Digi Connect IT 4 User manual

Digi Connect IT® 4
User Guide
Firmware version 23.3

Revision history—90002355
Revision Date Description
W May 2023 Release of Digi Connect IT 4 firmware version 23.3:
nSurelink:
lRedesigned Surelink configuration settings.
lAdded show surelink state Admin CLI command to display
the overall pass/fail status of enabled Surelink tests.
nAdded a AT&T LWM2M support setting to enable or disable AT&T
lightweight M2M on cellular modems.
nVPN:
lDMVPN phase 1 spoke support with NHRP or mGRE, including
compatibility with Cisco DMVPN hubs.
lAdded support for SHA2 ciphers for IKEv2 IPsec tunnels.
nIf the device has a configured System >Name, it is now displayed
on the Dashboard.
Additional changes
nAdded serial port logging configuration documentation for these
serial port modes: Login,Remote Access, and UDP Serial.
nUpdated serial port logging information. See Review the serial
port message log.
V December
2022
Release of Digi Connect IT 4 firmware version 22.11:
nUpdated the Linux kernel to version 5.19.
nThe intelliFlow feature now integrates with Digi Remote
Manager to provide aggregated insights and analytics for all Digi
devices in your environment.
nAdded support for Next-hop routing protocol (NHRP).
nAdded support for mGREtunnels.
nAdded support for ICMP redirect messages.
nAdded a polling interval to control how often the cellular modem
is polled for signal strength and other status.
nNew commands: tail and grep.
nAdd Timeout option to modem Carrier Scan window in the Web
UI.
nAdded advanced watchdog to:
lMonitor critical services and reboot the device if those
services fail.
Digi Connect IT® 4 User Guide 2

Revision Date Description
lMonitor memory usage and log errors or reboot the device
based on current memory usage.
nAdded the ability to have serial port data written to the system
log.
lRemoved options in the local web UI and Admin CLI for
manually starting, stopping, and clearing serial logs. These
actions are now controlled under the data logging
configuration settings.
Additional changes:
nUpdated Send Email notification and/or an SNMP trap when an
event occurs.
U September
2022
Release of Digi Connect IT 4 firmware version 20.8:
nSupport for NEMO/DMNR virtual private networks.
nSupport for serial Modbus Gateway.
nSupport for Ethernet network bonding.
nSupport for VRRP+, an extension to the VRRP standard that uses
network probing to monitor connections through VRRP-enabled
devices.
nCloud service enhancements:
lReduced data usage for reporting health metrics to Digi
Remote Manager.
Added Monitoring >Device Health >Only report changed
values to Digi Remote Manager option to control sending
metrics to Digi Remote Manager on the basis of whether the
values have changed since they were last reported.
lAdded Monitoring >Device Health >Data point tuning
configuration options to fine tune what datapoints are
uploaded as health metrics to Digi Remote Manager.
lAdded the ability to select Digi aView as the cloud service.
nAdded the ability to duplicate firmware to copy the active
firmware to the secondary firmware partition.
nMoved the update firmware CLI command to system firmware
update.
nAdded new Authoritative option under TACACS+, RADIUS, and
LDAP user authentication methods to prevent falling back to
additional authentication methods.
nCisco Umbrella content filtering.
nAdded options under System >Log >Server list to allow users to
specify the TCP/UDP protocol and port of the remote syslog
server.
nSerial port enhancements:
Digi Connect IT® 4 User Guide 3

Revision Date Description
lAdded configuration option under Serial >TCP connection to
specify encrypted connection types.
lAdded configuration option under Serial >TCP/Telnet/SSH
connections to enable/disable TCP keep-alive messages and
nodelay.
nEnhanced SMS support:
lAdded System >Scheduled tasks >Allow scheduled
scripts parameter to allow custom python scripts to handle
sending/receiving SMS messages
lAdded the digidevice.sms python module for
sending/receiving SMS messages in a custom python script.
nMQTT client support via Paho Python module.
nAdded a random unprivileged port for performing ntp time syncs
if standard port 123 fails.
nScripting enhancements:
lAdded a Status >Scripts page in the web UI and show
scripts command to the Admin CLI to view custom scripts
and applications configured in the device, along with their
status.
Added the system scripts stop command to the Admin CLI to
stop a custom script or application.
Additional changes:
nUpdated LED information: Connect IT 4 hardware and LEDs
T June 2022 Release of Digi Connect IT 4 firmware version 22.5:
n5G enhancements:
lAdded 5G slice support for configuring the slice type for the
5G modems.
nSurelink enhancements:
lEnabled Surelink reset_modem action by default on cellular
interfaces and set fail count to three.
lUpdated Surelink reset_modem action to automatically
power cycle the modem in the event that the modem fails to
reset.
nSerial port support enhancements:
lAdded serial PPP dial-in mode to handle AT-based connection
requests from a device connected to a serial port and provide
IPv4 networking to the device.
nAdded cellular APN and cellular connection duration as
datapoints sent to Digi Remote Manager.
nWi-Fi scanner enhancements:
Digi Connect IT® 4 User Guide 4

