Configure an interface to operate in passthrough mode

You can configure interfaces on your Connect EZ 2 device to operate in passthrough mode, which means that the device passes the IP address assigned to it on a WAN or cellular modem interface, to a client connected to a LAN interface.

 

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Network > Interfaces.
  4. Create the interface or select an existing interface:
    • To create a new interface, for Add interface, type a name for the interface and click .

    • To edit an existing interface, click to expand the interface.

    The Interface configuration window is displayed.

    New Interfaces are enabled by default. To disable, toggle off Enable.

  5. For Interface type, select IP Passthrough.
  6. For Zone, select Internal.
  7. For Device, select an Ethernet device or a Wi-Fi access point.
  8. Add one or more interface that will be the source of the passed-through IP address:
    1. Click to expand Source interfaces.
    2. Click to add a source interface.
    3. Select the appropriate Interface.
    4. Repeat for additional interfaces.
  9. (Optional) Packet filtering is disabled by default. Toggle on to enable.

    If packet filtering is disabled, traffic is allowed in both directions and it is the responsibility of the external device to provide its own firewall.

  10. (Optional) Allow all addresses is disabled by default. Toggle on to enable.

    When enabled, this option allows forwarding between the source interface and devices connected to this interface, which allows connected devices to forward and receive packets without network address translation (NAT). This should normally be disabled unless it is required for modem passthrough, because some cellular will disconnect modems that send packets that are not from the carrier-assigned IP address.

  11. Ancillary addressing is enabled by default, which provides an IPv4 address to the connected device when the source address is not available.

    1. For Ancillary address/netmask, type the IPv4 address and netmask to provide to the connected device when the source address is not available.

    2. For Ancillary gateway, type the IPv4 address of the network gateway to be used when the connected device when the source address is not available.

    3. Ancillary DNS redirect is enabled by default, which means resolves all DNS requests to the connected device and redirects HTTP traffic to the device's web administration page.

  12. For Server type, select the type of server to use to pass the IP address through to the client.

  13. If PPPoE server is selected for Server type:

    1. Click to expand PPPoE server.

    2. For Service name, type the name of service to offer to the client.

    3. For Access concentrator name, type the name of the access concentrator to report to the client. If no name is provided, the host name is used.

    4. For Authentication method, select the authentication method used to connect to the remote peer.

      If an authentication method is selected, type the Username and Password required to authenticate the remote peer.

    5. (Optional) Click to expand Custom PPP configuration.

    6. Custom PPP configuration is disabled by default. Click toggle on Enable.

    7. Enable Override to override the default configuration and use only the custom configuration file.

    8. For Configuration file, type or paste configuration data using the format of a pppd options file.

  14. The Connect EZ 2 can function as an 802.1x authenticator; it does not function as an 802.1x supplicant.

    1. Click to expand Authentication.
    2. Click Enable server to enable the 802.1x authenticator on the Connect EZ 2 device.
    3. Set the Reauth period.
  15. Configure IPv4 settings:
    1. Click to expand IPv4.

      IPv4 support is enabled by default.

    2. Set the Metric.
    3. For Weight, type the relative weight for default routes associated with this interface. For multiple active interfaces with the same metric, Weight is used to load balance traffic to the interfaces.
    4. Set the Management priority. This determines which interface will have priority for central management activity. The interface with the highest number will be used.
    5. Set the MTU.
    6. For Use DNS, select one of the following:
      • Always: DNS will always be used for this WAN; when multiple interfaces have the same DNS server, the interface with the lowest metric will be used for DNS requests.
      • When primary default route: Only use the DNS servers provided for this interface when the interface is the primary route.
      • Never: Never use DNS servers for this interface.
    7. See Configure SureLink active recovery to detect WAN/WWAN failures for information about configuring SureLink for active recovery.
    1. Click to expand IPv6.
    2. Enable IPv6 support.
    3. Set the Metric.
    4. For Weight, type the relative weight for default routes associated with this interface. For multiple active interfaces with the same metric, Weight is used to load balance traffic to the interfaces.
    5. Set the Management priority. This determines which interface will have priority for central management activity. The interface with the highest number will be used.
    6. Set the MTU.
    7. For Use DNS, select one of the following:
      • Always: DNS will always be used for this WAN; when multiple interfaces have the same DNS server, the interface with the lowest metric will be used for DNS requests.
      • When primary default route: Only use the DNS servers provided for this interface when the interface is the primary route.
      • Never: Never use DNS servers for this interface.
    8. See Configure SureLink active recovery to detect WAN/WWAN failures for information about configuring SureLink for active recovery.
  17. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the Connect EZ 2 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Create a new interface or edit an existing one:
    • To create a new interface named ip_passthrough_interface:
      (config)> add network interface ip_passthrough_interface
(config network interface ip_passthrough_interface)>
    • To edit an existing interface named ip_passthrough_interface, change to the IP-passthrough-interface node in the configuration schema:
      (config)> network interface ip_passthrough_interface
(config network interface ip_passthrough_interface)>
  4. Set the interface type to passthrough:
    (config network interface ip_passthrough_interface)> type passthrough
(config network interface ip_passthrough_interface)>
  5. Set the firewall zone to internal:
    (config network interface ip_passthrough_interface)> zone internal
(config network interface ip_passthrough_interface)>
  6. Select an Ethernet device or a Wi-Fi access point for this interface:
    1. Enter device ? to view available devices and the proper syntax.
      (config network interface my_wan)> device ?


