamically assigned to the asynchronous serial ports or the REM pseudo-port. Each application that uses the router to access an X.25 network has its own particular configuration requirements. For example, you may need to program your Network User Address (NUA) and specify which Logical Channel Numbers (LCNs) to use on your X.25 service. This information is available from your X.25 service provider. You also need to decide whether your application uses B- or D-channel X.25. Once you have this information, use the PAD configuration pages to set up the appropriate parameters.
B-channel X.25
The router can transfer data to/from X.25 networks over either of the ISDN B-channels. Once the router has been configured appropriately, the ISDN call to the X.25 network can be made using an ATD command or by executing a pre-defined macro. The format of the ATD command allows you to combine the ISDN call and the subsequent X.25 call in a single command. Alternatively, the X.25 call may be made separately from the PAD> prompt once the ISDN connection to the X.25 network has been established.
D-channel X.25
The router can transfer data to/from X.25 networks over the ISDN D-channel if your ISDN service provider supports this facility. The speed at which data can be transferred varies depending on the service provider, but is generally 9600 bits per second or lower.
X.28 commands
Once an X.25 session layer has been established the router switches to PAD mode. In this mode, operation of the PAD is controlled using the standard X.28 PAD commands listed in the following table:
Digi TransPort® Routers User Guide
636
Configuring legacy protocols
Configure X.25 parameters
Command CALL CLR ICLR INPAR? INPROF INSET INT LOG PAR? PROF RESET RPAR? RSET SET STAT
Description Make an X.25 call. Clear an X.25 call. Invitation to CLR. List X.3 parameters of specified PAD instance. Load or save specified PAD profile. Set X.3 parameters of specified PAD instance. Send Interrupt packet. Log off and disconnect. List local X.3 parameters. Load or save PAD profile. Send reset packet. List remote X.3 parameters. Set remote X.3 parameters. Set local X.3 parameters. Display channel status.
CALL command: Make an X.25 call
The full structure of a CALL command is:
CALL [<facilities->]<address>[D<user data>]
where:
n <facilities-> is an optional list of codes indicating the facilities to be requested in the call (separated by commas, terminated with a dash)
n <address> is the destination network address. n <user data> is any optional user data to be included with the call.
The facility codes supported are:
n F: Fast select-no restriction n Q: Fast select-restricted response n Gnn: Closed User Group n Gnnnn: Extended Closed User Group n R: Reverse charging n N<NUI>:Network User Identity code (NUI)
Example The following command places a call to address 56512120 using reverse charging and specifying Closed User Group 12. The string MYNUI is your Network User Identity. The string Hello appears in
Digi TransPort® Routers User Guide
637
Configuring legacy protocols
Configure X.25 parameters
the user data field of the call packet.
CALL R,G12,NMYNUI-56512120DHello
Note The particular facilities available vary among X.25 service providers.
If a CALL command is issued without the address parameter, it is assumed you want to go back online to a previously established call, using the PAD recall facility to temporarily return to the PAD> prompt.
Fast select (ISDN B-channel only)
When the standard Fast select facility is requested using the F facility code, the call packet generated by the CALL command is extended to allow the inclusion of up to 124 bytes of user data. For example: CALL F-1234567890DThis DATA sent with call packet causes an X.25 CALL packet to be sent using the Fast select facility including the message This DATA sent with call packet. The Carriage Return for entering the command is not transmitted. If the Fast select facility code is not included, only the first 12 characters are sent. When a Fast select CALL has been made, the PAD accepts an extended format response from the called address. This response, consisting of up to 124 bytes of user data, can be appended to the returning call accepted or call clear packet. When one of these packets is received, the user data is extracted and passed from the PAD to the terminal immediately prior to the CLR DTE . . . message in the case of a call clear packet or CON COM message in case of a call accepted packet. When a restricted response Fast select call has been made using the Q facility code, the call packet indicates that a full connection is not required, so that any response to the user data in the CALL packet should be returned in a call clear packet. When the PAD receives an incoming call specifying Fast select, the call is indicated to the terminal in the normal way. For example:
IC 1234567890 FAC: Q,W:2 COM
indicates that an incoming call had been received requesting Restricted response fast select and a window size of 2. The user (or system) then has 15 seconds in which to pass up to 124 bytes of data to the PAD to be included in the clear indication packet that is sent in response to the call. The PAD does not differentiate between standard and restricted response Fast select on incoming calls and, consequently, will always respond with a clear indication.
Network User Identity (NUI) The N facility code allows you to include your Network User Identity in the call packet. For security reasons, the PAD echoes each character as an asterisk (*) during the entry of an NUI. Some X.25 services use the NUI field to pass both a username and password for validation. For example, if your username is MACDONALD and your password is ASDF, a typical CALL command would have the format:
CALL NMACDONA;ASDF-56512120
where the ; character separates the username from the password.
Closed User Group (CUG) Most X.25 networks support Closed User Groups. Closed User Groups restrict subscribers to only making calls or receiving calls from other members of the same CUG. The CUG number effectively provides a form of sub-addressing working with the NUA to identify the destination address for a call.
Digi TransPort® Routers User Guide
638
Configuring legacy protocols
Configure X.25 parameters
When the G facility code is specified in a CALL packet, it must be followed by the CUG number. This can be a 2- or 4-digit number. If you are a member of a closed user group, the network may restrict you to only making calls to or receiving calls from other members of the same group.
Reverse charging Reverse charging, specified using the R facility code, allows outgoing calls to be charged to the account of destination address. Whether or not a call is accepted on a reverse charging basis is determined by the service provider and by the type of account held by the called user.
Calling user data The calling user data field for a normal call can contain up to 12 bytes of user data. If the first character is an exclamation mark (!), the PAD omits the 4-byte protocol identifier, and allows the full 16 bytes as user data. The same is true for a fast select call, except the maximum amount of user data is increased from 124 to 128 bytes. When entering user data, you can use the tilde character () to toggle between ASCII and binary mode. In ASCII mode, data is accepted as typed, but in binary mode, you must enter each byte as the required decimal ASCII code separated by commas. For example, to enter the data Line1 followed by [CR][LF] and Line2, enter:
DLine1~13,10~Line2
CLR command: Abort a CALL command To abort an X.25 CALL, use the X.28 CLR command, do one of the following:
n Press [Enter]. n Drop DTR from the terminal while the call is in progress. Dropping DTR will also terminate an
established call.
If a call is terminated by the network or by the remote host, the router returns a diagnostic message before the NO CARRIER result code. Messages can be numeric or verbose, depending on the setting of the ATV command.
Verbose messages and their numeric codes The following table lists the verbose messages and equivalent numeric codes:
Note The router may abbreviate some verbose messages.
Code Verbose message
1
Unallocated (unassigned) number
2
No route to specified transit network
3
No route to destination
4
Channel unacceptable
6
Channel unacceptable
7
Call awarded and being delivered in an established channel
16 Normal call clearing
Digi TransPort® Routers User Guide
639
Configuring legacy protocols
Code Verbose message 17 User busy 18 No user responding 19 No answer from user (user alerted) 21 Call rejected 22 Number changed 26 Non-selected user clearing 27 Destination out of order 28 Invalid number format 29 Facility rejected 30 Response to STATUS ENQUIRY 31 Normal, unspecified 34 No circuit/channel available 38 Network out of order 41 Temporary failure 42 Switching equipment congestion 43 Access information discarded 44 Requested circuit/channel not available 47 Resources unavailable, unspecified 49 Quality of service unavailable 50 Requested facility not subscribed 57 Bearer capability not authorized 58 Bearer capability not presently available 63 Service or option not available, unspecified 65 Bearer capability not implemented 66 Channel type not implemented 69 Requested facility not implemented 70 Only restricted digital information bearer 79 Service or option not implemented, unspecified 81 Invalid call reference value 82 Identified channel does not exist
Configure X.25 parameters
Digi TransPort® Routers User Guide
640
Configuring legacy protocols
Configure X.25 parameters
Code Verbose message 83 A suspended call exists, but this call identity does not 84 Call identity in use 85 No call suspended 86 Call having the requested call identity has been cleared 88 Incompatible destination 90 Destination address missing or incomplete 91 Invalid transit network selection 95 Invalid message, unspecified 96 Mandatory information element is missing 97 Message type non-existent or not implemented 98 Message not compatible with call state or message type nonexistent or not implemented 99 Information element non-existent or not implemented 100 Invalid information element contents 101 Message not compatible with call state 102 Recovery on timer expired 111 Protocol error, unspecified 127 Interworking, unspecified 128 General level 2 call control failure (probable network failure)
CLR command: Clear an X.25 Call The CLR command clears the current call and release the associated virtual channel for further calls. On completion of call clear, the PAD> prompt is re-displayed. Several other situations can clear a call. If one of these situations occurs, a message is issued to the PAD in the following format:
CLR <Reason> C:<n> - <text>
where:
n <Reason> is a 2/3 character clear down code n <n> is the numeric equivalent of the clear down code n <text> is a description of the reason for clear down
The clear down reason codes supported by the router are listed in the following table:
Reason Code DTE
Numeric Code 0
Text by remote device
Digi TransPort® Routers User Guide
641
Configuring legacy protocols
Configure X.25 parameters
Reason Code OOC INV NC DER NA NP RPE ERR ROO RNA ID FNA SA
Numeric Code 1 3 5 9 11 13 17 19 21 25 33 41 57
Text number busy invalid facility requested temporary network problem number out of order access to this number is barred number not assigned remote procedure error local procedure error cannot be routed as requested reverse charging not allowed incompatible destination fast select not allowed ship cannot be contacted
If an unknown reason code is received, the text field is blank.
ICLR command: Invitation To CLR The ICLR command invites the remote X.25 service to CLR the current X.25 session.
INT command: Send interrupt packet INT causes PAD to transmit an interrupt packet. These packets flow outside normal buffering/flow control constraints interrupt the current activity.
LOG command: Log off and disconnect LOG terminates an X.25 session. It causes the PAD to clear any active X.25 calls, disconnect, and return to AT command mode.
PAR? command: List local X.3 parameters PAR? lists the local X.3 parameters for the current session.
PROF command: Load or save a PAD profile The PROF command stores or retrieves a pre-defined set of X.3 PAD parameters, called a PAD profile. The information is stored in system file called X3PROF. There are 4 pre-defined profiles, numbered 50, 51, 90, and 91. Additionally, you can create 4 user PAD profiles, numbered 1 to 4. Profile 50 is automatically loaded when a PAD is first activated. To load one of the other pre-defined profiles, use the PROF command, followed by the required profile number. For example:
PROF 90
To create a user PAD profile, use the SET command to configure the various PAD parameters to suit your application, then use the PROF command in the format:
PROF &nn
Digi TransPort® Routers User Guide
642
Configuring legacy protocols
Configure X.25 parameters
where nn is the number of the User PAD profile to store, such as 03. Alternatively, you can use the web interface to edit the parameters directly (Configuration > Network > Legacy Protocols > X.25 > PADs n-n > PAD n > PAD Settings).
The pre-defined profiles (50, 51, 90, 91), cannot be overwritten and are permanently configured as shown in the following table:
Parameter
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
Profile
50
51
90
91
1
0
1
0
0
0
1
0
0
0
126
0
5
5
0
20
0
3
1
0
5
5
1
0
0
8
2
2
0
0
0
0
0
0
0
0
0
0
0
0
15
15
15
15
0
3
1
0
0
0
0
0
0
0
0
0
0
0
0
0
8
8
127
127
24
24
24
24
18
18
18
18
2
2
1
1
64
64
0
0
0
0
0
0
0
0
0
0
Stored X.25 PAD profiles are held in non-volatile memory, and are not lost when the router is switched off. When in the following format, the PROF command loads the stored profile specified by nn:
prof nn
Digi TransPort® Routers User Guide
643
Configuring legacy protocols
Configure X.25 parameters
RESET command: Send reset packet RESET issues a reset for the current call to the network. It does not clear the call, but it does return the network level interface to a known state by re-initializing all Level 3 network control variables. All data in transit is lost.
RPAR? command: Read remote X.3 parameters RPAR? lists the current X.3 parameter settings for the remote system.
RSET command: Set remote X.3 parameters RSET sets one or more X.3 parameters for the remote system. It is entered in the format:
RSET par #:value[,par #:value[,par #:value ...]]
SET command: Set local X.3 parameters SET sets one or more of the local X.3 parameters for the duration of the current session. The format of the command is:
SET par #:value[,par #:value[,par #:value ...]]
STAT Display Channel Status STAT displays the current status for each logical channel indicating whether it is free or engaged. For example:
stat PAD STATE 1 ENGAGED 2 FREE 3 FREE 4 FREE
Digi TransPort® Routers User Guide
644
Configuring legacy protocols
Configure a MODBUS gateway
Configure a MODBUS gateway
Digi TransPort routers support conversion from MODBUS serial to MODBUS TCP.
Requirements for MODBUS support in TransPort devices
When converting from MODBUS serial to MODBUS TCP over a WAN link, it is necessary to have intelligence in the router to minimize the effect of the higher latency. Digi TransPort supports being a MODBUS server only. Clients, such as remote PCs, can send overlapping requests. The router will create a queue of info requests and deal with them appropriately, sending them out over the serial port and relaying the responses back. Overlapping polls from multiple clients are supported.
Configure the MODBUS gateway
Web
1. Go to Configuration > Network > Legacy Protocols > MODBUS Gateway > Modbus Gateway n.
2. Configure MODBUS gateway parameters:
Digi TransPort® Routers User Guide
645
Configuring legacy protocols
Configure a MODBUS gateway
Enable MODBUS Gateway
Enables or disables MODBUS gateway instance.
Async Port
The local serial port number (asynchronous port) for the MODBUS serial interface.
Async Mode
The serial driver for RS232 or RS485 on supported hardware.
Duplex Mode
The duplex mode, which can be half or full. Use full for 4-wire installations; otherwise half is required.
Operation Mode
The operation mode to master or slave.
Idle Gap
When receiving an modbus response from a station when this idle gap (pause with no reception of characters) is detected the message (currently received from the station) is at that staged forwarded on as the complete response.
Fix slave address
The address of the slave is fixed at this value. An address conversion will occur if a message that does not contain this address is received from the TCP master. If you do not use this setting, the TCP master must use the correct slave address.
Adjust slave address
The address of the slave is adjusted by this value. If left at 0, the slave address is not adjusted at all.
Response time
This parameter is used in master mode. It specifies the amount of time, in milliseconds, that the router waits for a for a response after polling a station. Default is 700 milliseconds. This timer stops as soon the router receives the first few serial characters from the slave, since a response is coming and is either end good or a bad CRC.
IP Port
The UDP or TCP port on which to listen for protocol messages.
IP Mode
Select the IP mode using this drop down list. The default mode is TCP. 3. Click Apply.
Digi TransPort® Routers User Guide
646
Configuring legacy protocols
Configure a MODBUS gateway
Command line
Command Instance Parameter
modbus n
enabled
Values
1=enabled 0=disabled
Equivalent web parameter Enable MODBUS Gateway
modbus n
asy_add
0-255
Async Port
modbus n
op_mode
Master/Slave
Operation mode
modbus n
async_mode
RS322 or RS422
Async Mode
modbus n
duplex
0=full 1=half
Duplex Mode
modbus n
idle_gap
0-2147483647
Idle Gap
modbus n
fix_slave_address 0-255
Fix slave address
modbus n
adj_slave_address 0-255
Adjust slave address
modbus n
ipport0
0-65535
IP Port (row 1)
modbus n
nbsocks0
0 -"currently available" Number of sockets (row 1)
modbus n
ipmode0
0=TCP, 1=UDP
IP Mode (row 1)
modbus n
rawmode0
1=enabled 0=disabled
Raw Mode (row 1)
modbus n
Ipport1
0-65535
IP Port (row 2)
modbus n
nbsocks1
0 -"currently available" Number of sockets (row 2)
modbus n
ipmode1
0=TCP, 1=UDP
IP Mode (row 2)
modbus n
rawmode1
1=enabled 0=disabled
Raw Mode (row 2)
modbus n
bcasts_on
off, on
Broadcast support.
modbus n
response_to
Response time
Configure MODBUS slaves
Web
Go to Configuration > Network > Legacy Protocols > MODBUS Gateway > Modbus Slaves. The MODBUS Slaves page defines access for the following MODBUS slaves when operating as act-asslave. You can define up to 32 MODBUS slaves.
Digi TransPort® Routers User Guide
647
Configuring legacy protocols
Configure a MODBUS gateway
Slave addresses/unit ids
The address of the slave unit.
Remote Host
The IP address of the remote host, such as the slave unit.
IP Port
The IP port number. The default port is 502.
IP Mode
Select the IP mode using this drop down list. The default mode is TCP.
Add
Adds the slave to the MODBUS configuration.
Digi TransPort® Routers User Guide
648
Configuring legacy protocols
Configure Protocol Switch software
Configure Protocol Switch software
The Protocol Switch software is available on some of the Digi TransPort models. The Protocol Switch provides X.25 call switching between the various protocols and interfaces that may be available including:
Interface / Protocol Off/None LAPD LAPD X LAPB 0 LAPB 1 LAPB 2 LAPB 0 PVC LAPB 1 PVC LAPB 2 PVC XoT XoT PVC TCP stream
UDP stream
VXN SSL DialServ
Handling through Protocol Switch
Data is note switched from or backed-up to this protocol.
Data is switched from or backed-up to LAPD using the X.25 service.
As above, but the actual LAPD instance to use is determined by the NUA.
Data is switched from or backed-up to LAPB 0.
Data is switched from or backed-up to LAPB 1.
Data is switched from or backed-up to LAPB 2.
Data is switched from or backed-up to an X.25 PVC on LAPB 0.
Data is switched from or backed-up to an X.25 PVC on LAPB 1.
Data is switched from or backed-up to an X.25 PVC on LAPB 2.
Data is switched from or backed-up to an XOT (X.25 over TCP/IP) connection.
Data is switched from or backed-up to an XOT PVC connection.
Data is switched from / backed-up to a TCP socket. The socket's IP address will be determined from the IP stream port setting.
Similar to the TCP stream setting, but instead of switching onto a TCP socket, data is switched onto a UDP socket. In the case of switching from X.25. the effect is that a UDP frame will be sent for each packet of X.25 data being switched.
Data is switched or backed-up to Datawire's VXN protocol.
Data is switched or backed-up to SSL.
Data is switched or backed-up to an analog modem via the built-in DialServ daughter card.
Digi TransPort® Routers User Guide
649
Configuring legacy protocols
Configure Protocol Switch software
When this optional feature is included, the device can be configured to pass X.25 calls or data received in a TCP connection to another protocol or interface.
In addition, it is possible to specify a backup protocol or interface so if an outgoing call on one interface fails, the backup interface is automatically tried. You can use LAPB to switch to either ISDN or X.25 over serial, depending on the configuration of the LAPB instance chosen.
Digi TransPort® Routers User Guide
650
Configuring legacy protocols
Configure Protocol Switch software
Protocol Switch software logic
This flowchart outlines the logic in the switching software. The notes after the flowchart provide a more in-depth explanation of the actions taken in each of the numbered boxes.
n The router first looks up the Called NUA/NUI in the Configuration > Network > Protocol Switch > NUA to Interface Mappings mapping table to determine the IP address to use in the event that the call ends up being switched to a TCP or XOT interface. If a match is found on the Called NUA/NUI the router assigns the matching IP address from the table to the call. If IP address mapping table does not contain an entry for the Called NUA/NUI and the call is eventually switched to a TCP or XOT channel, the router uses the default IP address (IP Stream or XOT Remote IP Address).
Digi TransPort® Routers User Guide
651
Configuring legacy protocols
Configure Protocol Switch software
n The router then determines from the source interface of the incoming call which interface type it should be switched to, from the Switch from parameters on the Protocol Switch page.
l For example, if the call arrived via a LAPB 0 interface and the Switch from LAPB 0 to parameter was set to LAPD, then the outgoing interface would LAPD.
l If the outgoing interface is LAPD the router changes the Calling NUA field of the incoming call to the D-Channel NUA value (as defined on the Protocol Switch page). If the outgoing interface is NOT LAPD processing proceeds as at step 6.
n The router then searches the Configuration > Network > Protocol Switch > NUA Mappings table to see if there are any matches for the Called or Calling NUA values on the specified interface. When the Interface Description is Off/None data is not switched from or backed-up from this protocol is a match, the NUA In value is substituted by the NUA Out value, as the mapping is applied individually to both the Calling NUA and Called NUA for the packet.
n The router checks the leading characters of the Calling NUA to see if there is a match with the Call Prefix parameter. If there is a match, the prefix digits are removed before the outgoing X.25 call is made. Otherwise, the call is made anyway, and the switching process is complete for this call.
n If after step 3, the router has determined that the outgoing interface is not LAPD, it checks if the outgoing interface is LAPB. If it is, it checks to see if the Called NUA field in the call packet matches the LAPB 0 NUA parameter. If it does, it selects LAPB 0 as the outgoing interface. If the Called NUA field does not match LAPB 0 NUA, it checks for a match with LAPB 1 NUA. If there is a match, it sets the outgoing interface to LAPB 1.
n If the Called NUA field in the calling packet matches neither the LAPB 0 NUA or LAPB 1 NUA parameters, the outgoing interface is set to the interface specified by the relevant Switch from parameter.
n If the call is being switched over LAPB 0. the router sets the Called NUA to the TE NUA (LAPB 0) value. If the call is being switched over LAPB 1, the router sets the Called NUA to the TE NUA (LAPB 1) value.
Digi TransPort® Routers User Guide
652
Configuring legacy protocols
Configure the Protocol Switch
Web
1. Go to Configuration > Network > Protocol Switch.
Configure Protocol Switch software
The Protocol Switch page has several following sub-menu options:
Digi TransPort® Routers User Guide
653
Configuring legacy protocols
Configure Protocol Switch software
n A table for setting interface switches and backup interfaces n LAPD parameters n LAPB parameters n IP Stream/XOT parameters n X.25 parameters 2. Configure protocol switch parameters:
TCP or XoT Controls the switching of incoming X.25 calls received via TCP or XOT. Select the interface to which data should be switched from the drop down list, or select Off and the protocol switch will not respond to any incoming XOT or TCP connections.
LAPD Controls the switching of incoming X.25 calls received via ISDN LAPD. Select the interface to which data should be switched from the drop down list, or select Off and the protocol switch will not respond to any incoming LAPD calls.
LAPB n Controls the switching of incoming X.25 calls received via LAPB X. Select the interface to which data should be switched from the drop down list, or select Off and the protocol switch will not respond to any incoming LAPB X calls.
LAPB n PVC Controls the switching of incoming X.25 calls received via LAPB X PVC. Select the interface to which data should be switched from the drop down list, or select Off and the protocol switch will not respond to any incoming PVC calls on LAPB X.
XOT PVC Controls the switching of incoming X.25 calls received via an XOT PVC. Select the interface to which data should be switched from the drop down list, or select Off and the protocol switch will not respond to any incoming XOT PVC calls.
Backup to interface If any of the Switch from parameters has been set to XOT, and XOT is unavailable, you can use this parameter to specify an alternative interface to switch the X.25 call to. Any of the other interfaces can be selected, or None. If None is selected, no backup call is attempted.
LAPD backup to interface If any of the Switch from parameters has been set to LAPD, and LAPD is unavailable, you can use this parameter to specify an alternative interface to switch the X.25 call to. Any of the other interfaces can be selected, or None. If None is selected, no backup call is attempted.
LAPB X backup to interface If any of the Switch from parameters has been set to LAPB X, and LAPB X is unavailable, you can use this parameter to specify an alternative interface to switch the X.25 call to. Any of the other interfaces can be selected, or None. If None is selected, no backup call is attempted.
Digi TransPort® Routers User Guide
654
Configuring legacy protocols
Configure Protocol Switch software
VXN backup to interface If any of the Switch from parameters has been set to VXN, and VXN is unavailable, you can use this parameter to specify an alternative interface to switch the X.25 call to. Any of the other interfaces may be selected, or None. If None is selected, no backup call is attempted. 3. Configure LAPD parameters:
Calling Prefix The call prefix to inserted in front of the NUA in calls being switched to LAPD. For example, if the called NUA in the call being received by the LAPB 0 interface is 56565, and the call prefix is 0242, the call placed on the LAPD interface is to NUA 024256565. Also, for calls in the reverse direction, if the prefix in the calling NUA matches this parameter, it is removed from the calling NUA field.
D-Channel LCN The value of the first LCN assigned for outgoing X25 calls on LAPD.D-Channel LCN Direction.
Max VCs: Unlimited The maximum number of Virtual Circuits (VCs) on an LAPD interface. When the maximum has been reached, the backup call will take place immediately, or the call will clear if there is no backup call. If this parameter is set to 0, there is no limit.
Default Packet Size The default packet size for X.25 calls being switched onto LAPD. The default packet size is 128, other possible values are 256, 512, or 1024 bytes.
Default Window Size The default window size for calls being switched onto LAPD. The default window size is 2; the valid range is 1 to 7. 4. Configure LAPB parameters:
LCN The value of the first LCN that will be assigned for outgoing X25 calls on LAPB.
LCN direction: Up Down Determines whether the LCN for outgoing X.25 calls on LAPB is incremented or decremented from the starting value.
Max VCs: Unlimited The maximum number of Virtual Circuits (VCs) on a LAPB interface. When the maximum has been reached, then the backup call occurs immediately, or the call will clear if there is no backup call. If this parameter is set to 0, there is no limit.
B-Channel Number An ISDN number for calls switched in the direction of LAPB 0 or LAPB 1.
Enable ENQ Char When this parameter is set to On, when an incoming call on LAPB is switched and the router connects to it, the X.25 switch sends a data packet on the LAPB X.25 SVC containing the ENQ character.
Digi TransPort® Routers User Guide
655
Configuring legacy protocols
Configure Protocol Switch software
LAPB 0 Default Packet Size: 128 256 512 1024 The default packet size for calls being switched onto LAPB 0. The default packet size is 128. Other possible values are 256, 512, or 1024 bytes.
LAPB 0 Default Window Size: 2 1 3 4 5 6 7 The default window size for calls being switched onto LAPB 0. The default window size is 2. The valid range is 1 to 7.
LAPB 1 Default Packet Size: 128 256 512 1024 The default packet size for calls being switched onto LAPB 1. The default packet size is 128. Other possible values are 256, 512, or 1024 bytes.
LAPB 1 Default Window Size: 2 1 3 4 5 6 7 The default window size for calls being switched onto LAPB 1. The default window size is 2. The valid range is 1 to 7.
LAPB 2 Default Packet Size: 128 256 512 1024 The default packet size for calls being switched onto LAPB 2. The default packet size is 128. Other possible values are 256, 512, or 1024 bytes.
LAPB 2 Default Window Size: 2 1 3 4 5 6 7 The default window size for calls being switched onto LAPB 2. The default window size is 2. The valid range is 1 to 7. 5. Configure IP Stream / XOT parameters:
IP Stream or XOT Remote IP Address: For calls being switched in the direction of XOT, this parameter specifies the destination IP address for the outgoing XOT call. The router also uses this value as the destination IP address in the IP/UDP stream modes.
IP Stream or XOT Backup IP Address If the Switch from XOT to parameter is set to XOT, this is the IP address the XOT call will be switched to, if the original XOT IP address is unavailable.
IP Stream Port The IP port number to use when IP stream or UDP stream are selected as the parameter for any of the Switch from or Backup from parameters.
Note The XOT remote IP address and IP stream port parameters are overridden by the values in the NUA/NUI to IP addresses table if the call matches any entry in that table.
IP Length Header: Off On 8583 Ascii 4 byte On (inclusive) When IP length header is On, a length indicator field is inserted at the start of each packet. When set to 8583 Ascii 4 byte, the IP length header conforms to the ISO 8583 format.
Source IP address interface: Auto Ethernet PPP The default value for this parameter is Auto, which means that the source IP address of an outgoing XOT connection on an un-NATed W-WAN link is the address of the PPP interface assigned to W-WAN. This is because the XOT connection is initiated (automatically) within the
Digi TransPort® Routers User Guide
656
Configuring legacy protocols
Configure Protocol Switch software
router, and does not originate from the local subnet (LAN segment to which the router is attached via the Ethernet interface). However, this means that if you are routing traffic from the local subnet across a VPN tunnel, you would have to set up two Eroutes: one to match the local subnet address, and one to match the XOT source address, such as the address of the PPP interface associated with to the wireless network. If set to Ethernet, the router uses the IP address of the Ethernet port instead of that of the PPP interface, so that you need only set up on Eroute. 6. Configure X.25 parameters:
Don't switch facilities If this parameter is set to Off, the packet size and window size are only switched if they need to, such as if they specify a value different from what is currently being negotiated. If this parameter is set to On, the facilities are not switched.
Don't strip facilities When set to On, this parameter stops the X.25 switch from stripping packet size and window size facilities as it switches an X.25 call. When set to Off, the X.25 switch strips facilities if the requested facilities match the defined defaults for that interface.
L2 Deactivation Clear Cause When one side of a switch call fails because layer 2 drops, the other side is usually cleared with a clear cause 9,out of order. This parameter allows you to set this code to any value.
X25 Version: 84 88 Allows you to switch between X.25 version 88, and X.25 version 84, in which clear causes are always 0 when issued if the router is the DTE.
Interpret no facilities on Call Accept as P7W2 When this parameter is set to On, the X.25 switch interprets any call accept packets that do not include the window size (W) or packet size (P) as if the call accept has P7W2, such as a packet size of 128 bytes and a windows size of 2. 7. Click Apply.
Command line
Command x25sw x25sw x25sw x25sw
Instance 0 0 0 0
Parameter swfrlapb0 swfrlapb0pvc swfrlapb1 swfrlapb1pvc
Values
0, 1, 3- 10, 12-15 (see below)
0-5, 7-10, 12-15 (see below)
0-2, 4-10, 12-15 (see below)
0-6, 8-10, 12-15 (see below)
Equivalent web parameter Switch from LAPB 0 to Switch from LAPB 0 PVC to Switch from LAPB 1 to Switch from LAPB 1 PVC to
Digi TransPort® Routers User Guide
657
Configuring legacy protocols
Configure Protocol Switch software
Command x25sw x25sw x25sw x25sw x25sw x25sw x25sw x25sw
x25sw x25sw
x25sw x25sw x25sw
x25sw x25sw x25sw x25sw
x25sw
Instance 0 0 0 0 0 0 0 0
0 0
0 0 0
0 0 0 0
0
Parameter swfrlapb2 swfrlapb2pvc swfrlapd swfrxot swfrxotpvc callprefix dlcn dlcnup
dmaxvc lapb0ppar
lapb0wpar blcn blcnup
bmaxvc bnumber benqcon lapdppar
lapdwpar
Values
0-10, 13-15 (see below)
0-10, 12, 14, 15 (see below)
0, 2-10, 12-15 (see below)
0-3, 5-10, 12-15 (see below)
0-7, 9, 10, 12-15 (see below)
<NUA>
0-65535
off, on Off=Down On=Up
0-65535
7, 8, 9, 10 7=128 8=256 9=512 10=1024
1-7
0-65535
off, on Off=Down On=Up
0-65535
ISDN number
off, on
7, 8, 9, 10 7=128 8=256 9=512 10=1024
1-7
Equivalent web parameter Switch from LAPB 2 to Switch from LAPB 2 PVC to Switch from LAPD to Switch from XOT (TCP) to Switch from XOT PVC to Calling Prefix D-Channel LCN D-Channel LCN Direction
Max VCs Default Packet Size
Default Window Size LCN LCN direction
Max VCs B-Channel Number Enable ENQ Char LAPB 0 Default Packet Size
LAPB 0 Default Window Size
Digi TransPort® Routers User Guide
658
Configuring legacy protocols
Configure Protocol Switch software
Command x25sw
x25sw x25sw
x25sw x25sw x25sw x25sw x25sw
x25sw x25sw x25sw x25sw x25sw x25sw
x25sw
Instance Parameter
0
lapb1ppar
0
lapb1wpar
0
lapb2ppar
0
lapb2wpar
0
ipaddr
0
buipaddr
0
ip_port
0
iphdr
0
srcipadd
0
srcipent
0
noswfac
0
nostripfac
0
l2deactcc
0
x25ver84
0
accdefp7w2
Values
Equivalent web parameter
7, 8, 9, 10 7=128 8=256 9=512 10=1024
LAPB 1 Default Packet Size
1-7
LAPB 1 Default Window Size
7, 8, 9, 10 7=128 8=256 9=512 10=1024
LAPB 2 Default Packet Size
1-7
LAPB 2 Default Window Size
IP address
IP Stream or XOT Remote IP Address
IP address
IP Stream or XOT Backup IP Address
0-65535
IP Stream Port
0, 1, 2 0=Off 1=On 2=8583 Ascii 4 byte
IP Length Header
Interface number Source IP address interface 0-65535
<blank>, PPP, ETH
Source IP address interface
off, on
Don't switch facilities
off, on
Don't strip facilities
0-65535
L2 Deactivation Clear Cause
off, on Off=88 On=84
X25 Version
off, on
Interpret no facilities on Call Accept as P7W2
Interfaces are coded as follows:
Parameter value 0
Interface type None
Digi TransPort® Routers User Guide
659
Configuring legacy protocols
Configure Protocol Switch software
Parameter value 1 2 3 4 5 6 7 8 9 10 12 13 14 15
Interface type LAPD LAPB 0 LAPB 1 XOT LAPD X (actual instance is determined by NUA) LAPB 0 PVC LAPB 1 PVC XOT PVC TCP stream UDP stream LAPB 2 LAPB 2 PVC VXN SSL
Answering NUAs programmed on active PADs
Because the other interfaces can operate as normal, even when the switch is operating, take special care in answering NUAs programmed on active PADs. For example, when a call is being received on a LAPD or LAPB interface, a PAD instance or remote configuration session can answer and terminate the call in preference to the call being switched. This means that you should leave the PADs Answering NUA parameters blank to ensure that the router's PADs are not answering calls that need to be switched. If you do want a PAD instance to answer a call, program the Answering NUA field with as many digits as you can to ensure it only answers calls destined for that PAD.
These same precautions apply to the Allow CLI access from X.25 address parameter on the web interface Configuration > System > General page.
Digi TransPort® Routers User Guide
660
Configuring legacy protocols
Configure Protocol Switch software
Configure CUD mappings parameters
Protocol Switch CUD mappings allow you to map an incoming call's CUD (call user data) from one value to another. The PID (protocol identifier) portion of the CUD, if present, is maintained from input to output and is not involved in the comparison.
Web
1. Go to Configuration > Network > Protocol Switch > CUD Mappings.
2. Enter CUD mappings. The CUD Mappings page displays a table with four columns in which you can specify the CUD In values, corresponding CUD Out values and to which interfaces the mappings should be applied. The interface field defines which output interfaces this mapping applies to. Wildcard characters are allowed, and In each case the interface type to which the mapping applies can be selected from ANY, LAPD, LAPB0, LAPB1, LAPB2, or XOT.
3. Click Add to add each CUD mapping. 4. Click Apply.
Command line
Command cudmap cudmap cudmap
Instance 0-9 0-9 0-9
Parameter cudfrom cudto Interface
Values
0-65536
0-65536
0, 1, 2, 3, 4, 12 0=Any 1=LAPD 2=LAPB 0 3=LAPB 1 4=XOT 12=LAPB 2
Equivalent web parameter CUD In CUD Out Interface
Digi TransPort® Routers User Guide
661
Configuring legacy protocols
Configure Protocol Switch software
Configure IP sockets to protocol switch
Web
1. Go to Configuration > Network > Protocol Switch > IP Sockets to Protocol Switch.
The IP Sockets to Protocol Switch page contains a table for entering a series of IP Port numbers and X.25 Call strings, as shown below. It configures the router so IP data can be switched to any of the protocols support by the protocol switch, including X.25. For example, data received on a TCP connection can be forwarded over SSL, XoT, or a UDP stream. The only columns that must be filled out are Port and Number of Sockets. This table is duplicated in theConfiguration > Network > Legacy Protocols > X.25 > IP to X.25 Callsection, as it can also convert an incoming TCP connection to an X.25 session to be answered by PAD without using the protocol switch. It is included at this point in the web user interface as a convenience, in case you are using the table with PAD and not the protocol switch.
IP Port Used to set up the port numbers for those IP ports that will listen for incoming connections to be switched over X.25 or other protocol. In the case of switching to X.25, when such a connection is made, the router makes an X.25 Call to the address specified in the X.25 Call field. Once this call has been connected, data from the port is switched over the X.25 session.
Number of Sockets How many IP sockets should simultaneously listen for data on the specified port. The number of available IP sockets depend on your router model and how many are already in use. See note at the end of these settings descriptions.
X25 Call The X.25 call field may contain an X.25 NUA or NUI or one of the X.25 Call Macros defined on the Configuration > Advanced applications > X25 > Macros page.
PID The Protocol Identifier (PID) to use when the router switches an IP connection to X.25. The PID (protocol ID) field takes the format of four hexadecimal digits separated by commas, such as 1,0,0,0, at the start of the Call User Data field in the X.25 call.
Confirm Mode When set to On, the incoming TCP socket is not successfully connected until the corresponding outgoing call has been connected. The incoming TCP socket triggers the corresponding
Digi TransPort® Routers User Guide
662
Configuring legacy protocols
Configure Protocol Switch software
outgoing call either to a local PAD instance or to whatever is configured. The effect of this mode is that the socket fails if the outbound call fails and so may be useful in backup scenarios. In addition it ensures that no data is sent into a "black hole". When this setting is not enabled, data sent on the inbound TCP connection before the outbound connection has been successful can be lost.
RFC 1086 Mode: RFC 1086 specifies a mode of operation in which the IP socket answers, and then, with a simple protocol in the socket, identifies the X.25 address and other X.25 call setup parameters to use. When the X.25 call parameters have been identified, the X.25 call is made. If successful, data is switched between the X.25 call and the IP socket. The protocol selects whether incoming or outgoing support is required.
SSL Mode If enabled, the router operates similarly to the TCP Stream interface, except that it negotiates SSL over the socket, and encrypts all user data.
IP length header When IP length header is On, the IP length indicator field is inserted at the start of each packet. When set to 8583 Ascii 4 byte, the IP length header conforms to the ISO 8583 format. In the example above, 3 IP sockets will listen for an incoming connection on IP Port 2004. Once connected, they each make an X.25 Call to jollyroger. The router recognizes that jollyroger is a pre-defined macro, as illustrated below, and translates it into an X.25 Call to address 32423 with the string x25 data included as data in the call. The outgoing X.25 call(s) are made over whichever interface is specified by the Switch from XOT(TCP) to parameter on the Configuration > Network > Protocol Switch page.
Note At the top of the page, the total number of sockets available and the number currently free is shown. Take care to not allocate too many of the free sockets, unless you are confident they are not required for other applications.
2. Click Add to add each IP sockets to protocol mapping. 3. Click Apply.
Digi TransPort® Routers User Guide
663
Configuring legacy protocols
Configure Protocol Switch software
Command line
Command Instance Parameter
ipx25
n
ip_port
Values 0-65535
Equivalent web parameter IP Port
ipx25
n
nb_listens
0-software-dependent max Number of Sockets
ipx25
n
x25call
NUA, NUI or X.25 macro name
X25 Call
ipx25
n
pid
hex numbers
PID
ipx25
n
cnf_mode
1=enabled, 0=disabled
Confirm Mode
x25sw
n
ipx25
n
swfrxot
15
rfc1086_mode 1=enabled, 0=disabled
SSL Mode RFC 1086 Mode
ipx25
n
iphdr
0=Off 1=On 2=8583 Ascii 4 byte
IP length header
Digi TransPort® Routers User Guide
664
Configuring legacy protocols
Configure Protocol Switch software
Configure NUA to interface mappings
Web
1. Go to Configuration > Network > Protocol Switch > NUA to Interface Mappings.
2. Enter NUA to interface mappings. The NUA to Interface Mappings page contains a table to enter a series of X.25 NUA or NUI values along with IP addresses/Ports to which they should be mapped, if you need to override the default settings in the Configuration > Network > Legacy Protocols > X.25 > NUA/NUI Interface Mappings page.