Revision Date Description
lAdded support for sending an HTTP or TCP stream of results
from the Wi-Fi scanner to one or more remote servers.
nSCEP enhancements:
lNew SCEP client settings and underlying functionality to
support connecting to additional SCEP servers.
lAdded show scep Admin CLI command to show the sync
status, expiration dates, and additional details of any
configured SCEP clients.
nVPN enhancements:
lInclude the hostname of the device in the client .ovpn file
listed on the Status → OpenVPN → Servers page in the web
UI.
nLocation services enhancements:
lNew settings to control the NMEA message content that the
devices sends when there is no valid fix from any of the
configured location sources.
Additional changes
nDocumented new Connect IT features: Configure Connect IT
features
nUpdated the CORE module insertion steps.
S April 2022 Updated ERASEbutton information. See Erase device configuration and
reset to factory defaults.
Trademarks and copyright
Digi, Digi International, and the Digi logo are trademarks or registered trademarks in the United
States and other countries worldwide. All other trademarks mentioned in this document are the
property of their respective owners.
© 2023 Digi International Inc. All rights reserved.
Disclaimers
Information in this document is subject to change without notice and does not represent a
commitment on the part of Digi International. Digi provides this document “as is,” without warranty of
any kind, expressed or implied, including, but not limited to, the implied warranties of fitness or
merchantability for a particular purpose. Digi may make improvements and/or changes in this manual
or in the product(s) and/or the program(s) described in this manual at any time.
Warranty
To view product warranty information, go to the following website:
www.digi.com/howtobuy/terms
Digi Connect IT® 4 User Guide 5

Customer support
Gather support information: Before contacting Digi technical support for help, gather the following
information:
Product name and model
Product serial number (s)
Firmware version
Operating system/browser (if applicable)
Logs (from time of reported issue)
Trace (if possible)
Description of issue
Steps to reproduce
Contact Digi technical support: Digi offers multiple technical support plans and service packages.
Contact us at +1 952.912.3444 or visit us at www.digi.com/support.
Feedback
To provide feedback on this document, email your comments to
[e-mail]
Include the document title and part number (Digi Connect IT® 4 User Guide, 90002355 A) in the subject
line of your email.
Digi Connect IT® 4 User Guide 6

Contents
Digi Connect IT® 4 User Guide
Get started with Connect IT
Verify product components 20
Included equipment 20
Required additional equipment 21
Cellular ONLY: Insert the CORE module 21
Prerequisites 22
Connect the hardware to a network 23
Connect hardware and connect to a cellular network 23
Connect hardware and connect to site network using an Ethernet LAN 23
Connect equipment to the Connect IT serial ports
Serial port pinout and use 24
Firmware configuration
Review Connect IT 4 default settings 27
Local WebUI 27
Digi Remote Manager 27
Default interface configuration 27
Other default configuration settings 28
Change the default password for the admin user 28
Configuration methods 30
Using Digi Remote Manager 31
Access Digi Remote Manager 31
Using the local web interface 31
Log out of the web interface 32
Use the local RESTAPI to configure the Connect IT 4 device 32
Use the GETmethod to return device configuration information 32
Use the POST method to modify device configuration parameters and list arrays 34
Use the DELETE method to remove items from a list array 35
Access the terminal screen from the web UI 36
Using the command line 38
Access the command line interface 38
Log in to the command line interface 38
Exit the command line interface 39
Digi Connect IT® 4 User Guide 7

