Digi IX20 User manual

IX20
User Guide

Revision history—90002381
Revision Date Description
A March 2020 Initial release of the IX20 User Guide.
B June 2020 Release of Digi IX20 firmware version 20.5:
nSupport for LDAP user authentication.
nPreconfigured Wi-Fi SSIDand password enabled by
default (available for the Wi-Fi enabled IX20W model only).
lThe default SSID for the access point is:
Digi-IX20W-serial_number
lDefault password is the unique password as found on
the device's label.
You will need to change the SSIDand password before
any configuration changes can be saved.
nWi-Fi client isolation options.
nFirmware installation from the Digi firmware server.
nEnhanced Digi Remote Manager support:
lSupport for remote proxy server for Digi Remote
Manager.
lWatchdog support for connection to Digi Remote
Manager.
lLocally authenticate CLI option added to Digi
Remote Manager configuration to control whether a
user is required to provide device-level authentication
when accessing the console of the device through
Digi Remote Manager.
lAdded a randomized two minute delay window for
uploading health metrics to the Digi Remote Manager
to avoid situations where multiple devices are
uploading metrics at the same time.
nEnhanced Python support:
lSupport for the Python serial module to allow
programmatic access to serial ports.
lSupport for the Python HID module to allow
programmatic access to a USB Human Interface
Device (HID) from within a Python script.
nApplication mode for serial ports to allow for Python
programmatic control.
IX20 User Guide 2

Revision Date Description
C September 2020 Release of Digi IX20 firmware version 20.8:
nSupport for NEMO/DMNR virtual private networks.
nSupport for serial Modbus Gateway.
nSupport for Ethernet network bonding.
nSupport for VRRP+, an extension to the VRRP standard
that uses network probing to monitor connections
through VRRP-enabled devices.
nCloud service enhancements:
lReduced data usage for reporting health metrics to
Digi Remote Manager.
Added Monitoring >Device Health >Only report
changed values to Digi Remote Manager option to
control sending metrics to Digi Remote Manager on
the basis of whether the values have changed since
they were last reported.
lAdded Monitoring >Device Health >Data point
tuning configuration options to fine tune what
datapoints are uploaded as health metrics to Digi
Remote Manager.
lAdded the ability to select Digi aView as the cloud
service.
nAdded the ability to duplicate firmware to copy the active
firmware to the secondary firmware partition.
nMoved the update firmware CLI command to system
firmware update.
nAdded new Authoritative option under TACACS+,
RADIUS, and LDAP user authentication methods to
prevent falling back to additional authentication
methods.
nCisco Umbrella content filtering.
nWi-Fi enhancements:
lAdded new options under Network >Wi-Fi to control
Tx Power of the Wi-Fi module.
lAdded support for multiple RADIUS servers for WPA2
Enterprise.
nAdded options under System >Log >Server list to allow
users to specify the TCP/UDP protocol and port of the
remote syslog server.
nSerial port enhancements:
lAdded configuration option under Serial >TCP
connection to specify encrypted connection types.
lAdded configuration option under Serial >
IX20 User Guide 3

Revision Date Description
TCP/Telnet/SSH connections to enable/disable TCP
keep-alive messages and nodelay.
nEnhanced SMS support:
lAdded System >Scheduled tasks >Allow
scheduled scripts parameter to allow custom
python scripts to handle sending/receiving SMS
messages
lAdded the digidevice.sms python module for
sending/receiving SMS messages in a custom python
script.
nMQTT client support via Paho Python module.
nAdded a random unprivileged port for performing ntp
time syncs if standard port 123 fails.
nScripting enhancements:
lAdded a Status >Scripts page in the web UI and
show scripts command to the Admin CLI to view
custom scripts and applications configured in the
device, along with their status.
Added the system scripts stop command to the
Admin CLI to stop a custom script or application.
Trademarks and copyright
Digi, Digi International, and the Digi logo are trademarks or registered trademarks in the United
States and other countries worldwide. All other trademarks mentioned in this document are the
property of their respective owners.
© 2020 Digi International Inc. All rights reserved.
Disclaimers
Information in this document is subject to change without notice and does not represent a
commitment on the part of Digi International. Digi provides this document “as is,” without warranty of
any kind, expressed or implied, including, but not limited to, the implied warranties of fitness or
merchantability for a particular purpose. Digi may make improvements and/or changes in this manual
or in the product(s) and/or the program(s) described in this manual at any time.
Warranty
To view product warranty information, go to the following website:
www.digi.com/howtobuy/terms
Customer support
Gather support information: Before contacting Digi technical support for help, gather the following
information:
IX20 User Guide 4