Current value:

(config network interface ip_passthrough_interface)> device
    2. Set the device for the interface: 
      (config network interface ip_passthrough_interface)> device device
(config network interface my_wan)>
  7. Set passthrough options
  8. Configure IPv4 settings:
    • IPv4 support is enabled by default. To disable:
      (config network interface ip_passthrough_interface)> ipv4 enable false
(config network interface ip_passthrough_interface)>
    1. Set the IP metric:
      (config network interface ip_passthrough_interface)> ipv4 metric num
(config network interface ip_passthrough_interface)>

    2. Set the relative weight for default routes associated with this interface. For multiple active interfaces with the same metric, the weight is used to load balance traffic to the interfaces.

      (config network interface ip_passthrough_interface)> ipv4 weight num
(config network interface ip_passthrough_interface)>
    3. Set the management priority. This determines which interface will have priority for central management activity. The interface with the highest number will be used.
      (config network interface ip_passthrough_interface)> ipv4 mgmt num
(config network interface ip_passthrough_interface)>
    4. Set the MTU:
      (config network interface ip_passthrough_interface)> ipv4 mtu num
(config network interface ip_passthrough_interface)>
    5. Configure how to use DNS:
      (config network interface ip_passthrough_interface)> ipv4 use_dns value
(config network interface ip_passthrough_interface)>

      where value is one of:

      • always: DNS will always be used for this WAN; when multiple interfaces have the same DNS server, the interface with the lowest metric will be used for DNS requests.
      • primary: Only use the DNS servers provided for this interface when the interface is the primary route.
      • never: Never use DNS servers for this interface.

    6. See Configure SureLink active recovery to detect WAN/WWAN failures for information about configuring SureLink for active recovery.
    1. Enable IPv6 support:
      (config network interface ip_passthrough_interface)> ipv6 enable true
(config network interface ip_passthrough_interface)>
    2. Generally, the default settings for IPv6 support are sufficient. You can view the default IPv6 settings by using the question mark (?):
      (config network interface ip_passthrough_interface)> ipv6 ?

IPv6

 Parameters                Current Value
-------------------------------------------------------------------------------
 enable                    true               Enable
 metric                    0                  Metric
 mgmt                      0                  Management priority
 mtu                       1500               MTU
 use_dns                   always             Use DNS
 weight                    10                 Weight

(config network interface ip_passthrough_interface)>
    3. Modify any of the remaining default settings as appropriate.

  10. Note The Connect EZ 2 can function as an 802.1x authenticator; it does not function as an 802.1x supplicant.

    1. Enable the 802.1x authenticator on the Connect EZ 2 device:
      (config network interface ip_passthrough_interface)> 802_1x authentication enable true
(config network interface ip_passthrough_interface)>
    2. Set the frequency period for reauthorization:
      (config network interface ip_passthrough_interface)> 802_1x authentication reauth_period value
(config network interface ip_passthrough_interface)>

      3. where value is an integer between 0 and 86400. The default is 3600.

  11. Save the configuration and apply the change.
    (config network interface ip_passthrough_interface)> save
Configuration saved.
>
  12. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.