Digi Connect IT Mini User manual

Digi Connect IT® Mini
User Guide
User Guide

Revision history—90002358
Revision Date Description
D June 2020 Release of DigiConnect IT Mini firmware version
20.5:
nSupport for LDAP user authentication.
nFirmware installation from the Digi
firmware server.
nEnhanced Digi Remote Manager support:
lSupport for remote proxy server for
Digi Remote Manager.
lWatchdog support for connection to
Digi Remote Manager.
lLocally authenticate CLI option
added to Digi Remote Manager
configuration to control whether a
user is required to provide device-
level authentication when accessing
the console of the device through
Digi Remote Manager.
lAdded a randomized two minute
delay window for uploading health
metrics to the Digi Remote Manager
to avoid situations where multiple
devices are uploading metrics at the
same time.
E June 2020 nAdded note that for devices
manufactured prior to the release of
firmware version 19.11.x, the default
user name may be root.
nAdded additional web UI connection
information.
F July 2020 Updated information about the factory default
network settings.
G August 2020 Added information about running Python
applications.
Digi Connect IT® Mini User Guide 2

Revision Date Description
H September 2020 Release of Digi Connect IT Mini firmware version
20.8:
nSupport for NEMO/DMNR virtual private
networks.
nSupport for serial Modbus Gateway.
nSupport for VRRP+, an extension to the
VRRP standard that uses network
probing to monitor connections through
VRRP-enabled devices.
nCloud service enhancements:
lReduced data usage for reporting
health metrics to Digi Remote
Manager.
Added Monitoring >Device Health >
Only report changed values to Digi
Remote Manager option to control
sending metrics to Digi Remote
Manager on the basis of whether the
values have changed since they were
last reported.
lAdded Monitoring >Device Health >
Data point tuning configuration
options to fine tune what datapoints
are uploaded as health metrics to
Digi Remote Manager.
lAdded the ability to select Digi aView
as the cloud service.
nAdded the ability to duplicate firmware
to copy the active firmware to the
secondary firmware partition.
nMoved the update firmware CLI
command to system firmware update.
nAdded new Authoritative option under
TACACS+, RADIUS, and LDAP user
authentication methods to prevent
falling back to additional authentication
methods.
nCisco Umbrella content filtering.
nAdded options under System >Log >
Server list to allow users to specify the
TCP/UDP protocol and port of the
remote syslog server.
nSerial port enhancements:
Digi Connect IT® Mini User Guide 3

Revision Date Description
lAdded configuration option under
Serial >TCP connection to specify
encrypted connection types.
lAdded configuration option under
Serial >TCP/Telnet/SSH
connections to enable/disable TCP
keep-alive messages and nodelay.
nEnhanced SMS support:
lAdded System >Scheduled tasks >
Allow scheduled scripts parameter
to allow custom python scripts to
handle sending/receiving SMS
messages
lAdded the digidevice.sms python
module for sending/receiving SMS
messages in a custom python script.
nMQTT client support via Paho Python
module.
nAdded a random unprivileged port for
performing ntp time syncs if standard
port 123 fails.
nScripting enhancements:
lAdded a Status >Scripts page in the
web UI and show scripts command
to the Admin CLI to view custom
scripts and applications configured in
the device, along with their status.
Added the system scripts stop
command to the Admin CLI to stop a
custom script or application.
Trademarks and copyright
Digi, Digi International, and the Digi logo are trademarks or registered trademarks in the United
States and other countries worldwide. All other trademarks mentioned in this document are the
property of their respective owners.
© 2020 Digi International Inc. All rights reserved.
Disclaimers
Information in this document is subject to change without notice and does not represent a
commitment on the part of Digi International. Digi provides this document “as is,” without warranty of
any kind, expressed or implied, including, but not limited to, the implied warranties of fitness or
merchantability for a particular purpose. Digi may make improvements and/or changes in this manual
or in the product(s) and/or the program(s) described in this manual at any time.
Digi Connect IT® Mini User Guide 4

Warranty
To view product warranty information, go to the following website:
www.digi.com/howtobuy/terms
Customer support
Gather support information: Before contacting Digi technical support for help, gather the following
information:
Product name and model
Product serial number (s)
Firmware version
Operating system/browser (if applicable)
Logs (from time of reported issue)
Trace (if possible)
Description of issue
Steps to reproduce
Contact Digi technical support: Digi offers multiple technical support plans and service packages.
Contact us at +1 952.912.3444 or visit us at www.digi.com/support.
Feedback
To provide feedback on this document, email your comments to
[e-mail]
Include the document title and part number (Digi Connect IT® Mini User Guide, 90002358 C) in the
subject line of your email.
Digi Connect IT® Mini User Guide 5