If, in the Protocol Switch configuration, you had configured the router to switch from LABP 0 to TCP, the IP Address and Port values would normally be determined from the XOT Remote IP address and IP stream port parameters. However, having set up the NUA/NUI to IP addresses table as shown in the example above, if an X.25 call with NUA of value 222 is received on LAPB 0, it is switched onto a TCP socket using IP address 1.2.3.4 on port 45 instead of the settings configured on the Configuration > Network > Legacy Protocols > X.25 > NUA/NUI Interface Mappings page.
Similarly, NUIs can also be matched. In this example, a call with NUI of value test is switched onto a TCP socket using IP address 100.100.100.1 on port 678.
All three comparison fields, NUA, NUI and Call Data can use the wildcard matching characters ? and *. In the example shown above, when an X.25 call is received with either the NUA having 1234 followed by any 2 digits or a call being received with call user data with any 4 characters followed by aa, the call is switched to a TCP socket on address 100.100.100.52 on port 4001.
When a connection has been successfully established and data is being switched from the X.25 call to the socket and from the socket to the X.25 connection, it can be terminated by either the socket closing or the X.25 call clearing.
If the connection terminates because of an incoming X25 CALL CLEAR packet, the switch terminates the socket connection. If the connection terminates because the socket is closed, the switch clears the X.25 call by transmitting a CALL CLEAR packet.
3. Click Add to add each NUA to interface mapping.
4. Click Apply.
Command line
Command Instance Parameter Values
nuaip
0-255 nua
0-65536
Equivalent web parameter NUA
Digi TransPort® Routers User Guide
665
Configuring legacy protocols
Configure Protocol Switch software
Command Instance Parameter Values
nuaip
0-255 ipaddr
IP address
nuaip
0-255
ip_port
0-65536
nuaip
0-255 swto
0-10, 12-15 (see table below)
nuaip
0-255 buswto 0-10, 12-15 (see table below)
Equivalent web parameter IP Address IP Port Interface Backup Interface
Interfaces are as follows:
Parameter Value 0 1 2 3 4 5 6 7 8 9 10 12 13 14 15
Interface Type Default LAPD LAPB 0 LAPB 1 XOT LAPD X (actual instance determined by NUA) LAPB 0 PVC LAPB 1 PVC XOT PVC TCP stream UDP stream LAPB 2 LAPB 2 PVC VXN SSL
Digi TransPort® Routers User Guide
666
Configuring legacy protocols
Configure Protocol Switch software
Configure NUA mappings
Protocol switch NUA mappings allow you to redirect specified NUAs to alternative NUAs for switched X.25 calls. Up to 20 NUA In to NUA Out mappings are available. These mappings alter the called NUA field in any X.25 call. The comparison uses tail matching, so only the rightmost digits in the NUA are compared with the table entry.
Web
1. Go to Configuration > Network > Protocol Switch > NUA Mappings.
The NUA Mappings page displays a table with four columns in which you can specify the NUA In values, corresponding NUA Out values, to which interfaces the mappings should be applied, and whether the mapping should apply if the router is making the call, receiving the call, or both. For example, if the called NUA is 123456789345 and there is an NUA In table entry of 9345, with Called/Calling set to either Both or Called, this will match, and the entire called NUA will be replaced with the corresponding NUA Out entry. In each case, the interface type to which the mapping applies can be selected from ANY, LAPD, LAPB0, LAPB1, LAPB2, or XOT.
2. Click Add to add each NUA to mapping.
3. Click Apply.
Command line
Command x25map x25map x25map
x25map
Instance 0-19 0-19 0-19
0-19
Parameter nuafrom nuato interface
ca_or_ci
Values
0-65536
0-65536
0, 1, 2, 3, 4, 12 0=Any 1=LAPD 2=LAPB 0 3=LAPB 1 4=XOT 12=LAPB 2
0, 1, 2 0=Both 1=Called 2=Calling
Equivalent web parameter NUA In NUA Out Interface
Called / Calling
Digi TransPort® Routers User Guide
667
Configuring alarms
Configure events to trigger alarms
669
Edit event descriptions
685
Configure an SMTP email account to send alarms
692
Digi TransPort® Routers User Guide
668
Configuring alarms
Configure events to trigger alarms
Configure events to trigger alarms
The router maintains a log of events in the logcodes.txt pseudo file. When an event of a specified or lower priority level occurs, a syslog message, an email alert, or SMS alert can be sent to a pre-defined address.
Web
1. Go to Configuration > Alarms > Event Settings. The Event Settings page has several submenu items: n Email Notifications n SNMP Traps n SMS n Local Logging n Syslog Messages n Syslog Server n pages
2. Set the following parameter values:
Only log events with a log priority of at least n
Enables a filter that ensures that only events having a specified severity or lower level are logged.
Do not log the following events
A numerical list of comma-separated values specifying events to be excluded from the log. These numerical values can be found in the eventlog.txt file on the router.
Digi TransPort® Routers User Guide
669
Configuring alarms
Configure events to trigger alarms
After power up, wait s seconds before sending Emails, SNMP traps, SMS or Syslog messages
The delay, in seconds, after power-up that the router should wait before sending any alert messages. This is useful when the sending of those items would fail if sent too soon after the router powers up because the underlying interface to use has not completed initialization.
Include event number in the event log and Email, SNMP traps or Syslog messages
If enabled, event numbers from the logcodes.txt file are included. 3. Click Apply.
Command line
Command Instance Parameter Values
event
n
loglevel
0-9 0 none 1 low 9 high
event
n
ev_filter
Commaseparated list of event numbers
event
n
action_dly Number of seconds (such as 60)
event
n
incevnums 0, 1
Equivalent web parameter Only log events with a log priority of at least n
Do not log the following events.
After power up, wait s seconds before sending Email, SNMP traps, SMS or Syslog messages. Include event number.
Digi TransPort® Routers User Guide
670
Configuring alarms
Configure events to trigger alarms
Configure sending email alert messages when events occur
About using email templates
One of the key features provided by the event log function is the ability to configure the router to automatically generate and send an email alert message each time an event of up to a specified priority occurs. The format of the message is determined by the email template specified in the Use email template file parameter, normally event.eml, and on the Configuration > Alarms > Event Settings > Email Notifications web page. If the standard event.eml template supplied with the router is not suitable, you can create your own template. An email template is a text file that defines the appearance and content of the email messages generated by the event logger.
Email template structure
An email template consists of a header section followed by a body section. One or more blank lines separate the two sections.
Header section The header section MUST contain the following three fields:
TO Used to specify at least one recipient's email address. Multiple addresses may be included and must be separated by a space, comma or semicolon character. For example: To: 123@456.com, 456@123.com; abc.def.com
FROM The email address of the sending unit. Alternatively, you can enter a simple string. This may depend on the SMTP server as to what is accepted. For example:
FROM: WR44
Or:
FROM: wr44@mycompany.com
SUBJECT A string describing the subject of the email message. For example:
Subject: Automated message from router
Other fields In addition to the required fields described above, the header section of an email can also contain one or more optional fields. Many such fields are defined in the relevant RFCs, but there are some fields the router handles a little differently, as described below. The router inserts other fields as necessary if it is required to send attachments with the email.
Reply To If the router discovers this field is not present in the email template, it inserts this field into the header. The string for this field is the one configured by the smtp 0 reply_to CLI command (or the use Reply To address parameter in the Configuration > Alarms > SMTP Account web page). This allows
Digi TransPort® Routers User Guide
671
Configuring alarms
Configure events to trigger alarms
for different reply addresses, and a simple way of using the same (easily configurable) reply address for all emails.
Date If this field is present in the header, the router inserts the current date and time into the header. The date and time are values local to the router and do not contain any time zone information.
Body section
The body section can include any text. This text is parsed for any function calls that may be present. Function calls must be enclosed between <% and %>. These sequences are substituted by text resulting from the function call. You can use the following functions:
Function TimeSmtp(); serial_number(); Smtpip(); email_event() Smtpid()
pppip("instance");
Description
Inserts the router's date and time.
Inserts the router's serial number
Inserts the IP address of the router as seen by the SMTP server during transmission
Inserts a formatted description of the event that caused the email transmission.
Inserts the router ID for this device as configured by the Router Identity field in the Configuration > System > Device Identity web page, or the cmd 0 unitid CLI command.
Inserts the IP address for a specific PPP instance, where instance is the PPP instance number.
Example email templates
Following are examples of email templates.
Example 1
TO: 123@abc.co.nz FROM: MyRouter SUBJECT: Remote Configuration ß This blank line is required Time: <%timeSmtp();%> Serial Number: <%serial_number();%> Req: CFG_RQ IP Address: <%smtpip();%> PPP 1 IP address: <%pppip("1");%>
Example 2
TO: fred@anyco.com, jane@anyco.co.uk FROM: MyRouter SUBJECT: automatic email MIME-Version: 1.0 ß This blank line is required Unit: <%smtpid();%> Event: <%email_event();%>
Digi TransPort® Routers User Guide
672
Configuring alarms
Configure events to trigger alarms
This event had sufficient priority to cause the transmission of this email. Please check the attached logs and review.
Include the output from CLI commands in the email body
You can also execute CLI commands and include their output within the email; the output from up to 10 CLI commands will be added to the body of the email. The command to be executed needs to be entered in place of xxxxx below. To include the output from multiple commands, use the run_cmd() function multiple times. The run_command() function is as follows:
<%run_cmd("xxxxx");%>
For example,
<%run_cmd("ati5");%> <%run_cmd("bufs");%> <%run_cmd("msgs");%>
For example, here is a template adding CLI commands:
TO: fred@anyco.com, jane@anyco.co.uk FROM: MyRouter SUBJECT: automatic email MIME-Version: 1.0 Unit: <%smtpid();%> Event: <%email_event();%> This event had sufficient priority to cause the transmission of this email. Please check the attached logs and review. <%run_cmd("ati5");%> <%run_cmd("bufs");%> <%run_cmd("msgs");%>
You can also specify an extra parameter which indicates the required priority of the event before the command is executed. This allows events to be sent off without attachments, but if the event has an equal or higher priority than the value of this parameter, the attachments are included. This ensures that the attachments are not included unnecessarily with non-critical events and using up all the data allowance on a wireless connection.
<%run_cmd("chkst","5");%>
An example template adding CLI commands with priority values is:
TO: fred@anyco.com, jane@anyco.co.uk FROM: MyRouter SUBJECT: automatic email MIME-Version: 1.0 Unit: <%smtpid();%> Event: <%email_event();%>
This event had sufficient priority to cause the transmission of this email. Please check the attached logs and review.
<%run_cmd("chkst","5");%>
In the example above, the command chkst is executed when an event with a priority equal to or higher than 5 is detected.
Digi TransPort® Routers User Guide
673
Configuring alarms
Configure events to trigger alarms
Web
1. To use the email alert facility, go to Configuration > Alarms > SMTP Account. 2. Specify a valid Dial-out number, Username, and Password, and set the SMTP parameters
correctly. The Dial-out number, Username and Password parameters should match the values on the on the Configuration > Network > Interfaces > Advanced > PPP n pages where n is the relevant interface number. 2. Go to Configuration > Alarms > Event Settings > Email Notifications. 3. Enable the Send email notifications setting.
4. Set email notifications parameters:
Send email notifications Enables the display of the configurable parameters when checked.
Send an email notification when the event priority is at least n The lowest priority event that will generate an email alert message. For example, if this value is set to 6, only events with a priority of 6 or lower (7, 8, or 9) trigger an automated email alert message. To disable email alarms, set this value to 0.
Send a maximum of n emails per day The limit on the number of emails that can be sent during any 24-hour period. The intention is to prevent excessive alerts being sent when the event trigger value is set to a high priority / low value (for example, 1, 2, or 3), such as a value that results in a large number of automated email alert messages being generated. A maximum of 255 emails can be sent in a day.
n emails have been sent today A status message, indicating how many emails have been sent during the last 24-hour period.
Use email template file The name of a template file to form the basis of any email alert messages generated by the event logger. The default template is a file called event.eml stored in the compressed .web file. You can create alternative template, but to be valid, it must have the .eml file extension and be stored in the normal file directory. A new template with the name event.eml takes precedence over the predefined event.eml template, but it is recommended to use a new name, such as event1.eml.
Digi TransPort® Routers User Guide
674
Configuring alarms
Configure events to trigger alarms
Email To The standard email address format for the intended recipient of the alert.
Email From A valid email address that will be accepted by the SMTP server as being authorized to send email.
Email Subject A short description of the email content. 5. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
event
n
etrig
0-9 0 disables sending alerts
Send an email notification when the event priority is at least n
event
n
emax
0-255
Send a maximum of n emails per day
event
n
etemp
The name of a template Use email template file file. Default is event.emL
event
n
to
A valid email address, such Email To as you@yourdomain.com
event
n
from
A valid email address
Email From
event
n
subject
A brief description of the content of the email
Email Subject
Digi TransPort® Routers User Guide
675
Configuring alarms
Configure events to trigger alarms
Configure SNMP traps
The router firmware supports the use of SNMP, with the ability to generate traps. To make the SNMP (Simple Network Management Protocols) functional, you must configure a SNMP trap server.
Web
1. Go to Configuration > Remote Management > SNMP > SNMP Traps. 2. Specify which types of SNMP traps you want to generate:
Generate Enterprise traps Enables or disables generation of enterprise traps.
Generate Generic traps Enables or disables generation of generic traps.
Generate Authentication Failure traps Enables or disables generation of authentication failure traps.
Generate VRRP traps Enables or disables generation of VRRP traps. 3. In SNMP Trap Server 0, configure the settings for SNMP trap server 0:
Trap Server IP Address The IP address for the SNMP trap server.
Port The network port number for the SNMP trap server.
Use interface interface-type interface-number for the source IP address The interface type and number to use for the source IP address. interface-type can be Auto, PPP, or Ethernet.
Use SNMP Version The SNMP version to use (SNMPv1, SNMPv2c, or SNMPv3).
Send "Inform Request" message Enables or disables sending the trap as an Inform Request message, which requires an acknowledgment from the recipient. If this setting is enabled, these settings are displayed:
If no response, retransmit the Inform Request message after n seconds Sets the Inform Request to retransmit if there is no response from the recipient after the specified number of seconds.
Retransmit a maximum n times Sets the number of times to retransmit the Inform Request message.
Digi TransPort® Routers User Guide
676
Configuring alarms
Configure events to trigger alarms
Community / Confirm Community For SNMPv1 and SNMPv2c, these settings specify the SNMPv1 or SNMPv2c community name.
Username The SNMPv3 user name.
Authentication The SNMPv3 authentication type: None, MD5, SHA1, or SHA256.
Authentication Password / Confirm Authentication Password The SNMPv3 authentication password.
Encryption The SNMPv3 encryption type: None, DES, or AES.
Encryption Password / Confirm Encryption Password The SMPv3 encryption password. 4. Click Apply.
Command line
Command snmp snmp snmp
snmp snmptrap snmptrap
snmptrap snmptrap snmptrap
snmptrap snmptrap
snmptrap
Instance Parameter
0
enterprisetraps
0
generictraps
0
authtraps
0
vrrptraps
0
ipaddr
0
port
0
version
0
sendinforms
0
informto
0
informretries
0
auth
0
authpassword
Values
Equivalent web parameter
off, on
Generate Enterprise traps
off, on
Generate Generic traps
off, on
Generate Authentication Failure traps
off, on
Generate VRRP traps
IP address Trap Server IP Address
network port Port number
Use SNMP Version
off, on
Send "Inform Request" message
integer
If no response, retransmit the Inform Request message after n seconds
integer
Retransmit a maximum n times
none, md5, Authentication sha1, sha256
password Authentication Password
Digi TransPort® Routers User Guide
677
Configuring alarms
Configure events to trigger alarms
Command snmptrap snmptrap snmptrap snmptrap
Instance Parameter
0
priv
0
privpassword
0
ipent
0
ipadd
Values
Equivalent web parameter
password
Digi TransPort® Routers User Guide
678
Configuring alarms
Configure events to trigger alarms
Send SMS alert messages when events occur
Web
1. Go to Configuration > Alarms > Event Settings > SMS. The SMS page has three identical rows, each of which controls setting SMS alert messages.
Note The SMS Messages option is only available on routers with W-WAN capability.
2. Enter SMS message settings:
Send SMS messages to The destination telephone number (MSISDN) for SMS alert messages. The format for this field is the international dialing code followed by the number, but should not contain a + prefix. For example, UK mobile 07871 445677 would be 447871445677.
If the event priority is at least n Sets the trigger level for the alert message. For example, if this field is set to the value 6, only events with a priority of 6 or higher will trigger an automated SMS alert. Setting this field to 0 disables sending SMS alerts.
Use SMS template The name of the template file to form the basis of any alarm messages generated by the event logger. The default template file is a file called event.sms that is stored in the compressed .web file. A new template can be created, and if named event.sms, it takes precedence over the pre-defined event.sms template. However, it is recommended to use a new name, such as event1.sms. Templates should use the .sms file extension.
Send a maximum of n SMS messages per day Limits the number of SMS alert messages sent by the router in any one day. A maximum of 65535 SMS messages can be sent in a day.
n SMS messages have been sent today A status message, indicating how many SMS alert messages have been sent during the last 24hour period. 3. Click Apply.
Digi TransPort® Routers User Guide
679
Configuring alarms
Configure events to trigger alarms
Command line
Command Instance Parameter Values
Equivalent web parameter
event
n
sms_to
A valid mobile number such as 447871445677
Send SMS messages to
event
n
sms_trig 0-9
If the event priority is at least n
event
n
sms_to2 A valid mobile number such as 447871445677
Send SMS messages to
event
n
sms_trig2 0-9
If the event priority is at least n
event
n
sms_to3 A valid mobile number such as 447871445677
Send SMS messages to
event
n
sms_trig3 0-9
If the event priority is at least n
event
n
sms_temp event.sms (The template file stored Use SMS template in the compressed .web file)
event
n
sms_max 0-65535
Send a maximum of n SMS messages per day
Digi TransPort® Routers User Guide
680
Configuring alarms
Configure events to trigger alarms
Log events to a secondary log file on an external flash drive
You can create a secondary log file on a USB flash drive to which the router logs events. Using a secondary log file is useful if an extended logging period is required where, the normal eventlog.txt file would overwrite early events before the operator has had a chance to view them. The secondary log file can be limited in size or allowed to fill the USB flash drive. Once the log file is full, earlier events are pruned from the end of the file to allow new events to be added.
Web
1. Go to Configuration > Alarms > Event Settings > Local Logging.
2. Enter local logging settings:
Local Drive to log to Determines the drive letter where the USB flash drive is located. This is designated u for a USB drive.
Log filename The name of the file for the secondary event log.
Log size The maximum size of the log file in kilobytes.
XML logs On platforms that support it, event logs can be saved in XML format. This field specifies the size of the XML log file, in kilobytes. The files created will be named evxml1.xml, evxml2.xml, etc. 3. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
event
n
logdrive
Drive letter, such as u for USB flash drive.
Local drive to log to
event
n
logfile
Name of the file, such as mylog.txt.
Log filename
event
n
logsizek
Size of log in kilobytes, such as 1048576, Log size which is 1 MB.
event
n
xmllogs
None
Digi TransPort® Routers User Guide
681
Configuring alarms
Configure events to trigger alarms
Log events to a Syslog server
Besides logging events to an internal log file and to a file on a USB flash drive, the router can log events to a Syslog server.
Web
1. Go to Configuration > Alarms > Event Settings > Syslog Messages.
2. Configure Syslog server message settings:
Send Syslog messages When enabled, displays the following options:
Send a Syslog message when the event priority is at least n The lowest-priority event that will generate a syslog message. For example, if this value is set to 6, only events with a priority of 6 or lower (7, 8, or 9) will trigger an automated syslog message. To disable syslog messages, set this value to 0.
Send a maximum of n Syslog messages per day Sets the limit on the number of syslog messages that may be sent during any 24-hour period. The intention is to prevent excessive alerts being sent when the event trigger value is set to a high priority/low value (1, 2, or 3 for example), such as a value that results in a large number of syslog messages being generated. A maximum of 2147483647 Syslog messages can be sent in a day.
n Syslog messages have been sent today A status message that indicates how many Syslog messages have been sent in the last 24-hour period. 3. Click Apply.
Digi TransPort® Routers User Guide
682
Configuring alarms
Configure events to trigger alarms
Command line
Command Instance Parameter
event
n
syslog_trig
event
n
syslog_max
Values 0-9
0-2147483647
Equivalent web parameter
Send a Syslog message when the event priority is at least n.
Send a maximum of n Syslog messages per day.
Configure the Syslog server to which messages are sent
Web
Go to Configuration > Alarms > Event Settings > Syslog Server n.
Syslog Server IP Address The IP address of the server.
Port The port to use.
Note The following three items (Mode, TCP timeout, and Route) only appear on routers with TCP logging software option enabled, which is not a common option.
Digi TransPort® Routers User Guide
683
Configuring alarms
Configure events to trigger alarms
Mode There are currently three supported communication modes; these are selected from a dropdown list and are TCP, UDP, and a protocol described in IETFRFC 3195.
TCP timeout s seconds For TCP communications, this parameter sets the timeout on the socket.
Route using These radio buttons select which method of establishing a route to the server to use.
Routing table When this radio button is selected, the routing table determines the interface that to use for transmitting the syslog message.
Interface x,y If you choose to not use the routing table, you can select an interface type (PPP or Ethernet) from the drop-down selection box, and the interface instance number can be typed into the adjoining text entry box. That interface then determines the route.
Priority Select the event priorities that should cause the event to be logged.
Facility Select which of the router facilities should be logged.
Command line
Entity Instance Parameter Values
Equivalent web parameter
syslog n
server
IP address
Syslog server IP address
syslog n
port
IP port number
Port
syslog n
mode
UDP, TCP, RFC3195
Mode
syslog n
tcp_to
Timeout in seconds, such as 86400. TCP timeout s seconds
syslog n
source_ent PPP, ETH
Interface x,y x=Interface type
syslog n
source_add 0-4
Interface x,y y=interface number
syslog n
priority
Hyphen separated 0-7 Comma-separated 0, 3, 5 or all
Priority checkboxes.
syslog n
facility
Hyphen-separated 0-23
Facility checkboxes.
Comma-separated 4, 3, 5, 10, 15, 22
or all
Digi TransPort® Routers User Guide
684
Configuring alarms
Edit event descriptions
Edit event descriptions
Web
On the Event Logcodes page, you can edit the logcodes that describe events entered in the eventlog.txt file. If a change is made to the logcodes.txt file, the changes are saved in the file logcodes.d, so that when a firmware upgrade is performed, the changes to the logcodes are retained.
The Event Logcodes page initially shows a table containing the event descriptions and reason. Clicking on any of the items that are links in the table opens a configuration page associated with that item. The newly-opened page allows that item to be configured. The configuration options shown on that page are described below.
Digi TransPort® Routers User Guide
685
Configuring alarms
Edit event descriptions
Event
This is not a configurable parameter; it is simply the event number, displayed for information only. This is the number to refer to when filtering events in the event log settings Configuration > Alarms > Event Settings.
Description
A description of the event code. Clicking on a link in this field brings up the configuration page associated with that event.
Filter
This parameter is for information only. If event filtering is applied to an event, the associated filter is shown as On. This is a result of enabling the parameter Do not log this event as described below.
Event Priority
Controls the priority of the event and determines whether an event will trigger email, SMS messages, or SNMP traps.
Reasons
The reason why the event occurred. Not every event has a list of reasons.
Reason Priority
This parameter is for information only.
Attachment List ID
A fixed list of values for conveniently referring to the associated list of files to attach to an email.
Files
Allows entering a comma-separated list of names for the files that should be attached to an email.
Command line
Command event
Instance n
Parameter syslog_trig
Values ev_filter
Equivalent web parameter Do not log this event
There are no commands for editing event logcodes. However, you can edit the logcodes.txt file which holds all the logcode information. For details on how to do this, see View and manage the event log.
Digi TransPort® Routers User Guide
686
Configuring alarms
Edit event descriptions
Configure event logcodes
Web
1. Go to Configuration > Alarms > Event Logcodes. The Event Logcodes configuration page controls the configuration of the event that is displayed in bold font at the top of the page, just below the title bar.
2. Click on a particular link in the Event Logcodes page's Event Description column; for example, Power-up[%c]. The settings for the event are displayed.
3. Enter the event logcode settings as needed:
Do not log this event When enabled, this setting disables logging of the event. This parameter is not saved in the logcodes.txt file but in the config.dan file. This means that after changing this parameter, you must save the changes by clicking the save changes link when prompted (this appears after clicking the Apply button). If you click the Save All Event Code Changes, your changes are not reflected.
Log Priority The priority of the event to determine whether the event will trigger emails, SMS messages or SNMP traps. 0=disabled, 1=highest priority, 9=lowest priority.
Digi TransPort® Routers User Guide
687
Configuring alarms
Edit event descriptions
Alarm Priority If the above Inherit alarm priority from event setting is not enabled, this parameter selects the priority of the reason. Valid values are 0 to 9.
Alarm Priority is dependent on the event being logged by Entity Selecting this setting makes the priority conditional on which system entity triggered the event, such as Ethernet, and enables the following two configuration options:
Entity A list of the system entities.
All Selects all of the system entities.
Instance Selecting this radio button enable a text entry box that allows the user to enter the instance of the selected entity.
Priority only applies to A set of checkboxes, each checkbox controlling whether the priority is applied to that interface instance. So for example, to apply the priority to PPP interface 1, click on PPP 1 checkbox.
Store a snapshot of the Traffic Analyser trace on the log drive Causes a snapshot of the analyser trace to be stored on the USB flash drive
If this event creates an Email alarm Attach a snapshot of the Traffic Analyser trace Causes a snapshot of the analyser trace to be attached to the email.
After this event Leave the Analyser trace Leaves the analyser trace unchanged.
Freeze the Analyser trace Causes the analyser to be frozen, such as no more logging will take place until the email has been sent.
Delete the Analyser trace Causes the analyser trace to be deleted once the email has been sent.
Attach a snapshot of the Event Log Causes the event log to be attached to the email.
After this event Leave the Event Log Leaves the event log unchanged.
Delete the Event Log Deletes the event log after the email has been sent.
Digi TransPort® Routers User Guide
688
Configuring alarms
Edit event descriptions
Attachment List ID Lists the files to attach to the email. The ID refers to the table of files.
If this event creates a Syslog alarm, use Syslog Priority The Syslog priority associated with this event, if it creates a Syslog alarm. This drop-down selection box contains the following options:
n Emergency n Alert n Critical n Error n Warning n Info n Debug
Syslog Facility The Syslog facility associated with this event. This drop-down selection box contains the following options:
n Kernel n User n Mail n System n Auth n Syslog 4. Click Apply.
Command line
There are CLI commands for editing event logcodes. However, you can edit the logcodes.txt file which holds all the logcode information. For details on how to do this, see View and manage the event log.
Command event
Instance Parameter Values
n
ev_filter Comma-
separated
list of event
codes
Equivalent web parameter Do not log this event
Digi TransPort® Routers User Guide
689
Configuring alarms
Edit event descriptions
Configure handling of the reasons for an event
Web
1. Go to Configuration > Alarms > Event Logcodes. 2. Select an event by clicking thee links in the Event LogcodesReasons column; for example, the
Reboot command for the Power-up[%c] event. This opens a page for configuring the reason.
This page is similar to the Event Logcodes page for an event, but with the following difference: there is no Do not log this event checkbox. There is the following additional parameter:
Inherit alarm priority from event Causes the following Alarm Priority parameter to be disabled, and causes the priority to be the same as the event that triggered it. The Alarm Priority parameter is the same as in the Configuring Events page. 3. Click Apply.
Command line
There are no commands for editing event logcodes. However, you can edit the logcodes.txt file which holds all the logcode information. For details on how to do this, see View and manage the event log.
Digi TransPort® Routers User Guide
690
Configuring alarms
Command event
Edit event descriptions
Instance n
Parameter ev_filter
Values
Comma-separated list of event codes
Equivalent web parameter
Do not log this event
Digi TransPort® Routers User Guide
691
Configuring alarms
Configure an SMTP email account to send alarms
Configure an SMTP email account to send alarms
For the router to successfully send emails, an email account (SMTP) must be available.
Web
1. Go to Configuration > Alarms > SMTP Account. The SMTP Account page describes the configuration of the router to use the email account set up for it.
2. Enter SMTP account parameters:
Hostname or IP address of your SMTP server
The IP address or hostname of the SMTP mail server, such as smtp.myisp.com. Sending email requires a connection to the Internet. Depending upon how the router is configured, it may be necessary to check that the PPP configuration allows a connection to the ISP or external SMTP mail server.
Port
The Simple Mail Transfer Protocol (SMTP) uses TCP port 25, which is the default for this parameter. If the mail server uses a different TCP port, enter it here.
Username
Email accounts are controlled by requiring a username and password in order to send and receive mail. This field is where the account username is set. This information will be provided by the administrator of the email server.
Password
This field is where the account password is set.
Digi TransPort® Routers User Guide
692
Configuring alarms
Configure an SMTP email account to send alarms
Confirm password
Re-enter the password. The two passwords are compared to check that they are the same and that there hasn't been a typographical error when entering them. This check is deployed because password characters are not echoed. Therefore, the usual visual feedback is not available.
Display "Email From" as
The text for the MAIL FROM parameter, which forms part of the protocol when connecting to the email server. Most SMTP servers accept an empty string, while others require that this parameter is present. You may need to consult with the SMTP server administrator (or ISP) to determine whether this parameter is required.
Attachment size limit n Kbyte, Mbyte
Some email service providers place a limit on the size of an email attachment that they will accept, you can use this parameter to ensure that the limit is not exceeded. The traffic analyser and event logger can generate substantial files, and it may be required that these files are truncated when sent as email attachments. The size is specified in kilobytes. For example, setting this limit to 250 truncates the attachment to 250kB before transmission. Setting the size to 0 means that no limits are imposed.
If the email template does not contain one, use "Reply To" address
This address is inserted into the email header if no reply address exists in the appropriate email template. If the email template does contain an address in the reply to: field, that will override the default reply address.
Route using Routing table, Interface x,y
When selected, the routing code determines the outbound interface, and that interface determines the source IP address. If the Route using routing table option is not selected, the settings in the interface and interface instance text boxes determine the outbound interface and source IP address. These are selected from the drop-down selection box and are None, PPP, and Ethernet.
Resend the email after s seconds if the first attempt fails
This setting and associated text entry box enable the retry mechanism. If the first attempt to deliver the email fails, the router waits the specified number of seconds (which must be nonzero) before making another attempt. 3. Click Apply.
Command line
Command smtp
Instance Parameter Values
n
server
Valid hostname or IP
address
Equivalent web parameter
Hostname or IP address mailserver.isp.com 122.134.156.178
Digi TransPort® Routers User Guide
693
Configuring alarms
Command smtp smtp
smtp
smtp smtp
smtp
smtp smtp smtp smtp
Configure an SMTP email account to send alarms
Instance Parameter Values
Equivalent web parameter
n
port
Valid port number, such Port n
as25
n
username Free text field containing a Username
valid account username
such as my_account
n
password Free text field containing Password
account password, such as
my_password
n
mail_from Free text field
Display Email From as
n
att_lim
0-65535
Attachment size limit This CLI value is entered in Kilobytes only.
n
reply_to Free text field
If the email template does not contain one, use Reply To address
n
userouting 0, 1
Route using routing table
n
ll_ent
Blank,PPP,ETH
Route using Interface x,y x=Interface type
n
ll_add
0-255
Route using Interface x,y y=interface number
n
retry_dly 0-255
Resend the email after s seconds if the first attempt fails
Digi TransPort® Routers User Guide
694
Configuring system settings
Set device identity parameters
696
Set system date and time
698
Set commands to run automatically at bootup
709
Set web and command line interface options
710
Set miscellaneous system options
713
Set power control options
715
Set temperature monitoring
719
Digi TransPort® Routers User Guide
695
Configuring system settings
Set device identity parameters Web
1. Go to Configuration > System > Device Identity.
Set device identity parameters
2. Enter device identity settings:
Description
A description of up to of up to 64 characters that uniquely identifies the router. This description is helpful when your site has many routers. A descriptive name can be an easier identifier than its serial number or other unique parameter. The SNMP function in the router uses this parameter.
Contact
A contact name for the router.
Location
A location string for the router, which again may be helpful when referring to a particular router within a site or for identifying a particular site.
Device ID
This field is taken from the Remote Manager configuration and should not normally need to be changed. When using Remote Manager to manage the router, the configuration procedure assigns a device ID to the router. The device ID is a 64-byte value, with each 8-byte section separated with a - character. Valid digits are upper case hexadecimal. The first 16 digits (reading from left to right) are normally set to 0. The second 16 digits comprise the MAC address of the primary Ethernet interface and the digits FF to make up the full 8-digit. The following device ID illustrates the format, using the MAC address 00:11:22:33:44:55.:
00000000-00000000-001122FF-FF334455
Digi TransPort® Routers User Guide
696
Configuring system settings
Set device identity parameters
Router Identity
A string of up to 20 characters that identify the router in email alert messages generated by the event logger. This string also serves as the prompt string during a remote login. The factory configuration uses the character sequence %s. This sequence is replaced by the serial number of the router when the unit identity is displayed. You can use this character sequence when creating a custom identity for the router. For example, if the serial number of the router is 012345, entering the string My_Router_%s> would show the prompt My_Router_012345> during a remote login.
Hostname
Assigns a hostname of up to 64 characters to the local IP address of the router.
Secondary Hostname
Assigns a second hostname of up to 64 characters to a router. This is associated with the secondary IP address. 3. Click Apply.
Command line
Command snmp
Instance n
Parameter Name
snmp
n
snmp
n
cmd
n
cmd
n
Contact Location Unitid Hostname
cmd
n
sec_hostname
Values
Equivalent web parameter
Free text field up to 64 Description characters
Free text field
Contact
Free text field
Location
Free text field
Router Identity
Free text field up to 64 Hostname characters
Free text field up to 64 Secondary
characters
Hostname
Digi TransPort® Routers User Guide
697
Configuring system settings
Set system date and time
Set system date and time
The router keeps track of calendar time using an internal real time clock (RTC) device. The router uses this clock to time/date stamp logfiles. The router uses the 24-hour clock. Because maintaining an accurate system clock can be important for routers on the Internet, you can configure the router use NTP and SNTP services to maintain the internal system time, in addition to setting the system date and time manually.
Using NTP is recommended for greater accuracy
NTP is much more accurate than SNTP, with an accuracy of 200 microseconds (1/5000 second) can be achieved. The NTP functionality is in accordance with RFC1305. You can configure up to 4 remote peers. All the peers are polled at intervals, and the best peer is selected for using as the time source. Configure SNTP before using NTP. The router calculates the accuracy of the NTP time servers over a period of time, up to 2 hours. Once the drift compensation is calculated, the router uses NTP client. The drift compensation value is stored in NVRAM and written to the config.da0 file. If the router loses power or is rebooted, it does not need to re-calculate the accuracy of the NTP servers again. The compensation value is constantly monitored to make sure it remains correct.
Note Using SNTP achieves an accuracy of around 1 second. Using NTP achieves an accuracy of 200 microsecond. Not all models support NTP; this option only appears for models that do.
Set system date and time manually
Web
1. Go to Configuration > System > Date and Time.
2. Set date and time parameters:
Do not auto-set the system time
If enabled, allows you to set the system time manually. This is the system default, and this radio button is selected when the router is new, unless a different default configuration has
Digi TransPort® Routers User Guide
698
Configuring system settings
Set system date and time
been supplied. Click this radio button to close the SNTP or NTP configuration pages. Enabling this setting displays the following fields:
Current system time
The current system time appears at the top of this web page.
Manually set the time h hours, m minutes s seconds, M month D day Y year
These parameters are set using the associated drop-down selection menus.
Hours
Select from the drop-down list to set the hours.
Minutes
Select from the drop-down list to set the minutes.
Seconds
Select from the drop-down list to set the seconds. This setting may have limited use due to human reaction times.
Month
Select from the drop-down list to set the month.
Day
Select from the drop-down list to set the day.
Year
Select from the drop-down list to set the year.
Set
Click this button to apply the settings.
Timezone
Sets the time to display in the local time for the selected time zone.
Update for Daylight Saving Time.
When checked, causes the following parameters to appear, the router uses those settings to automatically adjust the system time to ensure the router uses local Daylight Saving Time.
Start parameters
Month
The month in which to switch to daylight saving time.
Digi TransPort® Routers User Guide
699
Configuring system settings
Set system date and time
Day
The day on which to switch to daylight saving time.
Hour
The hour at which to switch to daylight saving time.
End
Month
The desired month in which to switch back to GMT (UTC).
Day
The desired day on which to switch back to GMT.
Hour
The desired hour at which to switch back to GMT. 3. Click Apply.
Set system date and time automatically using an SNTP server
You can configure the router to have its system date and time set automatically by an SNTP server. SNTP continually polls an external NTP time server on either a private company network or the internet at a configured interval rate.
Digi TransPort® Routers User Guide
700
Configuring system settings
Set system date and time
Web
1. Go to Configuration >System > Date and Time > Autoset Date and Time. 2. Select Use SNTP to auto-set the system time. The SNTP server parameters appear:
3. Configure the SNTP server parameters:
SNTP server
The hostname or IP address of the desired SNTP server.
Authorisation key #
The SNTP authorization request key number. SNTP allows for authenticating SNTP requests and responses with a key. These SNTP requests include a key # field allowing the SNTP server can look up the appropriate key to use in performing the authorization.
Authorisation key
The key to associate with the configured authorization key number.
Check on Power-Up
When checked, causes the router to attempt to connect to the SNTP server every time it boots.
Update every h hours
The interval, in hours, the router should wait between updating the system clock.
Digi TransPort® Routers User Guide
701
Configuring system settings
Set system date and time
Update randomly between s1 and s2 seconds
It is possible to use a random update interval rather than a fixed interval. There are two textentry boxes for this purpose. Enter the minimum interval into the left-hand box, and the maximum desired interval into the right-hand box. Selecting the random update clears the fixed interval.
Offset from GMT
This parameter should be set to + or - the number of hours the router's time should be ahead or behind Greenwich Mean Time. 4. Click Apply.
Set system date and time automatically using an NTP server
You can configure the router to have its system date and time set automatically by an NTP server.
Digi TransPort® Routers User Guide
702
Configuring system settings
Web
Set system date and time
Digi TransPort® Routers User Guide
703
Configuring system settings
Set system date and time
1. Go to Configuration >System > Date and Time > Autoset Date and Time. 2. Select Use SNTP to auto-set the system time. The NTP server parameters appear:
Digi TransPort® Routers User Guide
704
Configuring system settings
Set system date and time
3. Configure the NTP server parameters:
Initial Drift Compensation n ppm
NTP incorporates compensation for clock drift. If this parameter is known, it can be entered here. Otherwise, the router calculates this value over a period of time. Once calculated, the value is displayed in the text box.
Clock Precision Limit
Select the clock precision limit from the drop-down selection box.
Disable NTP when interface x,y is out of service
If the specified interface is out of service, the NTP is disabled until the interface is available again.
NTP Servers 1 - 4
The router can have up to four NTP server connections. The more NTP servers deployed, the more accurate the time setting will be. The following section describes the configuration of the connections.
NTP Server 1/2/3/4-Hostname
The NTP server hostname or IP address.
Authorisation key #
The NTP authorization request key number. NTP allows for authenticating NTP requests and responses with a key. These NTP requests include a key # field allowing the NTP server can look up the appropriate key to use in performing the authorization.
Authorisation key
The key to associate with the configured authorization key number.
Broadcast Mode
When enabled, the NTP client operates in a different manner. Rather than sending out an NTP client message and expecting a reply, the NTP module sends out a broadcast mode packet to the IP address configured in NTP host field. The broadcast interval is determined by the value of Minimum poll interval.
Poll Interval s1 to s2 seconds
The minimum and maximum intervals between poll broadcasts. The values are time, in seconds, represented as a power of 2. This means that a value of 4 means that the minimum poll interval is 2^4=16 seconds.
