Advantech ICR-1601 Instruction sheet

LTE Industrial Router
ICR-1601
CONFIGURATION MANUAL

ICR-1601
2
Used Symbols
Danger –Information regarding user safety or potential damage to the router.
Attention –Problems that can arise in specific situations.
Information, notice –Useful tips or information of special interest.
Example –Example of function, command or script.
Advantech B+B SmartWorx s.r.o., Sokolska 71, 562 04 Usti nad Orlici, Czech Republic
Document No. MAN-0040-EN, revision from February 12, 2019. Released in the Czech Republic.

ICR-1601
3
Contents
1. Introduction................................................................................................................................... 6
1.1 Basic HW Information..............................................................................................................6
1.2 Installation & Maintenance Notice..........................................................................................7
1.2.1 System Requirements......................................................................................................7
1.2.2 Warnings..........................................................................................................................7
1.2.3 Hot Surface Caution.........................................................................................................7
1.3 Access to the Web Configuration ............................................................................................8
2. Basic Network................................................................................................................................ 9
2.1 WAN & Uplink..........................................................................................................................9
2.1.1 Physical Interface.............................................................................................................9
2.1.2 Connection Setup ..........................................................................................................13
2.2 LAN & VLAN ...........................................................................................................................36
2.2.1 Ethernet LAN..................................................................................................................36
2.2.2 VLAN ..............................................................................................................................38
2.2.3 DHCP Server...................................................................................................................51
2.3 WiFi .......................................................................................................................................58
2.3.1 WiFi Configuration.........................................................................................................59
2.3.2 Wireless Client List.........................................................................................................71
2.3.3 Advanced Configuration ................................................................................................72
2.3.4 Uplink Profile .................................................................................................................74
2.4 IPv6 ........................................................................................................................................79
2.4.1 IPv6 Configuration .........................................................................................................79
2.5 Port Forwarding .....................................................................................................................84
2.5.1 Configuration .................................................................................................................85
2.5.2 Virtual Server & Virtual Computer ................................................................................86
2.5.3 Special AP & ALG............................................................................................................91
2.5.4 DMZ & Pass Through .....................................................................................................95
2.6 Routing...................................................................................................................................97
2.6.1 Static Routing.................................................................................................................98
2.6.2 Dynamic Routing..........................................................................................................101
2.6.3 Routing Information ....................................................................................................106
2.7 DNS & DDNS.........................................................................................................................107
2.7.1 DNS & DDNS Configuration .........................................................................................107
3. Object Definition ........................................................................................................................111
3.1 Scheduling............................................................................................................................111
3.1.1 Scheduling Configuration.............................................................................................111
3.2 External Server.....................................................................................................................113
3.3 Certificate ............................................................................................................................115

ICR-1601
4
3.3.1 My Certificate ..............................................................................................................115
3.3.2 Trusted Certificate .......................................................................................................121
4. Security ......................................................................................................................................127
4.1 VPN ......................................................................................................................................127
4.1.1 IPSec.............................................................................................................................128
4.1.2 OpenVPN......................................................................................................................139
4.1.3 L2TP..............................................................................................................................147
4.1.4 PPTP .............................................................................................................................152
4.1.5 GRE...............................................................................................................................156
4.2 Firewall.................................................................................................................................161
4.2.1 Packet Filter .................................................................................................................161
4.2.2 URL Blocking ................................................................................................................165
4.2.3 MAC Control ................................................................................................................169
4.2.4 IPS ................................................................................................................................172
4.2.5 Options.........................................................................................................................175
5. Administration............................................................................................................................179
5.1 Configure & Manage............................................................................................................179
5.1.1 Command Script ..........................................................................................................180
5.1.2 TR-069..........................................................................................................................184
5.1.3 SNMP ...........................................................................................................................189
5.1.4 Telnet & SSH ................................................................................................................200
5.2 System Operation ................................................................................................................203
5.2.1 Password & MMI .........................................................................................................203
5.2.2 System Information .....................................................................................................206
5.2.3 System Time.................................................................................................................207
5.2.4 System Log ...................................................................................................................208
5.2.5 Backup & Restore ........................................................................................................212
5.2.6 Reboot & Reset............................................................................................................215
5.3 Diagnostic ............................................................................................................................216
5.3.1 Diagnostic Tools...........................................................................................................216
5.3.2 Packet Analyzer............................................................................................................217
6. Service........................................................................................................................................220
6.1 Cellular Toolkit.....................................................................................................................220
6.1.1 Data Usage...................................................................................................................221
6.1.2 SMS ..............................................................................................................................223
6.1.3 SIM PIN ........................................................................................................................226
6.1.4 Network Scan...............................................................................................................230
6.2 Event Handling.....................................................................................................................232
6.2.1 Configuration ...............................................................................................................233
6.2.2 Managing Events..........................................................................................................237