Contents
Digi Connect IT® Mini User Guide
Get started with the Connect IT Mini
Verify product components 16
Included equipment 16
Required additional equipment 17
Connect the hardware to a network 17
Connect hardware and connect to a cellular network 17
Connect hardware and connect to site network using an Ethernet port 18
Connect equipment to the Connect IT
Connect equipment to the Connect IT serial ports 19
Serial connector pinout 19
Connect equipment to the Connect IT USB port 20
Configuration and management
Review Connect IT Mini default settings 23
Local WebUI 23
Digi Remote Manager 23
Default interface configuration 23
Other default configuration settings 24
Change the default password for the admin user 24
Configuration methods 25
Using Digi Remote Manager 27
Access Digi Remote Manager 27
Using the web interface 27
Log out of the web interface 28
Manually configure a PCto connect to the Connect IT 28
Using the command line 30
Access the terminal screen from the web UI 30
Access the command line interface 30
Log in to the command line interface 31
Exit the command line interface 32
Digi Connect IT® Mini User Guide 6

Digi Connect IT® Mini User Guide 7
Configure Remote Power Management
Configure communication between the Connect IT, power controller, and a device 33
Create an access control to specify which users can access which outlets 33
Manage power to the power controller outlets 33
Configure the Connect IT to connect to a power controller using a serial port 34
Configure a serial port for Power Management 34
Connect a power controller to the Connect IT serial port 35
Configure the Connect IT to connect to a power controller using the network 35
Configure communication with a power controller using the network 35
Connect the Connect IT to your network 36
Optional: Connect a 3rd-party device to the serial port on the Connect IT and then to the
power controller 36
Create an access control group for power management and assign to users 36
Manage the power to the power controller outlets from the Connect IT 37
Control the outlet power from a terminal (all users) 37
View power controller status and manage power (Administrators) 38
Control the outlet power from the Serial Status page 38
Interfaces
Wide Area Networks (WANs) 41
Wide Area Networks (WANs) and Wireless Wide Area Networks (WWANs) 42
Configure WAN/WWAN priority and default route metrics 42
WAN/WWAN failover 44
Configure SureLink active recovery to detect WAN/WWAN failures 45
Configure the device to reboot when a failure is detected 52
Disable SureLink 58
Example: Use a ping test for WAN failover from Ethernet to cellular 61
Using cellular modems in a Wireless WAN (WWAN) 64
Configure a Wide Area Network (WAN) 77
Configure a Wireless Wide Area Network (WWAN) 83
Show WAN and WWAN status and statistics 92
Delete a WAN or WWAN. 95
Local Area Networks (LANs) 97
About Local Area Networks (LANs) 98
Configure a LAN 98
Show LAN status and statistics 104
Delete a LAN 105
DHCP servers 107
Create a Virtual LAN (VLAN) route 121
Bridging 124
Configure a bridge 125
Serial port
Configure the serial port 129
Show serial status and statistics 134
Serial Status page 135
Routing
IP routing 138

Digi Connect IT® Mini User Guide 8
Configure a static route 139
Delete a static route 142
Policy-based routing 143
Configure a routing policy 144
Routing services 152
Configure routing services 152
Show the routing table 155
Dynamic DNS 156
Configure dynamic DNS 156
Virtual Router Redundancy Protocol (VRRP) 161
VRRP+ 161
Configure VRRP 161
Configure VRRP+ 165
Example: VRRP/VRRP+ configuration 172
Configure device one (master device) 173
Configure device two (backup device) 176
Show VRRP status and statistics 181
Virtual Private Networks (VPN)
IPsec 185
IPsec data protection 185
IPsec modes 185
Internet Key Exchange (IKE) settings 185
Authentication 186
Configure an IPsec tunnel 186
Configure IPsec failover 208
Configure SureLink active recovery for IPsec 209
Show IPsec status and statistics 215
OpenVPN 217
Configure an OpenVPN server 218
Configure an OpenVPN Authentication Group and User 227
Configure an OpenVPN client by using an .ovpn file 231
Configure an OpenVPN client without using an .ovpn file 233
Configure active recovery for OpenVPN 238
Show OpenVPN server status and statistics 244
Show OpenVPN client status and statistics 245
Generic Routing Encapsulation (GRE) 247
Configuring a GREtunnel 247
Show GRE tunnels 251
Example: GRE tunnel over an IPSec tunnel 252
NEMO 267
Configure a NEMO tunnel 267
Show NEMO status 273
Services
Allow remote access for web administration and SSH 276
Configure the web administration service 279
Configure SSHaccess 286
Use SSH with key authentication 292
Generating SSH key pairs 292
Configure telnet access 294
Configure DNS 298