Startup burst Interval s seconds
When connecting to an NTP time server in polled mode, it may be necessary to send polls at intervals shorter than the minimum poll interval, to speed up the synchronization process. This parameter controls the interval between polls during the startup process. This feature is useful in situations where the router only has an intermittent Internet connection.
Digi TransPort® Routers User Guide
705
Configuring system settings
Set system date and time
4. Click Apply.
Command line
Command Instance Parameter Values
n/a
n/a
time
hh [mm [ss [DD [MM [YYYY]]]]]
sntp
n
server
Valid hostname or IP address sntp.timeserve.org
sntp
n
pwrchk
0, 1 0=Off 1=On
sntp
n
interval 0-255
sntp
n
randintsecs 0-86400
sntp
n
sntp
n
offset
-12 to +13
dstonmon 0-12
sntp
n
sntp
n
sntp
n
sntp
n
sntp
n
sntp
n
ntp
n
ntp
n
ntp
n
dstonday dstonhr dstoffmon dstoffday dstoffhr ntp
driftppm precision inhibit_int
0-31
0-23
0-12
0-31
0-23
0, 1 0=SNTP 1=NTP Default=OFF
-10000-+10000
-10-0
Blank, PPP, Ethernet
Equivalent web parameter Manually set the time. SNTP Server
Check on Power-up
Update every h hours Default=24 Randomly between s1 and s2 seconds Use format [s1,s2] For example, min 50, max 500 would be: [50,500] Offset from GMT. Start: Month Update for Daylight Saving Time 0 disables daylight saving. Start: Day Start: Hour End: Month End: Day End: Hour
Initial Drift Compensation Clock Precision Limit Disable NTP when interface x,y is out of service x=Interface type
Digi TransPort® Routers User Guide
706
Configuring system settings
Set system date and time
Command Instance Parameter Values
ntp
n
inhibit_add 0-255
ntp
n
ntp
n
ntp
n
server bcast
Valid IP address or hostname, such as ntp1@timeserver.org
0, 1
minpoll
3-14
ntp
n
ntp
n
ntp
n
ntp
n
ntp
n
ntp
n
ntp
n
ntp
n
maxpoll 3-14
burstint 0-255
server2 bcast2 minpoll2
Valid IP address or hostname, such as ntp2@timeserver.org
0, 1 0=disabled 1=enabled
3-14
maxpoll2 3-14
burstint2 0-255
server3
Valid IP address or hostname, such as ntp3.timeserver.org
Equivalent web parameter
Disable NTP when interface x,y is out of service y=interface number
NTP Server
Broadcast Mode 0=disabled 1=enabled
Poll Interval s1, s2 3=8 4=16 5=32 6=64 7=128 8=256 9=512 10=1024 11=2048 12=4096 13=8192 14=16384
Poll Interval s1, s2 See minpoll parameter for values.
Startup burst Interval s seconds
NTP Server
Broadcast Mode
Poll Interval s1, s2 See minpoll parameter for values.
Poll Interval s1, s2 See minpoll parameter for values.
Startup burst Interval s seconds
NTP Server.
Digi TransPort® Routers User Guide
707
Configuring system settings
Set system date and time
Command Instance Parameter Values
ntp
n
bcast3
0, 1 0=disabled 1=enabled
ntp
n
minpoll
3-14
ntp
n
maxpoll 3-14
ntp
n
ntp
n
ntp
n
ntp
n
burstint3 0-255
server4 bcast4 minpoll4
Valid IP address or hostname, such as ntp4.timeserver.org
0, 1 0=disabled 1=enabled
3-14
ntp
n
maxpoll4 3-14
ntp
n
burstint4 0-255
Equivalent web parameter Broadcast Mode
Poll Interval s1, s2 See minpoll parameter for values. Poll Interval s1, s2 See minpoll parameter for values. Startup burst Interval s seconds NTP Server.
Broadcast Mode
Poll Interval s1, s2 See minpoll parameter for values. Poll Interval s1, s2 See minpoll parameter for values. Startup burst Interval s seconds
ntpstat command: Check NTP client status
To check the status of the NTP client, use the ntpstat command. See the Command line section of Show NTP status.
Digi TransPort® Routers User Guide
708
Configuring system settings
Set commands to run automatically at bootup
Set commands to run automatically at bootup
The router can be configured to run a number of commands once it has booted. These commands are associated with specific asynchronous serial interfaces. For example, suppose a Script Basic script, sample.bas, must be run at boot up. Autorun commands are normally associated with an ASY port, but running a script for example is not ASY port-specific.
Web
1. Go to Configuration > System General > Autorun Commands.
2. In the Command field, enter the CLI command to run at bootup. For example, to run the Script Basic script sample.bas at bootup, you would enter bas sample.bas.
3. Click Add. 4. Click Apply.
Command line
Command cmd
Instance n
Parameter autocmd
Values Valid CLI command
Equivalent web parameter Autorun Commands
Digi TransPort® Routers User Guide
709
Configuring system settings
Set web and command line interface options
Set web and command line interface options Web
1. Go to Configuration > System > General > Web / Command Line Interface.
2. Set web and command line options as needed:
Automatically log user out if idle for h hours m minutes s seconds
To limit the probability of unauthorized users gaining access to the router, login timeouts are applied. These timeouts cause an existing connection to be closed after a predefined period. The default is 20 minutes.
For users connected on the local Async port Use access level None, Low, Med, High, Super
For security purposes, logging into the router is controlled by a user access level. This parameter controls the access level that applies when logging in via the local asynchronous serial port.
Automatically log user out Never / If idle for h hrs m mins s secs
How long the local port allows access before terminating the connection and requiring the user to log in again. Selecting the Never buttons allows permanent access to the router via the local asynchronous serial port. If, for security reasons, it is required that the access should be limited, the appropriate time period can be entered into the text entry boxes.
Disable Remote command echo for Telnet sessions
Enables/disables command echo for remote access. This applies to Telnet and TRANSIP sessions.
Digi TransPort® Routers User Guide
710
Configuring system settings
Set web and command line interface options
CLI Pre-Login Banner
The router can display a banner before any login information is requested. The parameter specifies the name of a file that is stored in the flash filing system and contains the text to be displayed before the request for the username and password. This can be useful for displaying a standard welcome message or any site-specific user instructions.
CLI Post-Login Banner
Once the user has successfully logged on to the router, a second message can be displayed. This parameter specifies the name of a file containing the text to display. As above, the file may contain site-specific instructions to be carried out once the user has logged in.
Allow CLI access from X.25 address n
Enables/disables logging into the router over an X.25 connection. The parameter n must be a valid X.25 NUA (Network User Address).
With TRANSIP, use access level None, Low, Med, High, Super
Controls the security access level when using TRANSIP to access the router.
Default WEB page
Sets the default web interface page to open for the router. The default is default.asp.
Display runtime info on the login WEB page
Shows or hides runtime status information about the device on the login page.
TACACs+ authorises WEB requests on a page by page basis
If enabled, each request for a page results in a TACACS+ authorisation request getting sent off to the TACACS server. The request will include the name of the requested page. If this setting is disabled and you are using TACACS for authorization, a TACACS authorisation request is only sent to the server when the user first logs in. 3. Click Apply.
Command line
Command cmd
Instance Parameter
n
tremto
Values 0-86400 seconds
Equivalent web parameter
Automatically log user out if idle for h hrs m mins s seconds This CLI value is entered in seconds only.
Digi TransPort® Routers User Guide
711
Configuring system settings
Set web and command line interface options
Command local
local cmd cmd cmd cmd local
web web
Instance Parameter
n
access
n
tlocto
n
noremecho
n
prebanner
n
postbanner
n
cmdnua
n
transaccess
0
prelogin_info
0
tacacspageauth
Values 0-4
Free text field 0, 1 0=Off (default) 1=On Valid filename such as welcome1.txt Valid filename such as welcome2.txt 0-1023
0-4
on, off Default value: off on, off Default value: on
Equivalent web parameter
Use access level 0=Super 1=High 2=Medium 3=Low 4=None 8=Read only
Never, h hrs, m mins, s secs
Enable Remote command echo
CLI Pre-Login Banner
CLI Post-Login Banner
Allow CLI access from X.25 address
With TRANSIP, use access level 0=Super 1=High 2=Medium 3=Low 4=None 8=Read only
Display runtime info on the login WEB page
TACACs+ authorises WEB requests on a page by page basis
Digi TransPort® Routers User Guide
712
Configuring system settings
Set miscellaneous system options
Set miscellaneous system options
Web
1. Go to Configuration > System > General. Depending on the router model, this page may have several miscellaneous system options in the Miscellaneous section; for example:
2. Set miscellaneous options as needed:
Use Config n when the router powers up
The router maintains two configuration files, either of which may be invoked on power-up. Select the required one from the drop-down selection box. Use this option with care as selecting the incorrect configuration file can cause confusion.
Allow anonymous FTP login
Enables or disables the router to accept anonymous logins. The default state is Off and the security implications of enabling this option should be considered carefully before applying.
Additional FTP NAT port n
Standard FTP uses two well-known ports, a control port and data port. These are low-number ports, and can be blocked by firewall rules. As such, it may be that an FTP server may be listening on a non-standard control port. This parameter sets the port the router should monitor for FTP PORT and PASV commands. These commands contain information relating to IP addresses and ports that should be modified during the NAT process. The NAT modifications can result in different-sized packets being generated that then require that the TCP sequence numbers be modified to allow for the changes.
SNMP Enterprise number
The value of the OID (Object IDentifier) SNMP management tools to use when accessing the MIB (Management Information Block). This number must form part of the OID for accessing individual items in the MIB as a prefix. For example: SNMPv2-SMI::enterprises.16378.10001.
Digi TransPort® Routers User Guide
713
Configuring system settings
Set miscellaneous system options
SNMP Enterprise Name
The name corresponding to the above Enterprise Number.
Only resolve DNS request for domain
Entering a domain name here restricts DNS requests to the specified domain only.
W-WAN LED to display W-WAN, ISDN/PSTN
On the front panel of the display of models fitted with a W-WAN module, is an LED that you can use to display the status of the W-WAN module or the status of the PSTN/ISDN connection. Use the drop-down selection box to choose what the LED displays. The ISDN/PSTN settings depend upon which of these two options are available on the router.
Serial LED to display Connection, DTR
On the front panel of the router is an LED dedicated to indicating the status of various signals on the asynchronous serial line. Use the drop-down selection box to choose which signal status to display. On modules fitted with W-WAN, this LED has additional functionality, you can use this LED to display the W-WAN signal strength. 3. Click Apply.
Command line
Command Instance Parameter Values
config
n
powerup 0, 1
cmd
n
snmp
n
snmp
n
anonftp
0, 1 0=Off (default) 1=On
ftpnatport 0-65535
ent_nb 0-65535
cmd
n
cmd
n
cmd
n
ent_name Free text field
dnsname Valid Domain name, such as mydomain.org
gprsled_ 0, 1 mode
cmd
n
asyled_ 0, 1 mode
Equivalent web parameter
Use Config n when the router powers up
Allow anonymous FTP login
Additional FTP NAT port
SNMP Enterprise Number Default 16378
SNMP Enterprise Name
Only resolve DNS request for domain
W-WAN LED to display W-WAN, ISDN/PSTN 0=W-WAN 1=ISDN/PSTN
Serial LED to display Connection, DTR 0=Connection 1=DTR status 2=W-WAN signal strength
Digi TransPort® Routers User Guide
714
Configuring system settings
Set power control options
Set power control options
You can reduce the amount of power a Digi TransPort router consumes.
n In normal operation, TransPort WR21 and WR31 models consume around 300 mA from a 12 V DC power supply, which equates to about 4 W.
n The TransPort WR41v2 consumes around 400 mA from a 12 V DC power supply which equates to about 4.8 W.
n The TransPort WR44v2 consumes around 800 mA from a 12 V DC supply, which equates to about 10 W.
Reducing power consumption is useful for emote sites with no mains supply available, solar or wind battery-powered applications, when the router is communicating with a serial device only, or when you want to wake the router at a certain time by using a Python script to turn on the cellular module and send data. The tradeoff for reducing power consumption is reduced functionality and/or reduced performance. For example, with the most aggressive power reductions available on the TransPort WR21, you can reduce the power consumption to under 1 W.
Functional areas for saving power
There are several areas of TransPort router functionality where you can save power, if necessary:
n Lower the CPU speed. TransPort WR21 and WR31 models have two CPU settings available: l 0 = high speed (454 MHz) l 1 = low speed (360 MHz)
TransPort WR41 & WR41v2 models have three CPU settings available: l 0 = high speed (400 MHz) l 1 = medium speed (266 MHz) l 2 = low speed (133 MHz)
n Turn off the LEDs on the front panel of the router. n Disable Ethernet capability. n Disable cellular module functionality. n Disable GPS functionality, where fitted. n Disable GPRS functionality, where fitted. n Disable Wi-Fi, where fitted. n Disable DSL functionality, where fitted. n Disable the USB port.
Power control profiles
The router has several groups of power control settings, referred to as power control profiles, numbered from 0 to 3. At startup, the router always uses power control profile 0 unless otherwise configured. You can change the power control profile from the command line only.
Digi TransPort® Routers User Guide
715
Configuring system settings
Set power control options
Additional information on power control
For more information, see Application Note 67: Using The Low Power Modes on TransPort.
Web
1. Go to Configuration > System > Power Control. The currently selected power control profile is shown in the Current profile field. By default, Profile 0 is selected. Each power control profile has these settings:
CPU speed
Sets the CPU speed for the router. You can set this value to High for high speed, and Low for low speed.
LEDs
Enables or disables the illumination of front-panel LEDs.
Mobile Module
Enables or disables the cellular module.
GPS
Enables or disables GPS functionality .
GPRS
Enables or disables GPRS functionality .
Ethernet
Enables or disables Ethernet capability.
Wi-Fi
Enables or disables Wi-Fi functionality.
DSL
Enables or disables DSL functionality.
USB
Enables or disables the USB port. 2. Click Apply.
Digi TransPort® Routers User Guide
716
Configuring system settings
Set power control options
Command line
Command Instance Parameter Values
Equivalent web parameter
pwrctrl 0-3
cpuspeed
0-3 Available speed values vary by
model 0 = high speed (454 MHz) 1 = low speed (360 MHz) 2 3
CPU Speed
pwrctrl 0-3
leds
on, off
LEDs
pwrctrl 0-3
eth
on, off
Ethernet
pwrctrl 0-3
gprs
on, off
Mobile Module
pwrctrl 0-3
gps
on, off
GPS
pwrctrl 0-3
wifi
on, off
Wi-Fi
pwrctrl 0-3
dsl
on, off
DSL
pwrctrl 0-3
act_rq
The power control profile number. You can enter this command immediately after setting the parameters and is useful when testing the functionality. You must save the profile by entering config 0 save.
None - Power control profile is selected through command line only.
pwrctrl none status
Displays the current active power control configuration
The Power Control display for the currently selected power control profile.
Example
To set setting a router's CPU to low-speed and all other power control parameters to off, enter:
pwrctrl 1 cpuspeed 1 OK pwrctrl 1 leds off OK pwrctrl 1 eth off OK pwrctrl 1 gprs off OK pwrctrl 1 gps off OK pwrctrl 1 ? Parameters are..
cpuspeed: 1 leds: OFF
Digi TransPort® Routers User Guide
717
Configuring system settings
eth: OFF gprs: OFF
gps: OFF OK
Set power control options
Digi TransPort® Routers User Guide
718
Configuring system settings
Set temperature monitoring
Set temperature monitoring
You can monitor the temperature of some of the components on the TransPort router in real time. The temperature is monitored through the Digi Remote Manager health metrics. You can configure the router to power off device subsystems when various components exceed a temperature limit. For more information, see Quick Note 46: Temperature Monitoring on Digi TransPort Routers
Web
1. Enable health metrics to display in the Digi Remote Manager health monitor. See Enable device health reporting.
2. Go to Configuration > System > Temperature Monitoring. Configure these settings:
Power off subsystems when motherboard above operating temperature limit
Displayed for Digi TransPort model WR44v2 only. Enables automatic shutdown of various subsystems when the mainboard temperature sensor indicates that the motherboard is operating above its normal temperature range.
Power off modem RF when module above operating temperature limit
Enables automatic shutdown of the cellular modem's RF interface when the cellular modem's temperature sensor indicates that the modem is operating above its normal temperature range. 3. Click Apply.
Command line
Command templog
templog
Instance 0
0
Parameter
mb_autooff (Digi TransPort model WR44v2 only)
mo_autooff
Values on, off
on, off
Equivalent web parameter
Power off subsystems when motherboard above operating temperature limit
Power off modem RF when module above operating temperature limit
Digi TransPort® Routers User Guide
719
Configuring remote management
Use Digi Remote Manager to manage devices
721
Use SNMP for remote management
731
Digi TransPort® Routers User Guide
720
Configuring remote management
Use Digi Remote Manager to manage devices
Use Digi Remote Manager to manage devices
Digi Remote Manager is a hosted remote configuration and management system for managing a large number of routers.
Digi Remote Manager provide a web-based interface that shows the configuration of selected routers allows the configuration to be changed and also facilitates remote firmware upgrade. The Digi Remote Manager servers also provide a data storage facility.
Using Digi Remote Manager requires setting up a Digi Remote Manager account. Applying for an account is a straightforward procedure; the local sales representative will have details. To set up a Digi Remote Manager account and learn more about Digi Remote Manager, go to http://www.digi.com/products/cloud/digi-remote-manager.
Digi TransPort® Routers User Guide
721
Configuring remote management
Use Digi Remote Manager to manage devices
Configure Digi Remote Manager
Web
1. Go to Configuration > Remote Management. 2. Set the following values:
Enable Remote Management using a client-initiated connection Displays the basic configuration parameters and enables the router to make the connection to the Remote Manager server.
Server Address The IP address or (more usually) the domain name of the Remote Manager host. This information will be supplied when your Remote Manager account is activated.
Automatically reconnect to the server after being disconnected The protocol for communicating with the server allows the router to detect that it is no longer connected to the server. Enabling this setting causes the router to attempt to reconnect when it discovers the connection has been lost.
Reconnect after h hours m minutes s seconds The interval to wait before attempting to reconnect to the server.
Password/Confirm password The authentication password for connecting to the server.
Use SSL Enables or disables use of SSL on the remote management connection. 3. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
cloud
0
clientconn 0, 1
Enable Remote Management and Configuration using a client-initiated connection 0=Off 1=On
cloud
0
server
Valid IP address such as 1.2.3.4 DNS Resolve Server
or domain name such as
Address only when a
login.remotemanager.digi.com default route is UP
Digi TransPort® Routers User Guide
722
Configuring remote management
Use Digi Remote Manager to manage devices
Command Instance Parameter Values
cloud
0
reconnect 0, 1
cloud
0
cloud
0
cloud
0
cloud
0
reconnsecs 0-86400
pwd epwd ssl
password string password string on, off
Equivalent web parameter
Automatically reconnect the server after being disconnected 0=Off 1=On
Reconnect after h, m, s This CLI value is entered in seconds only.
Password
Confirm Password
Use SSL
Digi TransPort® Routers User Guide
723
Configuring remote management
Use Digi Remote Manager to manage devices
Configure using SMS messages for remote management
The SMS feature supports sending and receiving SMS messages between Remote Manager and a Remote Manager-registered router. You can use SMS to:
n Send an SMS message to the router in order to have the router dynamically establish its EDP connection with Remote Manager
n Send user defined data to and from Remote Manager and Remote Manager-registered router n Perform limited device management such as pinging the router, as well as provisioning it
properly for SMS functionality with Remote Manager
For more information on the SMS feature, see the Digi Remote Manager User Guide.
Web
1. Go to Configuration > Remote Management > Remote Manager > SMS Settings. 2. Set the following values:
Enable Remote Manager SMS Check this box to enable Remote Manager SMS feature
Enable Opt-in Enable the opt-in to ensure that you have subscribed to the SMS service. Check this box to enable opt-in.
Enable Strict Sender You can enable the Strict Sender mode to ensure that the SMS messages from Remote Manager are never blocked. Check this box to enable the Strict Sender framework.
Enable responses to be sent to the sender's phone number Check this box to enable responses to be sent to the sender's phone number.
Accept Remote Manager client connection requests Enable client connection requests to accept the incoming connections. Check this box to enable Remote Manager client connection requests.
Accept requests to connect to other Remote Manager servers Check this box to accept request to connect to other Remote Manager servers.
Override the destination phone number with the following number Check this box to override the destination phone number with another phone number. Once you check this box, the phone number text box is enabled. You can enter the phone number in this text box.
Override the service ID with the following value Check this box to specify the service ID value. Once you check this box, the service ID text box is enabled. You can enter your service ID in this text box.
Digi TransPort® Routers User Guide
724
Configuring remote management
Use Digi Remote Manager to manage devices
Limit CLI response to You can specify the maximum CLI response size in this text box. 3. Click Apply.
Command line
Command cloudsms cloudsms cloudsms cloudsms
cloudsms
cloudsms
Instance 0
Parameter enable
0
optinenable
0
strictsender
0
replytosender
Values
off, on Default: off
off, on Default: off
off, on Default: off
off, on Default: off
0
pagedconnect
off, on
Default: off
0
connectoverride off, on
Default: off
cloudsms
0
phnum
Number
cloudsms
0
cloudsms
0
cloudsms
0
svcid maxcliresp debug
Number
Number Default: 0 off, on Default: off
Equivalent web parameter
Enable Remote Manager SMS
Enable Opt-in
Enable Strict Sender
Enable responses to be sent to the sender's phone number
Accept Remote Manager client connection requests
Accept requests to connect to other Remote Manager servers
Override the destination phone number with the following number
Override the service ID with the following value
Limit CLI responses to n bytes.
None
Digi TransPort® Routers User Guide
725
Configuring remote management
Use Digi Remote Manager to manage devices
Enable device health reporting
You can enable the gathering of health metrics information for your device to display on the Digi Remote Manager Device Health chart. For more information on the Device Health chart and health status reports, see the Digi Remote Manager User Guide. You can set how often you want health metrics samples reported to Digi Remote Manager, and which type of health metrics to report: Ethernet metrics, mobile/cellular metrics, and system metrics.
Web
1. Before enabling health reporting for the router, make sure the router is registered and set to connect with Digi Remote Manager. For instructions, see Configure Digi Remote Manager.
2. Go to Configuration > Remote Management > Remote Manager > Health Metrics. 3. Set the following values:
Report samples to Remote Manager every n minutes How often, in minutes, the router reports health metrics to Digi Remote Manager. The default is 60 minutes.
Enable Ethernet metrics Enables reporting of Ethernet metrics to Digi Remote Manager.
Sample Ethernet metrics every n minutes How often, in minutes, the router reports Ethernet health metrics to Digi Remote Manager. The default is 60 minutes.
Enable Mobile Metrics Enables reporting of mobile metrics to Digi Remote Manager.
Sample Mobile metrics every n minutes How often, in minutes, the router reports mobile health metrics to Digi Remote Manager. The default is 60 minutes.
Enable System Metrics Enables reporting of system metrics to Digi Remote Manager.
Sample System metrics every n minutes How often, in minutes, the router reports system health metrics to Digi Remote Manager. The default is 60 minutes. 4. Click Apply.
Digi TransPort® Routers User Guide
726
Configuring remote management
Use Digi Remote Manager to manage devices
Command line
Command Instance Parameter
metrics 0
report_rate
metrics 0 metrics 0
eth_metrics eth_sample_rate
metrics 0 metrics 0
metrics 0 metrics 0
mobile_metrics
mobile_sample_ rate sys_metrics sys_sample_rate
metrics 0
debug
Values integer Default is 60.
on, off
integer Default is 60.
off, on
integer Default is 60.
on, off integer Default is 60.
on, off
Equivalent web parameter
Report samples to Remote Manager every n minutes
Enable Ethernet metrics
Sample Ethernet metrics every n minutes
Enable Mobile Metrics
Sample Mobile metrics every n minutes
Enable System Metrics
Sample System metrics every n minutes
None. Enables debug mode for health metrics reporting.
Digi TransPort® Routers User Guide
727
Configuring remote management
Use Digi Remote Manager to manage devices
Configure advanced remote management settings
The main group of Remote Manager settings, along with the system defaults, are sufficient to establish a connection to the Remote Manager server. The settings in the Advanced section allow you to fine-tune the Remote Manager connection. Advanced remote management settings control detecting loss of connection. When the router first connects to the Remote Manager server, the link parameters are sent to it. The WAN settings and Ethernet settings described below are identical, but it should be noted in the command line descriptions, the default keepalive intervals are different. This is owing to the different characteristics of PPP and Ethernet links.
Web
1. Go to Configuration > Remote Management > Remote Manager > Advanced. 2. Configure the Connection Settings, as needed.
Connect using a proxy The router connects using HTTP over proxy.
Proxy Port When Connect using a proxy is selected, this value is the proxy host port.
Proxy URL When Connect using a proxy is selected, this value is the URL of the proxy server to which the router connects.
Disconnect when Remote Manager is idle Once the router has connected to the Remote Manager server, and the server has established that all the settings it holds for the router are current, and no new changes are being requested, the traffic between the router and Remote Manager server reduces to the sending of keep-alive packets. In this situation, it may be advantageous to terminate the connection to reduce bandwidth or to keep data costs down. Enabling this setting causes the router to negotiate termination of the connection.
Idle Timeout h hours, m minutes, s seconds The timeout entered here defines how long the router should wait after detecting the idle condition before negotiating termination of the link. Default is 10 seconds.
Data Service Token / Confirm data service token 3. Configure the WAN Settings, as needed.
Receive Interval s seconds The time between keep-alive packets that the router should wait before considering that the connection may be lost.
Transmit Interval s seconds The interval between transmission of keep-alive packets.
Digi TransPort® Routers User Guide
728
Configuring remote management
Use Digi Remote Manager to manage devices
Assume connection is lost after n timeouts Occasional packet loss is to be expected. This parameter allows for a specified number of lost keep-alive packets before the connection is deemed to have failed. 4. Configure the Ethernet Settings, as needed.
Receive Interval s seconds The time between keep-alive packets that the router should wait before considering that the connection may be lost.
Transmit Interval s seconds The interval between transmission of keep-alive packets.
Assume connection is lost after n timeouts Occasional packet loss is to be expected. This parameter allows for a specified number of lost keep-alive packets before the connection is deemed to have failed. 5. Click Apply.
Command line
cloud command
Command Instance Parameter
Values
Equivalent web parameter
cloud
0
use_proxy
on, off
Connect using a proxy
cloud
0
proxy_port
port number
Proxy Port
cloud
0
proxy_url
URL string Proxy URL
cloud
0
idledisconn 0, 1
Disconnect when Remote Manager server is idle 0=Do not disconnect 1=Disconnect
cloud
0
disconnsecs
0-28800 Idle Timeout h,m,s This CLI value is entered in seconds only.
cloud
0
ppprxkeepalive 0-28800 WAN - Receive Interval seconds.
cloud
0
ppptxkeepalive 0-28800 WAN - Transmit Interval seconds.
cloud
0
pppwaitfor
1-255
WAN - Assume connection is lost after n timeouts.
cloud
0
ethrxkeepalive 0-28800 Ethernet - Receive Interval seconds.
cloud
0
ethtxkeepalive 0-28800 Ethernet - Transmit Interval seconds.
cloud
0
ethwaitfor
1-255
Ethernet - Assume connection is lost after n timeouts.
Digi TransPort® Routers User Guide
729
Configuring remote management
Use Digi Remote Manager to manage devices
cloudstat command: Show status of socket connections
To show the status of the socket connections including whether there is a live connection to the Remote Manager server, enter the cloudstat without parameters. For example:
cloudstat
Connection Status: Not Connected
Server:
my.devicecloud.com
Current Server:
Client:
0
Auto-reconnect: 1
Reconnect:
0
Connect attempts: 0
Socket ID:
-1
Conn State:
Disabled
Uptime (secs):
0
Total Bytes RX: 0
Total Bytes TX: 0
OK
Digi TransPort® Routers User Guide
730
Configuring remote management
Use SNMP for remote management
Use SNMP for remote management
Simple Network Management Protocol (SNMP) is a protocol for remotely managing and monitoring network devices. Network administrators can use the SNMP architecture to manage nodes, including servers, workstations, routers, switches, hubs, and other equipment on an IP network, manage network performance, find and solve network problems, and plan for network growth.
Supported SNMP versions
The Simple Network Management Protocol (SNMP) is a well-established way of managing clusters of remote routers. TransPort devices support the SNMP versions SNMPv1, SNMPv2c, and SNMPv3.
Supported Management Information Bases (MIBs)
The standard Management Information Bases (MIBs) supported by the router are:
n SNMP MIB (RFC3418) n Interfaces MIB (RFC2233)* n IP MIB (RFC2011) n IP Forwarding Table MIB (RFC2096) n TCP MIB (RFC2012) n UDP MIB (RFC2013) n VRRP MIB (RFC2787) n SNMP MPD MIB (RFC3412) n SNMP USM MIB (RFC3414)**
* The following groups/tables in RFC2233 are not supported: ifXTable, ifStackTable, ifRcvAddressTable. ** The following groups/tables in RFC3414 are not supported: usmUserTable. Other MIBs may be available on request. Besides the above MIBs, there are two other MIBs that are supplied as standard:
n There is a MIB that is generated after the firmware has been installed. This is accomplished using the mibprint CLI command and the MIBEXE DOS tool, available from Digi Technical Support. This MIB changes with every firmware release, since the firmware revision is embedded in the Object Identifiers (OIDs). This MIB provides access to most of the configuration and statistics that are associated with the router.
n The second MIB is the Monitor MIB, a standard MIB that gives access to various Digi TransPort proprietary objects. The OIDs in this MIB do not change with every release, although it is possible for new objects to be added to it. This MIB is available from Digi Technical Support.
at\smib commands
The at\smib command allows you to view a single standard MIB variable. See at\smib commands for a description of the at\smib command variants.
Digi TransPort® Routers User Guide
731
Configuring remote management
Use SNMP for remote management
Configure SNMP settings
Web
1. Go to Configuration > Remote Management > SNMP. 2. Configure the SNMP settings, as needed.
Enable SNMPv1 Enables/disables support for version 1 of the protocol.
Enable SNMPv2c Enables/disables support for version 2c of the protocol.
Enable SNMPv3 Enables/disables support for version 3 of the protocol.
Use TACACS+ if enabled for authorisation If enabled, the router uses TACACS to authenticate user requests, if TACACS+ is properly configured. See Use TACACS+ to control access to the router.
Use UDP Port n The UDP port number to use. The default is UDP port 161.
SNMPv3 Engine ID Required as part of the SNMP v3 protocol. This is a 24-hexadecimal character string; any trailing zeros in this string making the value up to 24 characters can be omitted. A remote engine ID is required when a SNMP v3 Inform is configured. The router uses the remote engine ID to compute the security digest for authenticating and encrypting packets sent to a user on the remote host. 3. Click Apply.
Command line
Command snmp snmp snmp snmp snmp
snmp
Instance 0 0 0 0 0
0
Parameter v1enable v2cenable v3enable engineid port
tacacs_auth
Values on, off
Equivalent web parameter Enable SNMPv1
on, off Enable SNMPv2c
on, off Enable SNMPv3
String SNMPv3 Engine ID
0-65535 Use UDP Port Default=161
on, off Use TACACS+ if enabled for authorisation
Digi TransPort® Routers User Guide
732
Configuring remote management
Use SNMP for remote management
Configure SNMP users
TransPort routers support up to 10 SNMP users.
Web
1. Go to Configuration > Remote Management > SNMP > SNMP Users. 2. Depending on the SNMP version you have chosen for remote management, configure the
SNMP Users settings for each SNMP user, as needed.
SNMPv1 / SNMPv2c settings
Community The community string for Version 1 and Version 2c SNMP packets.
Confirm Community The community string is echoed as dots in the text entry box. Having a second confirmation field where the string is retyped allows a simple check to be performed for correct entry.
Access The SNMPv1 or SNMPv2c community name.
Digi TransPort® Routers User Guide
733
Configuring remote management
Use SNMP for remote management
SNMPv3 settings
Username The name of the SNMP user.
Authentication None, MD5, SHA1, SHA256 Select the authentication algorithm to apply to SNMP transactions.
Authentication Password The authentication password for the user.
Confirm Authentication Password The authentication password is not shown as clear text. The confirmation box allows a simple check that the password has been entered correctly.
Encryption None, DES, AES These three radio buttons select which encryption (privacy) algorithm should be applied to the SNMP data.
Encryption Password Enter the user's password for controlling privacy of the SNMP transactions into this text box.
Confirm Encryption Password The encryption password is not shown as clear text. The confirmation box allows a simple check that the password was entered correctly. 3. Click Apply.
Command line
Command snmpuser snmpuser snmpuser snmpuser snmpuser snmpuser
Instance n n n n n n
Parameter community name auth authPassword priv privPassword
Values public / private user_name Off,MD5,SHA1 my_password Off,DES,AES my_password
Equivalent web parameter Community Username Authentication, None, MD5, SHA1 Authentication Password Encryption, None, DES, AES Encryption Password
Digi TransPort® Routers User Guide
734
Configuring remote management
Use SNMP for remote management
Configure SNMP filters
SNMP filters allow the system administrator to control access to the router MIBs via SNMP. You can configure up to 10 SNMP filters.
Web
1. Go to Configuration > Remote Management > SNMP Filters. 2. Enter the SNMP filters in the table on this page. This table has three columns, two main
headed columns, described below, and a control column of buttons. You can configure up to 10 SNMP filters, ranging from 0 to 9.
Username The username of the user to whom the access restriction is applied, as configured in the Configuration > Security > Users section.
OID Prefix The Object ID (OID) prefix for the range of objects in the MIB that the user is not allowed to view. such as 1.3.6.1.2.1.4.
Add Adds the username and OID prefix into the table.
Delete Deletes the associated entry in the table. 3. Click Apply.
Command line
Entity snmpfilter snmpfilter
Instance n n
Parameter user oid
Values username Valid SNMP OID
Equivalent web parameter Username OID Prefix
Digi TransPort® Routers User Guide
735
Configuring remote management
Use SNMP for remote management
Configure SNMP traps
The router firmware supports the use of SNMP, with the ability to generate traps. To make the SNMP (Simple Network Management Protocols) functional, you must configure a SNMP trap server.
Web
1. Go to Configuration > Remote Management > SNMP > SNMP Traps. 2. Specify which types of SNMP traps you want to generate:
Generate Enterprise traps Enables or disables generation of enterprise traps.
Generate Generic traps Enables or disables generation of generic traps.
Generate Authentication Failure traps Enables or disables generation of authentication failure traps.
Generate VRRP traps Enables or disables generation of VRRP traps. 3. In SNMP Trap Server 0, configure the settings for SNMP trap server 0:
Trap Server IP Address The IP address for the SNMP trap server.
Port The network port number for the SNMP trap server.
Use interface interface-type interface-number for the source IP address The interface type and number to use for the source IP address. interface-type can be Auto, PPP, or Ethernet.
Use SNMP Version The SNMP version to use (SNMPv1, SNMPv2c, or SNMPv3).
Send "Inform Request" message Enables or disables sending the trap as an Inform Request message, which requires an acknowledgment from the recipient. If this setting is enabled, these settings are displayed:
If no response, retransmit the Inform Request message after n seconds Sets the Inform Request to retransmit if there is no response from the recipient after the specified number of seconds.
Retransmit a maximum n times Sets the number of times to retransmit the Inform Request message.
Digi TransPort® Routers User Guide
736
Configuring remote management
Use SNMP for remote management
Community / Confirm Community For SNMPv1 and SNMPv2c, these settings specify the SNMPv1 or SNMPv2c community name.
Username The SNMPv3 user name.
Authentication The SNMPv3 authentication type: None, MD5, SHA1, or SHA256.
Authentication Password / Confirm Authentication Password The SNMPv3 authentication password.
Encryption The SNMPv3 encryption type: None, DES, or AES.
Encryption Password / Confirm Encryption Password The SMPv3 encryption password. 4. Click Apply.
Command line
Command snmp snmp snmp
snmp snmptrap snmptrap
snmptrap snmptrap snmptrap
snmptrap snmptrap
snmptrap
Instance Parameter
0
enterprisetraps
0
generictraps
0
authtraps
0
vrrptraps
0
ipaddr
0
port
0
version
0
sendinforms
0
informto
0
informretries
0
auth
0
authpassword
Values
Equivalent web parameter
off, on
Generate Enterprise traps
off, on
Generate Generic traps
off, on
Generate Authentication Failure traps
off, on
Generate VRRP traps
IP address Trap Server IP Address
network port Port number
Use SNMP Version
off, on
Send "Inform Request" message
integer
If no response, retransmit the Inform Request message after n seconds
integer
Retransmit a maximum n times
none, md5, Authentication sha1, sha256
password Authentication Password
Digi TransPort® Routers User Guide
737
Configuring remote management
Use SNMP for remote management
Command snmptrap snmptrap snmptrap snmptrap
Instance Parameter
0
priv
0
privpassword
0
ipent
0
ipadd
Values
Equivalent web parameter
password
Digi TransPort® Routers User Guide
738
Configuring security
Configure system security settings
740
Configure user security settings
742
Firewall
748
Use a RADIUS client for authentication
790
Use TACACS+ to control access to the router
794
Use command filtering
799
Digi TransPort® Routers User Guide
739
Configuring security
Configure system security settings Web
1. Go to Configuration > Security > System.
Configure system security settings
2. Configure settings for system security , securing USB devices, and miscellaneous security settings.
Enable password encryption
By default, passwords stored on the router are not encrypted. They are obfuscated, and you can share unencrypted passwords among devices. Enabling this settings causes encrypts passwords using AES encryption and a key specific to the device. Note, however, that you cannot share encrypted passwords among devices.
USB Security Disable the following USB devices
You can restrict or disable the USB port for increased router security. This setting enables or disables the router using any of the following USB devices:
n All devices n Mass storage devices n Serial devices n Hub devices For additional information about restricting use of or disabling the USB port, see .Manage files using USB storage devices.
Digi TransPort® Routers User Guide
740
Configuring security
Configure system security settings
Allow autoexec.bat files to run from Mass Storage Devices
Enables/disables running the autoexec.bat files from the mass storage devices. For additional details on running autoexec.bat files from mass storage devices, see Manage files using USB storage devices.
Enable "Factory Default" reset button
Enables/disables execution of a complete hardware reset. 3. Click Apply.
Command line
Command cmd
Instance 0
Parameter encpasswords
usbcon
0
dislist
usbcon
0
cmd
0
batfile pbreset
Values
Equivalent web parameter
on, off Default is off
Enable password encryption
list of USB ports, where: x=1 for the bottom USB port and 2 for the top port. p=<port #> (if connected to a USB hub the port numbers can increase). DRIVER=MSD for Mass Storage Device, SERIAL for serial devices, or HUB for hub devices.
Disable the following USB devices
on, off
Allow autoexec.bat files to run from Mass Storage Devices
on, off
Enable "Factory Default" reset button
Digi TransPort® Routers User Guide
741
Configuring security
Configure user security settings
Configure user security settings
Web
1. Go to Configuration > Security> User. The User parameter pages allow you to configure several authorized users. The number of users available depends on the firmware build the router is running. Each user has a password and access level that determines the facilities to which the user has access.
2. For each user, configure user parameters
Username
The name of the user. Usernames can be up to 40 characters long. You can use some special usernames:
Username %s %i %c
Description Uses the serial number of the router as the username. Uses the IMEI of the cellular module as the username. Uses the ICCID of the SIM as the username.
If a % symbol is part of the username, you must enter another % character as an escape character. For example user%1 should be entered as user%%1.
Password / Confirm Password
The password for the user. Up to 40 characters are allowed.
Access Level
Selects the access level for the user. There are the following options:
Access level Super High
Medium Low Read Only None
Access allowed
Allows full access to all facilities.
Allows user to reconfigure the general configuration of the router and to change some settings such as the time and date. Not allowed to change user settings.
Allows user to access medium level configuration commands which allow some configuration of the router.
Allows user to access low level commands which tend to be status and statistics commands.
Read only access of the configuration.
User is not allowed to login via Web, FTP, SSH, and Telnet.