Digi Connect IT® 4 User Guide 8
Configure Remote Power Management
Configure communication between the Connect IT, power controller, and a device 40
Create an access control to specify which users can access which outlets 40
Manage power to the power controller outlets 40
Configure the Connect IT to connect to a power controller using a serial port 41
Configure a serial port for Power Management 41
Connect a power controller to the Connect IT serial port 42
Configure the power controller and the outlets for use with a serial port on the Connect IT 42
Connect a 3rd-party device to the Connect IT serial port and the power controller 43
Configure the Connect IT to connect to a power controller using the network 44
Configure communication with a power controller using the network 44
Connect the Connect IT to your network 45
Connect a 3rd-party device to a serial port on the Connect IT and then to the power
controller 45
Create an access control group for power management and assign to users 46
Manage the power to the power controller outlets from the Connect IT 47
Control the outlet power from a terminal (all users) 47
View power controller status and manage power (Administrators) 47
Control the outlet power from the Serial Status page 48
Configure Connect IT features
Configure automatic detection 49
Configure automatic detection from the web UI 49
Configure automatic detection from the script 50
Configure data pattern matching 51
Send Email notification and/or an SNMP trap when an event occurs 52
Configure email event notification 52
Configure an SNMPtrap 53
Interfaces
Wide Area Networks (WANs) 55
Wide Area Networks (WANs) and Wireless Wide Area Networks (WWANs) 56
Configure WAN/WWAN priority and default route metrics 56
WAN/WWAN failover 59
Configure SureLink active recovery to detect WAN/WWAN failures 60
Configure the device to reboot when a failure is detected 77
Disable SureLink 90
Example: Use a ping test for WAN failover from Ethernet to cellular 99
Using Ethernet devices in a WAN 101
Using cellular modems in a Wireless WAN (WWAN) 102
Configure a Wide Area Network (WAN) 125
Configure a Wireless Wide Area Network (WWAN) 133
Show WAN and WWAN status and statistics 143
Delete a WAN or WWAN 145
Default outbound WAN/WWAN ports 146
Local Area Networks (LANs) 147
About Local Area Networks (LANs) 148
Configure a Local Area Network (LAN) 148
Configure the WAN port as a LAN or in a bridge 155
Change the default LAN subnet 163
Show LAN status and statistics 165

Digi Connect IT® 4 User Guide 9
Delete a LAN 166
DHCP servers 168
Default services listening on LANports 185
Configure an interface to operate in passthrough mode. 186
Virtual LANs (VLANs) 191
Create a trunked VLAN route 193
Create a VLAN using switchport mode 194
Bridging 197
Edit the preconfigured LAN bridge 198
Configure a bridge 201
Show SureLink status and statistics 203
Show SureLink State 204
Show SureLink status for all interfaces 204
Show SureLink status for a specific interface 205
Show SureLink status for all IPsec tunnels 205
Show SureLink status for a specific IPsec tunnel 206
Show SureLink status for all OpenVPN clients 206
Show SureLink status for a specific OpenVPN client 207
Serial port
Default serial port configuration 208
Serial mode options 208
View serial port information 208
Default serial port configuration 208
Configure Login mode 209
Configure Remote Access mode 212
Configure Power Management mode 229
Configure PPP dial-in mode 231
Configure UDP serial mode 238
Configure Modbus mode 249
Show serial status and statistics 252
Serial Status page 252
Review the serial port message log 254
Routing
IP routing 257
Configure a static route 258
Delete a static route 261
Policy-based routing 263
Configure a routing policy 263
Routing services 272
Configure routing services 272
Show the routing table 275
Dynamic DNS 276
Configure dynamic DNS 276
Virtual Router Redundancy Protocol (VRRP) 281
VRRP+ 281
Configure VRRP 281
Configure VRRP+ 285
Example: VRRP/VRRP+ configuration 293
Configure device one (master device) 293
Configure device two (backup device) 297