Product name and model
Product serial number (s)
Firmware version
Operating system/browser (if applicable)
Logs (from time of reported issue)
Trace (if possible)
Description of issue
Steps to reproduce
Contact Digi technical support: Digi offers multiple technical support plans and service packages.
Contact us at +1 952.912.3444 or visit us at www.digi.com/support.
Feedback
To provide feedback on this document, email your comments to
[e-mail]
Include the document title and part number (IX20 User Guide, 90002381 C) in the subject line of your
email.
IX20 User Guide 5

Contents
Revision history—90002381 2
What's new in Digi IX20 version 20.8
Digi IX20 Quick start
Quick start using the Digi Remote Manager mobile app 16
Step 1: What's in the box 16
Step 2: Gather accessories 18
Step 3: Connect 18
Step 4: Power up 19
Step 5: Configure 20
Digi IX20 hardware reference
Digi IX20 features and specifications 21
IX20 accessories 21
IX20 front view 21
IX20 LEDs 22
Power 23
INT 23
Wi-Fi Service (IX20W model only) 23
SIM1 23
SIM2 23
LTE 24
Signal quality indicators 24
Ethernet Link and Activity 25
Signal quality bars explained 25
IX20 power supply requirements 26
Digi IX20 serial connector pinout 26
Configuration for extreme thermal conditions 27
Hardware setup
Install SIM cards in the Plug-in LTE modem 31
Tips for improving cellular signal strength 32
Connect data cables 32
Mount the IX20 device 32
Attach to a mounting surface by using the two mounting tabs 33
Attach to DIN rail with clip 33
IX20 User Guide 6

IX20 User Guide 7
Attach to DIN rail with bracket 34
Configuration and management
Review IX20 default settings 36
Local WebUI 36
Digi Remote Manager 36
Default interface configuration 36
Other default configuration settings 37
Change the default password for the admin user 38
Reset default SSID and pre-shared key for the preconfigured Wi-Fi access point 40
Configuration methods 42
Using Digi Remote Manager 42
Access Digi Remote Manager 42
Using the web interface 43
Log out of the web interface 44
Using the command line 45
Access the command line interface 45
Log in to the command line interface 45
Exit the command line interface 46
Interfaces
Wide Area Networks (WANs) 48
Wide Area Networks (WANs) and Wireless Wide Area Networks (WWANs) 49
Configure WAN/WWAN priority and default route metrics 49
WAN/WWAN failover 52
Configure SureLink active recovery to detect WAN/WWAN failures 53
Configure the device to reboot when a failure is detected 60
Disable SureLink 66
Example: Use a ping test for WAN failover from Ethernet to cellular 70
Using Ethernet devices in a WAN 73
Using cellular modems in a Wireless WAN (WWAN) 73
Configure a Wide Area Network (WAN) 88
Configure a Wireless Wide Area Network (WWAN) 95
Show WAN and WWAN status and statistics 104
Delete a WAN or WWAN. 106
Local Area Networks (LANs) 108
About Local Area Networks (LANs) 109
Configure a LAN 109
Show LAN status and statistics 115
Delete a LAN 117
DHCP servers 118
Create a Virtual LAN (VLAN) route 134
Bridging 137
Edit the preconfigured ETH2 bridge 138
Configure a bridge 141
Serial port
Configure the serial port 145
Show serial status and statistics 162