Digi TransPort® Routers User Guide
742
Configuring security
3. Click Apply.
Command line
Command user user user
Instance 0 0 0
Parameter name password access
Configure user security settings
Values
String (up to 40 chars)
String (up to 40 chars)
0=Super 1=High 2=Medium 3=Low 4=None 8=Read Only
Equivalent web parameter Username
Password
Access Level
Digi TransPort® Routers User Guide
743
Configuring security
Configure user security settings
Configure advanced user settings
Web
1. Go to Configuration > Security> Users > User n> Advanced.
2. Enter and change advanced user settings as needed.
Allow this user to log in over a PPP network Enabling this setting allows the user to log in to the router using PPP. Disabling this disables PPP login for the user, no matter their access level.
Use this number x when PPP dial-back is required for this user The telephone number for the user in the event that dial-back is required. If the username that the remote router uses during the PPP authentication matches the username of the user where a dial-back number is configured, the user's dial-back number overrides any dial-back number configured in the answering PPP interface.
Alternate IKE Key / Confirm Alternate IKE Key When IKE is the initiator, the responder-supplied HASH is checked using the normal password (above) and if that fails, the Alternate Key (this setting). The initiator remembers which password was successful, and uses that password to create the HASH if it becomes the responder of some new negotiation. If the IKE becomes a responder and IKE negotiations fail after supplying the HASH, the next negotiation uses the other password. Using this Alternate Key, it should be possible to configure new passwords into both ends of a tunnel, and not have too many failed negotiations. The process would be to add the Alternate Key into the remote router, then update the local router with the Alternate Key. Once that has been done, the administrator could move the Alternate Key to the usual location (Password) and remove the Alternate Key (newpwd) from the configuration. Should a negotiation take place during the period where the Alternate Key has been entered into the remote router, but not the local router, there should be no more than one failed negotiation, and only if the remote router is the initiator.
Remote Peer IP address In certain circumstances, it may be desirable for a user connecting in over a PPP connection to be allocated a specific IP address, rather than be allocated an address from a pool configured on a PPP interface. When this parameter is configured, the IP address negotiated on the PPP link will be this one, not an address from the regular IP address pool.
Remote Peer IP subnet If multiple PPP interfaces are enabled for answering and multiple remote routers can dial into the local router, the router cannot always use static routes cannot to ensure that packets which should be routed to the remote network are sent through the correct PPP interface. Use this parameter with the Remote Peer IP subnet mask parameter to associate a network subnet with a user. When a remote unit connects in and authenticates with the router, the router creates a dynamic route that will override any static routes for the duration of the PPP session. The interface for the dynamic route is the PPP interface that answered the call. The network address for the dynamic route comes from the entry in the user table matching the username the remote unit used during PPP authentication.
Digi TransPort® Routers User Guide
744
Configuring security
Configure user security settings
Remote Peer IP subnet mask The remote subnet mask parameter. Use with the Remote Peer IP subnet parameter above to fully qualify the network address for the user.
Public Key file The name of the file containing the public key for that user. If the public key matches the client supplied public key, the user is allowed access.
Default WEB page Sets the default web interface page to open for the user. 3. Click Apply.
Command line
Command Instance Parameter Values
user
0
dun_en on, off
user
0
phonenum Number
user
0
user
0
user
0
user
0
user
0
user
0
newpwd
fieldip ipaddr mask keyfile defpage
String (up to 14 chars)
IP Address
IP Address
IP Mask
Filename
Web page name
Equivalent web parameter Allow this user to log in over a PPP network Use this number x when PPP dial-back is required for this user Alternate IKE Key
Remote Peer IP address Remote Peer IP subnet Remote Peer IP subnet mask Public Key file Default WEB page
Digi TransPort® Routers User Guide
745
Configuring security
Configure user security settings
Change the default user name and password for a user
Change the user name and password for device users. The default user name and password are:
n User name: admin n Password: The default password is printed on the device label.
n If a device that was manufactured prior to release 8.0.0.3 has been upgraded to the current release: l If the device was upgraded using the Web UI Update Firmware, the router retains the existing default user accounts. For example, after upgrading from release 7.1.2.2 to the current release, the default user account name remains username, and the default password is password. o After upgrading using the Web UI Update Firmware, if you then factory reset the device, the user name will be admin, and the default password will be default. l If the device was upgraded using Flashwriter, the user name is admin, and the default password is default.
n If a device that was manufactured with release 8.x is downgraded to a release prior to 8.0.0.3: l If the device was downgraded using the Web UI Update Firmware, the user name is admin, and the default password is default. l If the device was downgraded using Flashwriter, the admin account is longer be present. Instead, the default account user name is username, and the default password is password. o After downgrading with Flashwriter, if you then upgrade to 8.0.0.3 or greater using the Web UI Update Firmware, the router will retain the username/password account and not include an admin account. If you then factory default the router, the admin account with the preprogrammed unique password will return. o After downgrading with Flashwriter, if you then upgrade to 8.0.0.3 or greater using Flashwriter, the admin account with the preprogrammed unique password will again be present and the username/password account will be removed.
Web
1. From the main menu, navigate to Configuration > Security> Users> User n. 2. In the Username field, enter the new user name. Up to 14 characters are allowed in a
username. . 3. In the Password / Confirm Password field, enter the new password.
Note Record the new password. If the changed password is lost, the router must be reset to the default firmware settings.
4. Select the access level for the user: Super, High, Medium, Low, Read Only, or None. 5. Click Apply.
Command line
Issue several user commands, specifying the name, password, and access parameters.
Digi TransPort® Routers User Guide
746
Configuring security
Configure user security settings
Note Record the new password. If the changed password is lost, the router must be reset to the default firmware settings.
Digi TransPort® Routers User Guide
747
Configuring security
Firewall
Firewall
Digi TransPort routers have a comprehensive firewall feature. A firewall is a security system for restricting the type of traffic the router transmits or receives based on a combination of IP address, service type, protocol type, port number, and IP flags. Firewalls minimize the risk of unauthorized access to the local network resources by external users or restrict the range of external resources to which local users have access. For a more detailed description of how firewalls operate on Digi routers, see Use firewall scripts. Review that topic before attempting to implement a firewall.
The rules governing the operation of the firewall are contained in a pseudo-file called fw.txt. You can create this file either by using the controls in the Configuration > Security > Firewall page in the web interface, or by using a text editor on a PC and then loading the resulting file onto the router using FTP or XMODEM. Digi Routers are shipped with a default fw.txt file you can use as the starting point for a custom firewall configuration.
Digi TransPort® Routers User Guide
748
Configuring security
Firewall
Configure firewall rules
Web
1. Go to Configuration > Security> Firewall. Since a default firewall configuration file is provided, when this page loads, it displays the rules in the default fw.txt file. If fw.txt does not exist, a blank table is displayed. There are three other buttons that appear just below the table.
Hits The numbers that appear in this column of the table are the number of hits for the rule that appears to the right.
# The rule number.
Delete Deletes the rule that appears to its left.
Insert Inserts new blank lines above the line on which the button appears. The button at the bottom creates a new blank line at the end of the table. (An empty table contains just the one button at the bottom). 2. To create a new firewall rule, click the button at the point the new rule should appear. A text box appears. 3. Type the firewall rule into the text box and click OK. To abandon any changes, click Cancel. 4. A validation is performed on the rule you entered. If the rule is valid, it is added to the table. If it contains errors, a warning message displays. Edit or delete the rule.
Edit These buttons that appear to the right of the rule open up the rule in an edit text box which allows the text to be edited. Click on the OK button to commit the changes or Cancel to abandon the edit.
Reset Hit Counters Resets to 0 all the rule hit counts that appear in the left-hand column of the table.
Save Saves changes to the table to the fw.txt file. If the changes are not saved using this button, they will be lost if the router is rebooted or loses power.
Restore Restores the original fw.txt to the table, provided that the changes have not been saved. Below the firewall editor table is another table that controls the interfaces to which the firewall rules apply.
Digi TransPort® Routers User Guide
749
Configuring security
Firewall
Interface A list of the available interfaces to which the firewall rules may be applied.
Enabled Enables the firewall for that interface. 5. Click Apply
Command line
Command fw fw fw
Instance n/a n/a n/a
Parameter logclr save -
Values -
Equivalent web parameter Reset Hit Counters Save Restore
To view the firewall rule hits from the command line console, use the type command: type fwstat.hit
Digi TransPort® Routers User Guide
750
Configuring security
Firewall
Configure stateful inspection settings
For more information on stateful inspection and firewall rules, see [inspect-state].
Web
To configure stateful inspection settings, go to Configuration > Security> Firewall> Stateful Inspection Settings. This page contains timer timeout values and other options for the firewall stateful inspection module. This module establishes firewall rules that last for a single connection only. Typically, the first packet of a TCP connection (SYN packet) creates a stateful inspection rule that only allows subsequent packets for that TCP connection through the firewall. The timers described below set limits on how long such rules persist.
Timer options
TCP Opening s seconds The time following receipt of a TCP packet that causes a stateful inspection rule to be created before a TCP connection must be established. If a TCP connection is not established within this period, the associated stateful rule is removed.
TCP Open s seconds The time an established TCP connection can remain idle before the stateful inspection rule created for it is removed. The timer is restarted each time a packet is processed by the associated stateful inspection rule.
TCP Closing s seconds The time allowed for a TCP socket to close once the first TCP FIN packet has been received. If the timer expires before the socket has completed closing, the stateful inspection rule is removed.
TCP Closed s seconds The time that a stateful inspection rule remains in place after a TCP connection has closed.
UDP s seconds The time that a stateful inspection rule remains in place following the receipt of UDP packet. The timer is restarted each time packets matching the rule pass in each direction. As a consequence, use rules based on UDP only if packets will travel in both directions.
ICMP s seconds Some ICMP packets, such as the ECHO request, generate response packets. The value in this text box specifies the length of time that a stateful inspection rule created for an ICMP packet will remain in place if the response is not received. The rule is removed immediately following receipt of the response.
Other protocols s seconds If a stateful inspection rule is created from a packet type other than TCP, UDP or ICMP, a rule timeout should be created for it. The parameter in this text box specifies the length of time such a rule persists. The timer is restarted each time a packet is processed by the rule.
Digi TransPort® Routers User Guide
751
Configuring security
Firewall
Other stateful inspection options
Expire entry after n consecutive packets in one direction The maximum number of consecutive packets that should pass in one direction before the corresponding rule entry is expired.
Count missed UDP echo packets as dropped Causes the firewall to increment the dropped packet count for each failed echo request in the situation where UDP echo is active on an interface that becomes disconnected.
Command line
Entity Instance Parameter
fwall 0
opening
fwall 0
open
fwall 0
closing
fwall 0
closed
fwall 0
udp
fwall 0
icmp
fwall 0
other
fwall 0
maxuni
Values 0-4294967296 0-4294967296 0-4294967296 0-4294967296 0-4294967296 0-4294967296 0-4294967296 0-2147483647
fwall 0
cntmissedecho off, on Default off
Equivalent web parameter TCP Opening s seconds TCP Open s seconds TCP Closing s seconds TCP Closed s seconds UDP s seconds ICMP s seconds Other protocols s seconds Expire entry after n consecutive packets in one direction Count missed UDP echo packets as dropped
Digi TransPort® Routers User Guide
752
Configuring security
Firewall
Use firewall scripts
A firewall is a protection and packet filtering system that allows or prevents the transmission of data (in either direction) based on a set of rules. The firewall prevents your local area network from unauthorized external access by other users of the Internet or another wide area network. Firewall rules allow filtering based on the following criteria:
n Source and destination IP addresses n Source and destination IP port or port ranges n Type of protocol in use n Direction of the data (in or out) n Interface type n The eroute the packet is on n Whether an interface is OOS (out of service) n ICMP message type n TCP flags (SYN, ACK, URG, RESET, PUSH, FIN) n A type of service (TOS) identifier n Status of a link and/or data packets on UDP/TCP and ICMP protocols
A firewall can also limit the degree of access local users have to external network resources. A firewall does not provide a complete security solution; it provides only one element of a fully secure system. Consider using additional security methods, such as user authentication and data encryption. See Configure Internet Protocol security (IPsec) for further information. Besides providing comprehensive filtering facilities, Digi TransPort routers support rules relating to the logging of information for audit/debugging purposes. You can log this information to a pseudo-file on the router called fwlog.txt, the eventlog.txt pseudo-file, or to a syslog server, and you can also use it to generate SNMP traps.
Digi TransPort® Routers User Guide
753
Configuring security
Firewall
Firewall script syntax
A firewall must be individually configured to match the needs of authorized users and their applications. On Digi routers, the rules governing firewall behavior are defined in a script file called fw.txt. Each line in this file consists of: a label definition, a comment, or a filter rule. The syntax for a firewall filter rule is as follows. Click each syntax element for more information about each script field.
[action][in-out][options][tos][version][proto][dnslist][ip-range][inspect-state]
Using labels A label definition is a string of up to 12 characters followed by a colon. Labels can only include letters, digits and the underscore character. Use labels with the break option to cause the processing of the script to jump to a new location.
Entering comments in a firewall script Any line starting with the hash character (#) is considered a comment and is ignored.
Digi TransPort® Routers User Guide
754
Configuring security
Firewall
Firewall script process flow
If you use a firewall script, these are the basic processing rules:
n When the firewall is active, the script is processed one line at a time as each packet is received or transmitted.
n Even when a packet matches a filter-rule, processing continues and all the other filter rules are checked until the end of the script is reached.
n The action taken on a particular packet is that specified by the last matching rule. n By using the [action] field's break option, you can redirect the script processing to a new
location or to the end of the script if required. n The default action that the firewall assigns to a packet is to block a packet: if the packet does
not match any of the rules.
Digi TransPort® Routers User Guide
755
Configuring security
Firewall
[action]
The [action] firewall script field defines the action to be performed. Allowed values:
n block n pass n pass-ifup n dscp n vdscp n debug
These actions operate as follows:
block Prevents a packet from being allowed through the firewall. When block is specified, an optional field can be included that causes an ICMP packet to be returned to the interface from which that packet was received. You can use blocking to confuse hackers by having different responses to different packets or for fooling an attacker into thinking a service is not present on a network. The syntax for specifying the return of an ICMP packet is:
"return-icmp" [icmp-type [icmp-code]]
where:
[icmp_type] Is a decimal number representing the ICMP type, or one of the predefined text codes listed in the following table:
ICMP type value 1 2 3 4 5 6 7 8 9 10 11 12
ICMP type Unreach Echo Echorep squench redir timex paraprob timest timestrap inforeq inforep maskreg
Digi TransPort® Routers User Guide
756
Configuring security
Firewall
ICMP type value 13 14 15
ICMP type maskrep routerad routersol
[icmp-code]
An optional decimal number representing the ICMP code of the return ICMP packet. If the [icmptype] is [unreach], the ICMP code can also be one of the following predefined text codes:
ICMP code net-unr host-unr proto-unr port-unr needfrag srcfail
Description Network unreachable Host unreachable Protocol unrecognized Port unreachable Needs fragmentation Source route fail
For example, this rule causes the router to return an ICMP Unreachable packet in response to all packets received on PPP 0:
block return-icmp unreach in break end on ppp 0
Instead of using the return-icmp option to return an ICMP packet, you can use return-rst to return a TCP reset packet instead. This would only be applicable for a TCP packet. For example, this rule returns a TCP reset packet when the firewall receives a TCP packet on the Ethernet interface 0 with destination address 10.1.2.*.
block return-rst in break end on eth 0 proto tcp from any to 10.1.2.0/24
return-icmpv6 In addition to the existing return-icmp option, which is used only with IPv4, you can include an optional field that causes an ICMPv6 packet to be returned to the interface from which that packet was received. The syntax for specifying the return of an ICMP packet is:
"return-icmpv6" icmpv6-type [icmpv6-code]
where:
[icmpv6_type] Is a decimal number representing the ICMPv6 type, or one of the predefined text codes listed in the following table:
Digi TransPort® Routers User Guide
757
Configuring security
Firewall
ICMPv6 type value 1 2 3 4 128 129 137 130 131 132 133 134 135 136 138
ICMPv6 type unreach toobig timex paramprob echo echorep redir mlquery mlreport mldone router-solicit router-advert neighbor-solicit neighbor-advert router-renum
[icmpv6-code]
An optional decimal number representing the ICMP code of the return ICMP packet. If the [icmpv6type] is [unreach], the code can also be one of the following pre-defined text codes:
ICMPv6 code no-route prohibited scope-mismatch addr-unr port-unr
Description No route to destination Communication prohibited IP address scope mismatch Address unreachable Port unreachable
For example, this rule causes the router to return an ICMPv6 Unreachable packet in response to all IPv6 packets received on PPP 0:
block return-icmpv6 unreach in break end on ppp 0
pass Allows packets that match the rule to pass through the firewall.
Digi TransPort® Routers User Guide
758
Configuring security
Firewall
pass-ifup Allows outbound packets that match the rule to pass through the firewall but only if the link is already active.
debug Causes the router to tag any packets matching the rule for debug. This means that for every matching rule that is encountered from this point in the script onwards, an entry will be placed in the pseudo-file FWLOG.TXT.
dscp Causes any packets matching this rule to have its DSCP value adjusted according to this rule. The DSCP value of a packet indicates the type of service required. The router uses it in conjunction with QOS (Quality of Service) functions. A decimal or hexadecimal number must follow the dscp keyword to indicate the value that should be set. For IPv6 packets, the traffic class portion of the IPv6 header will be modified with the DSCP value.
vdscp Similar to the dscp action, in that it adjusts the DSCP value in a packet. The difference is that this is a virtual change only, which means that the actual packet is not changed, and that the packet is processed as if it had the DSCP value as indicated. Like the dscp action, a decimal or hexadecimal number must follow.
Digi TransPort® Routers User Guide
759
Configuring security
Firewall
[in-out]
The [in-out] firewall script field specifies whether the action applies to inbound or outbound packets. Allowed values are in or out. When the field is left blank, the rule is applied to any packet regardless of its direction.
Digi TransPort® Routers User Guide
760
Configuring security
Firewall
[options]
The [options] firewall script field defines several options that apply to packets matching the rule.
log When the log option is specified, the router places an entry in the FWLOG.TXT file each time it processes a packet that matches the rule. This log normally details the rule that was matched along with a summary of the packet contents.
n If the log option is followed by the body sub-option, the complete IP packet is entered into the log file so when the log file is displayed, a more detailed decode of the IP packet is shown.
n The log field can also be followed by a further sub-option that specifies a different type of log output. This may either be snmp, syslog, or event. If snmp is specified, an SNMP trap (containing similar information to the normal log entry), is generated when a packet matches the rule. If syslog is specified, a syslog message is sent to the configured syslog manager IP address. This message contains the same information as that entered into the log file, but in a different format.
n If the body option has also been specified, some of the IP packet information is also included. n The size of the syslog message is limited to a maximum of 1024 bytes. n The syslog message is sent with default priority value of 14, which expands out to a facility of
USER, and the priority INFO. n If event is specified, the log output is copied to the eventlog.txt pseudo-file and the
FWLOG.TXT file. n The event log entry contains the line number and hit count for the rule that caused the packet
to be logged.
For example, suppose your local network is on subnet 192.168.*.* and you want to block any packets received on PPP 0 that were pretending to be on the local network, and log the receipt of any such packets to the FWLOG.TXT file and to a syslog server. The filter rule is constructed as follows:
block in log syslog break end on ppp 0 from 192.168.0.0/16 to any
break When specifying the break option, follow it with a user-defined label name or the predefined end keyword. When followed by a label, the rule processor jumps to that label to continue processing. When followed by the end keyword, rule processing is terminated and the packet is treated according to the last matching rule. For example:
break ppp_label on ppp 0 # insert rule processing here for packets that are not on ppp 0 break end ppp_label: # insert rule processing here for packets that are on ppp 0
on The interface to which the rule applies; must be followed by a valid interface name. For example, if you were only interested in applying a particular rule to packets being transmitted or received by PPP 0, you would include ppp 0 in the rule. Valid interface-names are eth n, tun n or ppp n, where n is the instance number.
Digi TransPort® Routers User Guide
761
Configuring security
Firewall
oneroute A rule will only match packets associated with the specified eroute. For example, including the option oneroute 2 causes the rule to only match on packets transmitted or received over Eroute 2. The oneroute option can be followed with the keyword any, which will match if the packet is on any eroute. Firewall rules specifying oneroute are only allowed with IPv4 rules. Using this keyword implies that the rule should only match on IPv4 packets.
onvlan Matches packets that have been received on the specified VLAN. Firewall rules specifying onvlan are only allowed with IPv4 rules. Using this keyword implies that the rule should only match on IPv4 packets.
onvrf Matches packets that have been assigned to the specified VRF. Firewall rules specifying onvrf are only allowed with IPv4 rules. Using this keyword implies that the rule should only match on IPv4 packets.
routeto When the routeto option is specified and the firewall is processing a received packet, if the rule is the last matching rule, the packet is tagged as being required to be routed to the specified interface. For example, the following filter rule ensures all packets from 10.1.*.* to 1.2.3.4 on the telnet port are all routed to ETH 1:
pass in break end routeto eth 1 from 10.1.0.0/16 to 1.2.3.4 port=telnet
Firewall rules specifying routeto are only allowed with IPv4 rules. Using this keyword implies that the rule should only match on IPv4 packets.
oosed Checks the out of service status of an interface. For example, including the option oosed ppp 1 would cause the rule to match only if interface PPP 1 is out of service. Firewall rules specifying onvlan are only allowed with IPv4 rules. Using this keyword implies that the rule should only match on IPv4 packets.
Digi TransPort® Routers User Guide
762
Configuring security
Firewall
[tos]
The [tos] firewall script field specifies the Type of Service (TOS) to match. If included, the [tos] field consists of the keyword tos followed by a decimal or hexadecimal code, identifying the type of service to match. For IPv6 packets, the traffic class field in the IPv6 header is checked. For example, to block any inbound packet on PPP 0 with a TOS of 0, the rule is:
block in on ppp 0 tos 0
Digi TransPort® Routers User Guide
763
Configuring security
Firewall
[version]
The [version] firewall script field specifies the IP version to which the rule applies. Allowed values are ipv4 and ipv6.
Match IPv4 packets only To match on IPv4 packets only, use the ipv4 keyword:
pass in break end on eth 1 ipv4
Match IPv6 packets only To match on IPv6 packets only, use the ipv6 keyword:
pass in break end on eth 1 ipv6
The firewall parser ensures that any tokens implying one IP version (such as an IP address) are not mixed with tokens that imply the other version. For example, this means it is not legal to mix the ipv6 keyword with an IPv4 IP address. If a rule does not specify any keywords that are IP version specific, the rule applies to both IP versions. For example, the following rule allows both IPv4 and IPv6 packets to pass on interface eth 0:
pass break end on eth 0
Digi TransPort® Routers User Guide
764
Configuring security
Firewall
[proto]
The [proto] firewall script field specifies the protocol to match. Specify using the proto keyword followed by one of the following protocol identifiers:
Identifier udp tcp ftp icmp icmpv6 decimal number
Meaning UDP packet TCP packet FTP packets regardless of port number ICMP packet ICMPv6 packet Decimal number matched to protocol type in IP header
The [proto] field is also important when stateful inspection is enabled for a rule (using the [inspectstate] field), as it describes the protocol to inspect (see [inspect-state]).
Digi TransPort® Routers User Guide
765
Configuring security
Firewall
[dnslist]
The [dnslist] firewall script field matches packets containing DNS names in a given dnslist. Following dnslist, there must be a name of a DNS list as specified by the #dns command. For example, consider the following DNS list:
#dns gglist www.Digi.co.*,www.*.co.nz
The following firewall rule blocks all DNS lookups to DNS names matching the above list:
block out break end on ppp 1 proto udp dnslist gglist from any to any port=dns
Digi TransPort® Routers User Guide
766
Configuring security
Firewall
[ip-range]
The [ip-range] firewall script field specifies the range of IP addresses and ports to match. The range can be specified in one of several ways. The basic syntax is:
ip-range="all" | "from" ip-object "to" ip-object [flags] [icmp]
where ip-object is an IP address specification. For full details of the syntax with examples, see Specifying IP addresses and ranges in firewall rules.
Digi TransPort® Routers User Guide
767
Configuring security
Firewall
[inspect-state]
The [inspect-state] firewall script field creates rules for stateful inspection. This is a powerful option in which the firewall script includes rules that allow the router to keep track of a TCP/UDP or ICMP session and therefore to only pass packets that match the state of a connection. You can also use the [inspect-state] field to specify an optional OOS (Out Of Service) parameter. The router uses this parameter to mark any route as being out-of-service for a given period of time in the event that the stateful inspect engine has detected an error.
[inspect] field syntax The [inspect] field has the following syntax
inspect = ["inspect-state" {"oos" {interface-name¦logical-name} secs {t=secs} {c=count} {d=count}} {r="ping"¦"tcp"{,secs{secs}}} {rd=x} {dt=secs}{stat}]
You can use the [inspect] field on its own, or with an optional oos (Out Of Service) parameter.
Using stateful inspection in firewall rules The Digi routing code stack contains a sophisticated scripted stateful firewall and route inspection engine. Stateful inspection is a powerful tool allowing the router to keep track of a TCP/UDP or ICMP session and match packets based on the state of the connection on which they are being carried. In addition to providing sophisticated firewall functionality, the SF/RI engine also provides a number of facilities for tracking the health of routes, marking dead routes as being Out Of Service (OOS) and creating rules for the automatic status checking of routes previously marked as OOS (for use in multilevel backup/restore scenarios). You can use the firewall to put interfaces into an OOS state, and control how the interfaces return to service. When an interface goes OOS, all routes configured to use that interface will have their route metric set to 16 (the maximum value), meaning that some other route with a lower metric will be selected. When a firewall stateful inspection rule expires, a decision is made as to whether the traffic being allowed to pass by this rule completed successfully or not. For example, if the stateful rule monitors SYN and FIN packets in both directions for a TCP socket then that rule will expire successfully. However, if SYNs are seen to pass in one direction but no SYNs pass in the other direction, the stateful rule will expire and the router will tag this as a failure.
Conditions that tag a stateful rule as a failure The following conditions tag a stateful rule as a failure:
n Packets have only passed in one direction. n Ten packets have passed in one direction with no return packets. For TCP, these packets must
also be retransmit packets.
How stateful rules can improve firewall security To better understand how to use stateful inspection, consider setting up a filter to allow all machines on a local network with addresses in the range 10.1.2.* to access the Internet on port 80. This example requires one rule to filter the outgoing packets and another rule to filter the responses. At a minimum, the firewall rules to achieve this are as follows:
pass out break end on ppp 0 from 10.1.2.0/24 to any port=80 pass in break end on ppp 0 from any port=80 to 10.1.2.0/24
In this example:
Digi TransPort® Routers User Guide
768
Configuring security
Firewall
n The first rule allows outgoing HTTP requests on PPP 0 from any address matching the mask 10.1.2.* on port 80.
n The second rule allows HTTP response packets to be received on PPP 0 on port 80 and addressed to an IP address matching the mask 10.1.2.*. However, this second rule creates a potential security hole. The problem with filtering based on the source port is that you can trust the source port only as much as you trust the source machine. For example, an attacker could perform a port scan and if the source port was set to 80 in each packet, it would get through this filter. Alternatively, on an already compromised system, a Trojan horse might be set up by listening on port 80.
You can define a more secure firewall using the inspect-state field. The stateful inspection system intelligently creates and manages dynamic filter rules based on the type of connection and the source/destination IP addresses. Applying stateful rules to the above example, you can redesign the script to make it both simpler and more effective. Since only the first packet in a TCP handshake will have the SYN flag set, we can use a rule that checks the SYN flag:
pass out break end on ppp 0 from 10.1.2.0/24 to any port=80 flags s inspect-state block in break end on ppp 0
At first glance, it appears that the second rule blocks all inbound packets on PPP 0. While this may be inherently more secure, it also means users on the network could not receive responses to their HTTP requests, making the rule of little use. This is not a problem because the stateful inspection system creates temporary filter rules based on the outbound traffic. The first of these temporary rules allows the first response packet to pass because it also has the SYN flag set. Once the connection is established, a second temporary rule is created that passes inbound or outbound packets if the IP address and port number match those of the initial rule, but does not check the SYN flag. It monitors the FIN flag, so the system can tell when the connection has been terminated. Once an outbound packet with the FIN flag is detected along with a FIN/ACK response, this temporary rule ceases to exist, and further packets on that IP address/port are blocked. In the above example:
n If a local user on address 10.1.2.34 issues an HTTP request to a host on 100.12.2.9, the outward packet would match and be passed.
n At the same time, a temporary filter rule is automatically created by the firewall that will pass inbound packets from IP address 100.12.2.9 that are addressed to 10.2.1.34 port x (where x is the source port in the original request from 10.1.2.34).
Using dynamic filters Using dynamic filters is more secure, because both the source and destination IP addresses/ports are checked. In addition, the firewall automatically checks that the router uses the correct flags for each stage of the communication. Using such a firewall rule virtually eliminates the potential for a security breach. Even if a hacker could time their attack perfectly, they would still have to do the following:
n Forge a response packet using the correct source address and port, randomly created by the sender of the HTTP request.
n Target the specific IP address that opened the connection.
Digi TransPort® Routers User Guide
769
Configuring security
Firewall
inspect-state rules are scalable As another advantage, inspect-state rules are scalable, allowing many machines to use the rule simultaneously. In the above example:
n Many machines on the local network could browse the Internet n The inspection engine would dynamically create precise inward filters as required. n The inspection engine would close the rules when they are no longer needed.
Protocol types on which the inspect-state option is allowed The inspect-state option is allowed on the following protocol types:
n TCP n UDP n The following ICMP packet types:
l echo l timest l inforeq l maskreq
Use [inspect-state] with flags You can use the inspect-state option with flags. For example, the original script for setting up a filter to allow all machines on a local network with addresses in the range 10.1.2.* to access the Internet on port 80 was:
pass out break end from 10.1.2.33 port>1023 to any port=telnet pass in break end from any port=telnet to 10.1.2.33 port>1023 flags a
Using the inspect-state option, you can replace this script with a single filter rule:
pass out break end from 10.1.2.33 port>1023 to any port=telnet flags s!a inspectstate
No rule is necessary for the return packets. This is because a temporary filter is created that allows only inbound packets to pass if they match sessions set up by this stateful inspection rule.
The flags s!a specification The flags s!a specification ensures that the rule only matches the first packet in a connection. This is because the first packet in a TCP connection has the SYN flag on and the ACK flag off, and so we only match on that combination. The stateful inspection engine handles matching the rest of the packets for this connection.
Use [inspect-state] with ICMP codes You can also use the [inspect-state] option with ICMP codes. To allow echo requests and allow echo replies, create one rule:
pass out break end on ppp 0 proto icmp icmp-type echo inspect-state
The advantage of using inspect-state besides simply needing one rule is that it leads to a more secure firewall. For example:
Digi TransPort® Routers User Guide
770
Configuring security
Firewall
n With the inspect-state option, the echo replies are not allowed in all the time; they are only allowed in once an echo request has been sent out on that interface.
n When a valid echo reply comes back or there is a timeout, echo replies will be blocked again. n Furthermore, the full IP address is checked; the IP source and destination must exactly match
the IP destination and source of the echo request. n If you compare this processing to the rule to allow echo replies in without using inspect-state,
it is not possible to check the source address at all, and the destination address would match any IP address on our network.
ICMP packet types that allow the inspect-state field You can use the inspect-state field with the following ICMP packet types:
ICMP type Echo Timest Inforeq Maskreq
Matching ICMP type Echo reply Timestrep Inforep Maskrep
Use [inspect-state] with ICMPv6 codes You can use the inspect-state field with the following ICMPv6 packet types:
ICMPv6 type Echo
Matching ICMPv6 type Echo reply
Use the Out Of Service (oos) parameter in inspect-state fields The optional oos parameter in an inspect-state field does several things:
n Allows the stateful inspect engine to mark as out of service any routes associated with the specified interface.
n Controls how the interfaces are returned to service. Routes that use the oos parameter are marked as out of service only if the specified oos option parameters are met.
Note For IPv6 packets, none of the oos options are supported.
Syntax
oos {interface-name¦logical-name} secs {t=secs} {c=count} {d=count} {r="ping"|"tcp"{,secs}}
interface-name or logical-name The interface with which the firewall rule is associated, such as PPP 1. This can also be a logical interface name which is simply a name that can be created (such as waffle). When a logical interface
Digi TransPort® Routers User Guide
771
Configuring security
Firewall
name is specified then this name can become oos (out of service) and can be tested in other firewall rules with the oosed keyword.
secs The length of time, in seconds, for which the routes that are using the specified interface are marked as out of service.
{t=secs} Optional. The length of time in seconds the router will wait for a response the packet that matched the rule.
{c=count} Optional. The number of times the stateful inspection engine must trigger the rule before the route is marked as out of service.
{d=count} Optional. The number of times the stateful inspection engine must trigger the rule before the interface is deactivated. This parameters applies to PPP interfaces only.
{r="ping"|"tcp"{,secs{,secs}}} Optional. Specifies a recovery procedure. When a recovery procedure is specified, the link is tested after the oos timeout has expired. The link is tested by either sending a TCP SYN packet or a ping packet to the address/port that caused the oos condition. The secs field specifies the retry time when checking for recovery. Only when the recovery succeeds will the interface be in service again.
Example: using the oos parameter for UDP packets An example set of firewall rules for UDP packets that uses the oos parameter is:
pass in pass out pass out on ppp 1 proto udp from any to 156.15.0.0/16 port=1234 inspect-state oos ppp 1 300 t=10 c=2 d=2
In this example:
n The first two rules configure the router to allow any type of packets to be transmitted or received. The default action of the firewall is to block all traffic.
Digi TransPort® Routers User Guide
772
Configuring security
Firewall
n The third rule is more complex: l It configures the stateful inspection engine to watch for UDP packets (with any source address) being routed via the PPP 1 interface to any address that begins with 156.15 on port 1234. l If a hit occurs on this rule, but the router does not detect a reply within 10 seconds (as specified by the t= parameter), it increments an internal counter. l When this counter reaches the value set by the c= parameter, the stateful inspection engine marks the PPP 1 interface (and therefore any routes using it), as being out of service for 300 seconds. l Similarly, if this counter matches the d= parameter, the stateful inspection engine deactivates PPP 1. l The stateful inspection engine marks any routes that use PPP 1 as out of service AND deactivates PPP 1 if no reply is detected within 10 seconds for two packets in a row. l Routes come back into service when either the specified timeout expires or if there are no other routes with a higher metric in service. l PPP interfaces re-activate when the routes using them are back in service and there is a packet to route and the AODI mode parameter is set to On.
Example: using the oos parameter for TCP packets An example set of firewall rules for TCP packets that uses the oos parameter is:
pass out log break end on ppp 3 proto tcp from any to 192.168.0.1 flags S!A inspect-state oos 30 t=10 c=2 d=2 pass in pass out
n This rule specifically traces attempts to open a TCP connection on PPP 3 to the 192.168.0.1 IP address and if it fails within 10 seconds twice in a row, will cause the PPP 3 interface to be flagged as out of service (such as its metric will be set to 16), for 30 seconds.
n The optional d=2 entry also deactivates the PPP link. Deactivating the link can be useful in scenarios where renegotiating the PPP connection is likely to resolve the problem.
n If a matching route with a higher metric is defined, the router uses it while PPP 3 routes are out of service, thus providing a powerful route backup mechanism.
Use [inspect-state] with the stat option You can use the inspect-state with the stat option. The stat option causes this firewall rule to record statistics associated with this firewall rule. Transaction times, counts and errors are recorded under the PPP statistics with this option.
Create a basic inspect-state rule with no out of service options This example firewall rule allows TCP packets from 10.1.1.1 to 10.1.2.1 port 23 with the SYN flag set to pass out on PPP 2. Because the rule uses the inspect-state field, a stateful rule is set up allowing other packets for that TCP socket to also pass.
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A inspect-state
Digi TransPort® Routers User Guide
773
Configuring security
Firewall
Create a rule to mark and interface out of service Using the above basic inspect-state rule, you can modify the rule to mark an interface out of service if a stateful rule identifies a failed connection:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A inspect-state oos 60
The addition of oos 60 means if the stateful rule sees a failure, interface PPP 2 sets the PPP 2 interface out of service for 60 seconds. If no interface is specified after the oos keyword, the interface set to out of service is the one on which the packet is currently passing. You can set a different interface to out of service by specifying the interface after the oos keyword. For example, oos ppp 1 60 sets interface PPP 1 out of service for 60 seconds.
Override the default time in a stateful rule To override the default time allowed by the stateful rule for a connection to open, use the {t=secs} option. For example, to override the default TCP opening time of 60 seconds to 10 seconds:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A inspect-state oos 60 t=10
A socket now has 10 seconds to become established (such as exchange SYNs) before the stateful rule expires and is tagged as a failure.
Set an interface to out of service after consecutive failures You can configure the firewall so the interface is only set to out of service after a number of consecutive failures occur. To do this, use the {c=count} option. For example:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A inspect-state oos 60 t=10 c=5
PPP 2 will now only be set to out of service after 5 consecutive failures.
Deactivate an interface after consecutive failures You can deactivate the interface after a number of consecutive failures. This is useful for WWAN interfaces, which may get into a state where the PPP connection appears to be operational, but in fact no packets are passing. In this case, deactivating and reactivating the interface sometimes fixes the problem. For example:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A inspect-state oos 60 t=10 c=5 d=10
Now, PPP 2 will be deactivated after 10 consecutive failures.
Digi TransPort® Routers User Guide
774
Configuring security
Firewall
Specifying IP addresses and ranges in firewall rules
ip-range The ip-range field of a firewall script rule identifies the IP address or range of addresses to which the rule applies. The syntax for specifying an IP address range is:
ip-range = "all" | "from" ip-object "to" ip-object [ flags ] [ icmp ] [icmpv6]
where: ip-object = addr [port-comp | port-range] flags = "flags" { flags } [ !{ flags } ] icmp = "icmp-type" icmp-type [ "code" decnum ] addr = "any" | ip-addr| ipv6-addr | ipv6-host | addr6-eth | addr6-ppp [ "/"decnum ] [ "mask" ip-addr | "mask" hexnum ] port-comp = "port" compare port-num port-range = "port" port-num "<>" | "><" port-num ip-addr = IP address in format nnn.nnn.nnn.nnn decnum = a decimal number hexnum = a hexadecimal number compare = "=" | "!=" | "<" | "<=" | ">" | ">=" port-num = service-name | decnum service-name = "http" | "telnet" | "ftpdat" | "ftpcnt" | "pop3" | "ike" | "xot"| "sntp" | "smtp" In the above syntax definition:
n Items in quotes are keywords. n Items in square brackets are optional. n Items in curly braces are optional and can be repeated. n The vertical bar symbol ("|") means or.
ip-object An ip-object consists of an IP address and an IP port specification, preceded by the keyword from or to define whether it is the source or destination address. The most basic form for an ip-object is an IP address preceded by from or to. For example, to block all packets destined for address 10.1.2.98 the script rule is: block out from any to 10.1.2.98 You can specify an ip-object using an address mask, describing which bits of the IP address are relevant when matching. The script processor supports two formats for specifying masks:
n Method 1: The IP address is followed by a forward slash and a decimal number. The decimal number specifies the number of significant bits in the IP address. For example, if you wanted to block all packets in the range 10.1.2.* the rule would be:
block from any to 10.1.2.0/24
such as, only the first 24 bits of the address are significant.
