Digi Connect EZ 4 User manual

Connect EZ 4/4i
User Guide
Firmware version 22.2

Revision history—90002459
Revision Date Description
C March 2022 Release of Digi Connect EZ firmware version 22.2:
nVPNenhancements:
lRenamed VPN >IPsec >Tunnels >Policies >Local network
setting to Local traffic selector and added Remote traffic
selector.
lAdded a Dynamic option to the Local traffic selector to
configuration of a local network by protocol and/or port
instead of a network address range.
lAdded Protocol and Port match criteria for Local traffic
selector and Remote traffic selector.
lAdded VPN >IPsec >Advanced >Debug level to specify the
logging verbosity of IPsec messages in the device system logs.
nEnhancements to communications with Digi Remote Manager:
lEnhanced security for communications with Digi Remote
Manager by using client-side certificates.
lThe default URL for the device's Remote Manager connection
is now edp12.devicecloud.com. This URL is required to utilize
the client-side certificate support.
nNew Switch SIM SureLink action for WWAN interfaces, which
allows SureLink to be configured to switch to the alternate SIM if
the modem is connected but SureLink test are failing.
lNew Switch SIM fail count option to determine how many
SureLink failures are required prior to switching to the
alternate SIM.
nNew Socket ID string option to send the configured text to the
remote server(s) when a TCP socket connection is opened to the
serial port.
nNew cat Admin CLI command for displaying file contents.
Additional change
nUpdate serial port mode documentation.
B December
2021
Release of DigiConnect EZ firmware version 21.11:
nConfiguration option to allow for automatic update of new
firmware (disabled by default).
nUser authentication enhancements:
lAdded TACACS+ command authorization and accounting for
Admin CLI commands.
Digi Connect EZ 4/4i User Guide 2

Revision Date Description
lAdded a new username alias to provide an alternate
username that allows for special characters in the username.
nWi-Fi enhancements:
lPKI certificate-based authentication for WPA2/WPA3
Enterprise Wi-Fi client connections, including options for SCEP
client integration for automatic certificate generation.
lImproved Wi-Fi scanning tool on the Status page to
automatically setup the underlying basic client-mode settings
so the device can scan for nearby APs without requiring the
user to first configure the client-mode settings.
nVPNenhancements:
lAdded support for PPP-over-L2TP tunnels.
lChanged default IPsec IKE DH group to 14 for enhanced
compatibility with industry standard settings.
nLocation services enhancements:
lNew option for Location service to specify the talker ID used
in NMEA mesage strings.
lInclude the mode indicator field in NMEA messages
constructed when a GPS fix isn’t obtained.
nSureLink enhancments:
lAdded new settings under cellular Surelink options to have
the device reset the cellular modem if a specified number of
Surelink tests fail
lAdded show surelink Admin CLI command.
nSerial port enhancements:
lNew option to add and configure an external USB-to-serial
adapter.
lDisable serial history in remote access mode by default.
nSupport for sending analog and digial I/O health metrics to Digi
Remote Manager.
Additional updates for Connect EZ 4i:
Added information for Connect EZ 4i intallations: Connect EZ 4i ONLY:
Review installation instructions for hazardous locations
A November
2021
Initial release of the document.
Trademarks and copyright
Digi, Digi International, and the Digi logo are trademarks or registered trademarks in the United States
and other countries worldwide. All other trademarks mentioned in this document are the property of
their respective owners.
© 2022 Digi International Inc. All rights reserved.
Digi Connect EZ 4/4i User Guide 3