IX20 User Guide 8
Wi-Fi
Wi-Fi configuration 165
Default access point SSID and password 165
Default Wi-Fi configuration 165
Configure the Wi-Fi radio's channel 167
Configure the Wi-Fi radio's band and protocol 169
Configure the Wi-Fi radio's transmit power 170
Configure a Wi-Fi access point with no security 172
Configure a Wi-Fi access point with personal security 177
Configure a Wi-Fi access point with enterprise security 182
Isolate Wi-Fi clients 189
Isolate clients connected to the same access point 189
Isolate clients connected to different access points 190
Show Wi-Fi access point status and statistics 196
Configure a Wi-Fi client and add client networks 197
Show Wi-Fi client status and statistics 204
Routing
IP routing 207
Configure a static route 208
Delete a static route 211
Policy-based routing 213
Configure a routing policy 213
Example: Dual WAN policy-based routing 221
Example: Route traffic to a specific WAN interface based on the client MACaddress 224
Routing services 229
Configure routing services 230
Show the routing table 233
Dynamic DNS 234
Configure dynamic DNS 234
Virtual Router Redundancy Protocol (VRRP) 239
VRRP+ 240
Configure VRRP 240
Configure VRRP+ 244
Example: VRRP/VRRP+ configuration 251
Configure device one (master device) 252
Configure device two (backup device) 256
Show VRRP status and statistics 262
Virtual Private Networks (VPN)
IPsec 265
IPsec data protection 265
IPsec modes 265
Internet Key Exchange (IKE) settings 265
Authentication 266
Configure an IPsec tunnel 266
Configure IPsec failover 288
Configure SureLink active recovery for IPsec 289
Show IPsec status and statistics 296
OpenVPN 298
Configure an OpenVPN server 299

IX20 User Guide 9
Configure an OpenVPN Authentication Group and User 308
Configure an OpenVPN client by using an .ovpn file 312
Configure an OpenVPN client without using an .ovpn file 315
Configure active recovery for OpenVPN 319
Show OpenVPN server status and statistics 326
Show OpenVPN client status and statistics 327
Generic Routing Encapsulation (GRE) 329
Configuring a GREtunnel 329
Show GRE tunnels 334
Example: GRE tunnel over an IPSec tunnel 335
NEMO 349
Configure a NEMO tunnel 350
Show NEMO status 356
Services
Allow remote access for web administration and SSH 359
Configure the web administration service 362
Configure SSHaccess 369
Use SSH with key authentication 375
Generating SSH key pairs 375
Configure telnet access 378
Configure DNS 383
Simple Network Management Protocol (SNMP) 389
SNMP Security 389
Configure Simple Network Management Protocol (SNMP) 389
Download MIBs 394
Configure the Modbus gateway 394
Configure gateway servers 396
Configure clients 398
System time 409
Configure the system time 409
Network Time Protocol 412
Configure the device as an NTP server 412
Configure a multicast route 417
Ethernet network bonding 420
Enable service discovery (mDNS) 423
Use the iPerf service 426
Example performance test using Iperf3 430
Applications
Configure applications to run automatically 433
Task one: Upload the application 433
Task two: Configure the application to run automatically 435
Run a Python application at the shell prompt 439
Start an interactive Python session 441
Digidevice module 443
Use digidevice.cli to execute CLI commands 444
Use digidevice.datapoint to upload custom datapoints to Digi Remote Manager 445
Use digidevice.config for device configuration 447
Use Python to respond to Digi Remote Manager SCI requests 449
Use digidevice runtime to access the runtime database 458
Use Python to upload the device name to Digi Remote Manager 460