Digi TransPort® Routers User Guide
775
Configuring security
Firewall
n Method 2: This same rule could be described another way using the mask keyword:
block from any to 10.1.2.0 mask 255.255.255.0
The IP address can also contain either addr-ppp n or addr-eth n, where n is the eth or ppp instance number. In this case, the rule specifies that the IP address is that allocated to the PPP interface or to the Ethernet interface. This is useful when IP addresses are obtained automatically and therefore are not known by the author of the filtering rules. For example:
block in break end on ppp 0 from addr-eth 0 to any
ipv6-addr Is an IPv6 address in the usual format (e.g. 2001:DB8::/32).
ipv6-host = "ipv6-host" ipv6-addr "/" decnumber ["/" decnumber] Specifies to host portion of an IPv6 address. For example, the ipv6-host value ::01:1111:2222:3333:4444/72 matches the 72 low-order bits of the address ::01:1111:2222:3333:4444. You can also specify a second decimal value to indicate how many host bits to match. For example, the ipv6-host value ::01:1111:2222:3333:4444/72/8 matches the 8 bits of the address starting from bit 128 - 72 (that is, 01).
addr6-eth = "addr6-eth" decnumber | "addr6-eth-lla" decnumber | "addr6-eth-ula" decnumber | "addr6-eth-global" decnumber addr6-eth is used to match on IPv6 addresses owned by the Ethernet interface specified by the value of decnumber. The -lla variant is used to match only on the link-local addresses associated with the interface. The -ula variant is used to match only on the unique local addresses associated with the interface. The -global variant is used to match only on the global addresses associated with the interface. For example, the following rule will pass incoming packets with destination address that matches a link-local address associated with eth 0:
pass in break end from any to addr6-eth-lla 0
The following rule will pass incoming packets with destination address that match any IPv6 associated with eth 0.
pass in break end from any to addr6-eth 0
addr6-ppp = "addr6-ppp" decnumber | "addr6-ppp-lla" decnumber | "addr6-ppp-ula" decnumber | "addr6-ppp-global" decnumber addr6-ppp is similar to addr-eth, but matches on PPP interfaces instead of Ethernet interfaces.
Address/Port translation One further option for specifying addresses is to use address translation. The syntax for this is:
srcdst = "all | fromto [-> [ip-object] "to" object]
such as directly after the IP addresses and port are specified. An optional ->can follow, indicating that the addresses/ports should be translated. The first source object is optional, as it is more normal to translate the destination address. The following example reroutes packets originally destined for 10.10.10.12 to 10.1.2.3:
Digi TransPort® Routers User Guide
776
Configuring security
Firewall
pass out break end from any to 10.10.10.12 -> to 10.1.2.3
In addition, complete subnets can have NAT applied. The address bits not covered by the subnet mask are taken from the original IP address. For example, to NAT the destination subnet of 192.168.0.0/24 to be 192.168.1.0/24, the firewall rule is:
pass out break end from any to 192.168.0.0/24 -> to 192.168.1.0/24
Address/port translation is not supported with IPv6 packets. A parsing error will be generated if a rule mixes address translation with IPv6-specific keywords.
Digi TransPort® Routers User Guide
777
Configuring security
Firewall
Set filters in firewall rules
Filter on port numbers Suppose a Telnet server is running on a machine on IP address 10.1.2.63, and you want to make this server accessible. Suppose also a filter is in place to block all packets to 10.1.2.*. To make the Telnet server available on 10.1.2.63, add the following line before the blocking rule:
pass in break on from any to 10.1.2.63 port=23 flags S!A inspect-state
A packet sent to the Telnet server (port 23) on IP address 10.1.2.63 matches this rule, and further checking is prevented by the break end option. Specifying in ensures that only incoming packets match the rule. Specifying flags S!A ensures that the rule only matches on the initial TCP SYN, and also implies that the rule should match on TCP packets. Specifying inspect-state means that if a packet matches the rule, a new stateful entry is created to allow other packets matching the same TCP socket, in either direction, to pass. The above example illustrates the = comparison. Other comparison methods supported are:
Symbol != > < <= >=
Meaning not equal greater than less than less than or equal to greater than or equal to
You can also specify a port in range or a port out of range with the >< or <> symbols. For example, to pass all packets to addresses in the range 23 to 28, the rule is:
pass break end from any to 10.1.2.63 port 23><28
To simplify ports references, some common port numbers are associated with the predefined strings, listed in the table below. For example, in the example above, if we substitute the number 23 with the string telnet, the rule is:
pass break end from any to 10.1.2.63 port=telnet
Other defined port keywords are as follows. The service keywords are predefined based on standard port numbers. These port numbers may have been defined differently on your system, in which case you should use the port numbers explicitly, and not the defined names.
Keyword Ftpdat Ftpcnt
Standard port number 20 21
Service File Transfer Protocol data port File Transfer Protocol control port
Digi TransPort® Routers User Guide
778
Configuring security
Firewall
Keyword telnet smtp http pop3 sntp ike xot
Standard port number 23 25 80 110 123 500 1998
Service Telnet server port SMTP server port Web server port Mail server port NTP server port Source/destination port for IKE key Destination port for XOT packets
Filter on TCP flags To filter on TCP flags, follow an ip-object by an optional [flags] field.
[flags] Filters based on any combination of TCP flags. The [flags] field specifies the flags to check and consists of the flags keyword followed by a string specifying the flags themselves. Each letter in this string represents a particular flag type as listed below:
Code f r s p u a
Flag FIN Flag RESET Flag SYN Flag PUSH Flag URG Flag ACK Flag
These flag codes allow the filter to check any combination of flags. Following on from the previous example, to block packets that have all the flags set you would need to precede the pass rule with the following block rule:
block break end from any to 10.1.2.0/24 port=telnet flags frspua
Here, the list of flags causes the router to check that those flags are set. This list may be optionally followed by an exclamation mark (!) and a second list of flags that the router should check for being clear. For example. the following [flags] field tests for the s flag being on and the a flag being off with all other flags ignored.
flags s!a
As a further example, suppose we want to allow outward connections from a machine on 10.1.2.33 to a Telnet server. We have to define a filter rule to pass outbound connections and the inbound response packets. Because this is an outbound Telnet service we can make use of the fact that all
Digi TransPort® Routers User Guide
779
Configuring security
Firewall
incoming packets will have their ACK bits set. Only the first packet establishing the connection will have the ACK bit off. The filter rules to do this would look like this:
pass out break end from 10.1.2.33 port>1023 to any port=telnet pass in break end from any port=telnet to 10.1.2.33 port>1023 flags !a
The first rule allows the outward connections, and the second rule allows the response packets back in which the ACK flag must always be on. This second rule will filter out any packets that do not have the ACK flag on. This will bar any attackers from trying to open connections onto the private network by simply specifying the source port as the Telnet port. Note that there is a simpler way to achieve the same effect using the inspect state option, described below.
Filter on ICMP codes An ip-object can be followed by an optional [icmp] field.
[icmp] Allows the script to filter packets based on ICMP codes. ICMP packets are occasionally employed to debug and diagnose a network and can be extremely useful. However, they form part of a low-level protocol and are frequently exploited by hackers for attacking networks. For this reason, most network administrators want to restrict the use of ICMP packets. The syntax for including ICMP filtering is:
icmp = "icmp-type" icmp-type ["code" decnum]
icmp-type Is one of the pre-defined strings listed in the following table or the equivalent decimal numeric value:
ICMP type Unreach Echo Echorep Squench Redir Timex Paramprob Timest Timestrep Inforeq Inforep Maskreq Maskrep
ICMP value 3 8 0 4 5 11 12 13 14 15 16 17 18
Digi TransPort® Routers User Guide
780
Configuring security
Firewall
ICMP type Routerad Routersol
ICMP value 9 10
The following two rules are equivalent:
pass in break end on ppp 0 proto icmp from any to 10.1.2.0/24 icmp-type 0 pass in break end on ppp 0 proto icmp from any to 10.1.2.0/24 icmp-type echorep
Both of these rules allow echo replies to come in from interface ppp 0 if they are addressed to our example local network address (10.1.2.*). In addition to having a type, ICMP packets also include an ICMP code field after the type. When specified, the code field must also match. Specify the ICMP code field with a decimal number. For example, to allow only echo replies and ICMP unreachable type ICMP packets from interface ppp 0. Then the rules would look something like this:
pass in break end on ppp 0 proto icmp from any to 10.1.2.0/24 icmp-type echorep code 0 pass in break end on ppp 0 proto icmp from any to 10.1.2.0/24 icmp-type unreach code 0 block in break end on ppp 0 proto icmp
The first two rules in this set allow in the ICMP packets that we are willing to permit and the third rule denies all other ICMP packets in from this interface. If we ever expect to see echo replies in on ppp 0, we should allow echo requests out on that interface too, using this rule:
pass out break end on ppp 0 proto icmp icmp-type echo
[icmpv6] This field allows the script to filter packets based on ICMPv6 codes. ICMPv6 packets are occasionally used to debug and diagnose a network and can be extremely useful. However, they form part of a lowlevel protocol and are frequently exploited by hackers for attacking networks. For this reason, most network administrators want to restrict the use of ICMP packets. The syntax for including ICMPv6 filtering is:
icmpv6 = "icmpv6-type" icmpv6-type ["code" decnum]
Where:
icmpv6-type Is one of the pre-defined strings listed in the following table or the equivalent decimal numeric value:
ICMPv6 type Unreach Toobig Timex Paramprob
ICMPv6 value 1 2 3 4
Digi TransPort® Routers User Guide
781
Configuring security
Firewall
ICMPv6 type Echo Echorep Redir Miquery Mireport Midone Router-solicit Router-advert Neighbor-solicit Neighbor-advert Router-renum
ICMPv6 value 128 129 137 130 131 132 133 134 135 136 138
The following two rules are equivalent:
pass in break end on ppp 0 proto icmp from any to 2001:db8::/32 icmpv6-type 129 pass in break end on ppp 0 proto icmp from any to 2001:db8::/32 icmpv6-type echorep
Digi TransPort® Routers User Guide
782
Configuring security
Firewall
Assign Differentiated Services Code Point (DSCP) values
When using Quality of Service (QoS), packet priorities are determined by the DSCP values in their [tos] (type of service) fields. These priorities may have already been assigned but if necessary, the router can be configured to assign them by inserting the appropriate rules in the firewall. This is done by using the dscp command. For example, the following rule sets the DSCP value to 46 for almost any type of packet received on ETH 0 from IP address 100.100.100.25 addressed to 1.2.3.4 on port 4000. This allows you to set the DSCP value for almost any type of packet.
dscp 46 in on eth 0 from 100.100.100.25 to 1.2.3.4 port=4000
The following rule sets outgoing mail traffic to the same top-priority queue(46 is, by default, a very high priority code in the DSCP mappings):
dscp 46 in on eth 0 proto smtp from any to any
Digi TransPort® Routers User Guide
783
Configuring security
Firewall
Log firewall events
When the log option is specified within a firewall script rule, an entry is created in the fwlog.txt pseudo-file each time an IP packet matches the rule. Each log entry contains the following information:
Parameter Timestamp Short Description
Dir Line Hits
Iface Source IP Dest. IP ID TTL PROTO
Src Port Dst Port Rule Text
Description The time when the log entry is created. Usually FW LOG but could be FW DEBUG for packets that hit rules with the debug action set. Either IN or OUT. Indicates the direction the packet is traveling. The line number of the rule that cause the packet to be logged. The number of matches for the rule that caused this packet to be logged. The Interface the packet was to be transmitted/received on. The source IP address in the IP packet. The destination IP address in the IP packet. The value of the ID field in the IP packet. The value of the TTL field in the IP packet. The value of the protocol field in the IP packet. This will be expanded to text as well for the well-known protocols. The value of the source port field in the TCP/UDP header. The value of the source port field in the TCP/UDP header. The rule that caused the packet to be logged is also entered into the log file.
In addition, port numbers are expanded to text predefined port numbers.
Example log file entries
Log entry without the body option
----- 15-8-2002 16:25:50 -----FW LOG Dir: IN Line: 11 Hits: 1 IFACE: ETH 0 Source IP: 100.100.100.25 Dest IP: 100.100.100.50 ID: 39311 TTL: 128 PROTO: TCP (6) Src Port: 4232 Dst Port: WEB (80) pass in log break end on eth 0 proto tcp from 100.100.100.25 to addr-eth 0 flags S/SA inspect-state
----------
Digi TransPort® Routers User Guide
784
Configuring security
Firewall
Log entry with the body option
----- 15-8-2002 16:27:56 -----FW LOG Dir: IN Line: 7 Hits: 1 IFACE: ETH 0 Source IP: 100.100.100.25 Dest IP: 100.100.100.50 ID: 40140 TTL: 128 PROTO: ICMP (1) block return-icmp echorep log body break end proto icmp icmp-type echo From REM TO LOCIFACE: ETH 0 45 IP Ver: 4 Hdr Len: 20 00 TOS: Routine Delay: Normal Throughput: Normal Reliability: Normal 00 3C Length: 60 9C CC ID: 40140 00 00 Frag Offset: 0 Congestion: Normal May Fragment Last Fragment 80 TTL: 128 01 Proto: ICMP0C E1 Checksum: 3297 64 64 64 19 Src IP: 100.100.100.25 64 64 64 32 Dst IP: 100.100.100.50 ICMP: 08 Type: ECHO REQ 00 Code: 0 04 5C Checksum: 1116 ----------
Text included in the eventlog.txt pseudo-file when the event sub-option is specified
16:26:32, 15 Aug 2002,Firewall Log Event: Line: 10, Hits: 3 IP Filter Filter Rule: block return-icmp unreach host-unr in log syslog break end on eth 0 proto tcp from any to 100.100.100.50 port=telnet Line: 10 Hits: 4
Syslog message where the body option is not specified
2002-09-04 16:30:06 User.Info100.100.100.50Aug 15 16:31:59 arm.1140
Syslog message with the body option specified
2002-08-30 16:19:59 User.Info100.100.100.50Aug 10 16:21:56 arm.1140 IP Filter - Filter Rule: block return-icmp unreach port-unr in log body syslog break end on eth 0 proto tcp from any to 100.100.100.50 port=telnet Line: 9 Hits: 3 PKT: Source IP: 100.100.100.25 Dest IP: 100.100.100.50 ID: 13317 TTL: 128 Protocol: TCP Source Port: 1441
Digi TransPort® Routers User Guide
785
Configuring security
Dest Port: 23 TCP Flags: S
Firewall
Digi TransPort® Routers User Guide
786
Configuring security
Firewall
Keep a route out of service and use recovery
You may want to keep an interface out of service until you are sure that a future connection will work. To do this, specify one or more recovery options. These options get the router to test connectivity between the router and the destination IP address of the packet that established the stateful rule. The recovery can be in the form of a ping or a TCP socket connection. You must also specify an interval between recovery checks. For example:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A inspect-state oos 60 t=10 c=5 d=10 r=tcp,120
Now the interface is set to OOS for 60 seconds after 5 consecutive failures. After the 60 seconds elapses, the recovery procedure initiates. In this example, the recovery consists of TCP connection attempts executed at 2-minute intervals. The interface remains OOS until the recovery procedure completes successfully. The destination IP address in this case is 10.1.2.1. To override the default socket connection time, specify an additional recovery option. For example:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A inspect-state oos 60 t=10 c=5 d=10 r=tcp,120,10
Now, 10 seconds is allowed for each recovery attempt. If the socket connects within that time, the recovery is successful, else the recovery is unsuccessful. The {rd=x} option disconnects the interface after a recovery attempt completes. Use this option to deactivate the interface after a recovery failure, success, or either. x is a bitmask indicating when the interface should be deactivated. Bit 0 deactivates the interface after a recovery failure. Bit 1 deactivates the interface after a recovery success, such as:
n rd=1 means deactivate after a recovery failure. n rd=2 means deactivate after a recovery success. n rd=3 means deactivate after either recovery success or recovery failure.
Extending our firewall rule to include this option, the resulting rule is:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A inspect-state oos 60 t=10 c=5 d=10 r=tcp,120,10 rd=3
Now the interface is deactivated after a recovery success or failure. If the rule does not use the {rd=x} option, the interface remains up until its inactivity timer expires, or it is deactivated by some other means. Use the {dt=secs} option to indicate that the interface is to remain OOS when it is disconnected, and that it should be reactivated some time after it last disconnected. Recovery procedures start after the interface connects. Extending our firewall rule to include this option gives:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A inspect-state oos 60 t=10 c=5 d=10 r=tcp,120,10 rd=3 dt=60
Now, the interface reconnects 60 seconds after it disconnects and recovery procedures start after the interface connects. Normally, use this option with the {rd=x} option so that recovery has control over when the interface connects and disconnects.
Digi TransPort® Routers User Guide
787
Configuring security
Firewall
Keep a route out of service and use recovery with a list of addresses This syntax expands on the functionality above, and checks connectivity to a range of addresses using a ping command. You can specify an address list that the recovery mechanism will ping in turn to see if any respond. This helps ensure that even when one, two, or three destinations cannot be reached due to an outage on the remote network, the connection will be made available again if at least one of the addresses in the list responds. The address lists are created using the following syntax:
#addrs <list-name> <address1,address2,address3,address4>
Address lists can span multiple lines if required, for example:
#addrs <list-name> <address1,address2> #addrs <list-name> <address3,address4>
The address list is called using the recovery option pingl. An example firewall rule is:
pass out break end on PPP 1 proto ICMP from 10.1.1.1 to 10.1.2.1 inspect-state oos 60 t=10 c=5 d=10 r=pingl listA ,120,10 rd=3 dt=60
This rule allows pings outbound, and on detecting a communication failure, it uses pings to a address list named listA. The address list named listA could look like this:
#addrs listA 10.1.2.1,10.1.3.1,10.1.4.1,10.1.5.1 #addrs listA 10.1.6.1,10.2.1.1,10.2.2.1
This causes the recovery to ping the range of address shown in the list above.
Digi TransPort® Routers User Guide
788
Configuring security
Firewall
Debug a firewall
When creating and managing firewall scripts, the scripts may need debugging to ensure that packets are being processed correctly. To assist in this, you can use a rule with the debug action.
If a rule with the debug action is encountered, an entry is made in the fwlog.txt pseudo-file each time the packet in question matches a rule from that point on. This allows you to follow a packet through a rule set, and can help determine what, if any, changes are required to the rule set. Rules specifying the debug action are typically placed near the top of the rule set, so all matching rules from that point on are entered into the log file.
You can identify entries created in the fwlog.txt file as the result of a debug rule using the short description FW_DEBUG at the top of the log entry.
An example rule set using a debug rule:
debug in on ppp 2 proto tcp from any to any port=http pass in break end proto tcp from any to any port=http flags s/sa inspect state pass out break end proto udp
If placed at the top of the rule set, any packet received on interface PPP 2 to destination port 80 generates a debug entry in the log file for each subsequent rule that it matches. In the example rule set above, a packet that matched the second rule would also match the first rule, and would therefore create two log entries. The same packet would not match the third rule, and so no log entry would be made for this rule.
Because of the extra processor time required to add all of these additional log entries, debug rules should be removed (or commented out) once the rule set is operating as desired.
Digi TransPort® Routers User Guide
789
Configuring security
Use a RADIUS client for authentication
Use a RADIUS client for authentication
You can use a RADIUS client for authentication purposes at the start of remote command sessions, SSH sessions, FTP sessions, HTTP sessions and Wi-Fi client connections (PEAP & EAP-TLS). Depending on how the RADIUS client is configured, the router may authenticate with one or two RADIUS servers, or may authenticate a user locally using the existing table configured on the router.
There are two RADIUS client configurations: RADIUS Client 0 and RADIUS Client 1. Both have specific functions and the correct instance (0, 1, or both) should be configured depending on the requirements.
To use RADIUS for authenticating router administration access, configure RADIUS Client 0. To use RADIUS for authenticating Wi-Fi clients, configure RADIUS Client 1.
When the router has obtained the remote user username and password, the RADIUS client passes this information (from the Username and Password attributes) to the specified RADIUS server for authorization. The server should reply with an ACCEPT or REJECT message.
You can configure the RADIUS client with up to two Network Access Servers (NAS). Depending on system requirements, you can turn on or off local authentication.
During user authentication, the configured RADIUS servers are contacted first. If a valid ACCEPT or REJECT message is received from the server, the user is allowed or denied access respectively. If no response is received from the first server, the second server is tried (if configured). If that server fails to respond, the router uses local authentication unless disabled. If both servers are unreachable and local authentication is disabled, all authentication attempts fail.
If a RADIUS server replies with a REPLY-MESSAGE attribute (18), the message is displayed after the login attempt and after any configured "post-banner" message. The router will then display a Continue Y/N? prompt to the user. If N is selected, the remote session is terminated. This applies to remote command sessions and SSH sessions only.
If the login attempt is successful and the server sends an IDLE-TIMEOUT attribute (28), the idle time specified will be assigned to the remote session. If no IDLE-TIMEOUT attribute is sent, the router applies the default idle timeout values to the session.
The access level is determined by the value of the SERVICE-TYPE attribute returned by the RADIUS server. Administrative access is determined by the value 6 being returned by the server. Any other value or no value returned will result in the access level low being assigned.
When the session starts and ends, the router sends the RADIUS accounting START/STOP messages to the configured server. Again, if no response is received from the primary accounting server, the secondary server will be tried. No further action is taken if the secondary accounting server is unreachable.
Because the router has separate configurations for authorization and accounting servers, you can configure the router to perform authorization functions only, accounting only, or both. An example of how to use this is to perform local authorizations, but send accounting start/stop records to an accounting server.
Web
1. Go to the Configuration > Security> Radius > RADIUS Client n.
2. Configure the RADIUS client settings for the route:
Digi TransPort® Routers User Guide
790
Configuring security
Use a RADIUS client for authentication
Authorization Primary Authorization Server
IP Address a.b.c.d
The IP address of the primary authorization NAS.
NAS ID
An identifier passed to the primary authorization NAS. Identifies the RADIUS client. The primary authorization NAS administrator supplies the appropriate value.
Password
The password supplied by the primary authorization NAS administrator. This password and the primary authorization NAS ID are entered to authenticate RADIUS packets.
Digi TransPort® Routers User Guide
791
Configuring security
Use a RADIUS client for authentication
Confirm Password
Type the above password into this text box so that the router can determine if the two are identical. 3. Click Apply.
Command line
Command radcli
radcli radcli radcli
radcli radcli radcli
radcli
radcli radcli radcli
radcli radcli
Instance Parameter
0, 1
server
0, 1
nasid
0, 1
password
0, 1
server2
0, 1
nasid2
0, 1
password2
0, 1
localauth
Values
Valid IP Address a.b.c.d
Up to 80 characters
Up to 40 characters
Valid IP Address a.b.c.d
Up to 80 characters
Up to 40 characters
off, on Default: on
0, 1
aserver
Valid IP
Address
a.b.c.d
0, 1
anasid
Up to 80
characters
0, 1
apassword Up to 40
characters
0, 1
aserver2
Valid IP
Address
a.b.c.d
0, 1
anasid2
Up to 80
characters
0, 1
apassword2 Up to 40
characters
Equivalent web parameter Primary Authorization Server IP Address
Primary Authorization Server NAS ID
Primary Authorization Server Password
Secondary Authorization Server IP Address
Secondary Authorization Server NAS ID
Secondary Authorization Server Password
Enable local authorization if there is no response from the authorization server(s)
Primary Accounting Server IP Address
Primary Accounting Server NAS ID
Primary Accounting Server Password
Secondary Accounting Server IP Address
Secondary Accounting Server NAS ID
Secondary Accounting Server Password
Digi TransPort® Routers User Guide
792
Configuring security
Use a RADIUS client for authentication
Configure advanced RADIUS client parameters
Web
1. Go to Configuration > Security> Radius> Radius Client n> Advanced. Enter advanced settings as needed:
Use Source IP Address If required, select an alternative source interface and instance. Select the required interface from the drop-down list and enter the interface instance in the text box. Interface options are
n Auto n PPP n Ethernet
If there is no response from the server
Retransmit the request after s seconds The interval between retransmissions of RADIUS packets.
Stop the negotiation after n retransmissions The maximum number of times RADIUS data should be transmitted to the NAS before the negotiation is deemed to have failed.
Stop the negotiation if there is no activity for s seconds The inactivity period after which the negotiation procedure is considered a failure. 2. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
radcli
0
ip_ent
Blank,ETH,PPP Use Source IP Address Blank=Auto
radcli
0, 1
retranint 0-2147483647 Retransmit the request after s seconds
Default 5
radcli
0, 1
retran
0-2147483647 Stop the negotiation after n retransmissions
Default 3
radcli
0, 1
inactto 0-2147483647 Stop the negotiation if there is no activity for s
Default 30
seconds
Digi TransPort® Routers User Guide
793
Configuring security
Use TACACS+ to control access to the router
Use TACACS+ to control access to the router
The Digi TransPort range of routers supports Terminal Access Controller Access-Control System Plus (TACACS+) for controlling access to the router. TACACS+ provides authentication, authorization and accounting (AAA) services. You can use TACACS+ to control the following access methods:
n Secured asynchronous serial (ASY) ports n Telnet n SSH n FTP n HTTP/HTTPS n SNMP
When any sort of request is performed by the TACACS+ client, the client first checks to see if a socket to the server (primary or backup) is already open. If a socket is already open, the router uses that socket for the TACACS+ request. If no socket is open, the primary server is tried first. If the primary server socket fails to open, the backup server will be tried. Regardless of whether the primary or backup socket connected, the primary server is always tried first on the next connection attempt. Once the connection to the TACACS+ server opens, all pending requests are sent to the TACACS+ server. If a connection to the TACACS+ server is not possible due to network or server problems, all requests by applications are denied.
Functions of the AAA services
If TACACS+ authentication is enabled, the request is sent to the TACACS+ server. If disabled, the router performs the authentication. At this point authorization is also performed. If TACACS+ authorization is disabled, the user access level is obtained from the local user table on the router. If TACACS+ authorization is enabled, an authorization request is sent to the TACACS+ server. The server returns a privilege level and may also return other attributed such as a new idle time for this session, which takes precedence over locally configured values. When the user has been authenticated and access has been authorized, the login is allowed. If the connection is via telnet or SSH, a welcome message showing the access level and the method of authentication is displayed. If the access level was assigned locally the following message is displayed:
Welcome. Your access level is SUPER
If the access level was assigned by the TACACS+ server, the following message is displayed:
Welcome. Your access level is obtained remotely
If accounting is enabled, session start and stop messages are sent to the TACACS+ server when the session opens and closes. During the session, details of commands executed and denied due to access level control will be sent to the TACACS+ server. At the end of the session the stop message is sent to the TACACS+ server with the elapsed session time included.
Digi TransPort® Routers User Guide
794
Configuring security
Use TACACS+ to control access to the router
TACACS+ to local privilege level mappings
TACACS+ level >= 15 12-14 8-11 4-8 0-3
Local level Super High Medium Low None
Web
To configure TACACS+ parameters:
1. Go to Configuration > Security > TACACS+. 2. Enter TACACS+ parameters:
Primary TACACS+ Server Hostname or IP address of Server a.b.c.d Port n
The IP address or hostname of the primary TACACS+ server is entered into the left-hand text box. If required a port number may also be specified using the right-hand text box. TACACS+ uses TCP port 49 by default. Entering a different number into this text box will cause the router to use that port instead. The primary and secondary TACACS+ servers use this port number.
Server Key
The encryption key to use when communicating with the primary server.
Confirm Server Key
The key to allow the router to confirm that the two strings are identical.
Secondary TACACS+ Server Hostname or IP address of Server
The IP address or hostname of the secondary (backup) TACACS+ server. The router uses this value if it cannot open a socket to the primary server.
Server Key
The encryption key to use when communicating with the secondary server.
Confirm Server Key
Enter the key into this text box to allow the router to confirm that the two entries are identical.
Digi TransPort® Routers User Guide
795
Configuring security
Use TACACS+ to control access to the router
Enable local authentication if there is no response from the server(s)
Allows local authentication if TACACS+ authentication fails.
Enable TACACS+ Authentication
Enables authentication. When authentication is enabled, user authentication takes place on the TACACS+ server. When disabled, user authentication takes place locally on the router.
Enable TACACS+ Authorisation
Enables authorization which means that authorization of the application takes place and authorization of application-related commands also takes place.
Enable TACACS+ Accounting
Enables accounting. Sends accounting messages at the start and end of application sessions, where applicable, and update messages from command sessions when commands are denied locally or after they are executed. 3. Click Apply.
Command line
Command tacplus
tacplus tacplus tacplus
tacplus tacplus
tacplus tacplus tacplus
Instance Parameter
0
svr
0
port
0
key
0
svr2
0
key2
0
localauth
0
authent
0
author
0
acct
Values
Equivalent web parameter
Up to 64 characters Hostname or IP address for hostname or valid of server IP address a.b.c.d
0-2147483647
Port
Default 49
Up to 20 characters Server Key
Up to 64 characters or valid IP address a.b.c.d
Hostname or IP address of server
Up to 20 characters Server Key
off, on
Enable local authentication if there is no response from the server(s)
off, on
Enable TACACS+ Authentication
off, on
Enable TACACS+ Authorization
off, on
Enable TACACS+ Accounting
Digi TransPort® Routers User Guide
796
Configuring security
Command tacplus tacplus
Use TACACS+ to control access to the router
Instance 0 0
Parameter debug tacacspageauth
Values off, on off, on
Equivalent web parameter
n/a
n/a
Digi TransPort® Routers User Guide
797
Configuring security
Use TACACS+ to control access to the router
Configure advanced TACACS+ security settings
Advanced TACACS+ parameters do not normally need to be adjusted.
Web
1. Go to Configuration > Security > TACACS+ > Advanced. 2. Enter advanced TACACS+ settings as needed:
Use source IP Address x, y If required because of a TACACS+ server being accessed via a VPN tunnel, you can select an alternative source interface here. Select the required interface from the drop-down list and enter the instance of that interface into the adjacent text box. The available interface options are
n Auto n PPP n Ethernet
Response Timeout s seconds The amount of time, in seconds, before waiting for a response from the TACACS+ server.
Stop the negotiation if there is no activity for s seconds The amount of time, in seconds, before an inactive socket is closed. 3. Click Apply.
Command line
Command Instance Parameter Values
Equivalent web parameter
tacplus 0
ip_ent
Blank,ETH,PPP Use source IP Address x,y Blank=Auto
tacplus 0
ip_add
0-2147483647 Use source IP Address x,y
tacplus 0
respto
0-2147483647 Response Timeout s seconds Default=30
tacplus 0
inact
0-2147483647 Stop the negotiation if there is no activity for s
Default=30
seconds
Digi TransPort® Routers User Guide
798
Configuring security
Use command filtering
Use command filtering
When the command filtering feature is enabled, commands will not reach the router's command interpreter unless they are defined in the Command Filters table. Terminal devices may send commands that the router will not necessarily understand but that require a basic OK or ERROR response.
With command filtering turned on, any command entered will be responded to with a MODEM-like OK or ERROR response (depending on settings below) unless the command is found in the Command Filters table. The command filter uses wild-card character matching so that command filters such as cmd* are permitted which would allow all cmd 0 ... commands to be executed. Note that the command mapping table is checked first and the command filter table is only checked if there was not a match in the command matching table.
For more information on command filtering, see Application Note 17: Command Line Response Manipulation.
Web
1. Go to Configuration > Security > Command Filters.
Digi TransPort® Routers User Guide
799
Configuring security
Use command filtering
2. In the Command field, enter the desired command to filter on into the text box and click Add. 3. Once a command is added, you can remove it from the command filtering table by clicking
Delete next to the command. 4. When you have entered all the commands on which you want to filter, click Apply .
Command line
Command Instance Parameter Values
Equivalent web parameter
cfilter
n
cmd
Valid command line command Command
cmd
n
cfilton
0, 1
n/a
0=Off
1=On
cmd
n
cfilterr
0, 1
n/a
0=Off-OK
1=On-ERROR
Enable command filtering
To enable command filtering from the command line for any particular instance of the command interpreter, use the following command:
cmd <n> cfilton 1
The default action is to respond with the OK response. If the response needed is ERROR, use the parameter:
cmd <n> cfilterr 1
Where n is the instance number.
Note Enclose any blank characters by double quotation marks. When substituting a command, upper case characters are considered the same as the corresponding lowercase characters.
Digi TransPort® Routers User Guide
800
Configuring security
Use command filtering
Set calling numbers to answer or reject
Note Only experienced personnel should use this feature for network testing and fault diagnosis. It is not required for normal use. To use this feature, the ISDN circuit must support the Calling Line Identification (CLI) facility. If CLI is supported, incoming calls from specified numbers can be answered normally or rejected with an optional reject code.
Web
1. Go to Configuration > Security > Calling Numbers. The Calling Numbers page has a table that accepts a series of telephone numbers, each of which has an associated Answer or Reject parameter, and, for numbers from which calls are to be rejected, a user-defined reason code. For each number set to Reject, the router rejects incoming calls from that number using the reason code specified. The reason code is a numeric value chosen to suit the particular application. If any of the entries is set to Answer, the router only answers incoming calls from that number and rejects calls from other numbers using a standard ISDN reject code.
Number The telephone number to either answer or reject.
Mode The drop-down list in this column selects either Answer to answer calls or Reject to reject calls.
Reject Code The reason code pertaining to the rejection of the call. 2. Click Add to add the calling number. 3. Click Apply.
Digi TransPort® Routers User Guide
801
Configuring security
Use command filtering
Command line
Command rejlst rejlst rejlst
Instance n n n
Parameter num ans code
Values up to 20 digits off, on 0-255
Equivalent web parameter Number Mode Answer,Reject code
Examples To display an entry in the calling numbers list enter the command:
rejlst <instance> ?
where <instance> is 0-9. For example: rejlst 5 ? To set up an entry to reject a number, use the following commands:
rejlst 0 num 1234567 rejlst 0 ans OFF rejlst 0 code 42
To set up an entry to answer a number, use the following commands:
rejlst 1 num 1234567 rejlst 1 ans ON
Digi TransPort® Routers User Guide
802
Configuring telemetry (GPS)
Configure GPS parameters
804
Configure WR31 Cellular GPS
809
Configure GPS support for the GOBI3000 module
811
Digi TransPort® Routers User Guide
803
Configuring telemetry (GPS)
Configure GPS parameters
Configure GPS parameters
Some TransPort router models can connect a GPS receiver the router uses to obtain geographical position information. The GPS module may be internal or external. In either situation, the router uses an internal asynchronous serial (ASY) port for the connection. The standard way that GPS modules send the data is using National Marine Electronics Association (NMEA) standard 0183 messages. This protocol is usually simply referred to as NMEA. Routers offering this functionality support the most common NMEA data messages. These messages are described below. GPS receiver modules normally accept configuration commands which specify which of the NMEA messages should be sent to the requesting host.
Web
1. Go to the Configuration > Telemetry > GPS page. 2. Configure the GPS parameters:
Set Initial Static GPS position
These settings define initial position for a static TransPort router.
Static Latitude
Defines the latitude component of the router, in degrees.
Static Longitude
Defines the longitude component of the router, in degrees.
Enable local monitoring
Allows messages from the GPS receiver to display on the Management > Position > GPS status page. The messages displayed are configured via entries in a table.
GPS Module Initialization String
Some GPS receivers may require configuration via an initialization message at start-up in order to send the appropriate messages in the required format, at the required data rate. Any such required command string is entered into the text entry box and will be sent to the attached GPS receiver module when the router initializes the module. The table described here controls which NMEA messages should be sent from the module. The default is to enable all messages.
GPS Message List / Include in IP Messages
A list of messages issued by the GPS, and whether to include each GPS message in IP messages.
Fix data (GGA)
The fix data in the selected format (2D, 3D or no fix).
Position (GLL)
The Geographic position (Latitude/Longitude).
Digi TransPort® Routers User Guide
804
Configuring telemetry (GPS)
Configure GPS parameters
Active Satellites (GSA)
The NMEA text containing the number of active satellites for calculating the position.
Satellites in view (GSV)
The NMEA text containing the number of satellites in view.
Position and Time (RMC)
The NMEA text containing the current position and time.
Course over Ground (VTG)
The NMEA text containing the course data.
UTC and local date/time data (ZDA)
Displays the NMEA sentence containing the current local time and date.
All other GPS messages
The above messages are the most common and useful NMEA messages. Many GPS modules support additional messages. Enabling this setting causes the modules to output any other supported messages.
IP Connection 1
The router can send GPS data to up to two IP destinations. These are specified in the following two sections of the web page.
Send GPS messages to IP address a.b.c.d
The IP address to which the GPS data should be sent.
Port n
The required TCP/UDP port number to which the GPS data should be sent.
Every n interval(s)
How often the GPS data is transmitted to the specified host. n A value of 1 transmits collected GPS data each time a UTC and local date/time data (ZDA) message is received from the GPS receiver module. n A value of 2 or greater transmits every second message, and so on.
For this feature to work over a TCP/IP connection, you must enable the ZDA message.
Use TCP / UDP
The protocol to use for sending the messages.
Prefix the message with t
A text string that should precede the NMEA data, if desired.
Digi TransPort® Routers User Guide
805
Configuring telemetry (GPS)
Configure GPS parameters
Suffix the message with t
A text string that should follow the NMEA data, if desired.
IP Connection 2
Sends GPS messages to IP address a.b.c.d.
Port n
The required TCP/UDP port number to which the GPS data should be sent.
Every n interval(s)
How often the GPS data is transmitted to the specified host. n A value of 1 causes collected GPS data to be transmitted each time a UTC and local date/time data (ZDA) message is received from the GPS receiver module. n A value of 2 causes every second message to be sent and so on.
For this feature to work over a TCP/IP connection, the ZDA message must be enabled.
Use TCP / UDP
The protocol to use for sending the messages.
Prefix the message with t
A text string that should precede the NMEA data, if desired.
Suffix the message with t
A text string that should follow the NMEA data, if desired. 3. Click Apply.
Command line
gps command
Command Instance Parameter Values
gps
0
asy_add The ASY port to which the GPS receiver is connected
gps
0
gpson
On, Off
gps
0
init_str Valid command for GPS receiver
gps
0
gga_on
0, 1 0=Off 1=On
Equivalent web parameter n/a
Enable local monitoring GPS Module Initialization string Fix data (GGA)
Digi TransPort® Routers User Guide
806
Configuring telemetry (GPS)
Command Instance Parameter Values
gps
0
gll_on
0, 1 0=Off 1=On
gps
0
gsa_on
0, 1 0=Off 1=On
gps
0
gsv_on
0, 1 0=Off 1=On
gps
0
rmc_on
0, 1 0=Off 1=On
gps
0
vtg_on
0, 1 0=Off 1=On
gps
0
zda_on
0, 1 0=Off 1=On
gps
0
oth_on
0, 1 0=Off 1=On
gps
0
IPaddr1 Valid IP address a.b.c.d
gps
0
gps
0
gps
0
gps
0
gps
0
gps
0
IPport1 Valid IP port n
nsecs1
Time s seconds
udpmode1 0, 1 0=TCP 1=UDP
IPprefix1 Free text
IPsuffix1 Free text
IPaddr2 Valid IP address a.b.c.d
gps
0
gps
0
gps
0
IPport2 Valid IP port n
nsecs2
Time s seconds
udpmode2 0, 1 0=TCP 1=UDP
Configure GPS parameters
Equivalent web parameter Position (GLL)
Active Satellites (GSA)
Satellites in view (GSV)
Position and time (RMC)
Course over Ground (VTG)
UTC and local date/time (ZDA)
All other messages
Send GPS message to IP address (1) port n every n interval(s) Use TCP/UDP
Prefix the message with Suffix the message with Send GPS message to IP address (2) port n every n interval(s) Use TCP/UDP
Digi TransPort® Routers User Guide
807
Configuring telemetry (GPS)
Configure GPS parameters
Command Instance Parameter Values
gps
0
IPprefix2 Free text
gps
0
IPsuffix2 Free text
Equivalent web parameter
Prefix the message with
Suffix the message with
The following gps command parameters are not available on the web interface:
Command gps gps gps gps gps gps gps
Instance 0 0 0 0 0 0 0
Parameter gga_int gll_int gsa_int gsv_int rmc_int vtg_int zda_int
Values s seconds 0255 s seconds 0-255 s seconds 0-255 s seconds 0-255 s seconds 0-255 s seconds 0-255 s seconds 0-255
Equivalent web parameter n/a n/a n/a n/a n/a n/a n/a
gpson command
When gpson is set to on, this indicates an instance of the command line interpreter is connected to the GPS receiver. The instance number should be the ASY port number to which the GPS receiver is connected. This parameter has two purposes:
n It tells a particular command interpreter instance that it is connected to a GPS receiver so that commands received by that instance should be ignored, rather than being treated as invalid commands.
n The at\gps command uses this parameter to determine where the GPS messages originate.
cmd <instance> gpson {on|off}
at\gps command
n This command causes messages from the GPS receiver to be sent directly to the ASY port from which the command has been entered.
n This requires setting the gpson parameter to be set to on for one of the command interpreter instances.
n As soon as the at\gps command has been issued, data from the GPS receiver will be sent to that ASY port.
n To stop the GPS data, enter the +++ escape sequence, followed by a pause, followed by at.
at\gps
Digi TransPort® Routers User Guide
808
Configuring telemetry (GPS)
Configure WR31 Cellular GPS
Configure WR31 Cellular GPS
For models of the Digi TransPort WR31 router that include GPS-enabled modems, use this page to configure cellular GPS. WR31 routers with the following modems include cellular GPS support:
n L9/MC7430--For APAC n M8/MC7455 For the rest of the World
Earlier L9 and M8 WR31s that did not include the GPS SMA antenna connector will have these controls, but will not have the ability to connect a GPS antenna.
