InHand InRouter900 Series User manual

InRouter900 Series
User Manual
InHand Networks
www.inhandnetworks.com
Version: v3.2
December 2016

1
Preface
Thanks for choosing InRouter900 series industrial routers! This user manual will
guide you in detail on how to configure InRouter900.
Readers
This manual is mainly intended for the following engineers:
Network planners
On-site technical support and maintenance personnel
Network administrators responsible for network configuration and maintenance
Conventions in the Manual
1. Format Conventions on Command Line
Format
Significance
Bold
Keywords of command line (the part that should be remained
unchanged in command and be entered as it is) are expressed with
bold font.
Italic
The parameters of command line (the part that must be replaced with
the actual value in command) are expressed in italic.
[ ]
Indicating that the part in “[]” is optional in command configuration.
{ x | y | ... }
Indicating to select one from multiple options.
[ x | y | ... ]
Indicating to select one or not to select from multiple options.
{ x | y | ... } *
Indicating to select at least one from multiple options.
[ x | y | ... ] *
Indicating to select one or more or not to select from multiple options.
&<1-n>
Indicating that the parameter in front of the symbol & can be
repeatedly entered for 1~n times.
#
The lines starting from no. “#” are comment lines.

2
2. Format Conventions on Graphic Interface
Format
Significance
<>
The content in angle brackets "<>" indicates button name, e.g. "click
<OK> button.”
[ ]
The content in square brackets "[]" indicates window name, menu
name or data sheet, e.g. “pop-up the [New User] window”.
/
Multi-level menu is separated by "/". For example, the multi-level
menu [File / New / Folder] indicates the menu item [Folder] under the
submenu [New] under the menu [File].
3. Various Signs
The manual also uses a variety of eye-catching signs to indicate the places to
which special attention should be paid in operation. The significances of these
signs are as follows:
It indicates matters to be noted. Improper operation may cause
data loss or damage to the device.
The necessary complement or description on the contents of
operation.
Technical Support
E-mail: [email protected]
www.inhandnetworks.com
Information Feedback
If you have any question on product information in use, you can feed back through the
following ways:
E-mail : [email protected]
Thanks for your feedback to let us do better!

3
Contents
I. INROUTER900 INTRODUCTION ...................................................................................................6
1.1 Overview.............................................................................................................................6
1.2 Packing List.........................................................................................................................6
1.3. Panel Introduction ..............................................................................................................8
1.4 Introductions to Status LED................................................................................................9
II. EQUIPMENT INSTALLATION .......................................................................................................9
2.1 DIN Rail Mounting and Disassembly ...............................................................................10
2.1.1 DIN Rail Mounting ....................................................................................................10
2.1.2 DIN Rail Disassembly................................................................................................10
2.2 Wall Mounting and Disassembly ......................................................................................12
2.2.1 Wall Mounting............................................................................................................12
2.2.2 Wall Mounting Disassembly ......................................................................................12
2.3 Installation of SIM Card and Antenna...............................................................................12
2.4 Installation of Power Supply and Protective Grounding...................................................14
2.5 Terminal Connection (only applicable to the device with industrial interface).................15
2.6 Login Router .....................................................................................................................16
III. WEB CONFIGURATION ...........................................................................................................17
3.1 Management......................................................................................................................17
3.1.1 System........................................................................................................................17
3.1.2 System Time...............................................................................................................17
3.1.3 Admin Access.............................................................................................................17
3.1.4 AAA ...........................................................................................................................18
3.1.5 Configuration Management .......................................................................................20
3.1.6 SNMP.........................................................................................................................20
3.1.7 Alarm..........................................................................................................................22
3.1.8 System Log ................................................................................................................22
3.1.9 System Upgrading......................................................................................................23
3.1.10 Reboot......................................................................................................................23
3.1.11 Device Management.................................................................................................23
3.1.12 GPS Locating Information .......................................................................................23
3.2 Network.............................................................................................................................25
3.2.1 Ethernet Port ..............................................................................................................25
3.2.2 Dialup Port .................................................................................................................26
3.2.3 ADSL Dialing (PPPoE)..............................................................................................27
3.2.4 Loopback Interface ....................................................................................................27
3.2.5 DHCP Service ............................................................................................................28
3.2.6 DNS Services .............................................................................................................29
3.2.7 Dynamic Domain Name.............................................................................................29
3.2.8 SMS............................................................................................................................30
3.2.9 VLAN Interface .........................................................................................................30
3.2.10 WLAN Interface.......................................................................................................31
3.3 Link Backup......................................................................................................................32