ICR-1601
5
6.2.3 Notifying Events...........................................................................................................240
7. Status .........................................................................................................................................243
7.1 Basic Network ......................................................................................................................243
7.1.1 WAN & Uplink Status...................................................................................................243
7.1.2 LAN & VLAN Status ......................................................................................................247
7.1.3 WiFi Status ...................................................................................................................248
7.1.4 DDNS Status .................................................................................................................250
7.2 Security ................................................................................................................................251
7.2.1 VPN Status ...................................................................................................................251
7.2.2 Firewall Status..............................................................................................................254
7.3 Administration .....................................................................................................................257
7.3.1 Configure & Manage Status.........................................................................................257
7.4 Statistics & Report ...............................................................................................................259
7.4.1 Connection Session......................................................................................................259
7.4.2 Device Administration .................................................................................................260
7.4.3 Cellular Usage ..............................................................................................................261
8. GPL Written Offer .......................................................................................................................262
9. Recommended literature ............................................................................................................267
10. Customers Support .....................................................................................................................268
10.1 Customer Support for NAM.................................................................................................268
10.2 Customer Support for Europe .............................................................................................268
10.3 Customer Support for Asia ..................................................................................................268

ICR-1601
6
1. Introduction
Cellular router ICR-1601 is designed for wireless communication in the mobile networks that make use
of traditional cellular technologies. The primary purpose of this router is its use in the newest Category
4 (Cat.4) services on the cellular LTE network.
LTE Category 4 (Cat.4) is the next step in 4G LTE device capability. Cat.4 rated ICR-1601 routers are
capable of achieving better typical speeds in 4G coverage areas where the network is enabled with 20 MHz
of contiguous spectrum. The peak downlink data rate for a Category 4 is approximately 150 Mbps. Also in
the uplink, LTE Category 4 provides a peak data rate of 50 Mbps.
Below is the list of the main router’s features:
Compact design: Built-in LTE and configurable Ethernet WAN/LAN can provide Ethernet machine easy
connection to internet/intranet by LTE or high reliable fail-over wired/LTE connection.
Dual SIM: Embedded 3G/4G with configurable dual-SIM achieve location free multi-ISP fail-over
requirement.
Versatile Cellular: Preferred service selection can simplify uplink setting; toolkit function of data usage
can control budget; configurable SMS command is useful and efficient for remote administration.
Complete Network: Built-in NAT/Port Forward/Routing/IPv6 are compatible to existing IP network.
Highly Security: Various VPN protocol & scenario can setup secure intranet; built-in Firewall prevents
malicious attacks; ACL & Authentication by MAC /User enhances secure access.
Flexible Administration: Web UI is used for basic setting; programmable CLI and Command Script are
used for advanced configuration; system can be managed by NMS based on TR-069.
Smart Event Handing: Mechanism to manage action for pre-defined events by administrator. Events
can be triggered or notified based on System/Interface status change, SMS, SNMP trap, or e-mail.
1.1 Basic HW Information
As a standard, the ICR-1601 router is equipped with two Fast Ethernet 10/100 Mbps interfaces, two
readers for SIM cards and reader for MicroSD card (log storage). The router can be equipped with WiFi
module or with GPS module. This router is supplied in a metal bracket casing. For more detail see User
Manual for ICR-1601 [2].
Before you install and use this product, please read this manual in detail for fully exploiting the
functions of this product.

ICR-1601
7
1.2 Installation & Maintenance Notice
1.2.1 System Requirements
Network Requirements
A fast Ethernet RJ45 cable
3G/4G cellular service subscription
IEEE 802.11b/g/n wireless client
10/100 Ethernet adapter on PC
Web-based Configuration Utility
Requirements
Computer with the following:
Windows®, Macintosh, or Linux-based operating system
An installed Ethernet adapter
Browser requirements:
Internet Explorer 6.0 or higher
Chrome 2.0 or higher
Firefox 3.0 or higher
Safari 3.0 or higher
1.2.2 Warnings
Only use the power adapter that comes with the package. Using a different voltage rating power
adaptor is dangerous and may damage the product.
Do not open or repair the case yourself. If the product is too hot, turn off the power immediately
and have it repaired at a qualified service center.
Place the product on a stable surface and avoid using this product and all accessories outdoors.
1.2.3 Hot Surface Caution
The surface temperature for the metallic enclosure can be very high!
Especially after operating for a long time, installed at a closed cabinet without air conditioning
support, or in a high ambient temperature space.
DO NOT touch the hot surface with your fingers while servicing!