Digi Connect IT® Mini User Guide 9
Simple Network Management Protocol (SNMP) 306
SNMP Security 306
Configure Simple Network Management Protocol (SNMP) 306
Download MIBs 310
Configure the Modbus gateway 311
Configure gateway servers 313
Configure clients 314
System time 325
Configure the system time 325
Network Time Protocol 327
Configure the device as an NTP server 328
Configure a multicast route 334
Enable service discovery (mDNS) 337
Use the iPerf service 340
Example performance test using Iperf3 344
Applications
Configure applications to run automatically 346
Task one: Upload the application 346
Task two: Configure the application to run automatically 348
Run a Python application at the shell prompt 352
Start an interactive Python session 354
Digidevice module 355
Use digidevice.cli to execute CLI commands 356
Use digidevice.datapoint to upload custom datapoints to Digi Remote Manager 357
Use digidevice.config for device configuration 359
Use Python to respond to Digi Remote Manager SCI requests 361
Use digidevice runtime to access the runtime database 369
Use Python to upload the device name to Digi Remote Manager 371
Use Python to send and receive SMS messages 373
Use Python to access serial ports 375
Use the Paho MQTTpython library 376
Stop a script that is currently running 379
Show script information 380
User authentication
Connect IT Mini user authentication 384
User authentication methods 384
Add a new authentication method 386
Delete an authentication method 388
Rearrange the position of authentication methods 389
Authentication groups 391
Change the access rights for a predefined group 392
Add an authentication group 394
Delete an authentication group 398
Local users 400
Change a local user's password 401
Configure a local user 402
Delete a local user 409
Terminal Access Controller Access-Control System Plus (TACACS+) 412
TACACS+ user configuration 413
TACACS+ server failover and fallback to local authentication 414

Digi Connect IT® Mini User Guide 10
Configure your Connect IT Mini device to use a TACACS+ server 414
Remote Authentication Dial-In User Service (RADIUS) 420
RADIUS user configuration 421
RADIUS server failover and fallback to local configuration 421
Configure your Connect IT Mini device to use a RADIUS server 422
LDAP 427
LDAP user configuration 428
LDAP server failover and fallback to local configuration 429
Configure your Connect IT Mini device to use an LDAP server 429
Disable shell access 434
Set the idle timeout for Connect IT Mini users 435
Example user configuration 437
Example 1: Administrator user with local authentication 437
Example 2: RADIUS, TACACS+, and local authentication for one user 439
Firewall
Firewall configuration 450
Create a custom firewall zone 450
Configure the firewall zone for a network interface 452
Delete a custom firewall zone 453
Port forwarding rules 455
Configure port forwarding 455
Delete a port forwarding rule 460
Packet filtering 462
Configure packet filtering 462
Enable or disable a packet filtering rule 466
Delete a packet filtering rule 467
Configure custom firewall rules 469
Configure Quality of Service options 471
System administration
Review device status 484
Configure system information 485
Update system firmware 487
Manage firmware updates using Digi Remote Manager 487
Certificate management for firmware images 487
Dual boot behavior 490
Update cellular module firmware 491
Reboot your Connect IT Mini device 492
Reboot your device immediately 493
Schedule reboots of your device 493
Reset the device to factory defaults 494
Configuration files 498
Save configuration changes 498
Save configuration to a file 499
Restore the device configuration 500
Schedule system maintenance tasks 503
Monitoring
intelliFlow 511