4
3.3.1 SLA............................................................................................................................32
3.3.2 Track Module .............................................................................................................32
3.3.3 VRRP .........................................................................................................................33
3.3.4 Interface Backup ........................................................................................................34
3.4 Routing..............................................................................................................................35
3.4.1 Static Route ................................................................................................................35
3.4.2 Dynamic Routing .......................................................................................................35
3.4.3 Multicast Routing.......................................................................................................38
3.5 Firewall .............................................................................................................................39
3.5.1 Access Control (ACL)................................................................................................39
3.5.2 NAT............................................................................................................................39
3.5.3 MAC-IP Binding........................................................................................................40
3.6 QoS ...................................................................................................................................40
3.7 VPN...................................................................................................................................42
3.7.1 IPSec ..........................................................................................................................42
3.7.2 GRE............................................................................................................................46
3.7.3 L2TP ..........................................................................................................................47
3.7.4 OPENVPN .................................................................................................................48
3.7.5 Authentication Management ......................................................................................49
3.8 Industrial (this Chapter Only Applies for IR900 Devices with Industrial Interface..........49
3.8.1 DTU ...........................................................................................................................50
3.8.1.1Serial Port Settings...............................................................................................50
3.8.1.2 DTU 1 .................................................................................................................50
3.8.2 IO Interface ................................................................................................................51
3.9 Tools..................................................................................................................................52
3.9.1 PING Detection..........................................................................................................52
3.9.2 Traceroute...................................................................................................................52
3.9.3 Link Speed Test..........................................................................................................52
3.10 Configuration Wizard......................................................................................................53
3.10.1 New LAN.................................................................................................................53
3.10.2 New WAN ................................................................................................................53
3.10.3 New Dial ..................................................................................................................53
3.10.4New IPSec Tunnel.....................................................................................................53
3.10.5 New Port Mapping ...................................................................................................54
4. TYPICAL APPLICATION CONFIGURATION .................................................................................55
4.1 DDNS Application Example.............................................................................................55
4.2 Device Management Application Example.......................................................................57
4.3 Restore Factory Default Settings ......................................................................................58
4.3.1 Via Webpage ..............................................................................................................58
4.3.2 Via Hardware .............................................................................................................58
4.4 Import/Export Configuration ............................................................................................59
4.5 Logs and Diagnostics ........................................................................................................60
4.6 Network Mode ..................................................................................................................61
4.6.1 Cellular.......................................................................................................................61

5
4.6.2 ADSL Dialup..............................................................................................................61
4.7 New LAN....................................................................................................................63
4.8 VRRP Typical Configuration Example .......................................................................64
4.9 Interface Backup Application Example.......................................................................66
4.10 Static Routing Application Example.......................................................................70
4.11 Dynamic Routing Application Example .....................................................................72
4.12 Multicast Routing Application Example .................................................................75
4.13 Access Control Application Example .........................................................................77
4.14 NAT Application Example ......................................................................................79
4.15 QoS Application Example.......................................................................................80
4.16 DTU Application Example......................................................................................81
4.17 IPSec VPN Configuration Example........................................................................83
4.18 DMVPN Networking Configuration Example........................................................88
4.19 OPENVPN Application Example............................................................................93
Appendix Instruction of Command Line..................................95

6
Main Text
I. InRouter900 Introduction
1.1 Overview
IR900 is a new generation of 4G LTE VPN industrial router developed by InHand Networks.
Integrating 4G LTE and various broadband WANs, IR900 provides uninterrupted access to
internet. With the features of complete security and wireless service, IR900 can connect up to ten
thousand devices, which can provide a high-speed data access for a real sense of equipment
informatization. IR900 has also been built for rapid deployment and easy management with
advanced software functions and full-industrialized hardware design platform, which enables
enterprises to quickly set up large scale industrial network within a minimized investment scope.
It also can provide multi-services such as data, voice and video.
There are currently three IR900 series: IR9x2, IR9x5, IR9x8, which can provide up to 8 intelligent
ports at most and they support LAN/WAN protocol. IR900 products not only offer more options
on WAN port access, but also effectively save additional purchasing cost on switch equipment.
With the development of industry, more businesses can be concentrated in data centre via wireless
network. By serving IR900 router as an access device at industrial site, a virtual tunnel with high
encryption performance can be set up via the VPN gateway of far-end industrial site and data
centre, which can save expensive special line lease input. The data is transmitted via IR900 secure
tunnel, which can effectively ensure the safe, rapid and reliable transmission of businesses.
Network diagram is shown in Fig. 4-1.
Site One
Site One
Collector
Collector
Main
Link
Main
Link
Backup
Link
Backup
Link
Data Centre
Firewall
Firewall
Equipment
Manager Equipment
Manager
Application
Server Data Server
LAN
Fig. 4-1
1.2 Packing List
Standard Accessories
Accessories
Quantity
Description
IR900
1
IR900 series industrial 4G router