Digi Connect IT® 4 User Guide 10
Show VRRP status and statistics 303
Virtual Private Networks (VPN)
IPsec 307
IPsec data protection 307
IPsec mode 307
IPsec modes 307
Internet Key Exchange (IKE) settings 307
Authentication 308
Configure an IPsec tunnel 308
Configure IPsec failover 336
Configure SureLink active recovery for IPsec 339
Show IPsec status and statistics 355
Debug an IPsec configuration 356
Configure a Simple Certificate Enrollment Protocol client 358
Example: SCEP client configuration with Fortinet SCEP server 364
Show SCEP client status and information 369
OpenVPN 372
Configure an OpenVPN server 373
Configure an OpenVPN Authentication Group and User 382
Configure an OpenVPN client by using an .ovpn file 386
Configure an OpenVPN client without using an .ovpn file 389
Configure SureLink active recovery for OpenVPN 393
Show OpenVPN server status and statistics 409
Show OpenVPN client status and statistics 410
Generic Routing Encapsulation (GRE) 412
Configuring a GREtunnel 412
Show GRE tunnels 417
Example: GRE tunnel over an IPSec tunnel 418
Dynamic Multipoint VPN (DMVPN) 433
Configure a DMVPN spoke 434
L2TP 440
Configure a PPP-over-L2TP tunnel 440
L2TP with IPsec 450
Show L2TP tunnel status 450
L2TPv3 Ethernet 452
Configure an L2TPv3 tunnel 452
Show L2TPV3 tunnel status 457
NEMO 458
Configure a NEMO tunnel 458
Show NEMO status 464
Services
Allow remote access for web administration and SSH 467
Configure the web administration service 470
Configure SSHaccess 481
Use SSH with key authentication 488
Generating SSH key pairs 488
Configure telnet access 491
Configure DNS 496
Show DNS server 502
Simple Network Management Protocol (SNMP) 503

Digi Connect IT® 4 User Guide 11
SNMP Security 503
Configure Simple Network Management Protocol (SNMP) 503
Download MIBs 508
Location information 509
Configure the location service 510
Configure the device to use a user-defined static location 512
Configure the device to accept location messages from external sources 514
Forward location information to a remote host 518
Configure geofencing 525
Show location information 537
Modbus gateway 538
Configure the Modbus gateway 539
Show Modbus gateway status and statistics 552
System time 556
Configure the system time 556
Manually set the system date and time 560
Network Time Protocol 560
Configure the device as an NTP server 561
Show status and statistics of the NTP server 566
Configure a multicast route 567
Ethernet network bonding 570
Enable service discovery (mDNS) 574
Use the iPerf service 578
Example performance test using iPerf3 582
Configure the ping responder service 583
Example performance test using iPerf3 586
Applications
Develop Python applications 589
Set up the Connect IT 4 for Python development 590
Create and test a Python application 590
Python modules 594
Set up the Connect IT 4 to automatically run your applications 629
Configure scripts to run automatically 629
Show script information 636
Stop a script that is currently running 637
Start an interactive Python session 638
Run a Python application at the shell prompt 639
Configure scripts to run manually 640
Task one: Upload the application 641
Task two: Configure the application to run automatically 642
Start a manual script 646
User authentication
Connect IT 4 user authentication 649
User authentication methods 649
Add a new authentication method 651
Delete an authentication method 653
Rearrange the position of authentication methods 654
Authentication groups 656
Change the access rights for a predefined group 658
Add an authentication group 660

Digi Connect IT® 4 User Guide 12
Delete an authentication group 664
Local users 666
Change a local user's password 667
Configure a local user 669
Delete a local user 677
Terminal Access Controller Access-Control System Plus (TACACS+) 679
TACACS+ user configuration 680
TACACS+ server failover and fallback to local authentication 681
Configure your Connect IT 4 device to use a TACACS+ server 681
Remote Authentication Dial-In User Service (RADIUS) 686
RADIUS user configuration 687
RADIUS server failover and fallback to local configuration 687
Configure your Connect IT 4 device to use a RADIUS server 688
LDAP 691
LDAP user configuration 693
LDAP server failover and fallback to local configuration 694
Configure your Connect IT 4 device to use an LDAP server 694
Configure serial authentication 699
Disable shell access 701
Set the idle timeout for Connect IT 4 users 703
Example user configuration 705
Example 1: Administrator user with local authentication 705
Example 2: RADIUS, TACACS+, and local authentication for one user 707
Firewall
Firewall configuration 719
Create a custom firewall zone 719
Configure the firewall zone for a network interface 721
Delete a custom firewall zone 722
Port forwarding rules 724
Configure port forwarding 724
Delete a port forwarding rule 729
Packet filtering 732
Configure packet filtering 732
Enable or disable a packet filtering rule 736
Delete a packet filtering rule 737
Configure custom firewall rules 739
Configure Quality of Service options 741
Web filtering 752
Configure web filtering with Cisco Umbrella 752
Configure web filtering with manual DNS servers 755
Verify your web filtering configuration 757
Show web filter service information 760
System administration
Review device status 762
Configure system information 763
Update system firmware 765
Manage firmware updates using Digi Remote Manager 765
Certificate management for firmware images 766
Downgrading 766
Dual boot behavior 770

