Digi IX10 User manual

IX10
User Guide
Firmware version 23.3

Revision history—90002399
Revision Date Description
G March 2022 Release of Digi IX10 firmware version 22.2:
nVPNenhancements:
lRenamed VPN >IPsec >Tunnels >Policies >Local
network setting to Local traffic selector and
added Remote traffic selector.
lAdded a Dynamic option to the Local traffic
selector to configuration of a local network by
protocol and/or port instead of a network address
range.
lAdded Protocol and Port match criteria for Local
traffic selector and Remote traffic selector.
lAdded VPN >IPsec >Advanced >Debug level to
specify the logging verbosity of IPsec messages in
the device system logs.
nAdded Realport support.
nEnhancements to communications with Digi Remote
Manager:
lEnhanced security for communications with Digi
Remote Manager by using client-side certificates.
lThe default URL for the device's Remote Manager
connection is now edp12.devicecloud.com. This
URL is required to utilize the client-side certificate
support.
nNew Switch SIM SureLink action for WWAN interfaces,
which allows SureLink to be configured to switch to the
alternate SIM if the modem is connected but SureLink
test are failing.
lNew Switch SIM fail count option to determine
how many SureLink failures are required prior to
switching to the alternate SIM.
nNew Socket ID string option to send the configured
text to the remote server(s) when a TCP socket
connection is opened to the serial port.
nNew cat Admin CLI command for displaying file
contents.
H June 2022 Release of Digi IX10 firmware version 22.5:
n5G enhancements:
lAdded 5G slice support for configuring the slice
IX10 User Guide 2

Revision Date Description
type for the 5G modems.
nSurelink enhancements:
lEnabled Surelink reset_modem action by default on
cellular interfaces and set fail count to three.
lUpdated Surelink reset_modem action to
automatically power cycle the modem in the event
that the modem fails to reset.
nSerial port support enhancements:
lAdded serial PPP dial-in mode to handle AT-based
connection requests from a device connected to a
serial port and provide IPv4 networking to the
device.
lAdded suppport for Realport serial mode.
nAdded the ability to configure CPU performance and
power consumption.
nAdded cellular APN and cellular connection duration as
datapoints sent to Digi Remote Manager.
nWi-Fi scanner enhancements:
lAdded support for sending an HTTP or TCP stream
of results from the Wi-Fi scanner to one or more
remote servers.
nSCEP enhancements:
lNew SCEP client settings and underlying
functionality to support connecting to additional
SCEP servers.
lAdded show scep Admin CLI command to show
the sync status, expiration dates, and additional
details of any configured SCEP clients.
nVPN enhancements:
lInclude the hostname of the device in the client
.ovpn file listed on the Status → OpenVPN → Servers
page in the web UI.
nLocation services enhancements:
lNew settings to control the NMEA message content
that the devices sends when there is no valid fix
from any of the configured location sources.
I Not used.
J September 2022 Release of Digi IX10 firmware version 22.8:
nCellular modem enhancements:
lAdded modem ota download and system
firmware ota download commands for
IX10 User Guide 3

Revision Date Description
downloading cellular modem and device firmware.
lAdded cellular carrier name and PLMN ID to the
Modems Status page in the Web UI.
lEnhanced access technology options to set the
modem to 5G-only, including setting to 5G SA-only,
NSA-only, or both NSA/SA-modes.
nVPN enhancements:
lAdded Dynamic Multipoint VPN (DMVPN) support.
lAdded a Strict routing setting to IPsec tunnels that
routes packets through the tunnel if both the
source IP and destination IP match the IPsec
tunnel’s policies. This makes IPsec behave like a
policy-based VPN, rather than a route-based VPN.
lAdded the Microsoft version of the Challenge-
Handshake Authentication Protocol (MS-CHAPv2) as
an option for L2TP network servers authentication
methods.
nContainer support:
lContainer support now a premium feature, enabled
through Digi Remote Manager.
lAdded new metrics for sending container status,
name, CPU load, and disk usage as datapoints to
DigiRM.
nAdded support for running a PPPoE server when an
interface is in IP passthrough mode.
nAdded ability to specify DFS channels for Wi-Fi client
background scanning when DFS client support is
enabled.
nAdded a show eth Admin CLI command to show the
link status of each Ethernet port.
nAdded a poweroff CLI command to perform a graceful
shutdown of the device without automatically
rebooting.
nAdded the ability to turn off all LEDs on the device to
reduce power consumption.
K December 2022 Release of Digi IX10 firmware version 22.11:
nUpdated the Linux kernel to version 5.19.
nThe intelliFlow feature now integrates with Digi Remote
Manager to provide aggregated insights and analytics
for all Digi devices in your environment.
nAdded an MQTTbroker service, including support for:
IX10 User Guide 4