7
DIN-Rail
1
Router fixation
Power Terminal
1
2-pin green power terminal
Cable
1
1.5m cable
Antenna
1
3G/4G antenna
Optional Accessories
Accessories
Quantity
Description
AC power cord
1
AC power cord
Power Adapter
1
12VDC power adapter
Antenna
1
Wi-Fi antenna
Serial port cable
1
Serial port cable

8
1.3. Panel Introduction
Protective Grounding Stud
SIM card seat
SIM card seat popup key
Power Port
Antenna Port
LED Indicator Light
RESET Indicator Light
CONSOLE Port
100M Ethernet Port
IR900 series has a variety of panel appearances, but all of the installation methods are the same.
The specific panel condition should be subject to the real object.

9
1.4 Introductions to Status LED
Status Description:
POWER
STATUS
WARN
ERROR
Description
(Red)
(Green)
(Yellow)
(Red)
On
On
On
Off
Powered On
On
Blinking
On
Off
Powered on succeed
On
Blinking
Blinking
Off
Dialing
On
Blinking
Off
Off
Dialing succeed
On
Blinking
Blinking
Blinking
Upgrading
On
Blinking
On
Blinking
Reset Succeed
For the LED of two SIM card, the LED of SIM card 1 will be on during "Powered On" and
"Powered on succeed" status. The following 4 conditions indicate the light turned on of SIM
card 1 in use and the figure is described based on SIM card 1.
Signal status LED and description:
Green LED 1
Green LED 2
Green LED
3
Description
Off
Off
Off
No signal
On
Off
Off
Signal strength 1-9 (Signal strength is weak,
please check antenna and the signal strength of
current location)
On
On
Off
Signal strength 10-19 (signal strength is basically
normal, and equipment can be used under normal
conditions)
On
On
On
Signal strength 20-31 (signal strong)
Ethernet status LED and description:
Green LED
Description
On
ETH 100M, normal, no data transmission
Blinking
ETH 100M, normal, there is data transmission
Off
No connection
MODEM LED and description:
MODEM Green LED
Description
On
Dialing succeed
Blinking
Dialing failed
WLAN LED and description:
WLAN Green LED
Description
On
Enable WLAN
Off
Disable WLAN
II. Installation
Precautions:
Power supply requirement: 24VDC (12~48VDC), please pay attention to the
voltage grade of the power supply. Rated current: 0.15~0.6A.

10
Environment requirement: working temperature -25℃~70℃, storage temperature
-40℃~85℃, relative humidity 5％~95% (noncondensing). High temperature can be applied on
equipment surface. During installation, surroundings should be taken into consideration and
installation should be carried out within restricted area.
Avoid direct sunlight, and keep away from heat sources or areas with strong electromagnetic
interference.
Routers need to be installed on an industrial DIN-Rail.
Check if there are cables and splices needed by installation.
2.1 DIN Rail Mounting and Disassembly
2.1.1 DIN Rail Mounting
The specific steps are shown in below:
Step 1: select the installation location of equipment to ensure an enough space.
Step 2: fix the top of DIN rail seat on DIN rail. By slightly rotating the equipment upward from
the bottom of equipment in the direction of arrow 2 shown below, the DIN rail seat can be fixed in
DIN rail. It should be ensured that the equipment is reliably installed on DIN rail as shown in fig.
2-1-1.
Fig. 2-1-1
2.1.2 DIN Rail Disassembly
The specific steps are shown in below:
Step 1: Press down the equipment to make the bottom of the equipment off the DIN rail as shown
by arrow 1 in Fig. 2-1-2.
Step II: Turn the equipment as per the direction shown in arrow 2 and move the equipment bottom
outwards simultaneously. Lift the equipment after the bottom is off the DIN rail. i.e., the
equipment can be taken off from the DIN rail.

