ELTEC CYBOX LTE 2 Foglio di istruzioni

CYBOX LTE 2

LTE ROUTER

CONFIGURATION MANUAL

Version: 1.0 for firmware V21.38.00 | Date: 23.09.2021

Contents

1 IMPORTANT INFORMATION 1

1.1 Revision 1

1.2 Disclaimer 1

1.2.1 Copyright 1

1.2.2 GPL Statement for CyBox Software 1

1.2.2.1 Disclaimer of Warrenty 2

1.2.2.2 Limitation of Liability 2

1.2.3 Regulatory Limits for Changes in Country and Transmit Power Settings 2

1.3 Known Issues 2

2 ABOUT THIS DOCUMENT 3

2.1 Information about Formatting 3

3 ABOUT THE CyBox LTE 2 3

4 HOW TO ACCESS THE CyBox LTE 2 4

4.1 IP Addresses of the CyBox LTE 2 4

4.2 Getting to the Web Interface 5

5 QUICK START GUIDE 6

5.1 Change Password 6

5.2 Change LAN IP address (Quick Guide) 6

5.2.1 Disabling IPv6 7

5.3 Example: Local Access Point 8

5.3.1 System Settings 8

5.3.2 Prepare WLAN Radio Interface 8

5.3.3 Connect radio0 to the Network 9

5.3.4 Connecting to WAN 10

5.4 Example: Connecting three VLANs to a server 10

5.4.1 Create the Management VLAN 11

5.4.2 Add two unmanaged VLANs 11

5.4.3 Configure and Enable the radio(s) 11

5.4.4 Attach the “Clients” VLAN to radio0 12

5.4.5 Attach the “Staff” VLAN to radio0 12

5.4.6 Check Configuration 13

5.4.7 Disable Unneeded Default Address 13

5.5 Example: Client Isolation within the Access Point 13

5.5.1 Isolate the Radio Clients 13

CYBOX LTE 2

5.5.2 Restrict Access to Local Ports to Specified Interfaces 14

6 THE WEB INTERFACE 15

6.1 Network 15

6.1.1 Interfaces 15

6.1.1.1 DHCP Server per Interface 15

6.1.1.2 Bridges 15

6.1.1.3 VLAN 17

6.1.1.4 LTE 17

6.1.1.4.1 Configuring LTE 18

6.1.1.4.2 LTE Troubleshooting 20

6.1.1.5 5G 20

6.1.2 WLAN 20

6.1.2.1 Channel, Wireless mode, HT mode, Power settings 21

6.1.2.2 Radio Band Configuration for Models with Antenna Combiner 22

6.1.2.3 JJPlus Radio Card Band Configuration 22

6.1.2.4 ESSID, WDS Mode, Client separation 23

6.1.2.5 Encryption 23

6.1.2.6 Hotspot 2.0 24

6.1.2.7 WLAN Clients test 25

6.1.2.8 Multi-AP Client Isolation 25

6.1.2.9 Connection Check 26

6.1.2.10 Access Point Scanning Service (Wireless Monitoring) 27

6.1.2.11 Client Counting Service 29

6.1.2.12 Rogue Access Point Detection Service 31

6.1.3 Multi-WAN Manager (MWAN3) 33

6.1.3.1 Capabilities 34

6.1.3.2 MWAN Test 35

6.1.3.2.1 Gateway 35

6.1.3.3 MWAN Status 35

6.1.3.4 MWAN Modem Interface Configuration 36

6.1.3.5 MWAN Members Configuration 38

6.1.3.6 MWAN Policies Configuration 39

6.1.3.7 MWAN Rules Configuration 40

6.1.3.8 MWAN Notification Configuration 40

6.1.4 LACP / Bonding 41

6.1.4.1 LACP configuration example 41

CYBOX LTE 2

6.1.4.1.1 Create LACP interface 41

6.1.4.1.2 Setup IP / Netmask 42

6.1.4.1.3 Setup bonding Policy / add slave Interfaces 42

6.1.4.1.4 Setup Firewall 43

6.1.4.1.5 Check interface Status 44

6.1.4.2 LACP testing example 45

6.1.4.2.1 Test Setup 45

6.1.4.2.2 Test bonding bandwidth improvement 46

6.1.4.2.3 Test bonding reliability improvement 46

6.1.5 Global DHCP and DNS Settings 46

6.1.6 Firewall 47

6.1.7 OpenVPN 48

6.1.7.1 Configuration file generation on Windows 48

6.1.7.2 VPN interface setup – 3 methods 48

6.1.7.2.1 Copy Ready-to-use configuration with SCP 48