Revision Date Description
lMultiple MQTT clients with unique topics and
authentication credentials.
lPre-shared key encryption with multiple
configurable keys.
lPattern filtering for topic access control.
nAdded support for Next-hop routing protocol (NHRP).
nAdded support for mGREtunnels.
nAdded support for ICMP redirect messages.
nAdded a polling interval to control how often the
cellular modem is polled for signal strength and other
status.
nNew commands: tail and grep.
nAdd Timeout option to modem Carrier Scan window in
the Web UI.
nAdded advanced watchdog to:
lMonitor critical services and reboot the device if
those services fail.
lMonitor memory usage and log errors or reboot the
device based on current memory usage.
nAdded the ability to have serial port data written to the
system log.
lRemoved options in the local web UI and Admin CLI
for manually starting, stopping, and clearing serial
logs. These actions are now controlled under the
data logging configuration settings.
L May 2023 Release of Digi IX10 firmware version 23.3:
nSurelink:
lRedesigned Surelink configuration settings.
lAdded show surelink state Admin CLI command to
display the overall pass/fail status of enabled
Surelink tests.
nNew configuration settings for LXC containers:
lStart on boot to configure the container to start
when the system boots.
lRestart timeout to configure the container to
restart if it stops.
lOptional parameters to include optional
parameters for the container.
lMounted directories to setup shared directories
between the host filesystem and the container.
IX10 User Guide 5

Revision Date Description
nAdded a AT&T LWM2M support setting to enable or
disable AT&T lightweight M2M on cellular modems.
nVPN:
lDMVPN phase 1 spoke support with NHRP or mGRE,
including compatibility with Cisco DMVPN hubs.
lAdded support for SHA2 ciphers for IKEv2 IPsec
tunnels.
nDisabled mDNS by default for improved cellular
performance.
nIf the device has a configured System >Name, it is now
displayed on the Dashboard.
Trademarks and copyright
Digi, Digi International, and the Digi logo are trademarks or registered trademarks in the United States
and other countries worldwide. All other trademarks mentioned in this document are the property of
their respective owners.
© 2023 Digi International Inc. All rights reserved.
Disclaimers
Information in this document is subject to change without notice and does not represent a
commitment on the part of Digi International. Digi provides this document “as is,” without warranty of
any kind, expressed or implied, including, but not limited to, the implied warranties of fitness or
merchantability for a particular purpose. Digi may make improvements and/or changes in this manual
or in the product(s) and/or the program(s) described in this manual at any time.
Warranty
To view product warranty information, go to the following website:
www.digi.com/howtobuy/terms
Customer support
Gather support information: Before contacting Digi technical support for help, gather the following
information:
Product name and model
Product serial number (s)
Firmware version
Operating system/browser (if applicable)
Logs (from time of reported issue)
Trace (if possible)
Description of issue
Steps to reproduce
IX10 User Guide 6

Contact Digi technical support: Digi offers multiple technical support plans and service packages.
Contact us at +1 952.912.3444 or visit us at www.digi.com/support.
Feedback
To provide feedback on this document, email your comments to
[email protected]
Include the document title and part number (IX10 User Guide, 90002399 L) in the subject line of your
email.
IX10 User Guide 7

Contents
Revision history—90002399 2
What's new in Digi IX10 version 23.3
Digi IX10 Quick start
Step 1: What's in the box 21
Step 2: Gather accessories 21
Step 3: Connect 22
Apply Dielectric Grease over SIMContacts 23
Step 4: Configure 24
Digi IX10 hardware reference
Digi IX10 features and specifications 26
IX10 accessories 26
IX10 front and side views 26
IX10 LEDs 27
Power (PWR) 28
SIM 28
LTE 28
Signal quality indicators 29
Ethernet Link and Activity 30
Signal quality bars explained 30
IX10 power supply requirements 31
Digi IX10 serial connector pinout 31
10-pin serial cabling options 32
QR code definition 32
Hardware setup
Install SIM cards 35
Apply Dielectric Grease over SIMContacts 35
SIM removal 36
Tips for improving cellular signal strength 36
Connect data cables 36
Mount the IX10 device 36
Attach to a mounting surface by using the mounting tabs 37
Attach to DIN rail with clip 37
IX10 User Guide 8

