Digi IX40 User manual

IX40
User Guide
Firmwareversion 23.12

Revision history—90002537
Revision Date Description
B January 2024 Releaseof Digi IX40firmwareversion 23.12:
nUpdated ActiveSIMslot definition: Configurecellular
modem.
nFIPSfeatureisavailablefor all DAL devices.Enable
FIPSmode
nLink OSPFroutesthrough aDMVPNtunnel and allow
for redirection of packetsbetween spokes. Configurea
DMVPNspoke.
nSupport for Rapid SpanningTreeProtocol (RSTP).
Configureabridge.
nNew settingwhich allowsdevice to initiatea Realport
connection to a remote server. ConfiguretheRealPort
service.
nNew After option for theSIMpreferenceschedule.
Configurecellular modem.
nNew WANBonding proxy and Client devicesoptions.
UseDigi RemoteManager to enableand configureWAN
bondingon multipledevicesor ConfigureWAN bonding
on your local device.
nNew BOOTP dynamic allocation option. Configurea
DHCPserver.
nRenamed SureLink Attemptsconfiguration settingto
Surelink test failuresto better indicate what this
settingdoes.
nNew Telnet Login settingto control whether a user
must supply credentialswhen openinga Telnet
connection to accessa serial port on aservice.
Configureserial authentication.
nNew Advanced watchdogModem check and recovery
settingto control whether watchdogwill monitor
initialization of theIX40cellular modem. Configurethe
system watchdog.
A06Dec2023 Initial releaseof theIX40device.
IX40User Guide 2

Revisionhistory—90002537
IX40User Guide 3
Revision Date Description
Releaseof DigiIX40firmwareversion 23.9:
nRegister a deviceto DRM:
lAdded a link to theDashboard of thelocal web UI
to register and add thedevice to Digi Remote
Manager.
nUpdated Dashboard:
lUpdated thelayout of theDashboard pageof the
web UI to combinethenetwork interfaceand
cellular modem detailsinto a singleNetwork
Activity panel.
nPrimary Responder:
lAdded Primary Responder mode setting to lock
down thedeviceto comply with AT&TFirstNet and
Verizon Response.
nDomain allow list:
lAdded a Domain allow list featureto control what
domainsareaccessiblethrough theDigi device.
nFallback:
lAdded a fallback server settingto control which
DNSserver isused asthefallback in theevent that
no configured or DHCP-obtained DNSserversare
available.
nMACsectunnel:
lAdded information about addinga MACsectunnel.
Trademarksand copyright
Digi, Digi International, and theDigi logo are trademarksor registered trademarksin theUnited States
and other countriesworldwide. All other trademarksmentioned in thisdocument aretheproperty of
their respectiveowners.
© 2024 Digi International Inc. All rightsreserved.
Disclaimers
Information in thisdocument issubject to changewithout noticeand doesnot represent a
commitment on thepart of Digi International. Digi providesthisdocument “asis,” without warranty of
any kind, expressed or implied, including, but not limited to, the implied warrantiesof fitnessor
merchantability for a particular purpose. Digi may make improvementsand/or changesin thismanual
or in theproduct(s) and/or theprogram(s) described in thismanual at anytime.
Warranty
To view product warranty information, go to thefollowing website:

Revisionhistory—90002537
IX40User Guide 4
www.digi.com/howtobuy/terms
Customer support
Gather support information: Before contactingDigi technical support for help, gather thefollowing
information:
Product nameand model
Product serial number (s)
Firmwareversion
Operatingsystem/browser (if applicable)
Logs(from timeof reported issue)
Trace(if possible)
Description of issue
Stepsto reproduce
Contact Digi technical support: Digi offersmultipletechnical support plansand servicepackages.
Contact usat +1952.912.3444or visit usat www.digi.com/support.
Feedback
To providefeedback on thisdocument, email your commentsto
[e-mail]
Includethedocument title and part number (IX40 User Guide, 90002537 A) in thesubject line of your
email.

Contents
Revision history—90002537 2
What'snew in IX40version 23.12
Digi IX40Quick start
Step 1: Connect your Digi IX40 18
Step 2: Set up accessto Digi Remote Manager 20
Step 3: Add your router to Digi Remote Manager 20
Step 4: Complete setup 20
Step 5: Configure cellular APN 20
About theDigi IX40
Digi IX40 key features 23
Digi IX40accessories 23
Digi IX40external hardware 23
Digi IX40front 24
Digi IX40back 25
Digi IX40bottom 25
Digi IX40left side 26
Digi IX40front view 26
IX40bottom view 40
IX40left sideview 41
IX40back view 42
Digi IX40hardwaresetup 43
Apply dielectric grease 44
Tipsfor improvingcellular signal strength 44
Connect datacables 44
Configuration for extremethermal conditions 44
Firmwareconfiguration
Primary Responder mode 48
Differencesbetween standard firmware operation and Primary Responder mode 48
Enable Primary Responder mode 48
Changethedefault password for theadmin user 50
Configuration methods 51
UsingDigi RemoteManager 52
Usingthelocal web interface 52
IX40User Guide 5