Web
1. Go to the Configuration > Telemetry > Cellular GPS page. 2. Configure the Cellular GPS parameters:
Enable Cellular GPS
By default, cellular GPS is off. To enable cellular GPS: a. Select the Enable Cellular GPS check box. b. Click Apply.
Enabling cellular GPS from this page automatically makes the following changes to the Configuration > Telemetry > GPS page:
n Enable local monitoring is selected. n The GPS Module Initialization String is set to $GPS_START. For more information about these options, see Configure GPS parameters.
Configure Cellular GPS Antenna Power
By default, the cellular GPS antenna is active, which requires that DC power of 3.3 volts be applied to the antenna. To use a passive GPS antenna, which does not require DC power:
a. Clear the Enable Cellular GPS Antenna Power checkbox. b. Click Apply.
Command line
cell_gps command
The following options for the cell_gps command are used to control the WR31 cellular GPS:
Command Instance Parameter Values
cell_gps 0
enable
On--Enables cellular GPS. Off (default)--Disables cellular GPS.
cell_gps 0
antenna
On (default)--Enables power for an active GPS antenna. Off--Disables power for a passive GPS antenna.
Equivalent web parameter Enable Cellular GPS
Enable Cellular GPS Antenna
Digi TransPort® Routers User Guide
809
Configuring telemetry (GPS)
Configure WR31 Cellular GPS
For information about viewing the most recent information received from the GPS module, see Show GPS data.
Digi TransPort® Routers User Guide
810
Configuring telemetry (GPS)
Configure GPS support for the GOBI3000 module
Configure GPS support for the GOBI3000 module
The GOBI3000 module supports GPS functionality. To configure the GOBI3000 module with GPS functionality:
Command line
Configure the GPS init string with the $GPS_START command:
gps 0 init_str $GPS_START
Set the gps asy_add parameter to 3.
Digi TransPort® Routers User Guide
811
Managing applications and programs
TransPort routers support loading and running applications in several programming languages.
Manage ScriptBasic applications
Scripting support allows end users to extend and enhance the functionality of the TransPort routers. ScriptBasic is a scripting language supported by Digi TransPort routers. This section describes how to run simple ScriptBasic scripts.
Web
1. Go to Applications > Basic > ScriptBasic. 2. Enter ScriptBasic application parameters. The main configuration setting is a table containing
a list of reference numbers and associated user parameters. The second setting is a text box containing the name of the script to run. Initially, the table is displayed empty, with a row that states No parameters have been defined. The leftmost column contains the number 1.
#n
The number of the parameter that appears in the next column. You can configure up to 30 parameters. It is best to enter the numbers in a consecutive, ascending sequence, since this is how the parameters will be referred to in any ScriptBasic script.
Parameter
The name of the parameter to create. This can be any alphanumeric string. Once defined, you can reference these parameters by a ScriptBasic script. For example, a script using parameter string1 will use the string defined in the text entry box associated with command index 1.
Digi TransPort® Routers User Guide
812
Managing applications and programs
Manage ScriptBasic applications
Add
Adds the parameter to the list of parameters. Parameters are added consecutively, with each parameter number referring to the string in the adjacent column.
Run Script
The name of the ScriptBasic script to run. This script must exist in the router's file system. Typically, ScriptBasic scripts use the .sb file extension, such as myscript.sb.
Run
Runs the named ScriptBasic script.
Stop
Stops the execution of the ScriptBasic script. 3. Click Apply.
Command line
Command basic
basic bas
Instance 0
0 n/a
Parameter string1string30 n/a n/a
Values
Equivalent web parameter
Free-form alphanumeric Parameter text
kill
Stop
Name of ScriptBasic script
Run Script
Examples
To set user parameter 1 to IPv4 address 10.1.1.1, enter: basic 0 string1 10.1.1.1 To execute a script, enter: bas <myscript.sb> To kill a running script, enter: Basic 0 kill
Digi TransPort® Routers User Guide
813
Managing applications and programs
Manage Python applications
Manage Python applications
Some Digi TransPort routers support the Python scripting language. Python allows you to extend and enhance the basic functionality of the router through programming. The routers contain a Python interpreter you can invoke from the command line. This is useful for developing scripts. The more usual way to use Python is to write a script to implement a required function and to run this script autonomously. It is common practice for Python scripts to use the file extension .py, such as myscript.py. A Python script is a text file containing Python commands and may be created using a normal plain text editor. Python is a powerful language and obtains some of its power from the many modules that are available for it. A description of the Python language is outside the scope of this manual. For more information on Python programming see the Digi Python Programmer's Guide on www.digi.com.
CAUTION! Avoid writing Python scripts, or taking any other kind of actions, that perform frequent flash writing. NAND flash typically accommodates a limited number of writes, up to 100,000. Exceeding this limit can cause device failure.
Web
1. Go to Applications > Python > Python Files.
2. Enter the Python file management settings as needed:
Module search path
The search path for Python modules that are not in the default search path. Specify multiple locations by separating pathnames with colons, such as pymod1.zip:python21.zip. This causes the interpreter to search for two compressed files pymod1.zip and python21.zip. TransPort routers have a flat filing system structure that does not support subdirectories.
Redirect the Python output to debug
Allows the redirection of the stdout file handle to the debug output (stderr) file handle. The default for this parameter is Off. The easiest way to see this redirection in action is to issue the command to start the Python interpreter from a debug/CLI terminal. Note that the screen remains blank. Stop the interpreter (using the exit() command), set this parameter to On, and re-issue the command to start the interpreter. This time, the familiar Python welcome message and prompt should appear on the console.
Digi TransPort® Routers User Guide
814
Managing applications and programs
Manage Python applications
Unbuffered output to stdout
Redirects unbuffered output to file handle to the debug output (stderr) file handle. 3. Click Apply.
Command line
Command pycfg
pycfg
Instance Parameter
0
modpath
0
stderr2stdout
Values
Equivalent web parameter
valid search path, such Module search path as mymod.py
0, 1 0=Off 1=On
Redirect the Python output to debug
The following informational/debugging commands are helpful when developing Python scripts:
n pycfg files: Displays the status of any Python files. n pycfg mem: Shows the memory usage for the router. n pycfg scripts: Shows the status of any scripts and change count.
Digi TransPort® Routers User Guide
815
Managing networks and connections
There are several web pages and commands for viewing network status and managing connections for your TransPort router.
Show network interface status
You can view the current status and statistics for various interfaces from the web interface and command line.
Digi TransPort® Routers User Guide
816
Show Ethernet status and statistics
Web
Go to Management > Network Status > Interfaces > Ethernet > ETH n. The ETH n page displays the current status and statistics of the selected Ethernet interface.
IP Address The IP address of the Ethernet interface, which is either manually configured or assigned via DHCP.
Mask The mask of the Ethernet interface, which is either manually configured or assigned via DHCP.
DNS Server / Secondary DNS Server The primary and secondary DNS Server IP addresses of the Ethernet interface, which are either manually configured or assigned via DHCP.
Digi TransPort® Routers User Guide
817
Managing networks and connections
Show network interface status
Gateway The IP gateway of the Ethernet interface, which is either manually configured or assigned via DHCP.
MAC Address The Ethernet interface's MAC address.
Speed The current speed of the Ethernet interface.
Duplex The current duplex mode of the Ethernet interface.
Bytes Received The number of bytes received on the Ethernet interface.
Bytes Sent The number of bytes sent on the Ethernet interface.
Packets Received The number of packets received on the Ethernet interface.
Packets Sent The number of packets sent on the Ethernet interface.
Unicast Packets Received The number of unicast packets received on the Ethernet interface.
Unicast Packets Sent The number of unicast packets sent on the Ethernet interface.
Broadcast Packets Received The number of broadcast packets received on the Ethernet interface.
Broadcast Packets Sent The number of broadcast packets sent on the Ethernet interface.
Multicast Packets Received The number of multicast packets received on the Ethernet interface.
Multicast Packets Sent The number of multicast packets sent on the Ethernet interface.
Rx Overruns The number of receive overruns that have occurred on the Ethernet interface. An Rx overrun occurs when there are not enough buffers to receive incoming packets which results in the received packets being dropped.
Digi TransPort® Routers User Guide
818
Managing networks and connections
Show network interface status
Collisions The number of times the router has detected a packet collision on the Ethernet network when transmitting a packet.
Late Collisions The number of times the router has detected a late packet collision on the Ethernet network when transmitting a packet.
Flood Protection The number of times the router has detected an Ethernet packet flood on the network and has enabled the Flood Protection mechanism. Flood protection is designed to stop the router from being overwhelmed by the sudden large increase in packets on the Ethernet network.
Alignment Errors The number of alignment errors that have been detected when receiving an Ethernet packet.
FCS Errors The number of Ethernet packets that have been received but had an invalid FCS.
Tx Deferred The Ethernet packets successfully transmitted after being initially deferred.
Long Frames The number of Ethernet packets that have been received which are too long.
Carrier Sense Error The number of carrier sense errors that have occurred. These errors occur when the router attempts to transmit an Ethernet packet but cannot detect the carrier sense condition on the Ethernet network.
Rx MAC Errors The number of internal errors that have occurred when receiving an Ethernet packet.
Tx MAC Errors The number of internal errors that have occurred when attempting to transmit an Ethernet packet.
Other Errors The number of errors that have occurred that are not counted by the other statistics.
Command line
Command
Instance Parameter Action
eth
n
status
Displays the current configuration and status of
Ethernet interface n.
ethstat
n
n/a
Displays the statistics for Ethernet interface n.
at\mibclr=eth.n.stats n/a
n/a
Clears the statistics for Ethernet interface n.
Digi TransPort® Routers User Guide
819
Managing networks and connections
Show network interface status
Show Wi-Fi status and statistics
Web
Go to Management > Network Status > Interfaces > WiFi > WiFi n.
Module Detected Indicates that the Wi-Fi hardware has been detected by the router.
Admin Status The current administrative state of the Wi-Fi interface. It indicates whether there is sufficient configuration to bring the Wi-Fi interface up. It can be either Up or Down.
Operational Status The current operational state of the Wi-Fi interface. It can be either Up or Down.
Channel Mode The Wi-Fi channel mode in use. The possible values for this parameter are A, A/N, A/N/AC, B/G, B/G/N.
Channel The Wi-Fi channel in use.
Bytes Received The number of bytes received on the Wi-Fi interface.
Bytes Sent The number of bytes sent on the Wi-Fi interface.
Packets Received The number of packets received on the Wi-Fi interface.
Packets Sent The number of packets sent on the Wi-Fi interface.
Receive Errors The number of receives errors that have occurred on the Wi-Fi interface.
Transmit Errors The number of transmit errors that have occurred on the Wi-Fi interface.
Received Packets Dropped The number of received packets that have been dropped on the Wi-Fi interface.
Wi-Fi Client Connections table
The Wi-Fi Client Connections table gives information on the Wi-Fi clients that are connected to the router's Wi-Fi Access Point interface.
Digi TransPort® Routers User Guide
820
Managing networks and connections
Show network interface status
Node The MAC address of the connected Wi-Fi client.
Wi-Fi Node The Wi-Fi node on the router the client is connected to.
RSSI The signal strength experienced by the Wi-Fi client.
Flags The state information for the Wi-Fi client connection.
Power Save The current power saving state of the Wi-Fi client. The possible values are Awake and Sleep.
Neg. Rates (Mbps) The transmission rates that have been negotiated with the Wi-Fi client.
Capability Info The capabilities the router has advertised to the Wi-Fi client.
Access Point Connections Table
This Access Point Connections table gives information on the Wi-Fi Access Points to which the router is connected.
Access Point The name and MAC address of the Wi-Fi Access Point that the router is connected to.
Wi-Fi Node The Wi-Fi node that for connecting to the Access Point.
RSSI The signal strength experienced by the router when connected to the Wi-Fi Access Point.
Digi TransPort® Routers User Guide
821
Managing networks and connections
Show network interface status
Flags The state information for the Wi-Fi Access Point connection.
Power Save The current power saving state of the router. The possible values are Awake and Sleep.
Neg. Rates (Mbps) The transmission rates that have been negotiated with the Wi-Fi Access Point.
Capability Info The capabilities of the Access Point to which the router is connected.
Disconnect Disconnects the specified client device.
Disconnect All Clients Disconnects all client devices.
Command line
Command wificonn wificonn wifistat
Options n/a x n/a
Parameter cscan
Equivalent web parameter Displays the Wi-Fi connection table. Performs wifi network scan Displays the Wi-Fi statistics.
Digi TransPort® Routers User Guide
822
Managing networks and connections
Show network interface status
Show mobile status and statistics
Web
Go to Management > Network Status > Interfaces > Mobile. The Mobile status page displays the current mobile connection, network and module information.
Digi TransPort® Routers User Guide
823
Managing networks and connections
Show network interface status
Mobile Connection status
Registration Status The GSM registration status of the mobile module with respect to the GSM network. It may be one of the following
n Not Registered, not searching n Not registered, searching n Registered, home network n Registered, roaming n Registration denied n Unknown n ERROR The registration status may sometimes be followed by additional information about the Location Area Code (LAC) and the Cell Identifier (CI).
Signal Strength The signal strength in dBm being received by the mobile module. The range is -113dBm (min) to 51dBm (max). The signal strength bars should match the Signal Strength LEDs on the front of the router.
Signal Quality A measure of the signal level of the cellular network, measured in dB.
Connection type Cellular connection type.
Mobile Statistics
IP Address The IP address of the mobile interface.
Primary DNS Address / Secondary DNS Address The primary and secondary DNS addresses the mobile interface uses.
Data Received The number of data bytes received on the mobile interface while it has been connected.
Data Sent The number of data bytes sent on the mobile interface while it has been connected.
Mobile Information
The information in this section varies by cellular module type.
GSM networks For GSM networks, the Mobile Information section can have the following items.
Digi TransPort® Routers User Guide
824
Managing networks and connections
Show network interface status
SIM Status This indicates whether or not a valid SIM card has been installed in the router. It may be one of the following
n READY: SIM is OK. n SIM PIN: PIN number required. n SIM PUK: SIM blocked (unblocking code required). n ERROR: SIM is not installed or is faulty.
Signal strength The signal strength in dBm being received by the mobile module. The range is -113dBm (min) to 51dBm (max). The signal strength bars should match the Signal Strength LEDs on the front of the router.
Radio technology The current network technology in use. It may be one of the following
n GSM n GPRS n EDGE n UMTS n HSDPA n HSUPA n CDMA
Signal quality A measure of the signal level of the cellular network, measured in dB.
Radio band The radio band on which the cellular modem is operating.
Channel The radio channel on which the cellular modem is operating.
Manufacturer The manufacturer of the mobile module.
Model The model of the mobile module.
IMEI The International Mobile Equipment Identification (IMEI) of the mobile module.
ESN The Electronic Serial Number (ESN) of the mobile module.
MEID The Mobile Equipment Identifier (MEID) of the mobile module.
Digi TransPort® Routers User Guide
825
Managing networks and connections
Show network interface status
IMSI The International Mobile Subscriber Identity (IMSI) of the mobile module.
ICCID This field specifies Integrated Circuit Card Identifier (ICCID) of the SIM card.
Firmware This specifies firmware running on mobile module.
Bootcode This field specifies bootcode firmware running on the mobile module.
Hardware version The hardware version of the mobile module.
GPRS Attachment Status The current status of the mobile module with respect to the Mobile service. It may be one of the following
n Not attached: The router has not connected to a mobile service. n Attached: The router has connector to a mobile service. n ERROR: Unknown response from the mobile module.
GPRS Registration See the Registration Status description.
APN in use The Access Point Name (APN) for the cellular interface being used by the cellular module.
Network The name of the GSM network to which the mobile module is currently connected to or ERROR if no network is available.
Preferred system The preferred technology. It can be one of following:
n Auto n GSM only n WCDMA only
CDMA networks For CDMA networks, the Mobile Information can have the following items.
Network The current network reported by the mobile module.
Signal strength 1xRTT The signal strength in dBm being received by the mobile module from 1xRTT networks.
Digi TransPort® Routers User Guide
826
Managing networks and connections
Show network interface status
Signal strength EVDO The signal strength in dBm being received by the mobile module from EVDO networks.
Manufacturer The manufacturer of the mobile module.
Model The model of the mobile module.
MDN The Mobile Directory Number (MDN) of the mobile module.
MIN The Mobile Identification Number (MIN) of the mobile module.
ESN The Electronic Serial Number (ESN) of the mobile module.
MEID The Mobile Equipment Identifier (MEID) of the mobile module.
Firmware The firmware running on mobile module.
Bootcode The bootcode firmware running on the mobile module.
Hardware version The hardware version of the mobile module.
Registration State See the Registration Status field.
Roaming status The current roaming status of the mobile module.
Radio interfaces in use Can be one of the following
n CDMA 1x n EVDO n No service n Unknown
PRL version The version of the Preferred Roaming List (PRL) loaded on the mobile module.
Digi TransPort® Routers User Guide
827
Managing networks and connections
Show network interface status
Activation status The activation state of the mobile module. It can be of the following:
n 0-Not activated n 1-Activated
Command line
Command
Option Action
modemstat
?
Displays mobile status information.
modemstat
s
Scans for networks.
pppstat
n
Displays mobile statistics (where n is the PPP interface the mobile
interface uses)
at\mibs=ppp.n.stats n
Displays the current interface statistics.
at\mibclr=ppp.n.stats n
Clears the current interface statistics.
Digi TransPort® Routers User Guide
828
Managing networks and connections
Show network interface status
Show DSL status and statistics
Web
Go to Management > Network Status > Interfaces > DSL. The DSL status page displays the current status and statistics of the DSL interface.
Modem Status The current status of the DSL modem. On the DR64 platform, the values can be one of the following:
n Idle n Activating n Ghs n Training n Up
Link Uptime The amount of time the modem has been in the Up state.
Digi TransPort® Routers User Guide
829
Managing networks and connections
Show network interface status
Firmware Version The version of the firmware running on DSL modem.
Operational Mode The operational mode that the DSL modem is in when in the Up state. It is in the format of:
<Mode> Annex <A | B | M>
where the <Mode> can be one the following:
n ANSI n ETSI n G.dmt n G.lite n ADSL2 n ADSL2+
Remote Vendor ID The remote vendor ID of the DSLAM that the DSL interface connected to.
Speed The current speed the downstream and upstream DSL channels in Kbps.
Channel The channel type in use. It can be either Fast or Interleaved.
Relative Capacity The current relative capacity on the downstream and upstream DSL channels. The relative capacity is the percentage of your overall available bandwidth fir obtaining your ATM service rate.
Attenuation The current attenuation, in decibels, on the downstream and upstream DSL channels. Attenuation is the measure of how much the signal has degraded between the DSLAM and the DSL modem. The lower the attenuation, the better the performance will be.
Noise Margin The current noise margin, in decibels, on the downstream and upstream DSL channels. The noise margin (aka Signal to Noise Ratio) is the relative strength of the DSL signal to noise. The larger the noise margin, the better the performance will do. In some instances, interleaving can help raise the noise margin.
Power Output The current amount of power, in dBm, that the DSL modem (upstream) and DSLAM (downstream) are using. The lower the power output, the better the performance.
Indicator Bits The indicator bit values in use on the downstream and upstream DSL channels.
Digi TransPort® Routers User Guide
830
Managing networks and connections
Show network interface status
Cells The number of cells that have received (downstream) and transmitted (upstream).
CRC The number of CRC errors that have occurred downstream and upstream.
HEC The number of Header Error Controls (HEC) errors that have occurred downstream and upstream.
LOS The number of Loss of Signal (LOS) errors that have occurred downstream and upstream.
SEF The number of Severely Errored Frame (SEF) errors that have occurred downstream and upstream.
Corrected Blocks The number of blocks received and corrected by the forward error correction (FEC) code.
Uncorrected Blocks The number of blocks that were received and could not be corrected by the forward error correction (FEC) code.
Overrun Cells The number of cells lost because of overrun errors.
Idle Cells The number of idle cells received.
Command line
Command
Instance Action
adslst
n/a
Displays the current DSL interface status.
at\mibs=adsl.0.stats n/a
Displays the current DSL interface statistics.
at\mibclr=adsl.0.stats n/a
Clears DSL statistics. Performs the equivalent of the web interface Clear Stats button
pppstat
n
Displays DSL statistics, where n is the PPP interface the DSL PVC
is using.
Digi TransPort® Routers User Guide
831
Managing networks and connections
Show network interface status
Show GRE interface status
Web
Go to Management > Network Status > Interfaces > GRE. The GRE page displays a summary table of the configured GRE interfaces.
# The GRE interface number.
Description The configured GRE interface description.
Oper. Status The current operational status of the GRE interface. It can be one of the following values:
n Up: The GRE interface is up. n Lower Layer Down: The GRE interface has keepalives enabled, but is not getting any response
from the configured destination.
IP Address The configured IP address for the GRE interface.
Mask The configured IP subnet mask for the GRE interface.
Source The configured source IP address or interface of the GRE interface.
Destination The configured destination IP address or domain name of the GRE interface. Further information on particular GRE interfaces can be obtained by selecting the appropriate GRE interface submenu underneath the GRE summary table. The following statistics are also displayed:
Bytes Received The number of bytes received on the GRE interface.
Digi TransPort® Routers User Guide
832
Managing networks and connections
Show network interface status
Bytes Sent The number of bytes sent on the GRE interface.
Packets Received The number of packets received on the GRE interface.
Packets Sent The number of packets sent on the GRE interface.
Keepalives Received The number of GRE keepalive packets received on the GRE interface.
Keepalives Sent The number of GRE keepalive packets sent on the GRE interface.
Rx Errors The number of receive errors that have occurred on the GRE interface. These can include the received being an invalid GRE packet.
Tx Errors The number of transmit errors that have occurred on the GRE interface. These can include an internal error due to no packet buffers being available.
Rx Unknown The number of packets that have been received with an unknown IP protocol and have been dropped.
Tx Discards The number of packets that have been discarded during transmission due to the GRE interface not being up or if a routing loop has been detected.
Command line
Command tunstat tunstat
Instance n n
Options n/a clear
Action Displays the GRE interface specific status and statistics. Clears the statistics for the GRE interface.
Digi TransPort® Routers User Guide
833
Managing networks and connections
Show network interface status
Show ISDN status and statistics
Web
Go to Management > Network Status > Interfaces > ISDN. The ISDN parameters section contains the status information for the ISDN interface.
ISDN BRI The status information is presented as a simple table having three or four columns as described below:
Channel There are three supported channels; the D-channel, B1, and B2 channels that appear in this column. Each channel row has an associated status, protocol and (for data channels) action. The Action column will only appear when the associated channel becomes active.
Status The status of each channel. The status is either ON or OFF.
Protocol The protocol in use by the channel. This should be as set up in the configuration procedure. For Dchannels, this will be LAPD. If the associated channel is not active, this entry will be blank.
Action When the link becomes active, a button should appear in this column. The text on the button will be Drop Link. Clicking the button deactivates the channel.
Command line
If a PPP instance has been associated with a B-channel, display the statistics for that PPP instance using the normal pppstat command.
Digi TransPort® Routers User Guide
834
Managing networks and connections
Show network interface status
Show PSTN interface status and statistics
Web
Go to Management > Network Status > Interfaces > ISDN. The PTSN section contains the network status information for the PSTN interface.
Link Name A description of the interface, if one was assigned during the configuration.
This PSTN interface is using PPP n When configuring the PSTN module, a PPP instance is assigned. This field is the instance number of the assigned PPP interface.
IP Address The IP address assigned to the interface.
Mask The subnet mask in use by the interface.
DNS Server The IP address of the DNS server in use by the interface.
Bytes Received The number of bytes received by the interface.
Bytes Sent The number of bytes sent by the interface.
LCP Packets Received The number of Link Control Protocol (LCP) packets received.
LCP Packets Sent The number of LCP packets sent by the interface.
PAP Packets Received The number of Password Authentication Protocol (PAP) packets sent by the interface.
PAP Packets Sent The number of PAP packets sent by the interface.
IPCP Packets Received The number of IP Control Protocol (IPCP) packets received by the interface.
IPCP Packets Sent The number of IPCP packets sent by the interface.
Digi TransPort® Routers User Guide
835
Managing networks and connections
Show network interface status
Receive Errors The number of frames received that contain an error (CRC etc).
Transmit Errors The number of frames the interface attempted to transmit, but were found to contain an error.
Refresh Updates the statistics on the page.
Clear PPP n Statistics Reset the statistics to 0.
Command line
The command to display the PPP status is:
pppstat <n>
where <n> is the interface number for the PPP interface assigned to the PSTN module and is shown at the top of the web page. For descriptions of the pppstat output, see Show PPP status and statistics.
Digi TransPort® Routers User Guide
836
Managing networks and connections
Show network interface status
Show serial status and statistics
Web
Go to Management > Network Status > Interfaces > Serial > Serial n. The Serial page displays the current status and statistics of the selected serial interface.
DTR The current status of the Data Terminal Ready (DTR) signal.
Bytes Received The number of bytes received on the serial interface.
Rx Overruns The number of receive overruns that have occurred on the serial interface. A receive overrun occurs when there are not enough buffers to receive incoming data, resulting in dropping the received data being dropped.
Tx Underruns The number of transmit underruns that have occurred on the serial interface. A transmit underrun occurs when there is not enough data available when it is about to be transmitted.
Breaks Received The number of times a break signal has been received.
Framing Errors Received The number of framing errors detected when receiving data on the serial interface.
Parity Errors Received The number of parity errors detected when receiving data on the serial interface.
Buffer Shortages The number of times data received on the serial interface was dropped because of a lack of system buffers.
Digi TransPort® Routers User Guide
837
Managing networks and connections
Show network interface status
Message Shortages The number of times data received on the serial interface was dropped because of a lack of system messages.
Command line
Command at\mibs=asy.n at\mibclr=asy.n
Instance n/a n/a
Parameter n/a n/a
Action Displays the statistics for serial interface n. Clears the statistics for serial interface n.
Digi TransPort® Routers User Guide
838
Managing networks and connections
Show network interface status
Show PPP status and statistics
Web
Go to Management > Network Status > Interfaces > Advanced > PPP > PPP n. The PPP n page displays the current status and statistics of the selected PPP interface.
Raise Link Activates the PPP interface.
Drop Link Deactivates the PPP interface.
Note The PPP interface remains deactivated until you click the Raise Link button.
Digi TransPort® Routers User Guide
839
Managing networks and connections
Show network interface status
Name The name assigned to the PPP interface.
Uptime The amount of time the PPP interface has been up.
MRU The maximum receive unit (MRU) that has been negotiated by each peer on the PPP connection.
ACCM The Asynchronous Control Character Map (ACCM) that has been negotiated by each peer on the PPP connection.
VJ Compression The Van Jacobson (VJ) compression that has been negotiated by each peer on the PPP connection.
Link with Active Entity The entity this PPP interface is using for connectivity.
IP Address The IP address assigned to this PPP interface. This could be either statically configured or assigned by the remote PPP peer.
DNS Server IP Address / Secondary DNS Server IP Address The primary and secondary DNS server IP addresses the PPP interface is using.
Outgoing Call To If this is dial-out PPP interface, this is the number for making the call.
Total Data Transferred The total amount of data bytes received and transmitted on the PPP interface, including PPP headers and payload.
Total Up Time Today The total amount of time, in minutes, the PPP interface has been connected in the current 24-hour period.
Bytes Received The number of bytes received on the PPP interface.
Bytes Sent The number of bytes sent on the PPP interface.
LCP Packets Received The number of Link Control Protocol (LCP) packets received on the PPP interface.
LCP Packets Sent The number of Link Control Protocol (LCP) packets sent on the PPP interface.
Digi TransPort® Routers User Guide
840
Managing networks and connections
Show network interface status
PAP Packets Received The number of Password Authentication Protocol (PAP) packets received on the PPP interface.
PAP Packets Sent The number of Password Authentication Protocol (PAP) packets sent on the PPP interface.
IPCP Packets Received The number of IP Control Protocol (IPCP) packets received on the PPP interface.
IPCP Packets Sent The number of IP Control Protocol (IPCP) packets sent on the PPP interface.
BACP Packets Received The number of Bandwidth Allocation Control Protocol (BACP) packets received on the PPP interface.
BACP Packets Sent The number of Bandwidth Allocation Control Protocol (BACP) packets sent on the PPP interface.
BAP Packets Received The number of Bandwidth Allocation Protocol (BAP) packets received on the PPP interface.
BAP Packets Sent The number of Bandwidth Allocation Protocol (BAP) packets sent on the PPP interface.
Unknown Packets Received The number of packets received with an unknown or unsupported PPP protocol.
Receive Errors The number of receive errors that have occurred on the PPP interface.
Transmit Errors The number of transmit errors that have occurred on the PPP interface.
CRC Errors Received The number of packets received on the PPP interface with invalid CRCs.
Framing Errors Received The number of packets received on the PPP interface with invalid framing.
Transaction Statistics
Last Counter Reset Timestamp The time when the PPP transaction statistics where last reset.
Successful Transaction Count The number of successful PPP transactions.
Dropped Transaction Count The number of transactions sent but no response has been received.
Digi TransPort® Routers User Guide
841
Managing networks and connections
Show network interface status
Minimum Transaction Time The shortest response time, in milliseconds, for a PPP transaction.
Maximum Transaction Time The longest response time, in milliseconds, for a PPP transaction.
Average Transaction Time The average response time, in milliseconds, for the successful PPP transactions.
Route OOS Count The number of Route Out Of Service messages sent by the firewall to the routing code. These messages put routes out of service for a period of time and are sent when enough failed PPP transactions have occurred.
Command line
Command ppp ppp ppp at\mibs=ppp.n.stats at\mibclr=ppp.n.stats
Instance Parameter Action
n
act_rq
Raises the PPP link.
n
deact_rq Drops the PPP link.
n
status
Displays the current status of PPP interface n.
n/a
n/a
Displays the statistics for PPP interface n.
n/a
n/a
Clears statistics for PPP interface n
Digi TransPort® Routers User Guide
842
Managing networks and connections
Show network interface status
Show IP statistics
Web
Go to Management > Network Status > IP Statistics.
Bytes Received Number of bytes received.
Bytes Sent Number of bytes sent.
Packets Received Number of packets received.
Packets Sent Number of packets sent.
Multicast Packets Received Number of multicast packets received.
Multicast Packets Sent Number of multicast packets sent.
Bytes Routed Number of bytes that have passed through the routing table.
Packets Routed Number of packets that have passed through the routing table.
Bytes NATed Number of outgoing bytes that have passed through the Network Address Table (NAT) code.
Packets NATed Number of outgoing packets that have passed through the NAT code.
Packets Filtered The number of packets filtered by the filter rule set during the most recent collection interval.
TCP Retransmits Number of TCP retransmits generated by local TCP sockets.
No Route Number of received packets that have no routing information associated with them.
Failed to Route Number of packets that have been routed to a route that is unavailable or out of service.
Digi TransPort® Routers User Guide
843
Managing networks and connections
Show network interface status
Packet Timeouts Number of packets that have been dropped due to TTL reaching 0.
NAT Shortages Number of times the pool of NAT entries has been exhausted. When this happens, the entry that has been used least recently is used.
Checksum Errors Number of packets that have not passed the checksum check.
Discards Number of packets dropped for miscellaneous reasons.
Command line
Use the ipstat command.
Digi TransPort® Routers User Guide
844
Managing networks and connections
Show the IP routing table
Web
Go to Management > Network Status > IP Routing Table. The IP Routing Table page displays the IPv4 routing table.
Show network interface status
Destination The destination IP network of the route. To use the route, the destination must match the destination IP address of an IP packet. For default routes, the destination IP network is always 0.0.0.0/0. The router uses default routes when no other route matches the destination IP address of an IP packet.
Src Addr When source address routing in use, to use the route, the Src Addr value must match the source IP address of an IP packet.
Gateway The IP address of the next router to which the IP packet will be routed to reach the destination network. On PPP and TUN interfaces, and ETH interfaces that have the gateway configured, this parameter can be blank.
Metric The route metric defines the cost of the route. If CIDR routing is enabled and there are two routes to the same destination, the router uses the route with the lower metric.
Protocol The protocol that created the route. This setting can be one of the following:
Setting Local Remote Static Static/RIP RIP
Description The route is for a network connected directly to the router. The route is for a remote network accessed via a PPP connection. The route is a static route. The route is a static route that has been updated by RIP. The route is a RIP route.
Digi TransPort® Routers User Guide
845
Managing networks and connections
Show network interface status
Setting IBGP EBGP OSPF
Description The route is an interior BGP route. The route is an exterior BGP route. The route is an OSPF route.
Idx Used for static routes only. The index of the configured static route.
Interface The interface over which the IP packet will be routed when using the route.
Status The current status of the route. This setting can be one of the following:
Setting Description
UP
The route is up and is ready for use in routing.
DOWN The interface that the route uses is currently down. The interface can be activated if the route is required.
OOS The interface that the route uses is currently "Out of Service".
Command line
Command route route
Options print printsrc
Action Displays the IPv4 routing table. Displays the IPv4 routing table with the src addr information.
Digi TransPort® Routers User Guide
846
Managing networks and connections
Show network interface status
Show the IP hash table
The router uses an IP routing hash table to improve IPv4 routing performance by reducing route lookup times.
Web
Go to Management > Network Status > IP Hash Table. The IP Hash Table contains information on recently routed IP packets such as source and destination IP address, IP protocol, etc, plus information on the interface and gateway in use when routing the IP packet. When the router receives an IP packet to route, it looks in the IP hash table before looking in the IPv4 routing table. Whenever the IPv4 routing table changes (such as a route is added, deleted or modified), all entries in the IP hash table are flushed out. To flush the IP hash table manually, click the Flush button. If there is no use of the table for 10 seconds, the router deletes entries in the IP hash table.
Src IP Address The source IP address of the routed IP packet.
Src Port The source TCP/UDP port of the routed IP packet. If the IP protocol is not TCP or UDP, then this field is 0.
Destination IP Address The destination IP address of the routed IP packet.
Dest Port The destination TCP/UDP port of the routed IP packet. If the IP protocol is not TCP or UDP, this field is 0.
Next Hop The next hop gateway to which the routed IP packet was sent.
IP Protocol The IP protocol field in the routed IP packet.
Interface The interface in use when the IP packet was routed.
Age The age, in seconds, of the entry in the IP hash table.
Digi TransPort® Routers User Guide
847
Managing networks and connections
Show network interface status
Idx The index in the IP hash table of the entry.
Usage The number of times the entry was used.
Command line
Command route route
Options hash flush
Action Displays the IP hash table. Flushes the IP hash table.
Digi TransPort® Routers User Guide
848
Managing networks and connections
Show network interface status
Show the port forwarding table
Web
Go to Management > Network Status > Port Forwarding Table. The Port Forwarding Table page displays the Port Forwarding / NAT table. The router uses this table to keep track of IP packets that have been modified via NAT or NAPT to be routed over a particular network. When the router receives a response to a previously modified IP packet, it looks up the matching entry in the Port Forwarding table to correctly modify the response IP packet.
Src IP Address The source IP address of the modified IP packet.
Dest IP Address The destination IP address of the modified IP packet.
IP Protocol The IP protocol field of the modified IP packet.
Src Port The source TCP/UDP port of the modified IP packet. For ICMP packets, this defines the ICMP Echo identifier value.
NAPT Port The new destination TCP/UDP of the modified IP packet. For ICMP packets, this defines the ICMP Echo identifier value.
Dest Port The original destination TCP/UDP port of the modified IP packet.
TTL The time to live, in seconds, for the Port Forwarding entry. The router deletes any entries not in use during this specified amount of time from the Port Forwarding table.
Command line
Command nat
Options list
Action Displays the Port Forwarding / NAT table.
Digi TransPort® Routers User Guide
849
Managing networks and connections
Show network interface status
Show firewall statistics
Web
Go to Management > Network Status > Firewall. The Firewall page displays the current firewall statistics and the Firewall Stateful Inspection table.
Passed Packets The number of packets the firewall has passed.
Blocked Packets The number of packets the firewall has blocked.
Logged Packets The number of packets the firewall has logged.
Stateful Packets The number of packets that have matched a stateful rule.
Undersized Packets The number of packets received by the firewall that are too small.
Oversized Packets The number of packets received by the firewall that are too large.
Return TCP RST The number of times the firewall has returned a TCP Reset packet.
Return ICMP The number of times the firewall has returned an ICMP packet.
Stateful rule shortages The number of times there has been a shortage of entries stateful inspection table.
HASH table errors The number of hashing errors when looking into the stateful inspection table.
In use stateful rules reused The number of times an in-use stateful inspection table has been reused.
Firewall Stateful Inspection Table
The Firewall Stateful Inspection table is a sophisticated, scripted stateful firewall and route inspection engine. Stateful inspection is a powerful tool allowing the router to keep track of a TCP/UDP or ICMP session and match packets based on the state of the connection on which they are being carried. The table contains a list of dynamic firewall rules that have been created when packets have matched a configured firewall with the inspect-state keyword specified. See the [inspect-state] keyword description for more information on stateful inspection.
Digi TransPort® Routers User Guide
850
Managing networks and connections
Show network interface status
TTL The number of seconds for the table entry to live. When this reaches 0, the entry is removed from the table.
Hits The number of times an IP packet has been matched against the firewall rule.
Direction The direction of the IP packets that match the firewall rule.
Src IP Addr The source IP address of the IP packets that match the firewall rule.
Src Port The source TCP/UDP port of the IP packets that match the firewall rule.
Dest IP Addr The destination IP address of the IP packets that match the firewall rule.
Dest Port The destination TCP/UDP port of the IP packets that match the firewall rule.
Trans. Src IP Addr If the firewall is configured to modify (such as NAT or NAPT) the source IP address of the IP packets that match the firewall, this defines the new source IP address of the IP packets.
Trans. Src Port If the firewall is configured to modify (such as NAPT) the source TCP/UDP port of the IP packets that match the firewall, this defines the new source TCP/UDP port of the IP packets.
Trans. Dest IP Addr If the firewall is configured to modify (such as NAT or NAPT) the destination IP address of the IP packets that match the firewall, this defines the new destination IP address of the IP packets.
Trans. Dest Port If the firewall is configured to modify (such as NAPT) the destination TCP/UDP port of the IP packets that match the firewall, this defines the new destination TCP/UDP port of the IP packets.
Protocol The IP protocol of the IP packets that match the entry.
Digi TransPort® Routers User Guide
851
Managing networks and connections
Show network interface status
Interface The interface over which the IP packets that match the entry are sent or received.
Command line
Command fwall
Options show
Action Displays the firewall stateful inspection table.