IX10 User Guide 9
Firmware configuration
Review IX10 default settings 41
Local WebUI 41
Digi Remote Manager 41
Default interface configuration 41
Other default configuration settings 42
Change the default password for the admin user 42
Configuration methods 44
Using Digi Remote Manager 45
Using the local web interface 45
Log out of the web interface 46
Use the local RESTAPI to configure the IX10 device 46
Use the GETmethod to return device configuration information 46
Use the POST method to modify device configuration parameters and list arrays 48
Use the DELETE method to remove items from a list array 49
Using the command line 51
Access the command line interface 51
Log in to the command line interface 51
Exit the command line interface 52
Central management
Digi Remote Manager support 54
Certificate-based enhanced security 54
Configure your device for Digi Remote Manager support 54
Collect device health data and set the sample interval 61
Enable event log upload to Digi Remote Manager 64
Log into Digi Remote Manager 66
Use Digi Remote Manager to view and manage your device 67
Add a device to Digi Remote Manager 67
Configure multiple IX10 devices by using Digi Remote Manager configurations 68
View Digi Remote Manager connection status 69
Learn more 69
Interfaces
Wireless Wide Area Networks (WWANs) 71
Configure SureLink active recovery to detect modem failures 71
Configure the device to reboot when a failure is detected 88
Disable SureLink 101
Using cellular modems in a Wireless WAN (WWAN) 110
Configure a Wireless Wide Area Network (WWAN) 129
Show WWAN status and statistics 139
Delete a WWAN. 140
Local Area Networks (LANs) 143
About Local Area Networks (LANs) 144
Configure a LAN 144
Change the default LAN subnet 151
Change the LAN address type 152
Show LAN status and statistics 154
Delete a LAN 155
DHCP servers 157
Virtual LANs (VLANs) 175

IX10 User Guide 10
Create a trunked VLAN route 176
Create a VLAN using switchport mode 178
Show SureLink status and statistics 180
Show SureLink State 180
Show SureLink status for all interfaces 181
Show SureLink status for a specific interface 181
Show SureLink status for all IPsec tunnels 182
Show SureLink status for a specific IPsec tunnel 182
Show SureLink status for all OpenVPN clients 183
Show SureLink status for a specific OpenVPN client 183
Serial port
Default serial port configuration 185
Serial mode options 185
View serial port information 185
Default serial port configuration 185
Configure Login mode 186
Configure Remote Access mode 190
Configure Application mode 206
Configure PPP dial-in mode 208
Configure UDP serial mode 215
Configure Modbus mode 226
Configure RealPort mode using the Digi Navigator 229
Installation and configuration process 230
Digi Navigator features 230
Install the Digi Navigator 230
Configure RealPort on a Digi device from the Digi Navigator 231
Digi Navigator application features 233
Advanced RealPort configuration without using the Digi Navigator 236
Windows Operating System 237
Linux Operating System 237
Download the RealPort driver 237
Configure RealPort on your laptop 237
Configure the serial port for RealPort mode 239
Configure the RealPort service 243
Show serial status and statistics 243
Review the serial port message log 244
Routing
IP routing 247
Configure a static route 248
Delete a static route 251
Policy-based routing 253
Configure a routing policy 253
Example: Dual WAN policy-based routing 261
Example: Domain-based routing with dual WAN 264
Example: Route traffic to a specific WAN interface based on the client MACaddress 267
Routing services 273
Configure routing services 273
Show the routing table 276
Dynamic DNS 277
Configure dynamic DNS 278