Disclaimers
Information in this document is subject to change without notice and does not represent a
commitment on the part of Digi International. Digi provides this document “as is,” without warranty of
any kind, expressed or implied, including, but not limited to, the implied warranties of fitness or
merchantability for a particular purpose. Digi may make improvements and/or changes in this manual
or in the product(s) and/or the program(s) described in this manual at any time.
Warranty
To view product warranty information, go to the following website:
www.digi.com/howtobuy/terms
Customer support
Gather support information: Before contacting Digi technical support for help, gather the following
information:
Product name and model
Product serial number (s)
Firmware version
Operating system/browser (if applicable)
Logs (from time of reported issue)
Trace (if possible)
Description of issue
Steps to reproduce
Contact Digi technical support: Digi offers multiple technical support plans and service packages.
Contact us at +1 952.912.3444 or visit us at www.digi.com/support.
Feedback
To provide feedback on this document, email your comments to
[email protected]
Include the document title and part number (Digi Connect EZ 4/4i User Guide, 90002459 A) in the
subject line of your email.
Digi Connect EZ 4/4i User Guide 4

Contents
Digi Connect EZ 4/4i User Guide
Get started with Connect EZ 4/4i
Connect EZ 4i ONLY: Review installation instructions for hazardous locations 19
Step 1: Verify product components 19
Included equipment for Connect EZ 4/4i 19
Optional additional cellular equipment 20
Step 2: Connect the power supply 21
Step 3: Connect to site network using an Ethernet LAN 22
Step 4: Connect the device to the network using Wi-Fi 22
Connect the Wi-Fi antenna 22
Enable Wi-Fi 22
Configure Wi-Fi on the device 23
Step 5: Discover the IPaddress using the Digi Navigator 23
Step 6: Configure RealPort from the Digi Navigator 24
Step 7: Connect to the web UI and update the Connect EZ firmware 25
Connect to the local Web UI on the Connect EZ 25
Update the firmware on the Connect EZ 26
Step 8:Connect to Digi Remote Manager 27
Connect equipment to the Connect EZ serial port
Serial Status page 28
Serial connector pinout 28
Serial Status page 29
Hardware
Front panel and LEDs 31
Wi-Fi LEDdescriptions 32
Cell service and signal LEDdescriptions 33
Back panel 34
Bottom panel 34
Change the password on the Connect EZ 35
Cellular connection: Insert the CORE module 35
Prerequisites 35
Connect hardware and connect to a cellular network 36
Mount the Connect EZ device 36
Attach to a mounting surface using the two mounting tabs 37
Digi Connect EZ 4/4i User Guide 5

Digi Connect EZ 4/4i User Guide 6
Attach to DIN rail with clip 37
Use the ERASEbutton to reset your device to the factory defaults 37
Discover the device'sIPaddress: Additional methods 38
Discover the IPaddress using a Micro USB cable 38
Manually configure the PCand assign an IPaddress to the device 39
Loose label sample 40
Configuration and management
Review Connect EZ default settings 43
Local WebUI 43
Digi Remote Manager 43
Default interface configuration 43
Other default configuration settings 44
Change the default password for the admin user 44
Reset default SSID and pre-shared key for the preconfigured Wi-Fi access point 45
Configuration methods 47
Using Digi Remote Manager 49
Access Digi Remote Manager 49
Using the web interface 49
Log out of the web interface 50
Use the local RESTAPI to configure the Connect EZ device 50
Use the GETmethod to return device configuration information 50
Use the POST method to modify device configuration parameters and list arrays 52
Use the DELETE method to remove items from a list array 53
Access the terminal screen from the web UI 54
Using the command line 55
Access the command line interface 55
Log in to the command line interface 55
Exit the command line interface 56
Interfaces
Wide Area Networks (WANs) 58
Wide Area Networks (WANs) and Wireless Wide Area Networks (WWANs) 59
Configure WAN/WWAN priority and default route metrics 59
WAN/WWAN failover 61
Configure SureLink active recovery to detect WAN/WWAN failures 62
Configure the device to reboot when a failure is detected 72
Disable SureLink 80
Example: Use a ping test for WAN failover from Ethernet to cellular 83
Using Ethernet devices in a WAN 86
Using cellular modems in a Wireless WAN (WWAN) 86
Configure a Wide Area Network (WAN) 105
Configure a Wireless Wide Area Network (WWAN) 113
Show WAN and WWAN status and statistics 123
Delete a WAN or WWAN 125
Default outbound WAN/WWAN ports 126
Local Area Networks (LANs) 127
About Local Area Networks (LANs) 128
Configure a LAN 128
Example: Configure two LANs 136
Show LAN status and statistics 144
Delete a LAN 146