Digi Connect IT® Mini User Guide 11
Enable intelliFlow 511
Use intelliFlow to display average CPU and RAMusage 514
Use intelliFlow to display top data usage information 515
Use intelliFlow to display data usage by host over time 517
Configure NetFlow Probe 518
Central management
Digi Remote Manager support 524
Configure Digi Remote Manager 524
Collect device health data and set the sample interval 530
Log into Digi Remote Manager 532
Use Digi Remote Manager to view and manage your device 534
Add a device to Digi Remote Manager 535
View Digi Remote Manager connection status 535
Use the Digi Remote Manager mobile app 536
Configure multiple devices using profiles 537
Learn more 537
File system
The Connect IT Mini local file system 539
Display directory contents 539
Create a directory 540
Display file contents 541
Copy a file or directory 541
Move or rename a file or directory 542
Delete a file or directory 543
Upload and download files 544
Upload and download files by using the WebUI 544
Upload and download files by using the Secure Copy command 545
Upload and download files using SFTP 546
Diagnostics
Generate a support report 549
View system event logs 550
View System Logs 550
View Event Logs 553
Configure syslog servers 555
Configure options for the event and system logs 557
Analyze network traffic 562
Configure packet capture for the network analyzer 563
Example filters for capturing data traffic 567
Capture packets from the command line 568
Stop capturing packets 569
Show captured traffic data 569
Save captured data traffic to a file 571
Download captured data to your PC 572
Clear captured data 573
Use the ping command to troubleshoot network connections 574
Ping to check internet connection 574
Stop ping commands 574

Digi Connect IT® Mini User Guide 12
Use the traceroute command to diagnose IProuting problems 574
Hardware
Connect IT Mini hardware and LEDs 576
Top panel and LEDs 576
Left side of the Connect IT 577
Right side of the Connect IT 578
Signal strength 578
Exchange power tips 579
Troubleshooting
Use the RESETbutton to reset your device to the factory defaults 580
Tips for improving cellular signal strength 580
Regulatory and safety information
FCC certifications 581
USA 581
European Union 581
Safety warnings 581
Command line interface
Access the command line interface 584
Log in to the command line interface 584
Exit the command line interface 585
Execute a command from the web interface 585
Display help for commands and parameters 586
The help command 586
The question mark (?) command 586
Display help for individual commands 587
Use the Tab key or the space bar to display abbreviated help 588
Auto-complete commands and parameters 588
Available commands 589
Use the scp command 590
Display status and statistics using the show command 591
show config 591
show system 592
show network 592
Device configuration using the command line interface 592
Execute configuration commands at the root Admin CLI prompt 593
Display help for the config command from the root Admin CLI prompt 593
Configuration mode 595
Enable configuration mode 595
Enter configuration commands in configuration mode 595
Save changes and exit configuration mode 595
Exit configuration mode without saving changes 596
Configuration actions 596
Display command line help in configuration mode 597
Move within the configuration schema 599
Manage elements in lists 600

Digi Connect IT® Mini User Guide 13
The revert command 602
Enter strings in configuration commands 604
Example: Create a new user by using the command line 604
Command line reference 607
analyzer 608
cp 609
help 610
ls 611
mkdir 612
modem 613
modem puk status [imei STRING] [name STRING] 616
more 618
mv 619
ping 620
reboot 621
rm 622
scp 623
show 624
system 633
traceroute 635

Digi Connect IT® Mini User Guide
This guide provides reference and usage information for the Connect IT.
The Connect IT Mini provides out-of-band management for remote network or infrastructure devices.
Cellular connectivity, available as standard in some models and as an option in other models, provides
fast reliable cellular connections without additional equipment. All connections are encrypted for
security.
Digi Connect IT® Mini User Guide 14

Get started with the Connect IT Mini
This section explains what comes with each Connect IT model, how to install the necessary software,
and how to connect the hardware.
1. Verify product components.
2. Connect the hardware to a network.
3. Access the device from the web UI.
4. Update the firmware on the Connect IT.
5. Change the password.
6. Administrators only: Additional configuration to the Connect IT can be done in Remote Manager
or in the Connect IT's local web user interface.
7. Connect equipment to the Connect ITMini.
Digi Connect IT® Mini User Guide 15

Get started with the Connect IT Mini Verify product components
Digi Connect IT® Mini User Guide 16
Verify product components
Verify that you have the following included equipment.
Included equipment
Equipment Description
Digi Connect IT
For detailed information about the front and back panels, see
Connect IT Mini hardware and LEDs.
Power supply kit If you purchased the USvariant (-OUS) you will receive a USplug
adapter.
If you purchased the global variant (-GLB) you will receive the
Universal power supply kit.
For instructions about exchanging power tips, see Exchange
power tips.
Antenna Antenna for use with an LTEmodem.