IX10 User Guide 11
Virtual Router Redundancy Protocol (VRRP) 283
VRRP+ 283
Configure VRRP 283
Configure VRRP+ 287
Example: VRRP/VRRP+ configuration 295
Configure device one (master device) 295
Configure device two (backup device) 300
Show VRRP status and statistics 305
Virtual Private Networks (VPN)
IPsec 309
IPsec data protection 309
IPsec mode 309
IPsec modes 309
Internet Key Exchange (IKE) settings 309
Authentication 310
Configure an IPsec tunnel 310
Configure IPsec failover 338
Configure SureLink active recovery for IPsec 341
Show IPsec status and statistics 357
Debug an IPsec configuration 358
Configure a Simple Certificate Enrollment Protocol client 360
Example: SCEP client configuration with Fortinet SCEP server 367
Show SCEP client status and information 372
OpenVPN 375
Configure an OpenVPN server 376
Configure an OpenVPN Authentication Group and User 385
Configure an OpenVPN client by using an .ovpn file 390
Configure an OpenVPN client without using an .ovpn file 393
Configure SureLink active recovery for OpenVPN 398
Show OpenVPN server status and statistics 415
Show OpenVPN client status and statistics 416
Generic Routing Encapsulation (GRE) 418
Configuring a GREtunnel 418
Show GRE tunnels 424
Example: GRE tunnel over an IPSec tunnel 425
Dynamic Multipoint VPN (DMVPN) 440
Configure a DMVPN spoke 441
L2TP 448
Configure a PPP-over-L2TP tunnel 448
L2TP with IPsec 457
Show L2TP tunnel status 458
L2TPv3 Ethernet 459
Configure an L2TPv3 tunnel 460
Show L2TPV3 tunnel status 464
NEMO 465
Configure a NEMO tunnel 466
Show NEMO status 471
Services
Allow remote access for web administration and SSH 474
Configure the web administration service 478

IX10 User Guide 12
Configure SSHaccess 488
Use SSH with key authentication 496
Generating SSH key pairs 496
Configure telnet access 499
Configure DNS 504
Show DNS server 510
Simple Network Management Protocol (SNMP) 512
SNMP Security 512
Configure Simple Network Management Protocol (SNMP) 512
Download MIBs 517
Location information 519
Configure the location service 520
Enable or disable modem GNSSsupport 522
Configure the device to use a user-defined static location 524
Configure the device to accept location messages from external sources 527
Forward location information to a remote host 530
Configure geofencing 536
Show location information 549
Modbus gateway 550
Configure the Modbus gateway 551
Show Modbus gateway status and statistics 564
System time 568
Configure the system time 568
Manually set the system date and time 572
Network Time Protocol 572
Configure the device as an NTP server 573
Show status and statistics of the NTP server 578
Configure a multicast route 579
Enable service discovery (mDNS) 582
Use the MQTTbroker service 585
Show MQTTbroker information 596
Use the iPerf service 597
Example performance test using iPerf3 602
Configure the ping responder service 602
Example performance test using iPerf3 606
Applications
Develop Python applications 608
Set up the IX10 for Python development 609
Create and test a Python application 609
Python modules 613
The use(led) function 642
Releasing the LEDs to system control 642
Use Python to control the color of multi-colored LEDs 642
Example: Set the LTE connection indicator to flashing purple 644
Set up the IX10 to automatically run your applications 653
Configure scripts to run automatically 653
Show script information 660
Stop a script that is currently running 661
Start an interactive Python session 662
Run a Python application at the shell prompt 663
Configure scripts to run manually 664
Task one: Upload the application 665
Task two: Configure the application to run automatically 666

IX10 User Guide 13
Start a manual script 670
User authentication
IX10 user authentication 673
User authentication methods 673
Add a new authentication method 675
Delete an authentication method 677
Rearrange the position of authentication methods 679
Authentication groups 681
Change the access rights for a predefined group 683
Add an authentication group 685
Delete an authentication group 690
Local users 692
Change a local user's password 693
Configure a local user 695
Delete a local user 703
Terminal Access Controller Access-Control System Plus (TACACS+) 705
TACACS+ user configuration 706
TACACS+ server failover and fallback to local authentication 707
Configure your IX10 device to use a TACACS+ server 707
Remote Authentication Dial-In User Service (RADIUS) 712
RADIUS user configuration 713
RADIUS server failover and fallback to local configuration 713
Configure your IX10 device to use a RADIUS server 714
LDAP 718
LDAP user configuration 719
LDAP server failover and fallback to local configuration 720
Configure your IX10 device to use an LDAP server 720
Configure serial authentication 725
Disable shell access 728
Set the idle timeout for IX10 users 730
Example user configuration 733
Example 1: Administrator user with local authentication 733
Example 2: RADIUS, TACACS+, and local authentication for one user 736
Firewall
Firewall configuration 744
Create a custom firewall zone 744
Configure the firewall zone for a network interface 746
Delete a custom firewall zone 748
Port forwarding rules 749
Configure port forwarding 750
Delete a port forwarding rule 754
Packet filtering 757
Configure packet filtering 757
Enable or disable a packet filtering rule 761
Delete a packet filtering rule 763
Configure custom firewall rules 765
Configure Quality of Service options 767
Web filtering 777
Configure web filtering with Cisco Umbrella 777
Configure web filtering with manual DNS servers 780