6.1.7.2.2 Upload configuration, certs, key-files with web interface 49

6.1.7.2.3 Manual configuration with web interface 50

6.1.7.3 VPN host configuration (on console) 50

6.1.8 ICCP 52

6.1.8.1 Coupling Concept 52

6.1.8.2 SSID Usage 53

6.1.8.3 WLAN Encryption 53

6.1.8.4 Configurable Parameters 53

6.1.8.5 Configuration Hint Web Interface 55

6.1.8.6 VLAN over Wireless ICCP 56

6.1.8.6.1 Features and Restrictions 56

6.1.8.6.2 Examples 56

6.1.9 QoS 60

6.2 GPS 60

6.2.1 GPS activation 60

6.2.2 GPS status 60

6.2.3 SNMP for GPS 62

6.3 System 63

6.3.1 System Properties 63

6.3.2 Configuration Backups 63

6.3.3 Firmware Upgrade 64

CYBOX LTE 2

iii

6.3.4 Reboot 64

6.3.5 Reset Button 65

6.3.6 Emergency Mode 65

7 SNMP 67

7.1 SNMP Protocol Support 67

7.2 SNMP V3 Protocol Support 67

7.2.1 SNMP V3 Protocol Examples 68

7.3 SNMP Basic Functions 69

7.4 SNMP Read and Write Authorizations 69

7.5 SNMP Commands 70

7.6 SNMP Read (snmpwalk and snmpget) 71

7.6.1 Reading System Information 71

7.6.2 Reading SNMP Object Information 71

7.6.2.1 Readout current Network Device Order 72

7.6.2.2 Readout SSID / WIFI Interface Order 72

7.6.2.3 Readout Network Device to SSID Assignment 73

7.7 SNMP Write (snmpset) 74

7.7.1 Direct command 74

7.7.1.1 Reboot 74

7.7.2 Edit configuration using Object Identifier (OID) 74

7.7.2.1 Set a new IP address 74

7.7.2.2 Set a new SSID 74

7.7.2.3 Set a new Macfilter 75

7.7.3 Edit configuration parameters, create new fields and delete items 75

7.7.3.1 Set new Hostname 76

7.7.3.2 Creating a system configuration description text 76

7.7.3.3 Delete system configuration description text 77

7.8 SNMP Applications 77

7.8.1 SNMP Support for GPS 77

7.8.2 SNMP Support for Second GPS Source 79

7.8.3 SNMP Support for LTE 80

7.8.3.1 LTE SNMP Read Control 80

7.8.3.2 LTE SNMP Write Control 82

8 THE FLYING CONTROLLER MECHANISM 82

9 IPSecVPN / StrongSwan 82

9.1 IPSec Customized Configuration 83

CYBOX LTE 2

9.2 IPSec default configuration 83

9.3 IPSec Secret configuration 84

9.4 IPSec Tunnel / Transport Connection 85

9.5 IPSec Crypto Proposal configuration 86

9.6 IPSec Firewall Custom Rules 87

9.7 IPSec Service Start 88

10 SSH / SERIAL CONSOLE 89

10.1 UCI Configuration 90

10.1.1 UCI configuration files 90

10.1.2 UCI Example 90

10.2 Other commands 91

11 SYSTEM MAINTENANCE 91

11.1 Remote Firmware Upgrade 91

11.1.1 Remote Firmware Upgrade without Config Change 91

11.1.2 Remote Firmware Upgrade with New Config 91

11.2 USB Possibilities 93

11.3 Status LED Blink Codes 94

12 APPENDIX: GPL LICENSE 95

13 APPENDIX: SNMP OID OVERVIEW 105

14 APPENDIX: DEFAULT FACTORY SETTINGS 107

CYBOX LTE 2

1 IMPORTANT INFORMATION

1.1 Revision

Internal version: 27f3a9f

Revision Changes Date

1.0 Initial version for this firmware 14.04.2021

1.2 Disclaimer

1.2.1 Copyright

references have been verified and found to be legitimate. In particular in the event of error they may, therefore,

be changed at any time without prior notice. The complete risk inherent in the utilization of this document or in

the results of its utilization shall be with the user; to this end, ELTEC Elektronik AG shall not accept any liability.