IX20 User Guide 10
Use Python to send and receive SMS messages 462
Use Python to access serial ports 464
Use the Paho MQTTpython library 465
Stop a script that is currently running 468
Show script information 469
User authentication
IX20 user authentication 473
User authentication methods 473
Add a new authentication method 475
Delete an authentication method 477
Rearrange the position of authentication methods 479
Authentication groups 480
Change the access rights for a predefined group 482
Add an authentication group 484
Delete an authentication group 488
Local users 490
Change a local user's password 491
Configure a local user 492
Delete a local user 500
Terminal Access Controller Access-Control System Plus (TACACS+) 502
TACACS+ user configuration 503
TACACS+ server failover and fallback to local authentication 504
Configure your IX20 device to use a TACACS+ server 504
Remote Authentication Dial-In User Service (RADIUS) 510
RADIUS user configuration 511
RADIUS server failover and fallback to local configuration 511
Configure your IX20 device to use a RADIUS server 512
LDAP 517
LDAP user configuration 518
LDAP server failover and fallback to local configuration 519
Configure your IX20 device to use an LDAP server 519
Disable shell access 524
Set the idle timeout for IX20 users 525
Example user configuration 528
Example 1: Administrator user with local authentication 528
Example 2: RADIUS, TACACS+, and local authentication for one user 530
Firewall
Firewall configuration 538
Create a custom firewall zone 538
Configure the firewall zone for a network interface 540
Delete a custom firewall zone 542
Port forwarding rules 543
Configure port forwarding 543
Delete a port forwarding rule 548
Packet filtering 551
Configure packet filtering 551
Enable or disable a packet filtering rule 555
Delete a packet filtering rule 557
Configure custom firewall rules 558
Configure Quality of Service options 560

IX20 User Guide 11
System administration
Review device status 572
Configure system information 573
Update system firmware 575
Manage firmware updates using Digi Remote Manager 575
Certificate management for firmware images 575
Dual boot behavior 578
Update cellular module firmware 579
Reboot your IX20 device 580
Reboot your device immediately 580
Schedule reboots of your device 581
Reset the device to factory defaults 582
Configuration files 586
Save configuration changes 586
Save configuration to a file 587
Restore the device configuration 588
Schedule system maintenance tasks 591
Monitoring
intelliFlow 599
Enable intelliFlow 599
Use intelliFlow to display average CPU and RAMusage 602
Use intelliFlow to display top data usage information 603
Use intelliFlow to display data usage by host over time 605
Configure NetFlow Probe 606
Central management
Digi Remote Manager support 612
Configure Digi Remote Manager 612
Collect device health data and set the sample interval 618
Log into Digi Remote Manager 621
Use Digi Remote Manager to view and manage your device 623
Add a device to Digi Remote Manager 624
View Digi Remote Manager connection status 624
Use the Digi Remote Manager mobile app 625
Configure multiple devices using profiles 626
Learn more 626
File system
The IX20 local file system 628
Display directory contents 628
Create a directory 629
Display file contents 630
Copy a file or directory 630
Move or rename a file or directory 631
Delete a file or directory 632
Upload and download files 633
Upload and download files by using the WebUI 633
Upload and download files by using the Secure Copy command 634

IX20 User Guide 12
Upload and download files using SFTP 635
Diagnostics
Generate a support report 638
View system event logs 639
View System Logs 639
View Event Logs 642
Configure syslog servers 644
Configure options for the event and system logs 646
Analyze network traffic 651
Configure packet capture for the network analyzer 652
Example filters for capturing data traffic 656
Capture packets from the command line 657
Stop capturing packets 658
Show captured traffic data 658
Save captured data traffic to a file 660
Download captured data to your PC 661
Clear captured data 662
Use the ping command to troubleshoot network connections 663
Ping to check internet connection 663
Stop ping commands 663
Use the traceroute command to diagnose IProuting problems 663
Digi IX20 regulatory and safety statements
RF exposure statement 665
Federal Communication (FCC) Part 15 Class B 665
Radio Frequency Interference (RFI) (FCC 15.105) 665
European Community - CE Mark Declaration of Conformity (DoC) 666
CE mark (Europe) 666
Maximum transmit power for radio frequencies 668
Innovation, Science, and Economic Development Canada (IC) certifications 668
RoHS compliance statement 669
Safety statements 669
Special safety notes for wireless routers 670
Product disposal instructions 671
DigiIX20 Certifications
International EMC (Electromagnetic Compatibility) and safety standards 671
Command line interface
Access the command line interface 673
Log in to the command line interface 673
Exit the command line interface 674
Execute a command from the web interface 674
Display help for commands and parameters 675
The help command 675
The question mark (?) command 675
Display help for individual commands 676
Use the Tab key or the space bar to display abbreviated help 676