IX10 User Guide 14
Verify your web filtering configuration 783
Show web filter service information 785
Containers
Use Digi Remote Manager to deploy and run containers 788
Use an automation to start the container 791
Upload a new LXC container 792
Configure a container 793
Starting and stopping the container 798
Starting the container 798
Stopping the container 799
View the status of containers 799
Show status of all containers 800
Show status of a specific container 800
Schedule a script to run in the container 801
Create a custom container 804
Create the custom container file 804
Test the custom container file 805
System administration
Review device status 807
Configure system information 808
Update system firmware 811
Manage firmware updates using Digi Remote Manager 811
Certificate management for firmware images 811
Downgrading 811
Dual boot behavior 815
Update cellular module firmware 816
Update modem firmware over the air (OTA) 817
Update modem firmware by using a local firmware file 819
Reboot your IX10 device 820
Reboot your device immediately 820
Schedule reboots of your device 821
Erase device configuration and reset to factory defaults 823
Custom factory default settings 826
Locate the device by using the Find Me feature 828
Configure a power profile 829
Configuration files 833
Save configuration changes 833
Save configuration to a file 834
Restore the device configuration 836
Schedule system maintenance tasks 838
Disable device encryption 843
Re-enable cryptography after it has been disabled. 844
Configure the speed of your Ethernet port 846
Configure the system watchdog 848
Monitoring
intelliFlow 853
Enable intelliFlow 854

IX10 User Guide 15
Configure service types 856
Configure domain name groups 858
Use intelliFlow to display average CPU and RAMusage 862
Use intelliFlow to display top data usage information 863
Use intelliFlow to display data usage by host over time 865
Configure NetFlow Probe 866
File system
The IX10 local file system 872
Display directory contents 872
Create a directory 873
Display file contents 874
Copy a file or directory 874
Move or rename a file or directory 875
Delete a file or directory 876
Upload and download files 877
Upload and download files by using the WebUI 877
Upload and download files by using the Secure Copy command 878
Upload and download files using SFTP 879
Diagnostics
Perform a speedtest 882
Generate a support report 882
Support report overview 883
View system and event logs 887
View System Logs 887
View Event Logs 889
Configure syslog servers 892
Configure options for the event and system logs 895
Analyze network traffic 900
Configure packet capture for the network analyzer 901
Example filters for capturing data traffic 910
Capture packets from the command line 911
Stop capturing packets 912
Show captured traffic data 913
Save captured data traffic to a file 915
Download captured data to your PC 915
Clear captured data 917
Use the ping command to troubleshoot network connections 918
Ping to check internet connection 918
Stop ping commands 918
Use the traceroute command to diagnose IProuting problems 918
Digi IX10 regulatory and safety statements
RF exposure statement 920
Federal Communication (FCC) Part 15 Class B 920
Radio Frequency Interference (RFI) (FCC 15.105) 920
European Community - CE Mark Declaration of Conformity (DoC) 920
IFETEL 921
Maximum transmit power for radio frequencies 922