11
Fig. 2-1-2

12
2.2 Wall Mounting and Disassembly
2.2.1 Wall Mounting
The specific steps are shown in below:
Step 1: Select the installation location of the device, making sure there is enough space.
Step 2: Use a screwdriver to attach the wall mounting plate to the back of the device as shown in
Figure 2-2-1.
Fig. 2-2-1
Step 3: Take out screw (packaged in a complete set with wall mounting plate) and fix the screw on
installation location. And then, pull down the device to ensure it is stable. As shown in Fig. 2-2-2.
Fig. 2-2-2
2.2.2 Wall Mounting Disassembly
The specific steps are shown in below:
Hold the device with a hand and disassemble the fixing screw on the top of device with another
hand, so as to disassemble the device from installation location.
2.3 Installation of SIM Card and Antenna
The IR900 supports dual SIM cards. Press the button and SIM card holder will pop up, and then,
install the SIM card.
Slightly rotate the movable part of metal SMA-J interface until it can not be rotated (at this time,
external thread of antenna cable can not be seen). Do not forcibly screw the antenna by holding

13
black rubber lining.
IR900 support dual antennas: ANT antenna and AUX antenna. ANT antenna is for data
receiving and transmission; AUX antenna is for increasing signal strength, which cannot be used
separately without ANT antenna.
Normally, ANT antenna is used; AUX antenna is required when the signal is weak.

14
2.4 Installation of Power Supply and Protective Grounding
Specific steps for power supply installation are shown below:
Step 1: take out the terminal from the router and screw down the lock screw on terminal;
Step 2: screw up the bolt after inserting power cable in terminal.
Specific steps for protective grounding installation are shown below:
Step 1: Remove the grounding nut.
Step 2: Connect the grounding ring of the cabinet’s grounding wire onto the grounding stud and
screw up the grounding nut.
To improve the immunity from interference of whole router, the router must be grounded when
using. According to operating environment, the ground wire should be connected with
grounding stud of router.

15
2.5 Terminal Connection (only applicable to the device with
industrial interface)
Serial port and IO port are of terminal access, thus relevant wires should be connected with
terminals before use.
Serial port of device provides two interface modes: RS232 and RS485. Input end of IO port: IN
indicates to digital quantity input end; COM indicates to grounding terminal. Input end of IO port:
RELAY indicates the output end of relay.
Take down the terminal from the device and loosen the locking screw on the terminal. Then, insert
the power supply cable into the terminal before tightening the screw. Cables are ordered as shown
in Fig. 2-7-1.
Lock Screw
Fig. 2-7-1

16
2.6 Login Router
Firstly, IP address of PC should be changed to ensure it is within a same network segment as the
device in the following two methods: automatic acquisition of IP address and static IP address.
Proxy server (if any) should be cancelled for PC management settings. After setting the IP address
of supervisory PC and ensuring there is no proxy server, the device can be logged in via web page.
I. Automatic acquisition of IP address (recommended)
Please set the supervisory computer to "automatic acquisition of IP address" and "automatic
acquisition of DNS server address" (default configuration of computer system) to let the device
automatically assign IP address for supervisory computer.
II. Set a static IP address
Set the IP address of supervisory PC (such as 192.168.2.2) and FE interface of device in same
network segment (initial IP address of FE interface of device: 192.168.2.1, subnet mask:
255.255.255.0).
III. Cancel the Proxy Server
If the current supervisory PC uses a proxy server to access the Internet, it is required to cancel the
proxy service. In the browser window, select "tools>>Internet options" and "connection" page and
click the button of LAN Settings to enter "LAN Settings" window interface. Please confirm if the
option "Use a Proxy Server for LAN" is checked; if it is checked, please cancel and click the
button <OK>.
IV. Log in/exit Web settings page
Operate Web browser and enter http://192.168.2.1 in address bar (user name /password default:
adm/123456). Click "exit" at the top right corner of Web interface and exit setting page after
confirmation.
At the same time, the router allows up to four users to manage through the Web
setting page. When multi-user management is implemented for the router, it is
suggested not to conduct configuration operation for the router at the same time;
otherwise it may lead to inconsistent data configuration.
For security, you are suggested to modify the default login password after the
first login and safe keep the password information.

17
III. Web Configuration
3.1 Management
The management includes 12 function modules: system, system time, management access, AAA,
configuration management, SNMP, alarm, system log, system upgrade, reboot, network
management platform and GPS locating information.
3.1.1 System
Here, system and network state and system time of synchronizing device and PC can be checked
and router WEB configuration interface language can be set as well as the name of mainframe of
router can be customized. Configuration interface can be directly entered via "Settings" after
clicking Cellular1, Fastethernet 0/1 and Fastethernet 0/2 under network state.
3.1.2 System Time
To ensure the coordination between this device and other devices, user is required to set the
system time in an accurate way since this function is used to configure and check system time as
well as system time zone. System time is allowed to be set as any expected value after Year 2000
manually. Users can also use SNTP to achieve time synchronization of all devices equipped with a
clock on network so as to provide multiple applications based on synced time.
Table 3-1-1 SNTP Client Parameter Description
Parameters
Description
Default
Enable
Enable/Disable SNTP client
Disable
Update Interval
Synchronization time intervals with SNTP server
3600
Source
Interface
Cellular1, Fastethernet 0/1 and Fastethernet 0/2
None
Source IP
The corresponding IP of source interface
None
SNTP Servers List
Server Address
SNTP server address (domain name /IP), maximum to set
10 SNTP servers
None
Port
The service port of SNTP server
123
Before setting a SNTP server, users should ensure SNTP server reachable. Especially when
the IP address of SNTP server is domain, users should ensure DNS server has been configured
correctly.
Users should configure either Source Interface or source IP. Source Interface and source IP
cannot be configured at the same time.
When setting multiple SNTP servers, system will poll all SNTP servers until an available
SNTP server found.
3.1.3 Admin Access
Admin Access allows create users, modify users and management services.
Users include Super User and Common User:
Super user: only one super user automatically created by the system, username adm. It has all
access rights to the router.
Common user: created by super user. Common users can view router configurations but don
not have access to change configurations.