Get started with the Connect IT Mini Connect the hardware to a network
Digi Connect IT® Mini User Guide 17
Required additional equipment
Equipment Description
Ethernet cable CAT 5/6 Ethernet cable
The cable is used to connect your PC to the Connect IT for initial
configuration.
See .
SIMcard An activated SIM card provided by your cellular network operator.
The Connect IT supports the standard mini-SIM cards (2FF).
Note This is required only if you are connecting to a cellular
network. See Connect hardware and connect to a cellular
network.
Connect the hardware to a network
These sections explain how to connect to either a cellular network or to a site network using an
Ethernet cable.
nConnect hardware and connect to a cellular network
nConnect hardware and connect to site network using an Ethernet port
Connect hardware and connect to a cellular network
This section explains how to connect the Connect IT hardware and then connect to a cellular network.
Prerequisites
nActivated SIM card from your cellular network provider.
nThe Connect IT supports a standard mini-SIM (2FF).
Note By default, the device uses a cellular network. As an alternative, you can also use an Ethernet
LAN connection. See Connect hardware and connect to site network using an Ethernet port.
To connect the hardware and connect to the cellular network:
1. Make sure that the Connect IT is powered down and not connected to a power supply.
2. Insert your activated SIM card into the SIM slot, which is on the left side of the Connect IT. The
notched end of SIM card should be inserted first, with the gold metal contacts facing down. You
will hear a click once the SIM is completely inserted.
3. Attach the included antenna. While gripping the metal connector section with your thumb and
forefinger, tighten until secure. Do not tighten the antenna by holding any part of the plastic
antenna housing.
4. Connect the power supply unit to the device.
5. Verify the cellular network signal strength indicator on the front of the Connect IT Mini shows
two or more bars for proper operation. See Signal strength.

Get started with the Connect IT Mini Connect the hardware to a network
Digi Connect IT® Mini User Guide 18
Connect hardware and connect to site network using an Ethernet
port
This section explains how to connect the Connect IT hardware and then connect to a site network,
using an Ethernet cable.
Prerequisites
nCAT5/6 Ethernet cable, which must be purchased separately.
To connect the hardware and connect to a site network:
1. Plug the power supply unit into an AC power outlet and connect the other end to the PWR plug
on the Connect IT Mini.
2. Connect one end of an Ethernet cable to your site gateway.
3. Connect the other end of the Ethernet cable to the ETH port on the Connect IT Mini.

Connect equipment to the Connect IT
This section explains how to connect equipment to the Connect IT.
Connect equipment to the Connect IT serial ports
After your device is connected and powered up, you can connect equipment to the device using the
serial ports.
The serial port on the Connect IT provides console access to connected critical equipment through the
cellular network, and optionally through a connected Ethernet LAN. Connect your network device to
the Connect IT serial port. For pinout information, see Serial connector pinout.
You must use a cable with an RJ45 connector to connect to the Connect IT with an RJ45, DB9F or
DB9M connector, as determined by your device type, to terminate to your device. Consult the user
guide for the device you are connecting to the Connect IT to determine the connector type, cable type,
and pinout positions for your specific device.
The serial port is enabled by default. The network devices connected to the serial ports may be
accessed using Remote Manager, the local web user interface, TCP, telnet, or SSH connections. TCP,
telnet and SSH connections to serial ports are disabled by default and must be enabled by a device-
specific configuration.
Serial connector pinout
The RS232 standard requires support for baud rates up to 9600 baud on shielded multi-core cable up
to 50 feet (15 meters) long. For the Connect IT the use of standard CAT 5 cables enables serial
communication at all baud rates up to 50 feet. CAT5 unshielded twisted pair cable lengths much
longer than 50 feet have been verified at 9600 baud but are non-standard and are not guaranteed.
Digi Connect IT® Mini User Guide 19

Connect equipment to the Connect IT Connect equipment to the Connect IT USB port
Digi Connect IT® Mini User Guide 20
The Digi Connect IT Mini RS232 serial port is DTE and has the following pin configuration.
Console port and
DTE mode Signal name Description
1 RTS Request to send Output from
Connect IT
2DCD Data carrier detect Input to Connect IT
3 RXD Receive data Input to Connect IT
Signal
4/5 GND Ground Ground
6 TXD Transmit data Output from
Connect IT
7 DTR Data terminal ready Output from
Connect IT
8 CTS Clear to send Input to Connect IT
Note Ring Indicate (RI) and Data Set Ready (DSR) are not implemented.
The serial port uses a female RJ45 jack to enable connection using UTP Ethernet cabling.
Connect equipment to the Connect IT USB port
The USB port on the Connect IT can provide console access to USB-based console ports or host a USB
device. The Connect IT has a TYPE A port. You should reference your device to select the proper USB
cable.