Digi Connect IT® 4 User Guide 13
Update cellular module firmware 771
Update modem firmware over the air (OTA) 772
Update modem firmware by using a local firmware file 773
Reboot your Connect IT 4 device 774
Reboot your device immediately 775
Schedule reboots of your device 775
Erase device configuration and reset to factory defaults 777
Custom factory default settings 780
Locate the device by using the Find Me feature 783
Configuration files 785
Save configuration changes 785
Save configuration to a file 786
Restore the device configuration 787
Schedule system maintenance tasks 790
Disable device encryption 795
Re-enable cryptography after it has been disabled. 796
Configure the speed of your Ethernet ports 798
Configure the system watchdog 800
Monitoring
intelliFlow 804
Enable intelliFlow 805
Configure service types 807
Configure domain name groups 809
Use intelliFlow to display average CPU and RAMusage 812
Use intelliFlow to display top data usage information 813
Use intelliFlow to display data usage by host over time 815
Configure NetFlow Probe 816
Central management
Digi Remote Manager support 822
Certificate-based enhanced security 822
Configure your device for Digi Remote Manager support 822
Collect device health data and set the sample interval 829
Enable event log upload to Digi Remote Manager 832
Log into Digi Remote Manager 834
Use Digi Remote Manager to view and manage your device 835
Add a device to Digi Remote Manager 835
Configure multiple Connect IT 4 devices by using Digi Remote Manager configurations 836
View Digi Remote Manager connection status 837
Learn more 837
File system
The Connect IT 4 local file system 839
Display directory contents 839
Create a directory 840
Display file contents 841
Copy a file or directory 841
Move or rename a file or directory 842
Delete a file or directory 843

Digi Connect IT® 4 User Guide 14
Upload and download files 844
Upload and download files by using the WebUI 844
Upload and download files by using the Secure Copy command 845
Upload and download files using SFTP 846
Diagnostics
Perform a speedtest 849
Generate a support report 849
Support report overview 850
View system and event logs 854
View System Logs 854
View Event Logs 856
Configure syslog servers 859
Configure options for the event and system logs 861
Analyze network traffic 866
Configure packet capture for the network analyzer 867
Example filters for capturing data traffic 876
Capture packets from the command line 877
Stop capturing packets 878
Show captured traffic data 879
Save captured data traffic to a file 880
Download captured data to your PC 881
Clear captured data 882
Use the ping command to troubleshoot network connections 884
Ping to check internet connection 884
Stop ping commands 884
Use the traceroute command to diagnose IProuting problems 884
Hardware
Connect IT 4 hardware and LEDs 886
Front panel and LEDs 886
Back panel 887
LTE status indicators 888
Signal strength 888
Exchange power tips 889
Select SIM card 889
QR code definition 890
Troubleshooting
Tips for improving cellular signal strength 891
Download a support report 891
Regulatory and safety information
FCC certifications 892
USA 892
INDUSTRY CANADA - CAN ICES-3(A)/NMB-3(A) 892
European Union 892
IFETEL 892
Caution statements 892