Digi Connect EZ 4/4i User Guide 7
DHCP servers 147
Create a Virtual LAN (VLAN) route 163
Default services listening on LANports 166
Bridging 167
Configure a bridge 168
Show Surelink status and statistics 171
Show Surelink status for all interfaces 171
Show Surelink status for a specific interface 172
Show Surelink status for all IPsec tunnels 172
Show Surelink status for a specific IPsec tunnel 173
Show Surelink status for all OpenVPN clients 173
Show Surelink status for a specific OpenVPN client 173
Serial port
Default serial port configuration 175
Serial mode options 175
View serial port information 175
Default serial port configuration 175
Configure Login mode 176
Configure Remote Access mode 180
Configure Application mode 186
Configure RealPort mode 189
Install RealPort on a Windows computer 189
Configure the serial port for RealPort mode 191
Configure the RealPort service 194
Configure UDP serial mode 195
Configure Modbus mode 201
Show serial status and statistics 206
Log serial port messages 206
Digi Navigator application 207
Step 6: Configure RealPort from the Digi Navigator 207
Step 5: Discover the IPaddress using the Digi Navigator 209
Install the Digi Navigator 209
Digi Navigator features 210
Connect to and access the Digi Navigator 211
Discover the IP address when connected to a network 211
Discover the IP address when not on a network 212
Manage the RealPort device list 212
Access the web UI from the Digi Navigator 213
Filter devices for display in the Digi Navigator 213
Access Digi Remote Manager from the Digi Navigator 214
Wi-Fi
Wi-Fi configuration 216
Default access point SSID and password 216
Default Wi-Fi configuration 216
Configure the Wi-Fi radio's channel 218
Configure the Wi-Fi radio to support DFS channels in client mode 219
Required configuration items 220
Configure the Wi-Fi radio's band and protocol 221
Configure the Wi-Fi radio's transmit power 223
Configure an open Wi-Fi access point 224

Digi Connect EZ 4/4i User Guide 8
Configure a Wi-Fi access point with personal security 229
Configure a Wi-Fi access point with enterprise security 236
Isolate Wi-Fi clients 243
Isolate clients connected to the same access point 243
Isolate clients connected to different access points 244
Configure a Wi-Fi client and add client networks 249
Show Wi-Fi access point status and statistics 258
Show Wi-Fi client status and statistics 259
Hotspot
Hotspot authentication modes 262
Hotspot DHCP server 263
Hotspot security 263
Hotspot configuration 264
Enable hotspot using the default configuration 265
Change the default hotspot SSID 269
Change the default hotspot IP address and subnet 270
Change the default hotspot bandwidth limits 273
Add an Ethernet port to the default hotspot 274
Use policy routes with hotspot 277
Create a new hotspot 278
Configure the hotspot to use local shared password authentication 289
Configure the hotspot to use RADIUSshared password authentication 291
Configure the hotspot to use RADIUS users authentication 294
Configure the hotspot to use HotspotSystem authentication 298
Show hotspot status and statistics 301
Customize the hotspot login page 304
Edit sample hotspot HTML pages 305
Upload custom hotspot HTML pages 306
Restore hotspot default sample pages 308
Hotspot RADIUS attributes 309
Routing
IP routing 311
Configure a static route 312
Delete a static route 314
Policy-based routing 316
Configure a routing policy 316
Routing services 324
Configure routing services 324
Show the routing table 327
Dynamic DNS 328
Configure dynamic DNS 328
Virtual Router Redundancy Protocol (VRRP) 333
VRRP+ 333
Configure VRRP 333
Configure VRRP+ 336
Example: VRRP/VRRP+ configuration 344
Configure device one (master device) 344
Configure device two (backup device) 348
Show VRRP status and statistics 353