IX20 User Guide 13
Auto-complete commands and parameters 676
Available commands 678
Use the scp command 679
Display status and statistics using the show command 680
show config 680
show system 681
show network 681
Device configuration using the command line interface 681
Execute configuration commands at the root Admin CLI prompt 682
Display help for the config command from the root Admin CLI prompt 682
Configuration mode 684
Enable configuration mode 684
Enter configuration commands in configuration mode 684
Save changes and exit configuration mode 684
Exit configuration mode without saving changes 685
Configuration actions 685
Display command line help in configuration mode 686
Move within the configuration schema 688
Manage elements in lists 689
The revert command 691
Enter strings in configuration commands 693
Example: Create a new user by using the command line 693
Command line reference 696
analyzer 697
cp 698
help 699
ls 700
mkdir 701
modem 702
modem puk status [imei STRING] [name STRING] 705
more 707
mv 708
ping 709
reboot 710
rm 711
scp 712
show 713
system 722
traceroute 724

What's new in Digi IX20 version 20.8
Release of Digi IX20 firmware version 20.8:
nSupport for NEMO/DMNR virtual private networks.
nSupport for serial Modbus Gateway.
nSupport for Ethernet network bonding.
nSupport for VRRP+, an extension to the VRRP standard that uses network probing to monitor
connections through VRRP-enabled devices.
nCloud service enhancements:
lReduced data usage for reporting health metrics to Digi Remote Manager.
Added Monitoring >Device Health >Only report changed values to Digi Remote
Manager option to control sending metrics to Digi Remote Manager on the basis of
whether the values have changed since they were last reported.
lAdded Monitoring >Device Health >Data point tuning configuration options to fine tune
what datapoints are uploaded as health metrics to Digi Remote Manager.
lAdded the ability to select Digi aView as the cloud service.
nAdded the ability to duplicate firmware to copy the active firmware to the secondary firmware
partition.
nMoved the update firmware CLI command to system firmware update.
nAdded new Authoritative option under TACACS+, RADIUS, and LDAP user authentication
methods to prevent falling back to additional authentication methods.
nCisco Umbrella content filtering.
nWi-Fi enhancements:
lAdded new options under Network >Wi-Fi to control Tx Power of the Wi-Fi module.
lAdded support for multiple RADIUS servers for WPA2 Enterprise.
nAdded options under System >Log >Server list to allow users to specify the TCP/UDP
protocol and port of the remote syslog server.
nSerial port enhancements:
lAdded configuration option under Serial >TCP connection to specify encrypted connection
types.
lAdded configuration option under Serial >TCP/Telnet/SSH connections to enable/disable
TCP keep-alive messages and nodelay.
IX20 User Guide 14

What's new in Digi IX20 version 20.8
IX20 User Guide 15
nEnhanced SMS support:
lAdded System >Scheduled tasks >Allow scheduled scripts parameter to allow custom
python scripts to handle sending/receiving SMS messages
lAdded the digidevice.sms python module for sending/receiving SMS messages in a custom
python script.
nMQTT client support via Paho Python module.
nAdded a random unprivileged port for performing ntp time syncs if standard port 123 fails.
nScripting enhancements:
lAdded a Status >Scripts page in the web UI and show scripts command to the Admin CLI
to view custom scripts and applications configured in the device, along with their status.
Added the system scripts stop command to the Admin CLI to stop a custom script or
application.

Digi IX20 Quick start
The following steps guide you through the setup of your DigiIX20 device.
Quick start using the Digi Remote Manager mobile app
After connecting your hardware and powering up, you can use the Digi Remote Manager mobile app to
quickly install your IX20 into your Digi Remote Manager account.
Here's how:
If you already have a Digi Remote Manager account:
1. Download the Digi Remote Manager mobile app from the App Store (iPhone) or Google Play
(Android).
2. Click Log in or Sign Up and log in to your account.
3. From the menu, select Install a device with a QR or bar code and scan the installation QR
code on the label.
4. Follow the prompts to complete your IX20 registration.
If you need to sign up for a Digi Remote Manager account:
1. Click here to create a new account. You'll receive an email with login instructions.
2. On your smartphone or tablet, download the Digi Remote Manager mobile app from the App
Store (iPhone) or Google Play (Android).
3. Open the Digi Remote Manager mobile app, click Log in and log into your new account.
4. From the menu, select Install a device with a QR or bar code and scan the installation QR
code on the label.
5. Follow the prompts to complete your IX20 registration.
Step 1: What's in the box
When you open the IX20 package, look for the following:
nDigi IX20 device
(Wi-Fi enabled IX20W unit shown)
IX20 User Guide 16