ICR-1601
8
1.3 Access to the Web Configuration
Attention! Wireless transmissions work only when you activate the SIM card for data traffic and
insert it into the router. Remove the power source before inserting the SIM card.
You may use the web interface to monitor, configure and manage the router. To do so, enter the
router’s IP address in your browser. The default address is http://192.168.1.1
1
. Please note that the DHCP
server is enabled by default.
When you see the login page, enter the user name and password and then click Login button. The
default username is "admin". The default password is "admin". Change the default password as soon as
possible!
For increased security of the network connected to the router, change the default router
password.
1
The default LAN IP address of this gateway is 192.168.1.1. If you change it, you need to login by using the
new IP address.

ICR-1601
9
2. Basic Network
2.1 WAN & Uplink
The router provides multiple WAN interfaces to let all client hosts in Intranet of the router access the
Internet via ISP. But ISPs in the world apply various connection protocols to let routers or user's devices
dial in ISPs and then link to the Internet via different kinds of transmit media.
2.1.1 Physical Interface
ICR-1601 routers are usually equipped with various WAN interfacess to support different WAN
connection scenario for requirement. You can configure the WAN interface one by one to get proper
internet connection setup. Refer to the product specification for the available WAN interfaces in the
product you purchased.

ICR-1601
10
The first step to configure one WAN interface is to specify which kind of connection media to be used
for the WAN connection, as shown in "Physical Interface" page.
In "Physical Interface" page, there are two configuration windows, "Physical Interface List" and
"Interface Configuration". "Physical Interface List" window shows all the available physical interfaces. After
clicking on the "Edit" button for the interface in "Physical Interface List" window the "Interface
Configuration" window will appear to let you configure a WAN interface.
Physical Interface:
Ethernet WAN: The router has one RJ45 WAN port that can be configured to be WAN connections.
You can directly connect to external DSL modem or setup behind a firewall device.
3G/4G WAN: The router has one built-in 3G/4G cellular as WAN connection. For each cellular WAN,
there are 1 or 2 SIM cards to be inserted for special failover function.
Please POWER OFF the router before you insert or remove SIM card!
The SIM card can be damaged if you insert or remove SIM card while the router is in operation.
WiFi Uplink WAN: For the product with WiFi Uplink function, one WiFi module can be configured to
be WAN connections. For the WiFi module with Uplink function activated, you can further create some
uplink profiles for ease of connecting to an uplink network.
Operation Mode:
There are three option items “Always on”, “Failover”, and “Disable” for the operation mode setting.
Always on: Set this WAN interface to be active all the time. When two or more WAN are established at
"Always on" mode, outgoing data will through these WAN connections.
Failover:
A failover interface is a backup connection to the primary.
That means only when its primary WAN connection is
broken, the backup connection will be started up to
substitute the primary connection.
As shown in the diagram, WAN-2 is backup WAN for
WAN-1. WAN-1 serves as the primary connection with
operation mode "Always on". WAN-2 won’t be activated
until WAN-1 disconnected. When WAN-1 connection is
recovered back with a connection, it will take over data
traffic again. At that time, WAN-2 connection will be
terminated.

ICR-1601
11
Seamless Failover:
In addition, there is a "Seamless" option for
Failover operation mode. When seamless option
is activated by checking on the "Seamless" box in
configuration window, both the primary
connection and the failover connection are
started up after system rebooting. But only the
primary connection executes the data transfer,
while the failover one just keeps alive of
connection line. As soon as the primary
connection is broken, the system will switch,
meaning failover, the routing path to the failover
connection to save the dial up time of failover
connection since it has been alive.
When the “Seamless” enable checkbox is activated, it can allow the Failover interface to be connected
continuously from system booting up. Failover WAN interface just keeps connecting without data traffic.
The purpose is to shorten the switch time during failover process. So, when primary connection is
disconnected, failover interface will take over the data transfer mission instantly by only changing routing
path to the failover interface. The dialing-up time of failover connection is saved since it has been
connected beforehand.
VLAN Tagging
Sometimes, your ISP required a VLAN tag to be inserted into the WAN packets from Router for specific
services. Please enable VLAN tagging and specify tag in the WAN physical interface. Please be noted that
only Ethernet and ADSL physical interfaces support the feature. For the device with 3G/4G WAN only, it is
disabled.