Regardless of the applicability of respective copyrights, no portion of this document shall be copied, forwarded

or stored in a data reception system or entered into such systems without the express prior written consent of

ELTEC Elektronik AG, regardless of how such acts are performed and what system is used (electronic, mechanic,

photocopying, recording, etc.). All product and company names are registered trademarks of the respective

companies.

Our General Business, Delivery, Offer, and Payment Terms and Conditions shall otherwise apply.

1.2.2 GPL Statement for CyBox Software

This software product contains software covered by the GNU GPL (see below in this document), it may in addition

contain other parts covered by other licenses (such as LGPL). A list of all modules and their licenses (“FOSS” list)

is available on request (see link below). The source code of all GPL-covered modules can also be requested by

owners of the CyBox LTE 2-W/LTE (see link below).

For the GPL-covered parts this license is valid:

This program is free software: you can redistribute it and/or modify

it under the terms of the GNU General Public License as published by

the Free Software Foundation, either version 3 of the License, or

(at your option) any later version.

This program is distributed in the hope that it will be useful, but

WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

GNU General Public License for more details.

You should have received a copy of the GNU General Public License

along with this program. If not, see

<https://www.gnu.org/licenses/>.

FOSS and sources are not included in the binary distribution in the products and in the product documentation

due to space limitations.

Use this link to request FOSS and sources, please send in your request by mail (handling fees for sources may

apply):

CYBOX LTE 2

ELTEC Elektronik AG

Galileo-Galilei-Str. 11

55129 Mainz

Germany

1.2.2.1 Disclaimer of Warrenty

There is no warranty for the program, to the extent permitted by applicable law. except when otherwise stated in

writing the copyright holders and/or other parties provide the program “as is” without warranty of any kind,

either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness

for a particular purpose. The entire risk as to the quality and performance of the program is with you. Should the

program prove defective, you assume the cost of all necessary servicing, repair or correction.

1.2.2.2 Limitation of Liability

In no event unless required by applicable law or agreed to in writhing will any copyright holder, or any other

party who modifies and/or conveys the program as permitted above, be liable to you for damages, including any

general, special, incidental or consequential damages arising out of the use or inability to use the program

(including but not limited to loss of data or data being rendered inaccurate or losses sustained by you or third

parties or a failure of the program to operate with any other programs), even if such holder or other party has

been advised of the possibility of such damages.

You should have received the following text in an “About” box (see Tab “System”) together with the product.

Here it is replicated for reference:

This software product contains software covered by the GNU GPL license.

A list of all modules and their licenses (“FOSS” list) is available on

request, as is the source code of all GPL-covered modules. For details

and GPL text, see the Software Configuration Manual, available on

<https://www.eltec.com>. In case of problems use the

mail (street) address below.

Request FOSS and sources with a mail to:

ELTEC Elektronik AG

Galileo-Galilei-Str. 11

55129 Mainz

Germany

1.2.3 Regulatory Limits for Changes in Country and Transmit Power Settings

Make sure that only persons with proper knowledge also in regulatory matters have access to the access point’s

configuration settings. They must be aware of the consequences of an improper setting of country and transmit

power (there may be additional settings). To do so, the standard configuration password must be changed

before the access point is deployed. This new password must be given to knowledgeable and responsible

persons only.

One example of a regulation affecting country selection is that in Germany, as of October 2016, the frequencies in

the range 5150 MHz - 5350 MHz must be used in closed rooms and similar environments only. For more

information please see www.bundesnetzagentur.de.

1.3 Known Issues

• When operating WLAN in 11ac mode, the transmit data rate is erroneously wrongly reported as 6 Mbit/s.

CYBOX LTE 2

2 ABOUT THIS DOCUMENT

This configuration manual is intended for system developers and integrators. It is not intended for end users. It

describes the firmware functions of the access point/router/gateway product family and provides information for

special applications and configurations of the product.

This manual is intended to guide through the configuration process of an Access Point/Router/Gateway (the

names of which are used interchangeably for this manual) for use in a train or bus. We tried to cover the main

aspects of this task, including

• Backup and restore of configurations

• Install new firmware versions

• Handling of IP addresses, DHCP, VLAN, VPN, firewall

• Configuration of WiFi and LTE

• MWAN configuration for multiple WAN connection

• ELTEC’s train coupling, wireless backbone protocol ICCP

• Remote administration via SNMP

• Scripting and UCI.

Not covered is a complete list of all functions and of all configuration elements in detail.

Information about mechanical and electrical installation of the access points is available in a separate

product-specific installation manual which can be downloaded from the Download Center at www.eltec.com.