Digi TransPort® Routers User Guide
852
Managing networks and connections
Show network interface status
Show firewall trace output
Using the log keyword in a firewall rule appends output to the firewall trace output. Typically, the last rule in the form block log break end uses the log keyword to log a summary of all packets not matching one of the allow rules. The log keyword provides more logging flexibility; see the log action description in Use firewall scripts. Here is example firewall trace output from a firewall rule, showing two logged packets. Output for the first packet is:
block log break end ----- 5-10-2009 23:12:08 -----FW LOG Dir: IN Line: 37 Hits: 4730 IFACE: ETH 3 Source IP: 222.45.112.59 Dest IP: 217.34.133.21 ID: 256 TTL: 106 PROTO: TCP (6) Src Port: 12200 Dst Port: 8118 block log break end -------------- 5-10-2009 23:13:15 -----FW LOG Dir: IN Line: 37 Hits: 4731 IFACE: ETH 3 Source IP: 218.61.22.42 Dest IP: 217.34.133.21 ID: 35372 TTL: 136 PROTO: TCP (6) Src Port: FTP CTL (21) Dst Port: 16794 block log break end ----------
Next is the time stamp of the blocked packet.
----- 5-10-2009 23:12:08 -----FW LOG Dir: IN Line: 37 Hits: 4730 IFACE: ETH 3 Source IP: 222.45.112.59 Dest IP: 217.34.133.21 ID: 256 TTL: 106 PROTO: TCP (6) Src Port: 12200 Dst Port: 8118
n Dir is the direction of the packet that was logged, either IN or OUT of the router.
n Line is the line number within the firewall rules that caused this packet to be logged.
n Hits is the number of packets that have matched this rule.
n IFACE is the interface which the packet was logged on.
n Source IP is the source IP address of the packet that was logged.
n Dest IP is the destination IP address of the packet that was logged.
n ID is the ID of the packet, this is taken from the packet header.
n TTL is the Time To Live value.
n PROTO is the layer 3 protocol of the logged packet.
n Src Port is the source TCP or UDP port number of the packet that was logged.
n Dst Port is the destination TCP or UDP port number of the packet that was logged.
n block log break end is the actual rule that caused the packet to be logged.
Command line
Command type fwlog.txt
Options n/a
Action Displays the current firewall trace.
Digi TransPort® Routers User Guide
853
Managing networks and connections
Show DHCP status
Web
Go to Management > Network Status > DHCP.
Show network interface status
IP Address The IP address assigned to the hostname.
Hostname The hostname to which the IP address has been assigned.
Lease time left (mins) The length of time, in minutes, the IP address lease is valid for. After this time, the DHCP client will need to renew its IP address.
Mac Address The MAC address.
Command line
Command dhcp dhcp
Instance 0 0
Parameter status clear
Action Displays the current status of the DHCP table. Deletes all the entries in the DHCP table.
Digi TransPort® Routers User Guide
854
Managing networks and connections
Show DNS status
Web
Go to Management > Network Status > DNS Status.
Show network interface status
Hostname The hostname that has been resolved.
IP Address The IP address of the hostname.
TTL The time to live, in seconds, for the DNS entry. When the TTL reaches 0, the entry is deleted.
Command line
Command dns dns
Instance 0 0
Parameter status clear
Action Displays the current status of the DNS table. Deletes all the entries in the DNS table.
Digi TransPort® Routers User Guide
855
Managing networks and connections
Show IGMP status
Web
Go to Management > Network Status > IGMP Status.
Show network interface status
Digi TransPort® Routers User Guide
856
Managing networks and connections
Show network interface status
Show Quality of Service (QoS) status
Web
Go to Management > Network Status > QoS. Status. The Ethernet QoS status pages display the current Quality of Service (QoS) status table for a particular interface. The Advanced pages show the Quality of Service for any PPP interfaces. Both displays show the same type of information. For example:
Priority Q The priority queue in the table.
TX rate (kbps) The current transmit rate in kbps of the queue.
Limit The current transmit rate limit in kbps of the queue.
Weighted Q length The weighted queue length using the Weighted Random Early Discard (WRED) algorithm.
Q length The number of packets on the queue.
Digi TransPort® Routers User Guide
857
Managing networks and connections
Show NTP status
Web
Go to Management > Network Status > NTP Status.
Show network interface status
Command line
To check the status of the NTP client, use the ntpstat command.
Show NTP system status information ntpstat sys
Digi TransPort® Routers User Guide
858
Managing networks and connections
Show network interface status
Show NTP peer information ntpstat peers Reset system information and allow NTP to recalculate the drift compensation ntpstat rst
Digi TransPort® Routers User Guide
859
Managing networks and connections
Manage connections
Manage connections
There are several web interface pages and commands for viewing and managing connections for the TransPort router.
Digi TransPort® Routers User Guide
860
Managing networks and connections
Manage connections
Show IP connections
Web
Go to Manage > Connections > IP Connections. The IP Connections page displays the current status of the TCP sockets on the router. The router has two types of sockets:
Socket type TCP Sockets General Purpose Sockets
Use Reserved for WEB and FTP connections. Any application for TCP connections can use this socket type.
TCP Sockets
ID The TCP socket identifier.
SID An internal socket identifier.
State The current state of the socket.
Digi TransPort® Routers User Guide
861
Managing networks and connections
Manage connections
Local IP Addr The IP address on the router in use for the TCP connection.
Local Port The TCP port on the router in use for the TCP connection or which is being listened on.
Remote IP Address The IP address of the remote device that has the TCP connection to the router.
Remote Port The TCP port in use by the connected remote device.
SYNs Waiting The number of TCP SYN packets that are currently being processed by the router.
Free SYN entries The number of entries available to process an incoming TCP SYN packet.
General Purpose Sockets
Web
ID The ID of the general purpose socket.
Owner The software task that created the socket.
Digi TransPort® Routers User Guide
862
Managing networks and connections
Manage connections
Protocol The protocol in use by the socket.
Mode The mode of operation of the socket.
State The current state of the socket.
Local Port The port of the router that in use by the socket.
Remote IP Addr The IP address of the remote device that has a TCP connection with the socket.
Remote Port The TCP port in use by the remote device.
Inactivity Timeout The socket's inactivity timeout, in seconds. If the timer reaches 0 seconds, the TCP connection is closed.
Total Number of Sockets The total number of general purpose sockets available on the router.
Number of Free Sockets The number of free general purpose sockets available on the router.
Command line
Command Options Action
socks
None
Displays the current status of the TCP sockets.
gpstat
None
Displays the current status of the general purpose sockets.
gpstat
close <ID> Closes the general purpose socket connection with the ID number specified.
Digi TransPort® Routers User Guide
863
Managing networks and connections
Manage connections
Manage PPP connections
Web
Go to Management > Connections > PPP Connections > PPP n. PPP connection status fields and controls are as follows:
Raise Link Activates the PPP connection.
Drop Link Deactivates the PPP connection.
Link status The current status of the PPP connection.
Uptime The uptime for the PPP connection.
MRU The maximum receive unit (MRU) for the local and remote ends of the PPP connection.
ACCM The Asynchronous Control Character Map (ACCM) bit settings for the local and remote ends of the PPP connection.
VJ Compression Whether Van Jacobson TCP/IP header data compression is on or off.
Link Active With Entity The entity with which the PPP connection is active.
IP Address The IP address of the local end of the PPP connection.
DNS Server IP Address The IP address of the DNS server for the PPP connection.
Secondary DNS Server IP Address The IP address of the secondary DNS server for the PPP connection, if any.
Outgoing Call To Identifies the destination of the outgoing call for the PPP connection.
Command line
Use the pppstat n command, where n is the PPP interface number (0-19).
Digi TransPort® Routers User Guide
864
Managing networks and connections
Manage connections
Show VPN connections
Web
Go to Management > Connections > VPN. There are several sub-menus:
n IPsec: Displays IPsec tunnel connections n IPsec Peers: Displays IPsec peers n IKE SAs: Displays the current status of the Internet Key Exchange (IKE) Security Associations
(SA) n OpenVPN: Displays OpenVPN connections and their current status
Show IPsec tunnel connections
Go to Management > Connections> VPN > IPsec > IPsec Tunnels.
# IPsec tunnel number.
SPI The Security Parameters Index (SPI) is a pointer that references the session key and algorithm for protecting the data in the IPsec tunnel.
Peer IP The IP address of the remote device that is the other end of the IPsec tunnel.
Local Network The local IP network of the IPsec tunnel that is connected to the router.
Remote Network The remote IP network of the IPsec tunnel that is connected to the remote device.
First Rem. IP / Last Rem. IP For IPsec tunnels that have been negotiated using IKEv2, this is the range IP addresses available on the remote IP network.
Digi TransPort® Routers User Guide
865
Managing networks and connections
Manage connections
First Loc. IP / Last Loc. IP For IPsec tunnels that have been negotiated using IKEv2, this is the range IP addresses available on the local IP network.
AH The AH algorithm in use, if any.
ESP Auth The ESP authentication algorithm in use, if any.
ESP Enc The ESP encryption algorithm in use, if any.
IPComp The data compression algorithm in use, if any.
KBytes Delivered The total amount of data that has been transferred (in both directions) over this IPsec tunnel.
KBytes Left The amount of data left to be transferred over the IPsec tunnel before the data duration limit is reached. The data duration is negotiated between the router and the remote device.
Time Left The time left, in seconds, before the time duration limit is reached. The time duration is negotiated between the router and the remote device.
Interface The interface over which the IPsec tunnel operates.
Show status of IPsec peers
Go to Management > Connections> VPN > IPsec > IPsec Peers. This page displays the current status of the IPsec peers. This is the list of remote devices that have successfully negotiated an IPsec tunnel with the router.
Peer IP Address The IP address of the remote device.
Our ID The ID of the router.
Digi TransPort® Routers User Guide
866
Managing networks and connections
Manage connections
Peer ID The ID of the remote device.
Dead Peer Detection (DPD) The DPD status and the time until the next DPD request.
NATT Local Port The local NAT-Traversal port.
NATT Remote Port The remote NAT-Traversal port.
Show status of IKE SAs
Go to Management > Connections> VPN > IPsec > IKE SAsThis page displays the current status of the IKE Security Associations (SA).
Our ID The ID of the router.
Peer ID The ID of the remote device with which the IKE SA has been negotiated.
Peer IP Address The IP address of the remote device.
Our IP Address The IP address the router uses to negotiate the IKE SA.
Time Left The time remaining, in seconds, for the IKE SA to remain in force.
Session ID The ID of the IKE SA.
Internal ID An internal identifier for the IKE SA.
Digi TransPort® Routers User Guide
867
Managing networks and connections
Show status of OpenVPN instances
Web
Go to Management > Connections> VPN > OpenVPN > OVPN n.
Manage connections
Raise Link Activates the OpenVPN connection.
Drop Link Deactivates the OpenVPN connection.
Name The name of the OpenVPN connection.
Link status field The current status of the OpenVPN connection.
Bytes Received The number of bytes received over the OpenVPN connection.
Bytes Sent The number of bytes sent over the OpenVPN connection.
Packets Received The number of packets received over the OpenVPN connection.
Packets Sent The number of packets sent over the OpenVPN connection.
Digi TransPort® Routers User Guide
868
Managing networks and connections
Manage connections
Pings Received The number of pings received over the OpenVPN connection.
Pings Sent The number of pings sent over the OpenVPN connection.
Ping Timeouts The number of ping timeouts that have occurred over the OpenVPN connection.
Key Renegotiations Number of times the OpenVPN encryption keys have been renegotiated on the connection.
Packet Replays Detected The number of packet replays detected over the OpenVPN connection.
Command line
Command Instance
sastat
None
sastat
None
sastat
None
ovpn
n
ovpn
n
ovpn
n
Parameter Description
[dyn]
Displays the current status of all of the IPsec tunnels. You can use the optional dyn parameter to display the status of the dynamic IPsec tunnels.
[dyn] <first> Displays the current status of the IPsec tunnels in
<last>
the range from <first> to <last>. such as sastat 0
49 or sastat dyn 0 49.
Displays the current status of the IPsec tunnels that match the given peer. The <peer> value can contain the * wildcard character. such as sastat peer uk-north-* or sastat dyn peer uk-north-*.
status
Displays status of an OpenVPN connection (equivalent of Management > Connections> VPN > OpenVPN > OVPN n).
deact_rq
Disconnects an OpenVPN connection (equivalent of Drop Link button)
act_rq
Connects an OpenVPN connection (equivalent of Raise Link button)
Digi TransPort® Routers User Guide
869
Managing networks and connections
Show GPS data
Show GPS data
Web
Go to Management > Telemetry > GPS. The GPS page displays a summary of the most recent information received from the GPS module (if fitted) and the status of the IP connections.
Longitude
The current longitude contained in the last GGA, GLL or RMC message from the GPS module.
Latitude
The current latitude contained in the last GGA, GLL or RMC message from the GPS module.
No of Satellites
The current number of satellites in use, as indicated in the last GGA message from the GPS module.
Type of fix
The current fix status as indicated in the last GGA, GLL or RMC message, followed by the type of fix (such as 2D, 3D or no fix) as indicated in the last GSA message.
UTC
The current UTC time as indicated in the last ZDA, GGA, GLL or RMC message from the GPS module.
True Heading
The current true heading as indicated in the last RMC message from the GPS module. If the router is not moving, this value is not available.
Digi TransPort® Routers User Guide
870
Managing networks and connections
Show GPS data
Speed
The current speed, as indicated in the last RMC message from the GPS module.
Integrity
The current data integrity as indicated in the last RMC message from the GPS module. It can be either Valid or Not Valid.
IP Connections
The current IP address, port number, connection type and status of the IP connections.
Command line
Command at\mibs=gps.0.stats
Options
Action Displays the current status of the GPS receiver.
Digi TransPort® Routers User Guide
871
Managing networks and connections
View and manage the event log
View and manage the event log
Web
Go to Management > Event Log. The Event Log page displays the current contents of the event log on the router.
The event log is stored in a pseudo-file named eventlog.txt. It acts as a circular buffer, so when there is no space available for new entries, the oldest entries are overwritten. Each entry in the log normally consists of a single line containing the date, time and a brief description of the event. In some case it may also identify:
n The type/number of the protocol instance the generated the message, such as PPP 0. n A reason code. n Additional information such as an X.25 address or ISDN telephone number.
The specific events that generate a log entry are pre-defined and cannot be altered although the text and priority of each event can be modified. This can be done via the Configuration > Alarms > Event Logcodes page.
Digi TransPort® Routers User Guide
872
Managing networks and connections
Command line
Command type eventlog.txt clear_ev
Options None None
View and manage the event log
Action Displays the contents of the event log. Clears the contents of the event log.
Digi TransPort® Routers User Guide
873
Managing networks and connections
Analyze data traffic
Analyze data traffic
Using the Analyser, you can configure the router to capture a trace of the data being transmitted and received on the various interfaces. The Analyser can capture the layer 1, 2, and 3 protocol data and present it in an easily readable format.
Digi TransPort® Routers User Guide
874
Managing networks and connections
Analyze data traffic
Capture data traffic
Web
1. Go to Management > Analyser > Settings. 2. Configure the Analyser to capture data traffic:
Enable Analyser Enables or disables the Analyser.
Maximum packet capture size The number of bytes that are captured and stored for each packet. If the packet is bigger than the configured size, the packet is truncated. Bear in mind that the larger this value, the quicker the pseudo file ana.txt will become full so that the effective length of the Analyser trace is reduced.
Log Size The maximum size of the pseudo file ana.txt for storing the captured data packets. Once the maximum size is reached, the oldest captured data packets are overwritten when new packets are captured. The maximum value is 180 Kb, but since the data is compressed, more than 180 Kb of trace data will be captured.
Protocol layers The check-boxes under this heading specify which protocol layers are captured and included in the Analyser trace. You can choose to capture Layer 1 (physical / PPP), Layer 2 (Layer protocol, the Network Layer (Layer 3) protocol or any combination, by checking or clearing the appropriate check-boxes. In addition, you may select XOT (X.25 over TCP/IP) tracing if this feature is included on the router.
Enable IKE debug Enables or disables including IKE packets in the Analyser trace when using IPsec.
Enable QMI trace Enables or disables including data from the Qualcomm Management Interface in the Analyser trace.
Enable SNAIP trace Enables or disables including the SNAIP packet in the Analyser trace.
ISDN Sources Selects the ISDN channels (D, B1 and B2) over which packets will be captured and included in the Analyser trace.
LAPB Links Selects the LAPB links over which packets are captured and included in the Analyser trace.
Digi TransPort® Routers User Guide
875
Managing networks and connections
Analyze data traffic
Serial Interfaces Selects the serial interfaces over which packets will be captured and included in the Analyser trace. The list of available interfaces include the physical serial interfaces, internal virtual serial interfaces (if present), and interfaces the built-in WWAN and/or PSTN modems use.
Ethernet Interfaces Selects the Ethernet interfaces over which packets are captured and included in the Analyser trace.
Raw SYNC Sources Selects the synchronous sources over which packets are captured and included in the Analyser trace.
DSL PVC Sources Selects the ADSL ATM PVCs over which packets are captured and included in the Analyser trace.
PPP Interfaces Selects the PPP interfaces over which packets are captured and included in the Analyser trace.
IP Sources Selects the IP sources over which packets are captured and included in the Analyser trace. These sources include IP packets transmitted and received over Ethernet, PPP and OpenVPN (OVPN) interfaces. It is also possible to select GRE Tunnels via the advanced sections of the individual GRE Tunnel configuration pages.
IP Options:
Trace discarded packets Enables or disables the capture of packets that are discarded by an interface, and displays a reason for why the packet was discarded.
Trace loopback packets Enables or disables the capture of IP loopback packets.
IP Packet Filters / Discarded IP Packet Filters options
TCP/UDP Ports Filters out TCP or UDP packets with particular source or destination port numbers. The format of this parameter is a comma-separated list of port numbers. For example, suppose you want to exclude the capture of Telnet and HTTP traffic that would otherwise swamp the data of interest. To do this, enter 23,80 for this parameter. Conversely, to capture traffic on a specific source or destination port only, use a tilde () symbol before the list of ports. For example, to only capture Telnet and SSH packets, enter 22,23 for this parameter.
IP Protocols Filters out IP packets with particular IP protocol numbers. The format of this parameter is a comma-separated list of protocol numbers. For example, suppose you want to exclude the capture of TCP traffic that would otherwise swamp the data of interest. To do this, enter 6 for this parameter. Conversely, to capture traffic with a specific IP protocol number only, use a
Digi TransPort® Routers User Guide
876
Managing networks and connections
Analyze data traffic
tilde () symbol before the list of protocol numbers. For example, to only capture UDP traffic, enter 17 for this parameter.
IP Addresses Filters out IP packets with particular source or destination IP addresses. The format of this parameter is a comma-separated list of IP addresses. For example, you may want to exclude the capture of traffic from IP hosts 10.1.2.3 and 10.2.2.2. To do this, enter 10.1.2.3,10.2.2.2 for this parameter. Conversely, to capture traffic to and from particular IP hosts only, use a tilde () symbol before the list of IP addresses. For example, to only capture packets to and from IP host 192.168.47.1, enter 192.168.47.1 for this parameter. 3. Click Apply.
Command line
Command Instance Parameter
ana
0
anon
ana
0
maxdata
ana
0
logsize
ana
0
l1on
ana
0
l2on
ana
0
l3on
ana
0
xoton
ana
0
ikeon
ana
0
qmion
ana
0
snaipon
ana
0
lapdon
ana
0
lapbon
ana
0
asyon
ana
0
syon
ana
0
ana
0
ana
0
discardson loopon ipfilt
Values on, off 16-2000 3 -180 on, off on, off on, off on, off on, off on, off on, off 0-7 See below 0-7 See below Bitmap See below Bitmap See below on, off on, off Comma-separated list
Equivalent web parameter Enable Analyser Maximum packet capture size Log Size Protocol Layers / Layer 1 Protocol Layers / Layer 2 Protocol Layers / Layer 3 Protocol Layers / XOT Enable IKE debug Enable QMI trace Enable SNAIP trace ISDN Sources
LAPB Links
Serial Interfaces
Raw SYNC Sources
IP Options / Trace discarded packets IP Options / Trace loopback packets IP Packet Filters / TCP/UDP Ports
Digi TransPort® Routers User Guide
877
Managing networks and connections
Analyze data traffic
Command Instance Parameter Values
ana
0
ipprotfilt
Comma-separated list
ana
0
ipaddfilt
Comma-separated list
ana
0
discportfilt Comma-separated list
ana
0
discprotofilt Comma-separated list
ana
0
discipaddfilt Comma-separated list
eth
n
ethanon on, off
eth
n
ipanon
on, off
ovpn
n
ipanon
on, off
ppp
n
ipanon
on, off
ppp
n
pppanon on, off
tun
n
ipanon
on, off
tun
n
tunanon on, off
Equivalent web parameter IP Packet Filters / IP Protocols
IP Packet Filters / IP Addresses
Discarded IP Packet Filters / TCP/UDP Ports Discarded IP Packet Filters / IP Protocols Discarded IP Packet Filters / IP Addresses Ethernet Interfaces IP Sources IP Sources IP Sources PPP Interfaces GRE IP Sources GRE Tunnel Interfaces
Related CLI commands not available via the web interface
Command Instance Parameter Values Action
ana
0
fcon
on, off Enables serial flow control tracing.
ana
0
stopbufs 0-255
Stops Analyser when number of free system buffers matches this value.
ana
0
stopmsgs 0-255
Stops Analyser when number of free system messages matches this value.
ana
0
stopflood 0-1
Stops Analyser when Ethernet flood protection is activated.
ana
0
lowbufcmd Command Run this command when the number of free
String
system buffers match lowbuflvel.
ana
0
lowbuflev
Integer
Displays the free system buffer threshold that lowbufcmd uses.
ana
0
lowmsgcmd Command Run this command when the number of free
String
system messages match lowmsglvel.
ana
0
lowmsglev Integer
Displays the free system message threshold that lowmsgcmd uses.
Digi TransPort® Routers User Guide
878
Managing networks and connections
Analyze data traffic
Command Instance Parameter Values Action
ana
0
logdrive
String
Specifies an alternate file system drive on which to store the Analyser trace. To use an external USB flash device, this should be set to u: If the router has an internal SDIO flash device, select it by specifying s:
ana
0
logfile
Filename Stores the Analyser trace in the named file on an alternate drive.
ana
0
contfile
Filename Stores the Analyser trace in the named file on an alternate drive once the file indicated by logfile is reaches its max size as specified by logsizek.
ana
0
logsizek
Value in Kbytes
Sets the maximum size in Kbytes of the file on the alternate drive. When set to 0, the file size is only limited by the flash device.
ISDN Sources
LAPD2 OFF OFF OFF OFF ON ON ON ON
LAPD1 OFF OFF ON ON OFF OFF ON ON
LAPD0 OFF ON OFF ON OFF ON OFF ON
Value 0 1 2 3 4 5 6 7
LAPB Links
LAPD1 OFF OFF ON ON
LAPD0 OFF ON OFF ON
Value 0 1 2 3
Digi TransPort® Routers User Guide
879
Managing networks and connections
Analyze data traffic
Serial Interfaces
Interface Serial 0 Serial 1 Serial 2 Serial 3 Serial 4 Serial 5 Serial 6 Serial 7 Serial 8 Serial 9 Serial 10 Serial 11 Serial 12
Value 1 2 4 8 16 32 64 128 256 512 1024 2048 4096
To enable the Analyser on multiple serial interfaces, add the appropriate values together. For example, to enable the Analyser on serial interfaces 2 and 3, the value should be 12 (4+8). The number of serial interfaces can vary on different depending on which hardware and software options are available.
Raw Sync Interfaces
Interface ISDN D ISDN B1 ISDN B2 Physical Port 0 Physical Port 1
Value 1 2 4 8 16
To enable the Analyser on multiple serial interfaces, add the appropriate values together. For example, to enable the Analyser on Physical Ports 0 and 1, the value should 24 (8+16).
Digi TransPort® Routers User Guide
880
Managing networks and connections
Show captured data traffic
Web
Go to Management > Analyser > Trace to view the current Analyser trace.
Analyze data traffic
Command line
Command type ana.txt ana 0 anaclr
Options None None
Action Displays the contents of the event log. Clears the contents of the event log.
Digi TransPort® Routers User Guide
881
Managing networks and connections
Analyze data traffic
Set PCAP (such as Wireshark) traces
The traffic captured by the Analyzer is also available in PCAP format. A network protocol analyzer, such as Wireshark, can read files in this PCAP format. This powerful feature allows you to diagnose network protocol issues with relative ease. There are several PCAP files available to download. Each file contains a different set of captured packets.
Option IP Ethernet PPP Wi-Fi
PCAP File anaip.pcap anaeth.pcap anappp.pcap anawifi.pcap
Contents IP traffic captured from all enabled IP sources. Ethernet traffic captured from all enabled Ethernet sources. PPP traffic captured from all enabled PPP sources. Wi-Fi traffic captured from the enabled Wi-Fi source.
Wireshark is free software. To download, go to http://www.wireshark.org.
Web
1. Go to Management > Analyser > PCAP (e.g. Wireshark) traces. 2. Click the displayed links to download the desired PCAP-format file. Following is an example of Analyzer traffic output viewed in Wireshark:
Digi TransPort® Routers User Guide
882
Managing networks and connections
Use the Top Talkers monitor
Use the Top Talkers monitor
The router can be configured to monitor the data being transmitted and received on the various interfaces. It is able to report which IP hosts are generating the most traffic over a period between 1 and 30 minutes.
Top Talkers also allows you to block particular IP traffic flows to stop them from using bandwidth. The Management > Top Talkers page has the following menu options:
Digi TransPort® Routers User Guide
883
Managing networks and connections
Use the Top Talkers monitor
Configure Top Talkers monitor
Web
1. Go to Management > Top Talkers > Settings . 2. Configure Top Talkers settings as desired:
Ethernet Interfaces Selects the Ethernet interfaces Top Talkers will monitor.
PPP Interfaces Selects the PPP interfaces Top Talkers will monitor. 3. Click Apply.
Command line
Entity eth ppp
Instance n n
Parameter ttalker ttalker
Values on, off on, off
Equivalent web parameter Ethernet Interfaces PPP Interfaces
Digi TransPort® Routers User Guide
884
Managing networks and connections
Use the Top Talkers monitor
Show the Top Talkers trace
Web
Go to Management > Top Talkers > Trace to show the current top talkers trace. For example:
Digi TransPort® Routers User Guide
885
Performing device administration tasks
There are several administration tasks you may need to perform periodically on your TransPort router, such as displaying system information, managing files, managing certificates and keys, saving, backing up, and restoring the router's configuration, resetting or rebooting the router.
View system information Web
Go to Administration > System Information. The System Information provides an overview of router status.
Model
The model of the router.
Part Number
The Digi part number of the router.
Digi TransPort® Routers User Guide
886
Performing device administration tasks
View system information
Ethernet 0 MAC Address
The MAC address of the Ethernet 0 interface.
Firmware Version
The firmware version that is currently running on the router.
SBIOS Version
The SBIOS firmware version that is currently running on the router.
Build Version
The build configuration of the firmware that is currently running on the router.
HW Version
The hardware version on the router. This item may be blank.
CPU Utilization
The current and historical CPU utilization since the router booted up.
Up Time
The amount of time since the router booted up.
Date and Time
The current date and time on the router.
Total Memory
The total amount of RAM that is fitted on the router.
Used Memory
The amount of RAM that is currently in use on the router.
Free Memory
The amount of RAM that is currently free on the router.
Mobile Module
Which mobile module is fitted on the router.
SW Opts
Which firmware options are enabled on the router.
SW Cnts
Configuration parameters in use by firmware.
Switch Mode
The current setting of the Ethernet switch on routers with multiple Ethernet interfaces. It can be either Hub or Port Isolate.
Digi TransPort® Routers User Guide
887
Performing device administration tasks
Command line
Command ati5
Options n/a
hw
n/a
cpu
n/a
uptime
n/a
time
n/a
mem
n/a
View system information
Equivalent web parameter Model Firmware Version SBIOS Version Build Version Mobile Module SW Opts Part Number Ethernet 0 MAC Address HW Version CPU Utilization Up Time Date and Time Total Memory Used Memory Free Memory
Digi TransPort® Routers User Guide
888
Performing device administration tasks
Manage files
Manage files
Web
To manage files, go to Administration > File Management.
FLASH directory
The Administration > File Management > FLASH Directory web page displays the files held on the router's flash file system. The router has its own flash memory file system that uses DOS-like filenames of up to 12 characters long: 8 characters, followed by the . separator, and a 3-character extension. The filing system stores the system software, web pages, configuration information, and statistics in a single root directory. Files appear as hyperlinks, which can be downloaded and displayed in the web browser as long an appropriate viewer is installed and a file association with the viewer has been made. The directory listing of files on the FLASH directory also shows the file size, the access of rw (read write) or ro (read only) and the date the file was last modified. Below the file list is a summary of the FLASH file system, including the number of files, FLASH free, and FLASH used. For example:
Sub-directories are not supported. Depending on the router mode, you can store a maximum of 80300 files including system files, providing there is sufficient memory remaining. You can upload new files into the router from a local terminal or from a remote system over the WAN connection. Existing files can be renamed or deleted using DOS-like commands. Although the file system will only store a limited number of files, all those files associated with the web interface are stored in a single file with the .web extension and extracted as required.
Action
Selects each read/write file for deletion.
Digi TransPort® Routers User Guide
889
Performing device administration tasks
Manage files
File
The name of the file in the flash file system.
Size (bytes)
The size of the file, in bytes. This is not a fixed value. When downloaded, the size of the downloaded file will be different.
Access
This is the access settings for the file.
Setting rw ro
Description Read / Write access Read Only access
Last Modified
The date and time of when the file was last modified.
Delete Selected Files button
Deletes the selected files.
WEB Directory
The WEB directory contains a list of the files held within the active web file. The web file is shown on the FLASH file system as a single file. This file is compressed and holds approximately 300 files. Direct access to these files by an engineer is not normally required.
Digi TransPort® Routers User Guide
890
Performing device administration tasks
Manage files
File
The name of the file in web file.
Size (Bytes)
The size of the file, in bytes.
Compressed Size (Bytes)
The compressed size of the file, in bytes.
File Editor
Using the file editor, you can edit text files on the router.
Digi TransPort® Routers User Guide
891
Performing device administration tasks
Manage files
Filename
The name of the file to edit. In this field, you can create a new file by typing in the filename and clicking on the Save File button.
Load File
Load the file specified in the Filename field into the editor box.
Save File
Save the file to the flash file system.
Command line
copy command: Copy a file
The copy command makes a copy of a file. The format is: copy <filename> <newfilename> Where:
Digi TransPort® Routers User Guide
892
Performing device administration tasks
Manage files
<filename>
The name of an existing file.
<newfilename>
The name of the new copy that will be created.
del command: Delete a file
The del command deletes files from the filing system. The format is: del <filename>
<filename>
The name of an existing file. You can also use wild cards in the filename in order to delete several files at once. The * character can represent one or more characters in the filename. For example, del fw*.txt will delete files fw.txt and fwstat.txt. The del command returns OK if files have been deleted, or ERROR if no matching files have been found.
dir command: List the file directory
The dir command displays the file directory. There are several command variants:
Command Options Equivalent web parameter
dir
Displays the entire contents of the router's flash file system.
dir
<filter> Displays a filtered view of the router's flash file system. The filter can contain
wildcards using the *.
such as
dir *.pem
to display all the files ending in .pem.
dir
u:
Displays the contents of an USB flash stick if inserted into the USB port of
the router.
For example:
dir direct sbios mirror image
sregs.dat x3prof
CAcert.cer
60720 ro 524288 ro
60720 ro 4300995 rw
4096 rw 4096 rw 1371 rw
11:30:41, 31 Jan 2011 CRC ??? 11:30:43, 31 Jan 2011 CRC 6ba8 11:30:41, 31 Jan 2011 CRC ??? 15:22:23, 31 Jan 2011 CRC ab19 11:30:41, 31 Jan 2011 CRC 08b2 11:30:41, 31 Jan 2011 CRC bb5f 11:30:41, 31 Jan 2011 CRC 6764
Each line shows:
n The file name and extension, if any n The file size, in bytes
Digi TransPort® Routers User Guide
893
Performing device administration tasks
Manage files
n The read/write status: ro=read only; rw=read/write n The time/date of creation and the CRC value
Note File write operations are carried out as a background task and can be relatively slow due to the constraints of FLASH memory. As a result, the file directory may only be updated several seconds after a particular file operation has been carried out.
You can also use wildcards with the dir command in order to narrow your search. The * character can represent one or more characters in the filename. For example, dir fw*.txt will list only the fw.txt and fwstat.txt files, if they are present on the TransPort.
fattr command: Set or remove read only flag for a file
The fattr command adds or removes a read only flag for a file. Add a read only flag to set the file access permission to read only. Remove the read only flag to set the file access permission to read/write.
WARNING! Changing access permission for a system file can cause unexpected and undesired changes in system behavior. Do not use the fattr command to change access permissions on system files.
To set the file access permission to read/write, remove the read only flag for a file:
fattr -r <filename>
To set the access permission for a file to read only, add the read only flag for a file:
fattr +r <filename>
flock command: Lock files
The flock command prevents any further writing to the FLASH memory. This means that no files can be written to, added to or deleted from the filing system.
funlock command: Unlock files
The funlock command unlocks the FLASH memory if it had been locked using the flock command. Files can then be added, deleted, or copied to the filing system.
move command: Move a file
The move command replaces one file with another while retaining the original filename. The format is:
move <fromfile> <tofile>
For example, this command deletes the file called fw.txt and then rename the file called fw-temp.txt as fw.txt:
move fw-temp.txt fw.txt
Digi TransPort® Routers User Guide
894
Performing device administration tasks
Manage files
ren command: Rename a file
The ren command renames files in the filing system. The format is:
ren <oldfilename> <newfilename>
scan/scanr command: Scan the file system
The scan command performs a diagnostic check on the file system and reports any errors. For example:
scan Please wait...
direct ....ok sbios ....ok
mirror ....ok image ....ok, data ok
sregs.dat ....ok x3prof ....ok
CAcert.cer ....ok
The scanning process may take several seconds so you should not enter any other commands until the results are listed. The scanr command works in a similar fashion, except that it returns ERROR if any file is in error. This is useful when using scripts that can look for the ERROR failure result.
type command: Display a text file
The type command displays the contents of a text file. The format is:
type <filename>
For example:
type config.da0 [CFG] config last_saved "12:04:45, 31 Jan 2011" config last_saved_changes "1" config last_saved_user "ASY 0" eth 0 descr "LAN 0" eth 0 IPaddr "10.1.51.3" eth 0 mask "255.255.0.0" eth 0 bridge ON eth 1 descr "LAN 1" eth 2 descr "LAN 2" eth 3 descr "LAN 3" eth 4 descr "ATM PVC 0"
xmodem command: Initiate an XMODEM file upload
The xmodem command initiates an XMODEM file upload from the port at which the command is entered. The format is:
xmodem <filename>
Digi TransPort® Routers User Guide
895
Performing device administration tasks
Manage files
Where:
<filename>
The name under which the file will be saved when the upload is complete. After you enter the xmodem command, the router waits for your terminal program to start transmitting the file. When the upload is complete and the file has been saved, the router responds with the OK result code. To initiate a remote XMODEM upload, establish a Telnet session over ISDN, and then issue the xmodem command from the remote terminal.
Digi TransPort® Routers User Guide
896
Performing device administration tasks
Manage files
TransPort file system
A typical TransPort file directory includes the following files:
Filename ana.txt config.da0 direct eventlog.txt fw.txt fwstat.txt image *.web logcodes.txt pwds.da0 sbios sregs.dat x3prof
Description Pseudo file for Protocol Analyser output Data file containing Config.0 settings File directory Pseudo file for Event Log output Firewall script file Firewall script status file Main system image File containing compressed Web pages for your model Text file containing Event Log config. info. File containing obfuscated passwords TransPort BIOS and bootloader Data file containing AT command & S register settings X.25 PAD profile parameters
Once you have configured the router, you must save the chosen settings to non-volatile memory to avoid losing them when the power is removed.
n Application command settings are stored in one of two CONFIG files. n AT command and S register settings are stored in one file named SREGS.DAT.
Configuration files
Most configuration information is stored in one of two files called config.da0 and config.da1. This allows two different sets of configuration information to be stored using the Save option in the directory tree at the left of the web interface, or by using the config command from the command line. The Save All button saves the following files:
File name config.da0 pwds.da0 fw.txt sregs.dat x3prof
Configuration held in file Main configuration parameters Encrypted passwords Firewall rules Serial port S registers X.25 PAD profiles
Digi TransPort® Routers User Guide
897
Performing device administration tasks
Manage files
You can select which of the two config files is loaded when the router is powered-up or rebooted by setting the Use Config n parameter on the Configuration > System > General > Miscellaneous page when the router powers up as required, or by using the config n powerup CLI command.
Note The config.da0 and config.da1 files only contain details of settings that have been changed from the default values.
sregs.dat file
A combined set of AT command and S register settings are called a profile. Two such profiles, profile 0 and profile 1, can be stored for each ASY port in a file called sregs.dat. To save the file, use the Save Profile button on the relevant Configuration > Network > Interfaces > Serial > Serial Port n web page, or use the AT&W command. Saving the settings for one ASY port does not save the settings for the other ports. You must save the settings for each port individually. For each ASY port, the profile to be loaded at reboot or power-up is specified in the Power-up Profile setting on the relevant Configuration > Network > Interfaces > Serial > Serial Port 0 web page, or use the AT&Y command). You can load a profile for a particular ASY port to take immediate effect, using the Load Profile button on the ASY port's web page, the ATZ command.
pwds.da0 file
As of firmware version 4981, the encrypted forms of passwords entered into the configuration are stored in a separate file named pwds.da0. This file can only be accessed by users with Super level privileges. The file can be read with the type command, such as, type pwds.da0. The pwds.da0 file is only created when a password is changed from default and the configuration is saved. The router then removes encrypted versions of the default passwords from the config.da0 file and instead creates and uses a new pwds.da0 file. If you delete a pwds.da0 file, all remote access to the router that requires authentication will fail. In such a case, you will need a serial cable connection to re-configure passwords to gain access to the router. If both the pwds.da0 file exists and the config.da0 contains passwords also, the passwords in the config.da0 take precedence and overwrite the passwords in the pwds.da0 when a save command is issued.
Digi TransPort® Routers User Guide
898
Performing device administration tasks
Manage files
Manage files using USB storage devices
Most TransPort routers are equipped with USB ports that you can use to connect Mass Storage Devices (MSDs) such as external hard drives or flash-memory pen drives. All the files on the USB device are listed under the USB Directory Listing heading on the Administration > File Management > FLASH Directory page. The USB storage device must be formatted using the FAT16 or FAT32 file system.
WARNING! For the TransPort WR31, the USB port is for use in a normal location only, not a hazardous location.
When the USB storage device is first inserted into the router, the operating system looks for a file named autoexec.bat, and if found, executes it. To execute other batch files, press the Reset button one or more times. The batch file to execute must be called pb<n>.bat, where <n> is the number of times the Reset button must be pressed to execute the file.
SD memory card support
Some TransPort routers are available with internal SD memory card. The drive letter assigned to this card is s:. To access the SD memory using an FTP client, the subdirectory assigned is sdmmc. You can use the SD card in the same way as USB MSDs. The SD card is internal and cannot be removed.
Batch control commands
Batch files can contain one of the following two control lines: ERROR_EXIT or ERROR_RUN. ERROR_ EXIT causes any commands run after that point in the file to terminate the batch file if that command causes an error; for example, attempting to delete a file that does not exist. ERROR_RUN returns the operation to default, which is to continue executing batch file commands.
Digi TransPort® Routers User Guide
899
Performing device administration tasks
Manage files
Use USB filing system commands
Command line
The USB storage device responds to any of the standard filing system commands. For all filing system commands, the USB storage device is regarded as drive u:.
Note The router does not support subdirectories. Any subdirectories on the USB device display with a size of 0 bytes on the Administration > File Management > FLASH Directory page.
Display contents of the USB storage device Enter the command:
dir u: SERIALS.TXT 1843 EVENTL~1.TXT 1449 USB.TXT 4278 MASSR1~1.TXT 1255 OK
If the USB storage device is empty, the following message is displayed:
No files
If no USB device is present, the following message is displayed:
No USB flash directory
Copy a file To copy a file named image from the main flash memory onto the USB device, enter the command:
copy image u:image
To copy a file named Logcodes.TXT from the USB device to the main flash memory, enter the command:
copy u:Logcodes.TXT Logcodes.TXT
or
copy u:Logcodes.TXT
If no destination file is specified, the destination is set to the FLASH directory and the file name remains the same.