Digi IX20 Quick start Step 1: What's in the box
IX20 User Guide 17
The Digi IX20 has a product label on the bottom of the device. The label includes product
identification information and the default password assigned to the device. The IX20 also
includes a terminal connector for the power supply installed in the power input.
nDigi 1002-CM unit
nCM unit cover plate
nAntennas
Two cellular antenna are included. For the Wi-Fi-enabled IX20W device, a Wi-Fi antenna is also
included.
nPower supply and adapters
nEthernet cable
nInsert cards
nDigi IX20 label
Printed copy of the product label on the bottom of your device. You can affix this label to the
top or side of the device such that you can access the label after the device is mounted, or
store the label in a safe place for future reference.
nDigi COREmodem label

Digi IX20 Quick start Step 2: Gather accessories
IX20 User Guide 18
Printed copy of the COREmodem label on the bottom of your COREmodem. You can affix this
label to the top or side of the device such that you can access the label after the device is
mounted, or store the label in a safe place for future reference.
Step 2: Gather accessories
Accessories may be purchased with the IX20 device, or you can provide your own.
Here's the list of accessories used in this Quick start:
DIN rail clip
Ordered separately. For optionally clipping the IX20 to a DIN rail.
DIN rail mounting bracket
Ordered separately. For optionally mounting the IX20 to a DIN rail.
Laptop or personal computer
Use an Ethernet cable to connect your IX20 to a laptop or PC.
SIM card(s)
If you intend to configure cellular WWAN access at this time, acquire SIM cards as
needed. Note the carrier, network APN (Access Point Name), and SIM pin (if any)
for each card.
Smart phone or tablet
Optional: Use a smart phone or table to to automatically register your IX20 in
your Digi Remote Manager account and connect to your cellular network. See
Quick start using the Digi Remote Manager mobile app.
Step 3: Connect
1. Insert your activated SIMs provided by your cellular carrier into the Digi 1002-CM
COREmodem.
2. Insert the COREmodem into the IX20 by aligning the white clip. Press the modem in and then
push the white clip in until it locks firmly in place.

Digi IX20 Quick start Step 4: Power up
IX20 User Guide 19
3. Secure the COREmodem with one of the CM unit anchor screws.
4. Cover the installed COREmodem with the cover plate and secure the coverplate with screw.
5. (Optional) Attach spare label included with the COREmodem to the device.
6. Attach antenna(s).
7. If you intend to configure Ethernet WAN access at this time, use an Ethernet cable to connect
the IX20's WAN/ETH1 port to a hub with access to the Internet.
8. Use an Ethernet cable to connect the IX20 ETH2 port to your PC.
Step 4: Power up
a. Connect DC power.
Note If you need help understanding power requirements, see IX20 power supply
requirements.

Digi IX20 Quick start Step 5: Configure
IX20 User Guide 20
b. Indicator LEDs blink to show status during startup.
c. Wait for the power LED to stop blinking. The device is ready.
Step 5: Configure
a. On the PC connected to the IX20, open a browser and go to 192.168.2.1.
b. Log into the IX20:
User name: Use the default user name: admin.
Password: Use the unique password printed on the bottom label of the device (or the printed
label included in the package).
When you first log into the WebUI or the command line, you must change the password for the
admin user. See Change the default password for the admin user for instructions.
Additionally, for Wi-Fi enabled models, when you first log into the WebUI or the command line,
you will be required the change the SSID and pre-shared key (password) for the preconfigured
Wi-Fi access point. See Reset default SSID and pre-shared key for the preconfigured Wi-Fi
access point for instructions.