2.1 Information about Formatting

In the following sections, text formatted like this refers to titles, tabs, boxes, menu names, group names, keys,

and other descriptive text on the web-based configuration user-interface (“LuCI”). They are grouped by “→”.

This markup is used for all navigation elements needed to access settings, independent from the elements used

to click on them or just for visual grouping.

A typewriter font is used for text typed in.

3 ABOUT THE CyBox LTE 2

The CyBox LTE 2 is a member of the CyBox family of robust wireless communication routers. It is particularly

designed to meet the requirements of rolling stock applications. It offers stable, secure, and broadband LTE

connections for train-to ground communication and high-speed internet.

The CyBox LTE 2 hosts up to two LTE interfaces or one Wi-Fi 5 interface combined with an LTE interface to boost

network efficiency and connect to client devices such as mobile phones. Country-specific LTE/Wi-Fi standards

are adopted for worldwide use in every type of train.

The CyBox LTE 2 firmware provides a convenient management interface via a web service. Besides global setup

parameters the open source software allows the configuration of the radio interfaces, such as channel selection,

SSID, encryption keys, and firewall setup. The access point and router configurations as well as the management

firmware can be updated remotely.

The firmware of the device is based upon Linux and OpenWRT/LEDE. For Open Source information see the

preface.

CYBOX LTE 2

4 HOW TO ACCESS THE CyBox LTE 2

The CyBox LTE 2 can be configured in several ways:

1. The graphical web interface

2. The command line interface via a SSH or serial connection, see 10 SSH / SERIAL CONSOLE

3. Using an USB stick (to update the firmware or apply a prepared configuration, see 11.2 USB Possibilities )

4. Using SNMP (see 7 SNMP )

4.1 IP Addresses of the CyBox LTE 2

By default, the CyBox LTE 2 is accessible through the following IP addresses (see figure The page Network →

Interfaces (default settings)):

•192.168.100.1 (LAN)

• An address obtained using DHCP (if possible LAN_DHCP)

• An address derived from the serial number (LAN_ALIAS)

• An address derived from the MAC of the first Ethernet port (LAN_MAC)

The LAN_ALIAS address is derived from the serial number (which is printed on the type plate) as follows

(Example Serial Number: EL303289):

1. Strip non-digits: 303289

2. Print as six-digit hex value: 0x04A0B9

3. Use the upper 8 bits for x, the middle for y and the lower for z: x=0x04 y=0xA0 z=0xB9

4. Convert x,y,z to decimal: x=4 y=160 z=185

5. The LAN_ALIAS address is 10.4.160.185

In a similar manner, the LAN_MAC address is derived from the MAC address of the first Ethernet interface, which

is printed on the type plate (example MAC 00:00:5B:04:AE:03):

1. Take the last three bytes: 04:AE:03

2. Use the upper 8 bits for x, the middle for y and the lower for z: x=0x04 y=0xAE z=0x03

3. Convert x,y,z to decimal: x=4 y=174 z=3

4. The LAN_MAC address is 10.4.174.4

You can delete unneeded network interfaces by clicking on the red “Delete” button in the web interface.

CYBOX LTE 2

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali ELTEC Router di rete

ELTEC

ELTEC CYBOX RT 2-A Manuale utente

Manuali Router di rete popolari di altre marche

Allnet

Allnet ALL0333AU Manuale utente

HomeSeer

HomeSeer HT-SEL Manuale utente

Sercomm

Sercomm Genesis OC3505D Manuale utente

Billion

Billion BIPAC 5102 Series Manuale utente

TP-Link

TP-Link TD-8817 Manuale utente

Motorola

Motorola MR1900 Manuale utente

Digi

Digi IX14 Manuale utente

Cisco

Cisco NCS 540 Manuale

XAVi

XAVi X8821e Manuale utente

BEC

BEC 6200WZL Manuale utente

MikroTik

MikroTik hAP ac3 Series Manuale utente

Korenix

Korenix JetNet 5428G Series Manuale utente

NETGEAR

NETGEAR FS526T - Switch Manuale utente

Korenix

Korenix JetNet 5710G Series Manuale utente

Automated Logic

Automated Logic ZN551 Manuale del proprietario

Cisco

Cisco ASR 1000 Series Manuale dell'operatore

EnGenius

EnGenius ESR-9710 Manuale utente

Cisco

Cisco 805 Series Istruzioni operative e di sicurezza