Digi TransPort® Routers User Guide
900
Performing device administration tasks
Manage files
Use a USB device to upgrade firmware
The following functionality is available from firmware version 4891 onwards. The TransPort firmware can be upgraded using the USB storage device. To perform an upgrade:
1. Create a simple batch file named pb2.bat. 2. Place the relevant firmware upgrade files into the root directory of the USB storage device. 3. Insert the USB device into the TransPort router. 4. Press the router's reset button twice. The firmware upgrade will begin. You will see output
similar to the following:
ERROR_EXIT del *.web copy u:sbios1 sbios1 copy u:logcodes.txt logcodes.txt copy u:image image copy u:image4.c3 image4.c3 copy u:Y4890wVS.web Y4890wVS.web move sbios1 sbios scanr flashleds
5. When the LEDs on the TransPort start flashing, the upgrade is complete. 6. Reboot the TransPort router to activate the new firmware.
Digi TransPort® Routers User Guide
901
Performing device administration tasks
Manage files
Use USB devices with .all files
The following functionality is available from firmware version 4910 onwards. A .all file is a special file that contains all of the firmware and configuration files in a single file that has the file extension .all and is an exact copy of the TransPort router in its current state. This .all file can then be applied to another TransPort router, as long as it is the same model.
1. To extract a .all file, use the Digi Flash Writer software. 2. Copy the extracted .all file to a USB storage device and insert the device into the TransPort
router. 3. Issue the command dir u: to confirm that the TransPort can access the USB device. 4. To copy the .all file onto the TransPort router, from the command line enter this copy
command:
copy u:mr4110.all t.all
Replace mr4110.all with the correct .all file name. The t.all destination name can be any destination. The source file (in this example, mr4110.all) must adhere to the 8.3 filename convention, owing to limits of the FAT file system, or the process will fail.
Digi TransPort® Routers User Guide
902
Performing device administration tasks
Manage files
Prevent unauthorized access from a USB storage device
You can prevent unauthorized access to a TransPort router using a USB storage device, such as inserting a USB storage device with an autoexec.bat file designed to copy usernames and passwords, etc. Several commands prevent unauthorized access via the USB port:
Command line
1. Use the usbcon command to define an access key. If the .bat file does not contain the matching key, it will not be allowed to execute.
2. Use the uflash command's put parameter to encode the matching key onto the file.
Note When using the uflash command, do not prefix the filename with u: as the uflash command can only act on files stored on a USB storage device.
For example: n Create a key:
usbcon 0 flashkey
n Encode this key onto a file called autoexec.bat on the USB storage device:
uflash autoexec.bat put
n Remove a key from a file using the uflash command parameter clr:
uflash autoexec.bat clr
Note To use the uflash command, you must be logged onto the router with Super access level.
Digi TransPort® Routers User Guide
903
Performing device administration tasks
Manage files
Execute alternate batch files when a USB drive is inserted
By default, an autoexec.bat file executes when a USB drive is inserted. You can execute other batch files. To control this behavior, enter:
>usbcon 0 batfile <off|on>
Digi TransPort® Routers User Guide
904
Performing device administration tasks
Manage files
Disable or enable the USB ports
If required, you can disable the external USB ports. Disabling the USB ports prevents any unauthorized copying of files to or from the router, or unauthorized use of flash drives or serial devices connected to the USB ports.
Command line
To disable the USB ports, use the usbcon command. The parameters to use on the usbcon command are:
dislist Disables the USB port.
enalist Explicitly enables a list of USB drivers. The driver list can be comma-separated to specify more than one driver if required. The format of the usbcon command to disable the USB port is: usbcon 0 usb-x-p<.p>.<DRIVER> Where:
n x=1 for the bottom USB port and 2 for the top port. n p=<port #> (if connected to a USB hub the port numbers can increase). n DRIVER=MSD for Mass Storage Device, SERIAL for serial devices, or HUB for hub devices. For example: n Disable a Flash stick on the top port only:
usbcon 0 dislist usb-2-2.MSD
n Use wildcards to disable flash devices entirely:
usbcon 0 dislist usb-*.MSD
This will match on ALL MSD devices even if in another HUB. n Disable both external USB ports on a DR64x0, enter the following commands:
usbcon 0 dislist "usb-1-2*,usb-2-2*"
or
usbcon 0 dislist "usb-?-2*"
The final -2 is important in both cases. Otherwise, the command disables the internal USB devices, which could include connections to the wireless module or other components.
Digi TransPort® Routers User Guide
905
Performing device administration tasks
Manage files
n To disable serial devices from using either external USB port on a DR64x0, or on a port connected to a hub on either these ports:
usbcon 0 dislist "usb-1-2*.SERIAL,usb-2-2*.SERIAL"
or
usbcon 0 dislist usb-?-2*.SERIAL
n The enalist takes the same format, but when matches occur, it enables the device. If a device matches the enable list as well as the disable list, the enable list takes preference. When a device matches a list an event is written to the event log of the form:
"USB device usb-1-2.4.MSD disabled"
or, if the device matches the enalist:
USB device usb-1-2.4.MSD enabled"
n You can use these events to debug the correct matching string to match on when trying to configure these parameters.
n If both lists are left blank, all drivers are enabled and no extra events appear in the event log.
Digi TransPort® Routers User Guide
906
Performing device administration tasks
Manage files
Create a universal config.da0 file using tags
The config.da0 contains a list of commands, one per line that are parsed at boot. The commands in this file differ, depending on the model of the router, the firmware in use and the hardware options installed. You can create a single universal configuration file using tags, defining sections that only relate to a specific hardware type or firmware version. The tag values you can use are:
n The base model, for example: DR6410
n The complete model, for example: DR6410-H0A
n The platform build string, for example: 8W
n The type of DSL, for example: DSL2, 2+
n The type of WWAN module detected, for example: E (Edge), C (CDMA)
n The complete WWAN module string, for example: MOTO_G24SIEMENS_GPRS, SIEMENS_MC75, NOVATEL_3G, SIERRA_3G, OPTION_3G, NOVATEL_CDMA, CMOTECH_CDMA, SIERRA_CDMA
n PSTN or ISDN module, for example: PSTN, ISDN
Enclose the tags within angle brackets. Open and close the configuration sections with the relevant tag. For example, to open: <DR6410> To close: </DR6410> Note use of the / in the closing tag. To view a list of defined tags on a router, use the command tags. Here is example output of the tags command:
Router>tags tags defined:.. TransPort DR64 dr6410 8W OPTION_3G ISDN DSL 61690 OK
Example scenario
Suppose a single configuration file is required for a range of DR6410 routers. There is a mix of three types of 3G WWAN modules and some have GPRS modules installed. Different W-WAN modules need different modemcc commands to correctly configure the ASY ports. All these modules can have their own specific commands in one config file.
Digi TransPort® Routers User Guide
907
Performing device administration tasks
Manage files
Use comments in configuration files
You can use comments in configuration files to make them easier to read. The shaded comments are prefixed with a # symbol. In the example below, the info_asy_add parameters are for illustration purposes only and are not the actual ASY port numbers in use.
<DR6410-H0A> #Start of DR6410-H0A config <NOVATEL_3G> #Start of Novatel specific config modemcc 0 asy_add 7 modemcc 0 info_asy_add 8 #End of Novatel specific config </NOVATEL_3G> <OPTION_3G> #Start of Option specific config modemcc 0 asy_add 7 modemcc 0 info_asy_add 9 #End of Option specific config </OPTION_3G> <SIERRA_3G> #Start of Sierra specific config modemcc 0 asy_add 7 modemcc 0 info_asy_add 10 #End of Sierra specific config </SIERRA_3G>
#End of DR6410-H0A config </DR6410-H0A> <DR6410-E0A> #Start of DR6410-E0A config modemcc 0 asy_add 7 modemcc 0 info_asy_add 11 #End of DR6410-E0A config </DR6410-E0A> #Rest of generic config goes below here modemcc 0 apn internet" eth 0 ipaddr 192.168.0.99
Digi TransPort® Routers User Guide
908
Performing device administration tasks
Manage X.509 certificates and host key pairs
Manage X.509 certificates and host key pairs
The X.509 Certificate Management pages are for loading and managing X.509 certificates and public/private host key pairs that are public key infrastructure (PKI) based security.
Digi TransPort® Routers User Guide
909
Performing device administration tasks
Manage X.509 certificates and host key pairs
Manage Certificate Authorities (CAs)
A certificate authority (CA) is a trusted third party that issues digital certificates for use by other parties. digital certificates issued by the CA contain a public key. The certificate also contains information about the individual or organization to which the public key belongs. A CA verifies digital certificate applicant's credentials. The CA certificate allows verification of digital certificates and the information contained therein, issued by that CA.
Web
Go to Administration > X.509 Certificate Management > Certificate Authorities.
Installed Certificate Authority Certificates
This table lists the current CA certificates that have been installed onto the router. Use the View button to view the contents of each certificate.
Upload CA Certificates
Use the Choose File and Upload buttons to upload CA Certificates from a host PC onto the router.
Obtain CA certificates from a SCEP Server
The Simple Certificate Enrollment Protocol (SCEP) allows the user to request and enroll CA certificates from a CA server. The CA certificate files are automatically stored with the name CA<n>.pem, where n increments with each certificate.
SCEP Server IP address The IP address of the SCEP server/CA server.
Port The port on which SCEP server is listening. If the port is 0, the router uses default port of 80.
Path The path on the server to the SCEP application. The path can either be entered manually if known, or select from cgi-bin or Microsoft SCEP from the drop-down list.
Digi TransPort® Routers User Guide
910
Performing device administration tasks
Manage X.509 certificates and host key pairs
Application The SCEP application running on the server.
CA identifier The identifier for the CA server. The CA identifier to use to identify a particular CA when multiple CAs might be running on the server.
Command line
Command scep
scep scep scep scep
Instance 0
0 0 0 0
Parameter host
port path app caident
Values IP Address
0-65535 String String String
Equivalent web parameter SCEP Server IP address
Port
Path
Application
CA Identifier
Digi TransPort® Routers User Guide
911
Performing device administration tasks
Manage X.509 certificates and host key pairs
Manage IPsec/SSH/HTTPS certificates
The IPsec/SSH/HTTPS certificates page contains fields that required when sending a certificate request to a Certificate Authority (CA). This information forms part of the certificate request, and thus part of the signed public key certificate. The router can use certificates to establish IPsec tunnels with other routers and support SSH and HTTPS connections. For more information on using certificates with the router, See Application Note 22, IPSec VPN tunnel between two Digi Routers using Certificates and SCEP.
Web
Go to Administration > X.509 Certificate Management > IPsec/SSH/HTTPS Certificates.
Installed certificates
This table lists the current certificates that have been installed onto the router. It is possible to view the contents of each certificate using the View button.
Upload certificate or private keys
In the Upload Certificate or Private Keys section, you can upload certificates and private key files from a host PC onto the router using the Choose File and Upload buttons.
Create, enroll, and install certificate requests
The Enrollment section of the page has parameters to create a certificate request, enroll the certificate, and install the certificates on the router.
Digi TransPort® Routers User Guide
912
Performing device administration tasks
Manage X.509 certificates and host key pairs
Automatically re-enroll aging certificates Select to make sure any aging certificates are re-enrolled.
SCEP Server IP address The IP address of the SCEP server / CA server.
Port The port on which the SCEP server is listening. If the port is 0, the router uses the default port of 80.
Path The path on the server to the SCEP application. You can either enter your own path or select from cgibin or Microsoft SCEP from the drop-down list.
Application The SCEP application running on the server.
CA identifier The identifier for the CA server. The CA identifier to use to identify a particular CA when multiple CAs might be running on the server.
CA certificate The filename of the CA certificate.
Digi TransPort® Routers User Guide
913
Performing device administration tasks
Manage X.509 certificates and host key pairs
CA encryption certificate Sometimes when you get a CA certificate, a CA encryption certificate is installed on the router at the same time. You can identify a CA encryption certificate by looking at the X.509 Key Usage section in the certificate. It should display something like the following:
X509v3 Key Usage: critical Key Encipherment, Data Encipherment
If a CA encryption certificate has been installed by the CA you wish to use for the certificate request, enter the CA encryption certificate. If no CA encryption certificate has been installed for the CA, leave this file blank.
CA signature certificate Sometimes when you get a CA certificate, a CA signature certificate is installed on the router at the same time. You can identify a CA signature certificate by looking at the X.509 Key Usage section in the certificate. It should say something like the following
X509v3 Key Usage: critical Digital Signature, Non Repudiation
If a CA signature certificate has been installed by the CA you wish to use for the certificate request, enter the CA signature certificate. If no CA signature certificate has been installed for the CA, leave this file blank.
RSA Private key Selects either using an existing private key or generating a private key for each certificate request.
Private key filename The filename of the private key file to use.
Enrollment Password Before you can create a certificate request you must first obtain a challenge password from the Certificate Authority Server. This password is generally obtained from the SCEP CA server by way of a WEB server or a phone call to the CA Server Administrator. For the Microsoft® SCEP server, you browse to a web interface. If the server requires a challenge password, it will be displayed on the page along with the CA certificate fingerprint. This challenge password is usually only valid once and for a short period of time, in this case 60 minutes, meaning a certificate request must be created after retrieving the challenge password.
Common Name (CN) A name for the router. This parameter is important, as the router will use the common name as the router's ID for IKE negotiations.
Country Code (C) The two-character county code of where the router is located. A list of valid country codes can be found at http://www.iso.org/iso/english_country_names_and_code_elements.
State or Province (ST) The state, county, or province of where the router is located.
Digi TransPort® Routers User Guide
914
Performing device administration tasks
Manage X.509 certificates and host key pairs
Locality (L) The town or city of where the router is located.
Organisation (O) The company to whom the router belongs to.
Organisational unit (OU) The company department maintaining the router.
E-mail An appropriate email address of a contact for the router.
Unstructured name This parameter is optional. It can contain some descriptive to help identify the certificate.
Digest Algorithm The digest algorithm (MD5 or SHA1) when signing the certificate request.
Ignore NONCE in SCEP response The parameter instructs the router to ignore the NONCE field in the SCEP response. Use the NONCE field to prevent replay attacks.
Enroll button Sends the enrollment request to the SCEP server.
Command line
Command scep scep scep scep scep scep scep scep creq creq creq creq
Instance 0 0 0 0 0 0 0 0 0 0 0 0
Parameter host port path app caident cafile caencfile casigfile challenge_pwd commonname country state
Values IP Address 0-65535 String String String Filename Filename Filename String String String String
Equivalent web parameter SCEP Server IP address Port Path Application CA Identifier CA certificate CA encryption certificate CA signature certificate Enrolment Password Common Name (CN) Country Code (C) State or Province (ST)
Digi TransPort® Routers User Guide
915
Performing device administration tasks
Manage X.509 certificates and host key pairs
Command creq creq creq creq creq creq
Instance 0 0 0 0 0 0
Parameter locality orgname org_unit email unstructname digest
Values String String String Email Address String MD5 or SHA1
Equivalent web parameter Locality (L) Organisation (O) Organisational Unit (OU) E-Mail Unstructured Name Digest Algorithm
creq command Use the creq command to generate the certificate request using the configured parameters. If the private key does not already exist and you enter the appropriate parameters, the private key is generated at the same time. To generate a certificate request, enter:
creq new -k<priv key file> -o<cert request file>
To generate a private key and a certificate request, enter:
creq new b<priv key length> -k<priv key file> -o<cert req file>
To generate a certificate request file called request.pem from a private key called priv001.pem, enter:
creq new -kpriv001.pem -o request.pem
To generate a 512-bit private key named private.pem, and a certificate request named certreq.pem using that file, enter:
creq new -b512 -kprivate.pem -ocertreq.pem
Digi TransPort® Routers User Guide
916
Performing device administration tasks
Manage X.509 certificates and host key pairs
Manage RSA key files
Web
1. Go to Administration > X.509 Certificate Management > Key files. 2. Use the Choose File button to browse for and select the RSA key file to upload, or enter the
filename in the Filename field. 3. Enter the passphrase for the RSA key file in the Passphrase and Confirm Passphrase fields. 4. Click Upload.
Digi TransPort® Routers User Guide
917
Performing device administration tasks
Manage X.509 certificates and host key pairs
Generate private keys
You must create a private key before a certificate can be requested, as the request uses this private key.
Web
Go to Administration > X.509 Certificate Management > Key Generation. The Key Generation settings generate a private key. Fields in this section are as follows:
Key filename A name for the private key. The filename must be prefixed with priv and have a .pem extension.
Key size The size of the private key, in bits. The larger the key, the more secure the connection. But also, the larger the key, the slower the connection. The key size can be one of the following: 384, 512, 768, 1024, 1536, 2048.
Save in SSHv1 format If enabled, generates the private key in SSH version 1 format. If disabled, generates the private key in SSH version 2 format.
Generate Key button Generates the private key.
Command line
Use the genkey command to generate a private key file.
genkey 0 <keysize> <filename> <-ssh1>
where: n <keysize> is the size of the key in bits. n <filename> is the name of the private key file. n <-ssh1> is optional, and will generate the private key file in SSH version 1 format.
Note IPsec requires SSH version 2 private keys.
For example, to generate a 1024-bit SSH version 2 key called privkey.pem, enter:
genkey 1024 privkey.pem
Command output is:
Digi TransPort® Routers User Guide
918
Performing device administration tasks
Manage X.509 certificates and host key pairs
OK Starting 1024 bit key generation. Please wait. This may take some time... Key generated, saving to FLASH file privkey.pem Closing file Private key file created All tasks completed
Digi TransPort® Routers User Guide
919
Performing device administration tasks
Manage X.509 certificates and host key pairs
Split a private key
For increased security, you can split the private key file between the router flash and an USB memory stick. Once a private key has been split and stored in two parts, the USB memory stick must be present for any successful IKE negotiations that involve the private key. Because the USB memory stick only contains a part of the private key, you cannot use it in another router. For more information on using a USB memory stick, see Manage files using USB storage devices.
Command line
The command to split a private key is:
privsplit <certificate filename>
Digi TransPort® Routers User Guide
920
Performing device administration tasks
Back up and restore configuration settings
Back up and restore configuration settings
There are several mechanisms available to backup device configurations, and later restore them on your TransPort router. It is important to understand the Digi TransPort file system and which files should be backed up.
Configuration files associated with your TransPort router
The TransPort router file system includes several configuration files:
File name Purpose and contents
config.da0
Primary configuration file. This is where all feature configuration settings are written when a configuration is saved. You can also use the file named config.da1 to create and save an alternate configuration.
pwds.da0 Obfuscated passwords file.
fw.txt
Firewall rules.
sregs.dat Serial port configuration settings, if the serial settings were changed from their defaults.
x3prof
X.25 PAD profile. Rarely used.
logcodes.dif Event handler logcodes updates; may or may not be present.
For more information on these and other TransPort configuration and data files, see TransPort file system.
Methods for saving configuration files
You can save these files in several ways:
n From the web interface: Go to Administration > Backup/Restore. All selected files are stored in Zip format for easy storage and restoration to this same or different unit.
n FTP the files to a file using an FTP client. n Save the files from the web interface: Go to Administration > File Management > FLASH
directory. n Copy the files to a USB storage device (U:) n Use a remote management platform such as Digi Remote Manager, which can save
configurations, restore them, and do other system maintenance on scheduled basis.
Web
Backup and restore are available in the web interface only.
Digi TransPort® Routers User Guide
921
Performing device administration tasks
Back up and restore configuration settings
Back up the configuration to a file on your PC or a server
1. Go to Administration > Backup/Restore. 2. Select optional information to include in the backup file: passwords, CA certificates, certificates
and keys, the MySQL database file, routing protocol configuration files, debug.txt file. 3. Click Backup.
Restore the configuration to a file on your PC or a server
1. Go to Administration > Backup/Restore. 2. Select the file from which the settings should be restored. 3. Click Restore.
Digi TransPort® Routers User Guide
922
Performing device administration tasks
Update firmware
Update firmware
The Administration > Update Firmware page updates firmware. During the firmware update process, the router downloads a .zip file onto the router, uncompresses it, validates each file within the zip file, then updates the files in its flash file system. The .zip file containing the latest firmware version is available from the Digi website (http://transport.digi.com/digi/firmware/ftp/).
Web
Firmware update is available in the web interface only.
1. Download the .zip file to your PC before starting the firmware update. The Update Firmware web page has a link for doing so.
2. Go to Administration > Update Firmware.
Model
The model of the router.
Firmware Version
The current firmware version running on the router. 3. Click the Choose File button to browse for and select the .zip file on your PC containing the
firmware version to which you wish to update. 4. Click Update. The firmware update begins.
CAUTION! Do not remove the power from the router while an update is in progress, as it can corrupt the router's flash file system and might leave the router unable to boot up.
Do not navigate away from the Update Firmware page while an update is in progress,
Digi TransPort® Routers User Guide
923
Performing device administration tasks as that action can cause the update to abort prematurely.
5. Once the firmware update is complete, reboot the router.
Update firmware
Digi TransPort® Routers User Guide
924
Performing device administration tasks
Reset the router to factory defaults
Using the web interface
Web
1. Go to Administration > Factory Default Settings.
Reset the router to factory defaults
2. (Optional) Select Keep network settings option to preserve certain network settings after the reset, including: n Ethernet 0 IP address n Ethernet 0 Mask n Ethernet 0 Gateway n Ethernet 0 DHCP Client n Ethernet 0 DNS Server n Default Route 0 Interface n PPP 1 Username n PPP 1 Password n PPP 3 Username n PPP 3 Password n Mobile APN n Mobile SIM PIN
3. Click Restore.
CAUTION! To avoid corrupting flash memory, do not remove power from the router during this operation.
4. Click Reboot to reboot the router.
Digi TransPort® Routers User Guide
925
Performing device administration tasks
Reset the router to factory defaults
Using the reset button on the router
Most TransPort routers have a reset button.
n TransPort WR11: The reset button is on the far right of the front side panel. See TransPort WR11 hardware features.
n TransPort WR21: The reset button is on the front panel, to the right of the Signal LEDs. See TransPort WR21 hardware features.
n TransPort WR31: The reset button is above the USB connector. See TransPort WR31 hardware features.
n TransPort WR41: The reset button is on the underside of the unit. See TransPort WR41 hardware features.
n TransPort WR44: The reset button is on the underside of the unit. See TransPort WR44 / WR44 R hardware features.
n TransPort WR44 RR does not have a physical reset button.
To reset the router to factory defaults:
1. If the router is not already on, turn the router on and wait 15 seconds for the router to complete its initialization process.
2. Press and hold the reset button for 5 seconds. The router's LEDs will flash to indicate a factory reset is in progress. Once the reset is complete, the router automatically reboots.
CAUTION! To avoid corrupting flash memory, do not remove power from the router during this operation.
Digi TransPort® Routers User Guide
926
Performing device administration tasks
Save configuration settings to a file
Save configuration settings to a file
Once you have configured the router, save the settings to non-volatile memory to avoid losing them when the power is removed. You have two choices on saving configuration settings: saving the current configuration or saving the router's entire configuration.
Save the current configuration
The Save button in the web interface and the config command save the current configuration to the specified configuration file, config.da0 or config.da1. The default power-up configuration profile is profile 0. The extension*.da0 indicates that the configuration profile in use is profile 0. An extension of *.da1 indicates that configuration profile 1 is in use. Not every configuration setting is saved, however. See the Save All option.
Save All: Save the entire configuration
The Save All button in the web interface and saveall command save the router's entire configuration. This operation performs the following actions:
n Saves the current configuration parameters to the file config.da0 or config.da1. The default power-up configuration profile is profile 0. The extension*.da0 indicates that the configuration profile in use is profile 0. An extension of *.da1 indicates that configuration profile 1 is in use.
n Saves the ciphered versions of the passwords to the file pwds.da0 or pwds.da1 file**. n Saves the firewall configuration to the file fw.txt. n Saves the serial port configuration to profile0 of the sregs.dat. n Saves the PAD parameters on all the PADs to profile 0 of the file x3prof.
Web
1. Go to Administration - Save configuration.
Digi TransPort® Routers User Guide
927
Performing device administration tasks
Save configuration settings to a file
2. Select the configuration file to which the current configuration will be saved when the Save button is clicked. There are two options: profile 0 and profile 1. The configuration profile in use when the router powers up is indicated in the selection box. The default power-up profile is profile 0.
3. Click Save or Save All.
Command line
Parameter config saveall
Options save n/a
Equivalent web parameter Save current configuration to Config n Save all configuration
Digi TransPort® Routers User Guide
928
Performing device administration tasks
Execute a command from the web interface
Execute a command from the web interface
Web
1. To enter TransPort CLI commands from the web interface, go to Administration > Execute a Command. A majority of the commands mentioned in this User Guide can be entered using this feature.
2. Enter the command name and click Execute. The command output displays, for example:
Digi TransPort® Routers User Guide
929
Performing device administration tasks
Reboot the router
Reboot the router
You can reboot the router immediately or at a scheduled time. The router performs a reboot after any FLASH write operations are completed. There is an allowance of one second each for the following operations to be completed before reboot will occur:
n Create and send IPSec SA delete notifications are created and sent n Close TCP sockets n Disconnect PPP interfaces
Note To schedule reboots on a recurring basis, use Digi Remote Manager's device tasks feature and its schedule options. See the Digi Remote Manager User Guide.
Web
1. Go to Administration > Reboot.
2. Enter the reboot options:
Immediately
Causes the router to reboot after a few seconds. The router cleanly terminates any TCP and VPN connections before rebooting.
In h hrs m mins s secs
Schedules a reboot to occur after the configured period of time. To cancel a scheduled reboot, enter the reboot cancel command from the command line. 3. Click Reboot to reboot the router or set the scheduled reboot to occur.
Command line
Command reboot reboot
reboot
Options n/a 0-86400
cancel
Equivalent web parameter Immediately In h hrs m mins s secs. This CLI value is entered in minutes only.
Cancel reboot
Digi TransPort® Routers User Guide
930
Troubleshooting
Troubleshooting resources
932
Download the debug.txt file
933
Cannot open the web interface
935
Cannot log into the web interface
936
Troubleshoot the LTE-MIMO antenna orientation
937
Network start verbose call end reasons
937
Digi TransPort® Routers User Guide
931
Troubleshooting
Troubleshooting resources
Troubleshooting resources
There are several resources available to you for support of your Digi product or resolving configuration difficulties at Digi Support site. On this site, you can access Digi's support knowledge base and other support documents.
If the knowledge base or support forums do not have the information, make an online support request at Digi's Support site. You will need to create a user account if one is not already set up.
When submitting a support request, include a copy of the debug.txt file from the device's flash. This will greatly improve the quality of the initial response you receive. It will help the Digi Support team to provide accurate answers to your queries.
Digi TransPort® Routers User Guide
932
Troubleshooting
Download the debug.txt file
Download the debug.txt file
To download the debug.txt file from your Digi TransPort device:
1. Browse to the router's IP address to connect to the web interface. 2. Navigate to Administration > File Management > FLASH Directory. 3. Scroll to the debug.txt file. It is usually near the end of the file list. 4. Right-click on debug.txt and choose the available option on your operating system to save the
file, such as Save link as.
Digi TransPort® Routers User Guide
933
Troubleshooting
Download the debug.txt file
5. Once debug.txt is downloaded, send it to Digi Technical Support as file attachment.
Note For Digi TransPort WR44 RR, there are several ways to download the debug.txt file. For information on the other methods, see Quick Note 24 - Extracting the debug.txt file from a TransPort.
Digi TransPort® Routers User Guide
934
Troubleshooting
Cannot open the web interface
Cannot open the web interface
If you cannot open the web interface:
1. Make sure the LAN cable is properly connected to the LAN port and that the LAN status indicator on the front of the device is illuminated.
2. If it is not, there is a problem with either the LAN cable or the device to which the TransPort device is connected. If the status indicator is illuminated, check that the PC can communicate with the device. To do this, open the Command Prompt window on your PC and enter the command ping192.168.1.1. If you do not get a response, you may have a connection problem.
3. Try one or more of the following methods to establish a connection:
n Use the Digi Device Discovery Utility. The IP address of the device may have been changed from its default IP address of 192.168.1.1. The Digi Device Discovery Utility can usually discover the device on a network, unless your system's firewall is enabled.
n Check the PC's IP configuration. Make sure it is set to obtain an IP address automatically. If not, configure it to automatically obtain the IP address.
n Refresh the PC's IP settings by opening a command window and entering the commands ipconfig/release and ipconfig/renew
n Check the PC's LAN connection and any LAN device (such as an Ethernet switch) that connects to the router. Make sure the PC is connected to the network.
n Clear the PC's ARP cache with the command arp d *, then retry the ping command. If you do get a response but are unable to view the web interface, then there is most likely a problem with your web browser configuration.
Digi TransPort® Routers User Guide
935
Troubleshooting
Cannot log into the web interface
Cannot log into the web interface
If you cannot log in to the web interface, you will need to access the device via Telnet or SSH in order to configure it using the Command Line Interface (CLI). See Using the command-line interface for more information.
Digi TransPort® Routers User Guide
936
Troubleshooting
Troubleshoot the LTE-MIMO antenna orientation
Troubleshoot the LTE-MIMO antenna orientation
Separate the two LTE antennas sat the maximum distance possible, taking into consideration the available space of the installation. There should be a minimum distance of 1.5 inches between two antennas.
Network start verbose call end reasons
The event log for your TransPort WR router may include cellular network start logging messages that provide information about why a call was ended. These messages will look similar to the following:
12:16:57, 07 Feb 2019,GPRS: Network start verbose call end reason 209 12:16:57, 07 Feb 2019,GPRS: Network start verbose call end reason type 2
The following tables provides details about the call end reason type and the specific reason.
Call end reason type 1 2 3 6
7
Component Mobile Internal Call manager 3rd Generation Partnership Project (3GPP) specification Point-to-Point Protocol (PPP)
Description of specific reason See Call end reason type 1. See Call end reason type 2. See Call end reason type 3. See Call end reason type 6.
See Call end reason type 7.
Reason number Reason
Call end reason type 1
64
The foreign agent rejected Mobile IP (MIP) registration for an unspecified reason.
65
The foreign agent administratively prohibited Mobile IP (MIP) registration.
66
The foreign agent rejected Mobile IP (MIP) registration because of inefficient resources.
67
The foreign agent rejected Mobile IP (MIP) registration because the mobile node
authentication (MM-AAA) authenticator was wrong.
68
The foreign agent rejected Mobile IP (MIP) registration because of home agent
authentication failure.
69
The foreign agent rejected Mobile IP (MIP) registration because the requested lifetime
was too long.
70
The foreign agent rejected Mobile IP (MIP) registration because of a malformed request.
71
The foreign agent rejected Mobile IP (MIP) registration because of a malformed reply.
Digi TransPort® Routers User Guide
937
Troubleshooting
Network start verbose call end reasons
Reason number Reason
72
The foreign agent rejected Mobile IP (MIP) registration because the requested
encapsulation was unavailable.
73
The foreign agent rejected Mobile IP (MIP) registration because VJ Header Compression
was unavailable.
74
The foreign agent rejected Mobile IP (MIP) registration because reverse tunnel was
unavailable.
75
The foreign agent rejected Mobile IP (MIP) registration because reverse tunnel is
mandatory, but the T bit is not set.
79
The foreign agent rejected Mobile IP (MIP) registration because the delivery style is not
supported.
97
The foreign agent rejected Mobile IP (MIP) registration because the Network Access
Identifier (NAI) was missing.
98
The foreign agent rejected Mobile IP (MIP) registration because the home agent was
missing.
99
The foreign agent rejected Mobile IP (MIP) registration because the home address is
missing.
104
The foreign agent rejected Mobile IP (MIP) registration because of an unknown challenge.
105
The foreign agent rejected Mobile IP (MIP) registration because of a missing challenge.
106
The foreign agent rejected Mobile IP (MIP) registration because of a stale challenge.
128
The home agent rejected Mobile IP (MIP) registration for an unspecified reason.
129
The home agent administratively prohibited Mobile IP (MIP) registration.
130
The home agent rejected Mobile IP (MIP) registration because of insufficient resources.
131
The home agent rejected Mobile IP (MIP) registration because of a mobile node (MM-HA)
authentication failure.
132
The home agent rejected Mobile IP (MIP) registration because of a foreign agent
authentication failure.
133
The home agent rejected Mobile IP (MIP) registration because of a registration
ID mismatch.
134
The home agent rejected Mobile IP (MIP) registration because of a malformed request.
136
The home agent rejected Mobile IP (MIP) registration because of an unknown home
agent address.
137
The home agent rejected Mobile IP (MIP) registration because reverse tunnel was
unavailable.
138
The home agent rejected Mobile IP (MIP) registration because reverse tunnel was
mandatory, but the T bit was not set.
Digi TransPort® Routers User Guide
938
Troubleshooting
Network start verbose call end reasons
Reason number Reason
139
The home agent rejected Mobile IP (MIP) registration because the requested
encapsulation was unavailable.
-1
Unknown reason.
Call end reason type 2
201
Internal error.
202
The call ended.
203
Unknown internal cause code.
204
Unknown cause code.
205
A close operation was in progress.
206
Network-initiated termination.
207
Another application in modem preempted the data call.
208
IPv4 Packet Data Network (PDN) call was not allowed due to the network providing only
IPv6 addresses when the Vendor-Specific Network Control Protocol (VSNCP) was last
brought up.
209
IPv4 PDN call was throttled due to previous failure(s) when the VSNCP was last brought
up.
210
IPv6 PDN call was not allowed due to the network providing only IPv4 addresses when
the VSNCP was last brought up.
211
IPv6 PDN call was throttled due to previous failure(s) when the VSNCP was last brought
up.
212
Modem was restarted.
213
Packet Data Protocol (PDP) Point-to-Point Protocal (PPP) calls are not supported.
214
Radio Access Technology (RAT) on which the call was attempted or connected is no longer
the preferred RAT.
215
The physical link was in the process of closing.
216
The APN being used has not yet been handed over to the target RAT.
217
The APN bearer type in the profile does not match the preferred network mode.
218
The SIM card was refreshed or removed.
219
The device was going into lower power mode or powering down.
220
The APN has been disabled.
221
The maximum PPP inactivity timer expired.
222
IPv6 address transfer failed.
Digi TransPort® Routers User Guide
939
Troubleshooting
Network start verbose call end reasons
Reason number Reason
223
Target Radio Access Technology (RAT) swap failed.
Call end reason type 3
500
The device is in a Code-Division Multiple Access (CDMA) locked state.
501
An intercept order was received from the base station.
502
A reorder was received from the base station.
503
Received a release from the base station with a Service Option (SO) Reject reason.
504
Received an incoming call from the base station.
505
Received an alert stop from the base station.
506
There was an activation error.
507
The maximum number of access probes were transmitted.
508
Concurrent service is not supported by the base station.
509
No response was received from the base station.
510
The base station rejected the call.
511
The concurrent services requested were not compatible.
512
Already in the traffic channel.
515
Device does not have CDMA service.
516
MC was aborted.
517
Unknown error.
518
User Identity Module (UIM) is not present.
519
Received a retry order from the base station.
520
Access was blocked by the base station.
521
Access is blocked by the base station for all mobile devices.
522
The maximum number of access probes reached for the IS-707B call.
523
Put the device in a thermal emergency.
1000 Configuration failed.
1002 No gateway service.
1003 No General Packet Radio Services (GPRS) context.
1004
Network refused service to the mobile station, because either an identity of the mobile station is not acceptable to the network or the mobile station does not pass the authentication check.
Digi TransPort® Routers User Guide
940
Troubleshooting
Network start verbose call end reasons
Reason number Reason
1005
The mobile equipment could not be authenticated and the mobile equipment used is not acceptable to the network.
1006 Operation of either GPRS or non-GPRS services is not allowed.
1007 Operation of GPRS services is not allowed.
1008 No matching identity or context was found in the network.
1009
Mobile reachable timer has expired, or the GPRS Mobility Management (GMM) context data related to the subscription does not exist in the Serving GPRS Support Node (SGSN).
1010
The user equipment requested GPRS service, or the network initiated a detach request, in a Public Land Mobile Network (PLMN) which does not offer roaming for GPRS services to that mobile station.
1011
The mobile station requested service, or the network initiated a detach request, in a location area where the Home Public Land Mobile Network (PLMN) determines that the mobile station, by subscription, is not allowed to operate.
1012
The user equipment requested GPRS service, or the network initiated a detach request, in a PLMN that does not offer roaming for GPRS services.
1013 PDP context already exists.
1014 There was a Radio Access Technology (RAT) change on the user equipment.
1015 The network could not serve a request from the mobile station due to congestion.
1016
The mobile station requested an establishment of the radio access bearers for all active PDP contexts by sending a service request message indicating data to the network, but the SGSN does not have any active PDP context.
1017 Access class blocked restrictions for the current camped cell.
1500 CD is generating or busy.
5001 CD bill or authorization.
5002 Changed HDR.
5003 Exited HDR.
5004 No HDR session.
5005 HDR originated during a GPS fix.
5006 HDR CS timeout.
5007 HDR released by the call manager.
5010 No hybrid HDR service.
2000 Client ended the data call.
2001 Device had no service.
Digi TransPort® Routers User Guide
941
Troubleshooting
Network start verbose call end reasons
Reason number Reason
2002 Device lost the system due to fade.
2003 Received a release from the base station with no reason.
2004 Access attempt is already in progress.
2005 Access attempt failed.
2006 The device is in the process of redirecting or handing off to a different target system.
2500 The device is offline.
2501 The device is operating in emergency mode.
2502 2503
The device is in use (for example, a voice call).
The device's operational mode is different from the mode requested in the traffic channel bring up.
2504 The SIM was marked by the network as invalid.
2505 There is no co-located HDR.
2506 Call control was rejected. Call end reason type 6
8
The call was not allowed because of Operator Determined Barring (ODB).
25
Logical Link Control (LLC) Sub Network Dependent Convergence Protocol (SNDCP) failure.
26
Insufficient resources.
27
Unknown APN.
28
Unknown PDP
29
Authentication failure.
30
Activation was rejected by Gateway GPRS Support Node (GGSN), Serving Gateway, or PDN
Gateway.
31
Activation was rejected for an unspecified reason.
32
Requested service option is not supported.
33
Requested service option is unsubscribed.
34
Service option temporarily out of order.
35
Network Service Access Point Identifier (NSAPI) is already in used.
36
Regular deactivation.
37
Quality of service (QoS) was not accepted.
38
Network failure.
Digi TransPort® Routers User Guide
942
Troubleshooting
Network start verbose call end reasons
Reason number Reason
39
Universal Mobile Telecommunications System (UMTS) reactivation request.
40
Feature not supported.
41
There was a semantic error in the Traffic flow templates (TFT) operation.
42
There was a syntax error in the Traffic flow templates (TFT) operation.
43
Unknown PDP content.
44
There were semantic errors in the packet filter.
45
There were syntax errors in the packet filter.
46
Packet Data Protocol (PDP) was used without an active Traffic Flow Template (TFT).
81
There was an invalid transaction ID.
95
A message was semantically incorrect.
96
There was invalid mandatory information.
97
There was an unsupported message type.
98
There was an incompatible message type.
99
There was an unknown information element.
100
There was a conditional information element error.
101
The message and protocol state was incompatible.
111
There was a protocol error.
112
There was an APN type conflict.
50
Only a PDP of IPv4 is allowed.
51
Only a PDP of IPv6 is allowed
52
Only single address bearers are allowed.
53
Evolved Packet System (EPS) Session Management (ESM) information was not received.
54
The PDN connection does not exist.
55
Multiple connections to the same PDN are not allowed.
Call end reason type 7
1
A timeout occurred.
2
Authentication failed.
3
An option mismatch occurred.
31
A Push Access Protocol (PAP) failure occurred.
32
A Challenge Handshake Authentication Protocol (CHAP) failure occurred.
-1
Unknown cause.
Digi TransPort® Routers User Guide
943
madbuild