Digi Connect EZ 4/4i User Guide 9
Virtual Private Networks (VPN)
IPsec 356
IPsec data protection 356
IPsec mode 356
IPsec modes 356
Internet Key Exchange (IKE) settings 356
Authentication 357
Configure an IPsec tunnel 357
Configure IPsec failover 384
Configure SureLink active recovery for IPsec 387
Show IPsec status and statistics 394
Debug an IPsec configuration 395
Configure a Simple Certificate Enrollment Protocol client 396
Example: SCEP client configuration with Fortinet SCEP server 400
Disable hardware cryptographic acceleration 405
OpenVPN 407
Configure an OpenVPN server 408
Configure an OpenVPN Authentication Group and User 416
Configure an OpenVPN client by using an .ovpn file 420
Configure an OpenVPN client without using an .ovpn file 422
Configure SureLink active recovery for OpenVPN 427
Show OpenVPN server status and statistics 434
Show OpenVPN client status and statistics 435
Generic Routing Encapsulation (GRE) 437
Configuring a GREtunnel 437
Show GRE tunnels 441
Example: GRE tunnel over an IPSec tunnel 442
L2TP 457
Configure a PPP-over-L2TP tunnel 457
Configure SureLink active recovery for PPP-over-L2TP 466
L2TP with IPsec 473
Show L2TP tunnel status 473
L2TPv3 Ethernet 475
Configure an L2TPv3 tunnel 475
Show L2TPV3 tunnel status 479
NEMO 480
Configure a NEMO tunnel 481
Show NEMO status 485
Services
Allow remote access for web administration and SSH 488
Configure the web administration service 491
Configure SSHaccess 500
Use SSH with key authentication 507
Generating SSH key pairs 507
Configure telnet access 509
Configure DNS 513
Show DNS server 518
Simple Network Management Protocol (SNMP) 520
SNMP Security 520
Configure Simple Network Management Protocol (SNMP) 520
Download MIBs 524

Digi Connect EZ 4/4i User Guide 10
Location information 526
Configure the location service 527
Configure the device to use a user-defined static location 528
Configure the device to accept location messages from external sources 530
Forward location information to a remote host 534
Configure geofencing 541
Show location information 553
Modbus gateway 554
Configure the Modbus gateway 555
Show Modbus gateway status and statistics 568
System time 571
Configure the system time 571
Manually set the system date and time 574
Network Time Protocol 575
Configure the device as an NTP server 575
Show status and statistics of the NTP server 580
Configure a multicast route 581
Ethernet network bonding 584
Enable service discovery (mDNS) 586
Use the iPerf service 589
Example performance test using iPerf3 594
Configure the ping responder service 594
Example performance test using iPerf3 598
Applications
Configure scripts to run automatically 600
Task one: Upload the application 600
Task two: Configure the application to run automatically 602
Configure scripts to run manually 606
Task one: Upload the application 606
Task two: Configure the application to run automatically 608
Start a manual script 611
Stop a script that is currently running 612
Show script information 613
Run a Python application at the shell prompt 614
Start an interactive Python session 616
Digidevice module 617
Use digidevice.cli to execute CLI commands 618
Use digidevice.datapoint to upload custom datapoints to Digi Remote Manager 619
Use digidevice.config for device configuration 622
Use Python to respond to Digi Remote Manager SCI requests 624
Use digidevice runtime to access the runtime database 633
Use Python to upload the device name to Digi Remote Manager 635
Use Python to access the device location data 637
Use Python to set the maintenance window 641
Use Python to send and receive SMS messages 643
Use Python to access serial ports 645
Use the Paho MQTTpython library 646
User authentication
Connect EZ user authentication 651
User authentication methods 651