Digi Connect IT® 4 User Guide 15
Safety warnings
English 895
Bulgarian--български 896
Croatian--Hrvatski 897
French--Français 898
Greek--Ελληνικά 899
תי ִרבִע --Hebrew 900
Hungarian--Magyar 901
Italian--Italiano 902
Latvian--Latvietis 903
Lithuanian--Lietuvis 904
Polish--Polskie 905
Portuguese--Português 906
Slovak--Slovák 907
Slovenian--Esloveno 908
Spanish--Español 909
Command line interface
Access the command line interface 911
Log in to the command line interface 911
Exit the command line interface 912
Execute a command from the web interface 912
Display help for commands and parameters 914
The help command 914
The question mark (?) command 914
Display help for individual commands 915
Use the Tab key or the space bar to display abbreviated help 916
Auto-complete commands and parameters 916
Available commands 917
Use the scp command 918
Display status and statistics using the show command 920
show config 920
show system 920
show network 921
Device configuration using the command line interface 921
Execute configuration commands at the root Admin CLI prompt 921
Display help for the config command from the root Admin CLI prompt 922
Configuration mode 923
Enable configuration mode 923
Enter configuration commands in configuration mode 923
Save changes and exit configuration mode 924
Exit configuration mode without saving changes 924
Configuration actions 925
Display command line help in configuration mode 925
Move within the configuration schema 928
Manage elements in lists 929
The revert command 931
Enter strings in configuration commands 933
Example: Create a new user by using the command line 933
Command line reference 936
analyzer clear 937
analyzer save 938

Digi Connect IT® 4 User Guide 16
analyzer start 938
analyzer stop 938
clear dhcp-lease ip-address 938
clear dhcp-lease mac 939
cp 939
grep 939
help 939
ls 940
mkdir 941
modem at 941
modem at-interactive 941
modem firmware check 941
modem firmware list 941
modem firmware ota check 942
modem firmware ota download 942
modem firmware ota list 942
modem firmware ota update 942
modem firmware update 943
modem pin change 943
modem pin disable 943
modem pin enable 944
modem pin status 944
modem pin unlock 944
modem puk status 944
modem puk unlock 945
modem reset 945
modem scan 945
modem sim-slot 945
monitoring 946
monitoring metrics upload 946
more 946
mv 946
ping 947
poweroff 947
reboot 947
rm 947
scp 949
show analyzer 949
show arp 949
show cloud 949
show config 950
show dhcp-lease 950
show dns 950
show eth 950
show event 950
show hotspot 951
show ipsec 951
show l2tp lac 951
show l2tp lns 951
show l2tpeth 952
show location 952
show log 952
show manufacture 952
show modbus-gateway 952
show modem 953

Digi Connect IT® 4 User Guide 17
show mqtt 953
show nemo 953
show network 953
show ntp 954
show openvpn client 954
show openvpn server 954
show route 954
show scep-client 955
show scripts 955
show serial 955
show surelink interface 955
show surelink ipsec 955
show surelink openvpn 956
show surelink state 956
show system 956
show usb 956
show version 957
show vrrp 957
show web-filter 957
speedtest 957
ssh 958
system backup 958
system disable-cryptography 958
system duplicate-firmware 959
system factory-erase 959
system find-me 959
system firmware ota check 959
system firmware ota list 959
system firmware ota update 960
system firmware update 960
system power ignition off_delay 960
system restore 960
system script start 961
system script stop 961
system serial restart 961
system serial save 961
system serial show 961
system support-report 962
system time set 962
system time sync 962
system time test 962
tail 963
telnet 963
traceroute 963

Digi Connect IT® 4 User Guide
This guide provides reference and usage information for the Connect IT.
The Connect IT 4 provides out-of-band management for remote network or infrastructure devices.
Cellular connectivity, available as standard in some models and as an option in other models, provides
fast reliable cellular connections without additional equipment. All connections are encrypted for
security.
Digi Connect IT® 4 User Guide 18

Get started with Connect IT
This section explains what comes with each Connect IT model, how to install the necessary software,
and how to connect the hardware.
1. Verify product components.
2. Cellular ONLY: Insert the CORE module.
3. Connect the hardware to a network.
4. Using the local web interface.
5. Update system firmware
6. Change a local user's password
7. Connect equipment to the Connect IT serial ports.
Digi Connect IT® 4 User Guide 19

Get started with Connect IT Verify product components
Digi Connect IT® 4 User Guide 20
Verify product components
Verify that you have the following included equipment.
Included equipment
Equipment Description
Digi Connect IT 4
For detailed information about the front and back panels, see
Connect IT 4 hardware and LEDs.
Power supply kit If you purchased the USvariant (-OUS) you will receive a USplug
adapter.
If you purchased the global variant (-GLB) you will receive the
Universal power supply kit.
For instructions about exchanging power tips, see Exchange
power tips.
Antennas (2)
COREmodule
This is included with some versions of the Connect IT 4 modules.