Configure a LAN

Configuring a Local Area Network (LAN) involves configuring the following items:

Required configuration items

Additional configuration items

To create a new LAN or edit an existing LAN:

 

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Network > Interfaces.
  4. Create the LAN or select an existing LAN:
    • To create a new LAN, for Add interface, type a name for the LAN and click .

    • To edit an existing LAN, click to expand the LAN.

    The Interface configuration window is displayed.

    New LANs are enabled by default. To disable, toggle off Enable.

  5. For Interface type, leave at the default setting of Ethernet.
  6. For Zone, select the appropriate firewall zone. See Firewall configuration for further information.
  7. For Device, select an Ethernet device.

  8. The IX15 can function as an 802.1x authenticator; it does not function as an 802.1x supplicant.

    1. Click to expand Authentication.
    2. Click Enable server to enable the 802.1x authenticator on the IX15 device.
    3. Set the Reauth period.
  9. Configure IPv4 settings:
    1. Click to expand IPv4.

      IPv4 support is enabled by default.

    2. For Type, select Static IP address.
    3. For Address, type the IP address and subnet of the LAN interface. Use the format IPv4_address/netmask, for example, 192.168.2.1/24.
      1. Set the MTU.
    5. Enable the DHCP server:
      1. Click to expand DHCP server.
      2. Click Enable.

      See DHCP servers for information about configuring the DHCP server.

    6. Enable Force link to keep the network interface active even when the device link is down.
  10. See Configure DHCP relay for information about configuring DHCP relay.
    1. Click to expand IPv6.
    2. Enable IPv6 support.
    3. For Type, select IPv6 prefix delegration.
    4. For Prefix length, type the minimum length of the prefix to assign to this LAN. If the minimum length is not available, then a longer prefix will be used.
    5. For Prefix ID, type the identifier used to extend the prefix to the assigned length. Leave blank to use a random identifier.
    6. Set the MTU.

  12. Incoming packets will be dropped from any devices whose MAC addresses is included in the MAC address denylist.

    1. Click to expand MAC address denylist.
    2. For Add MAC address, click .
    3. Type the MAC address.

  13. If allowlist entries are specified, incoming packets will only be accepted from the listed MAC addresses.

    1. Click to expand MAC address allowlist.
    2. For Add MAC address, click .
    3. Type the MAC address.
  14. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the IX15 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Create a new LAN or edit an existing one:
    • To create a new LAN named my_lan:
      (config)> add network interface my_lan
(config network interface my_lan)>
    • To edit an existing LAN named my_lan, change to the my_lan node in the configuration schema:
      (config)> network interface my_lan
(config network interface my_lan)>
  4. Set the appropriate firewall zone:
    (config network interface my_lan)> zone zone
(config network interface my_lan)>

    See Firewall configuration for further information.

  5. Select an Ethernet device.
    1. Enter device ? to view available devices and the proper syntax.
      (config network interface my_lan)> device ?

Device: The network device used by this network interface.
Format:
  /network/device/eth
  /network/device/loopback
Current value:

(config network interface my_lan)> device
    2. Set the device for the LAN: 
      (config network interface my_lan)> device device
(config network interface my_lan)>
  6. Configure IPv4 settings:
    • IPv4 support is enabled by default. To disable:
      (config network interface my_lan)> ipv4 enable false
(config network interface my_lan)>
    • The LAN is configured by default to use a static IP address for its IPv4 configuration. To configure the LAN to be a DHCP client, rather than using a static IP addres:
      (config network interface my_lan)> ipv4 type dhcp
(config network interface my_lan)>

      These instructions assume that the LAN will use a static IP address for its IPv4 configuration.

    1. Set the IPv4 address and subnet of the LAN interface. Use the format IPv4_address/netmask, for example, 192.168.2.1/24.
      (config network interface my_lan)> ipv4 address ip_address/netmask
(config network interface my_lan)>
      1. Set the MTU:
        (config network interface my_lan)> ipv4 mtu num
(config network interface my_lan)>
    3. Enable the DHCP server:
      (config network interface my_lan)> ipv4 dhcp_server enable true

      See DHCP servers for information about configuring the DHCP server.

    4. See Configure WAN priority and default route metrics for further information about metrics.

    1. Enable IPv6 support:
      (config network interface my_lan)> ipv6 enable true
(config network interface my_lan)>
    2. Set the IPv6 type to DHCP:
      (config network interface my_lan)> ipv6 type dhcpv6
(config network interface my_lan)>
    3. Generally, the default settings for IPv6 support are sufficient. You can view the default IPv6 settings by using the question mark (?):
      (config network interface my_lan)> ipv6 ?

IPv6

 Parameters                Current Value
 -------------------------------------------------------------------------------
 enable                    true               Enable
 metric                    0                  Metric
 mgmt                      0                  Management priority
 mtu                       1500               MTU
 prefix_id                 1                  Prefix ID
 prefix_length             48                 Prefix length
 type                      prefix_delegation  Type
 weight                    10                 Weight

 Additional Configuration
 -------------------------------------------------------------------------------
 connection_monitor        Active recovery
 dhcpv6_server             DHCPv6 server

(config network interface my_lan)>

      View default settings for the IPv6 DHCP server:

      (config network interface my_lan)> ipv6 dhcpv6_server ?

DHCPv6 server: The DHCPv6 server settings for this network interface.

 Parameters                Current Value
 -------------------------------------------------------------------------------
 enable                    true           Enable

(config network interface my_lan)>
    4. Modify any of the remaining default settings as appropriate.

  8. Note The IX15 can function as an 802.1x authenticator; it does not function as an 802.1x supplicant.

    1. Enable the 802.1x authenticator on the IX15 device:
      (config network interface my_lan)> 802_1x authentication enable true
(config network interface my_lan)>
    2. Set the frequency period for reauthorization:
      (config network interface my_lan)> 802_1x authentication reauth_period value
(config network interface my_lan)>

      3. where value is an integer between 0 and 86400. The default is 3600.

  9. Incoming packets will be dropped from any devices whose MAC addresses is included in the MAC address denylist.

    1. Add a MAC address to the denylist:
      (config network interface my_lan)> add mac_denylist end mac_address
(config network interface my_lan)>

      where mac_address is a hyphen-separated MAC address, for example, 32-A6-84-2E-81-58.

    2. Repeat for each additional MAC address.

  10. If allowlist entries are specified, incoming packets will only be accepted from the listed MAC addresses.

    1. Add a MAC address to the allowlist:
      (config network interface my_lan)> add mac_allowlist end mac_address
(config network interface my_lan)>

      where mac_address is a hyphen-separated MAC address, for example, 32-A6-84-2E-81-58.

    2. Repeat for each additional MAC address.
  11. Save the configuration and apply the change.
    (config network interface my_lan)> save
Configuration saved.
>
  12. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.