18
Super User can neither modify nor delete its username (adm); but the password can be changed.
User right includes three levels:
User right 1-11: only access to parameters check rather than configuration;
User right 12-14: access to configure LAN IP, system time setting, basic configuration of
firewall, virtual IP mapping table, system log, certificate application, access control, static routing,
system upgrade and tool-ping detection. Others shown as grey, which can be checked but the
configuration can not be modified;
User right 15: access to the check and configuration for all parameters.
Management services include HTTP, HTTPS, TELNET and SSH.
HTTP: users can log in the device via HTTP and access and control it through Web after
clicking the button of "enable".
HTTPS: HTTPS (security version of hypertext transfer protocol) is HTTP which supports
SSL.
TELNET: after clicking the button of "enable", users can provide remote login via network.
Depending on Server/Client, Telnet Client could send request to Telnet server which provides
Telnet services. The device supports Telnet Client and Telnet Server.
SSH: Based on the RSA certification or the measures of encrypting username password and
data transmission via encryption algorithm DES, 3DES and AES128, secure remote login can be
provided via insecure network. IR900 only supports SSH server and it can receive many
connections from SSH client.
Table 3-1-2 Management Service Parameter Description
Parameters
Description
Default
HTTP
Hypertext Transfer Protocol, Plaintext Transmission, Port: 80.
On
HTTPS
Secure SSL Encryption Transmission Protocol. Port: 443
Off
TELNET
Standard protocol and main way for Internet telnet service. Port:
23
On
SSH
Port: 22
Timeout: timeout of SSH session. No operation within this period
on SSH Client, SSH Server disconnect. Default: 120s
Cipher Mode: set up public key encryption method (currently
only RSA supported). Cipher Code Length: set up cipher code
length, 512 or 1024. default: 1024
Off
3.1.4 AAA
AAA access control is used to control visitors and corresponding services available as long as
access is allowed. Same method is adopted to configure three independent safety functions. It
provides modularization methods for following services:
Authentication: verify whether the user is qualified to access to the network.
Authorization: related services available.
Charging: records of the utilization of network resources.
1) Radius
UDP protocol, generally applied in various network environments with higher requirements on

19
security and that permit remote user access.
2) Tacacs+
TCP protocol, mainly used for authentication, authorization and charging of access users and
terminal users adopting PPP and VPDN.
3) LDAP
LDAP, simple as a table, only requires username, command, and something else, which makes it
very simple.
Table 3-1-3 LDAP Parameter Description
Parameters
Description
Default
Name
Customized server name
None
Server
Address
Server address (domain name / IP)
None
Port
Consistent with the server port
None
Base DN
The top of LDAP directory tree
None
Username
Username accessing the server
None
Password
Password accessing the server
None
Security
Encryption mod: None, SSL, StartTLS
None
Verify
opposite end
Click to enable
Unopened
4) AAA
AAA supports following authentication ways:
None: with great confidence to users, legal check omitted, generally not recommended.
Local: Have user’s information stored on NAS. Advantages: rapidness, cost reduction.
Disadvantages: storage capacity limited by hardware.
Remote: Have user’s information stored on authentication server. Radius, Tacacs+ and LDAP
supported for remote authentication.
AAA supports following authorization ways:
None: authorization rejected.
Local: authorization based on relevant attributions configured by NAS for local user’s
account.
Tacacs+: authorization done by Tacacs+ Server.
Radius Authentication Based: authentication bonded with authorization, authorization only
by Radius not allowed.
LDAP Authorization
Authentication 1 should be set consistently with Authorization 1; Authentication 2 should be set
consistently with Authorization 2; Authentication 3 should be set consistently with
Authorization 3.
When configure radius, Tacacs+, local at the same time, priority order follow:
1 >2 >3.