IX40User Guide 6
Logout of theweb interface 53
Usethelocal REST API to configuretheIX40device 53
UsetheGET method to return deviceconfiguration information 53
Usethe POSTmethod to modify device configuration parametersand list arrays 55
UsetheDELETEmethod to remove itemsfrom alist array 56
Usingthecommand line 58
Accessthecommand lineinterface 58
Login to thecommand lineinterface 58
Exit thecommand lineinterface 59
Central management
Digi RemoteManager support 61
Certificate-based enhanced security 61
Configureyour devicefor Digi RemoteManager support 61
Collect devicehealth dataand set thesampleinterval 68
Enableevent logupload to Digi RemoteManager 71
Reach Digi RemoteManager on aprivatenetwork 73
Pinholemethod 73
Proxy server method 73
VPNTunnel method 73
Loginto Digi RemoteManager 74
UseDigi RemoteManager to view and manageyour device 75
Add adeviceto RemoteManager 75
Add adeviceto RemoteManager usinginformation from thelabel 75
Add adeviceto RemoteManager usingyour RemoteManager login credentials 76
Configure multiple IX40 devicesby using Digi Remote Manager configurations 77
View Digi RemoteManager connection status 78
Learn more 79
Interfaces
WideAreaNetworks(WANs) 81
WideArea Networks(WANs) and WirelessWideArea Networks(WWANs) 82
Configure WAN/WWANpriority and default routemetrics 82
WAN/WWANfailover 85
Configure SureLink activerecovery to detect WAN/WWANfailures 86
Configurethedeviceto reboot when a failureisdetected 101
DisableSureLink 114
Example: Usea pingtest for WANfailover from Ethernet to cellular 122
UsingEthernet devicesin aWAN 125
Usingcellular modemsin a WirelessWAN(WWAN) 125
ConfigureaWideAreaNetwork (WAN) 151
ConfigureaWirelessWideAreaNetwork (WWAN) 159
Show WANand WWANstatusand statistics 170
Deletea WANor WWAN 172
Default outbound WAN/WWANports 173
Local AreaNetworks(LANs) 174
About Local AreaNetworks(LANs) 175
ConfigureaLocal Area Network (LAN) 175
ConfiguretheWAN/ETH1port asa LANor in abridge 182
Changethedefault LANsubnet 188
Show LANstatusand statistics 189
Deletea LAN 191

IX40User Guide 7
DHCPservers 192
Default serviceslisteningon LAN ports 208
Configurean interfaceto operatein passthrough mode. 209
Virtual LANs(VLANs) 215
Createa trunked VLANroute 216
Createa VLANusingswitchport mode 217
Bridging 220
Configureabridge 221
Show SureLink statusand statistics 224
Show SureLink State 224
Show SureLink statusfor all interfaces 224
Show SureLink statusfor aspecificinterface 225
Show SureLink statusfor all IPsec tunnels 226
Show SureLink statusfor aspecificIPsec tunnel 226
Show SureLink statusfor all OpenVPNclients 227
Show SureLink statusfor aspecificOpenVPNclient 227
ConfigureaTCPconnection timeout 228
Serial port
Default serial port configuration 229
Serial modeoptions 229
View serial port information 229
Default serial port configuration 229
ConfigureLogin mode 230
ConfigureRemoteAccessmode 233
ConfigureApplication mode 249
ConfigurePPPdial-in mode 251
ConfigureUDPserial mode 257
ConfigureModem emulator mode 267
ConfigureModbusmode 270
ConfigureRealPort modeusingtheDigi Navigator 273
Installation and configuration process 273
Digi Navigator features 273
Install theDigi Navigator 274
ConfigureRealPort on a Digi devicefrom theDigi Navigator 275
Digi Navigator device discovery process 277
Servicesused to discover a devicewhen connected to a network 277
Digi Navigator application features 282
Advanced RealPort configuration without usingtheDigi Navigator 285
WindowsOperatingSystem 286
LinuxOperatingSystem 286
Download theRealPort driver 286
ConfigureRealPort on your laptop 286
Configuretheserial port for RealPort mode 288
ConfiguretheRealPort service 292
Show serial statusand statistics 294
Review theserial port messagelog 295
Routing
IProuting 298
Configureastatic route 299
Deletea staticroute 302