ICR-1601
12
Physical Interface Setting
Go to Basic Network > WAN & Uplink > Physical Interface tab.
The Physical Interface allows user to setup the physical WAN interface and to adjust WAN’s behavior.
When Edit button is applied, an Interface Configuration screen will appear. WAN-1 interface is used
in this example.
Interface Configuration:
Interface Configuration
Item
Value setting
Description
Physical Interface
1. A Must fill setting
2. WAN-1 is the
primary interface and
is factory set to Always
on.
Select one expected interface from the available interface dropdown list. It
can be 3G/4G, Ethernet or WiFi Module.
Depending on the router model, Disable and Failover options will be
available only to multiple WAN routers. WAN-2 ~ WAN-4 interfaces are only
available to multiple WAN router.
Operation Mode
A Must fill setting
Define the operation mode of the interface.
Select Always on to make this WAN always active.
Select Disable to disable this WAN interface.
Select Failover to make this WAN a Failover WAN when the primary or the
secondary WAN link failed. Then select the primary or the existed
secondary WAN interface to switch Failover from.
(Note: for WAN-1, only Always on option is available.)
VLAN Tagging
Optional setting
Check Enable box to enter tag value provided by your ISP. Otherwise
uncheck the box.
Value Range:1 ~ 4095.
Note: This feature is NOT available for 3G/4G WAN connection.

ICR-1601
13
2.1.2 Connection Setup
After specifying the physical interface for each WAN connection, administrator must configure their
connection profile to meet the dial in process of ISP, so that all client hosts in the Intranet of the router can
access the Internet.
In "Connection Setup" page, there are some configuration windows: "Internet Connection List",
"Internet Connection Configuration", "WAN Type Configuration" and related configuration windows for
each WAN type. For the Internet setup of each WAN interface, you must specify its WAN type of physical
interface first and then its related parameter configuration for that WAN type.
After clicking on the "Edit" button of a physical interface in "Internet Setup List" window, the "Internet
Connection Configuration" window will appear to let you specify which kind of WAN type that you will use
for that physical interface to make an Internet connection. Based on your chosen WAN type, you can
configure necessary parameters in each corresponding configuration window.

ICR-1601
14
Internet Connection List - Ethernet WAN
WAN Type for Ethernet Interface:
Ethernet is the most common WAN and uplink interface for ICR-1601 routers. Usually it is connected
with xDSL or cable modem for you to setup the WAN connection. There are various WAN types to connect
with ISP:
Static IP: Select this option if ISP provides a fixed IP to you when you subscribe the service. Usually is
more expensive but very important for cooperate requirement.
Dynamic IP: The assigned IP address for the WAN by a DHCP server is different every time. It is
cheaper and usually for consumer use.
PPP over Ethernet: As known as PPPoE. This WAN type is widely used for ADSL connection. IP is
usually different for every dial up.
PPTP: This WAN type is popular in some countries, like Russia.
L2TP : This WAN type is popular in some countries, like Israel.

ICR-1601
15
Configure Ethernet WAN Setting
When Edit button is applied, Internet Connection Configuration screen will appear. WAN-1 interface
is used in this example.
WAN Type = Dynamic IP
When you select it, "Dynamic IP WAN Type Configuration" will appear. Items and setting is explained below.
Dynamic IP WAN Type Configuration
Item
Value setting
Description
Host Name
An optional setting
Enter the host name provided by your Service Provider.
ISP Registered MAC
Address
An optional setting
Enter the MAC address that you have registered with your service
provider. Or Click the Clone button to clone your PC’s MAC to this field.
Usually this is the PC’s MAC address assigned to allow you to connect to
Internet.
WAN Type = Static IP
When you select it, "Static IP WAN Type Configuration" will appear. Items and setting is explained below.

ICR-1601
16
Static IP WAN Type Configuration
Item
Value setting
Description
WAN IP Address
A Must filled setting
Enter the WAN IP address given by your Service Provider
WAN Subnet Mask
A Must filled setting
Enter the WAN subnet mask given by your Service Provider
WAN Gateway
A Must filled setting
Enter the WAN gateway IP address given by your Service Provider
Primary DNS
A Must filled setting
Enter the primary WAN DNS IP address given by your Service Provider
Secondary DNS
An optional setting
Enter the secondary WAN DNS IP address given by your Service Provider
WAN Type = PPPoE
When you select it, "PPPoE WAN Type Configuration" will appear. Items and setting is explained below.