IX10 User Guide 16
Innovation, Science, and Economic Development Canada (IC) certifications 922
RoHS compliance statement 923
Special safety notes for wireless routers 923
Product disposal instructions 924
Safety warnings
English 926
Bulgarian--б ъ л га р с ки 927
Croatian--Hrvatski 928
French--Français 929
Greek--Ε λληνικά 930
Hungarian--Magyar 931
Italian--Italiano 932
Latvian--Latvietis 933
Lithuanian--Lietuvis 934
Polish--Polskie 935
Portuguese--Português 936
Slovak--Slovák 937
Slovenian--Esloveno 938
Spanish--Español 939
DigiIX10 Certifications
International EMC (Electromagnetic Compatibility) and safety standards 939
Command line interface
Access the command line interface 942
Log in to the command line interface 942
Exit the command line interface 943
Execute a command from the web interface 943
Display help for commands and parameters 945
The help command 945
The question mark (?) command 945
Display help for individual commands 946
Use the Tab key or the space bar to display abbreviated help 947
Auto-complete commands and parameters 947
Available commands 948
Use the scp command 949
Display status and statistics using the show command 951
show config 951
show system 951
show network 952
Device configuration using the command line interface 952
Execute configuration commands at the root Admin CLI prompt 952
Display help for the config command from the root Admin CLI prompt 952
Configuration mode 954
Enable configuration mode 954
Enter configuration commands in configuration mode 954
Save changes and exit configuration mode 955
Exit configuration mode without saving changes 955
Configuration actions 955

IX10 User Guide 17
Display command line help in configuration mode 956
Move within the configuration schema 959
Manage elements in lists 960
The revert command 962
Enter strings in configuration commands 964
Example: Create a new user by using the command line 964
Command line reference 967
analyzer clear 968
analyzer save 969
analyzer start 969
analyzer stop 969
clear dhcp-lease ip-address 969
clear dhcp-lease mac 970
container create 970
container delete 970
cp 970
grep 971
help 971
ls 972
mkdir 973
modem at 973
modem at-interactive 973
modem firmware check 973
modem firmware list 973
modem firmware ota check 974
modem firmware ota download 974
modem firmware ota list 974
modem firmware ota update 974
modem firmware update 975
modem pin change 975
modem pin disable 975
modem pin enable 976
modem pin status 976
modem pin unlock 976
modem puk status 976
modem puk unlock 977
modem reset 977
modem scan 977
modem sim-slot 977
monitoring 978
monitoring metrics upload 978
more 978
mv 978
ping 979
poweroff 979
reboot 979
rm 979
scp 981
show analyzer 981
show arp 981
show cloud 981
show config 982
show containers 982
show dhcp-lease 982
show dns 982

IX10 User Guide 18
show eth 982
show event 983
show hotspot 983
show ipsec 983
show l2tp lac 983
show l2tp lns 984
show l2tpeth 984
show location 984
show log 984
show manufacture 984
show modbus-gateway 985
show modem 985
show mqtt 985
show nemo 985
show network 986
show ntp 986
show openvpn client 986
show openvpn server 986
show route 987
show scep-client 987
show scripts 987
show serial 987
show surelink interface 987
show surelink ipsec 988
show surelink openvpn 988
show surelink state 988
show system 988
show usb 989
show version 989
show vrrp 989
show web-filter 989
speedtest 989
ssh 990
system backup 990
system disable-cryptography 990
system duplicate-firmware 991
system factory-erase 991
system find-me 991
system firmware ota check 991
system firmware ota list 992
system firmware ota update 992
system firmware update 992
system power ignition off_delay 992
system restore 992
system script start 993
system script stop 993
system serial restart 993
system serial save 993
system serial show 994
system support-report 994
system time set 994
system time sync 994
system time test 994
tail 995
telnet 995

IX10 User Guide 19
traceroute 995

What's new in Digi IX10 version 23.3
Release of Digi IX10 firmware version 23.3:
nSurelink:
lRedesigned Surelink configuration settings.
lAdded show surelink state Admin CLI command to display the overall pass/fail status of
enabled Surelink tests.
nNew configuration settings for LXC containers:
lStart on boot to configure the container to start when the system boots.
lRestart timeout to configure the container to restart if it stops.
lOptional parameters to include optional parameters for the container.
lMounted directories to setup shared directories between the host filesystem and the
container.
nAdded a AT&T LWM2M support setting to enable or disable AT&T lightweight M2M on cellular
modems.
nVPN:
lDMVPN phase 1 spoke support with NHRP or mGRE, including compatibility with Cisco
DMVPN hubs.
lAdded support for SHA2 ciphers for IKEv2 IPsec tunnels.
nDisabled mDNS by default for improved cellular performance.
nIf the device has a configured System >Name, it is now displayed on the Dashboard.
IX10 User Guide 20