IX40User Guide 8
Policy-based routing 303
Configurearoutingpolicy 304
Example: Dual WAN policy-based routing 311
Example: Domain-based routingwith dual WAN 313
Example: Routetrafficto a specificWANinterfacebased on theclient MAC address 316
Routingservices 321
Configureroutingservices 322
Show theroutingtable 324
DynamicDNS 325
Configuredynamic DNS 326
Virtual Router Redundancy Protocol (VRRP) 330
VRRP+ 330
ConfigureVRRP 331
ConfigureVRRP+ 334
Example: VRRP/VRRP+configuration 341
Configuredeviceone(master device) 341
Configuredevicetwo (backup device) 345
Show VRRPstatusand statistics 350
Virtual PrivateNetworks(VPN)
IPsec 354
IPsec dataprotection 354
IPsec mode 354
IPsec modes 354
Internet Key Exchange (IKE) settings 354
Authentication 355
Configurean IPsec tunnel 355
ConfigureIPsec failover 382
Configure SureLink activerecovery for IPsec 385
Show IPsecstatusand statistics 400
Debugan IPsec configuration 401
ConfigureaSimpleCertificateEnrollment Protocol client 403
Example: SCEPclient configuration with Fortinet SCEPserver 409
Show SCEPclient statusand information 414
OpenVPN 416
Configurean OpenVPNserver 417
Configurean OpenVPNAuthentication Group and User 425
Configurean OpenVPNclient byusingan .ovpn file 430
Configurean OpenVPNclient without usingan .ovpn file 433
Configure SureLink activerecovery for OpenVPN 437
Show OpenVPNserver statusand statistics 452
Show OpenVPNclient statusand statistics 453
GenericRoutingEncapsulation (GRE) 455
Configuringa GRE tunnel 455
Show GREtunnels 460
Example: GREtunnel over an IPSec tunnel 461
DynamicMultipoint VPN(DMVPN) 475
ConfigureaDMVPNspoke 476
L2TP 482
ConfigureaPPP-over-L2TPtunnel 482
L2TPwith IPsec 492
Show L2TPtunnel status 492
L2TPv3Ethernet 494
Configurean L2TPv3tunnel 494

IX40User Guide 9
Show L2TPV3tunnel status 498
MACsec 499
ConfigureaMACsectunnel 499
NEMO 502
ConfigureaNEMOtunnel 502
Show NEMOstatus 507
Services
Allow remoteaccessfor web administration and SSH 510
Configuretheweb administration service 513
ConfigureSSH access 522
UseSSHwith key authentication 529
GeneratingSSHkey pairs 529
Configuretelnet access 532
ConfigureDNS 537
Show DNSserver 542
WAN bonding 543
UseDigi RemoteManager to enableand configureWANbonding on multipledevices 544
ConfigureWAN bondingon your local device 547
Show WANbondingstatusand statistics 552
SimpleNetwork Management Protocol (SNMP) 555
SNMPSecurity 555
ConfigureSimpleNetwork Management Protocol (SNMP) 555
Download MIBs 560
Location information 562
Configurethelocation service 563
Configurethedeviceto usea user-defined static location 565
Configurethedeviceto accept location messagesfrom external sources 567
Forward location information to a remote host 570
Configuregeofencing 577
Show location information 588
Modbusgateway 590
ConfiguretheModbusgateway 591
Show Modbusgateway statusand statistics 604
System time 607
Configurethesystem time 607
Manually set the system dateand time 611
Network TimeProtocol 611
Configurethedeviceasan NTPserver 612
Show statusand statisticsof theNTPserver 617
Configureamulticast route 617
Ethernet network bonding 619
Enable service discovery (mDNS) 624
UsetheMQTT broker service 627
Show MQTT broker information 637
UsetheiPerf service 638
Exampleperformancetest usingiPerf3 642
Configurethepingresponder service 642
Exampleperformancetest usingiPerf3 646
Applications
Develop Python applications 648

IX40User Guide 10
Set up theIX40for Python development 649
Createand test aPython application 649
Python modules 653
Theuse(led) function 681
ReleasingtheLEDsto system control 681
UsePython to control thecolor of multi-colored LEDs 681
Example: Set theLTEconnection indicator to flashing purple 683
Set up theIX40 to automatically run your applications 691
Configurescriptsto run automatically 692
Show script information 699
Stop a script that iscurrently running 699
Start an interactivePython session 700
Run aPython application at theshell prompt 701
Configurescriptsto run manually 703
Task one: Upload theapplication 703
Task two: Configure theapplication to run automatically 705
Start amanual script 708
User authentication
IX40user authentication 711
User authentication methods 711
Add anew authentication method 713
Deletean authentication method 715
Rearrangetheposition of authentication methods 716
Authentication groups 718
Changetheaccessrightsfor a predefined group 720
Add an authentication group 722
Deletean authentication group 726
Local users 728
Changea local user'spassword 729
Configurealocal user 731
Deletea local user 738
Terminal AccessController Access-Control System Plus(TACACS+) 740
TACACS+user configuration 741
TACACS+server failover and fallback to local authentication 742
Configureyour IX40deviceto usea TACACS+server 742
RemoteAuthentication Dial-In User Service(RADIUS) 747
RADIUSuser configuration 748
RADIUSserver failover and fallback to local configuration 748
Configureyour IX40deviceto usea RADIUSserver 749
LDAP 752
LDAPuser configuration 754
LDAPserver failover and fallback to local configuration 755
Configureyour IX40deviceto usean LDAPserver 755
Configureserial authentication 760
Disableshell access 762
Set theidletimeout for IX40users 764
Exampleuser configuration 766
Example 1: Administrator user with local authentication 766
Example 2: RADIUS, TACACS+, and local authentication for oneuser 768