ICR-1601
17
PPPoE WAN Type Configuration
Item
Value setting
Description
PPPoE Account
A Must filled setting
Enter the PPPoE User Name provided by your Service Provider.
PPPoE Password
A Must filled setting
Enter the PPPoE password provided by your Service Provider.
Primary DNS
An optional setting
Enter the IP address of Primary DNS server.
Secondary DNS
An optional setting
Enter the IP address of Secondary DNS server.
Service Name
An optional setting
Enter the service name if your ISP requires it
Assigned IP Address
An optional setting
Enter the IP address assigned by your Service Provider.
WAN Type = PPTP
When you select it, "PPTP WAN Type Configuration" will appear. Items and setting is explained below.
PPTP WAN Type Configuration
Item
Value setting
Description
IP Mode
A Must filled setting
Select either Static or Dynamic IP address for PPTP Internet connection.
When Static IP Address is selected, you will need to enter the WAN
IP Address, WAN Subnet Mask, and WAN Gateway.
WAN IP Address (A Must filled setting): Enter the WAN IP
address given by your Service Provider.
WAN Subnet Mask (A Must filled setting): Enter the WAN
subnet mask given by your Service Provider.
WAN Gateway (A Must filled setting): Enter the WAN
gateway IP address given by your Service Provider.
When Dynamic IP is selected, there are no above settings required.
Server IP
Address/Name
A Must filled setting
Enter the PPTP server name or IP Address.
PPTP Account
A Must filled setting
Enter the PPTP username provided by your Service Provider.
PPTP Password
A Must filled setting
Enter the PPTP connection password provided by your Service Provider.

ICR-1601
18
Connection ID
An optional setting
Enter a name to identify the PPTP connection.
MPPE
An optional setting
Select Enable to enable MPPE (Microsoft Point-to-Point Encryption)
security for PPTP connection.
WAN Type = L2TP
When you select it, "L2TP WAN Type Configuration" will appear. Items and setting is explained below.
L2TP WAN Type Configuration
Item
Value setting
Description
IP Mode
A Must filled setting
Select either Static or Dynamic IP address for L2TP Internet connection.
When Static IP Address is selected, you will need to enter the WAN
IP Address, WAN Subnet Mask, and WAN Gateway.
WAN IP Address (A Must filled setting): Enter the WAN IP
address given by your Service Provider.
WAN Subnet Mask (A Must filled setting): Enter the WAN
subnet mask given by your Service Provider.
WAN Gateway (A Must filled setting): Enter the WAN
gateway IP address given by your Service Provider.
When Dynamic IP is selected, there are no above settings required.
Server IP
Address/Name
A Must filled setting
Enter the L2TP server name or IP Address.
L2TP Account
A Must filled setting
Enter the L2TP username provided by your Service Provider.
L2TP Password
A Must filled setting
Enter the L2TP connection password provided by your Service Provider.

ICR-1601
19
Service Port
A Must filled setting
Enter the service port that the Internet service.
There are three options can be selected :
Auto: Port will be automatically assigned.
1701 (For Cisco): Set service port to port 1701 to connect to
CISCO server.
User-defined: enter a service port provided by your Service
Provider.
MPPE
An optional setting
Select Enable to enable MPPE (Microsoft Point-to-Point Encryption)
security for PPTP connection.
Ethernet Connection Common Configuration
There are some important parameters to be set up no matter which Ethernet
WAN type is selected. You should follow up the rule to configure.
Connection Control
Auto-reconnect: This gateway will establish
Internet connection automatically once it has
been booted up, and try to reconnect once
the connection is down. It’s recommended to
choose this scheme if for mission critical
applications to ensure full-time Internet
connection.

ICR-1601
20
Connect-on-demand: This gateway won’t
start to establish Internet connection until
local data is going to be sent to WAN side.
After normal data transferring between LAN
and WAN sides, this gateway will disconnect
WAN connection if idle time reaches value of
Maximum Idle Time.
Manually: This gateway won’t start to
establish WAN connection until you press
“Connect” button on web UI. After normal
data transferring between LAN and WAN
sides, this gateway will disconnect WAN
connection if idle time reaches value of
Maximum Idle Time.
Please be noted, if the WAN interface serves as the primary one for another WAN interface in Failover
role, the Connection Control parameter will not be available to you to configure as the system must set it
to “Auto-reconnect (Always on)”.