Release Notes PN 93000646_C3 Digi Connect WAN 3G IA 82001912_C3 EOS March 16, 2010 INTRODUCTION This is a production release of firmware for the Digi Connect WAN 3G IA. The WAN 3G IA starts with the feature set of Digi's Connect WAN 3G, then adds support for Industrial Automation protocols and capabilities. See http://www.digi.com/support/ for complete documentation related to these protocols and special capabilities. The Digi Connect WAN 3G IA is a hardened, upgradeable 3G cellular router that provides secure high speed wireless connectivity to remote sites and devices. It can be used for primary wireless broadband network connectivity to equipment at remote locations, as well as for a backup to existing landline communications. The Digi Connect WAN 3G is ideal for use where wired networks (e.g., leased line/frame relay, ISDN, DSL) are not feasible, or where alternative network connections are required. The standard Connect WAN 3G IA hardware includes screw terminals for 9-30Vdc power supply and EIA-232/422/485 field selectable serial port. SUPPORTED PRODUCTS Digi Connect WAN 3G IA Digi Connect WAN 3G IA NEMA SUPPORTED CELLULAR MODEMS Within the cellular product family, Digi has continued to add support for cellular modules as vendors make updates and improvements to support the latest chipsets and cellular technology. As new modules come on the market and older ones go obsolete, Digi is committed to supporting the products we have sold and continue to sell to our customers. The level of support that we are able to provide falls into one of the following categories: 1) FULL SUPPORT These modules are shipping in Digi products. An essential part of our product testing is to make sure these modules are compatible and function properly. Operational and performance issues with these modules that are found by customers will be verified, scoped and scheduled to be fixed in an upcoming firmware release. Sierra Wireless: MC5725, p2005001,20224 [Sep 21 2006 15:43:22],, VID: PID: MC5727, Modem Revision: p2410701,51240 [Nov 08 2007] BOOT: SWI6800V2_PP.01.07.01 2007/11/08 APPL: SWI6800V2_PP.01.07.01 2007/11/08 MC8775, H1_1_9_3MCAP C:/WS/FW/H1_1_9_3MCAP/MSM6280/SRC 2007/12/12 MC8790, Revision ID: K1_0_2_8AP C:/WS/FW/K1_0_2_8AP/MSM6290/SRC 2008/09/17 Ericsson: F3507g, Revision ID: R1D06 F3307, Revision ID: R1K06 Option Wireless: GTM382, Revision IDs: 1.4.6.0Hd (Date: Oct 1 2008, Time: 11:50:07) 1.8.0.0Hd (Date: Jan 14 2009, Time: 14:46:50) 1.9.1.0Hd (Date: Mar 26 2009, Time: 09:10:10) 2) PARTIAL SUPPORT These modules had shipped in Digi products in the past but are no longer actively supported by the module vendor. Firmware testing no longer includes these modules, however every attempt is made to maintain support as features and improvements are implemented. Issues with these modules that are found by customers will be verified, scoped and either scheduled to be fixed or a newer, supported module offered as an upgrade option. Sierra Wireless: MC5720, MC8755 3) LIMITED SUPPORT These modules have never shipped in Digi products and have never been part of firmware testing and verification efforts. These modules may be similar to full/partially supported modules by the same vendor and may even have been informally tested and shown to work in Digi products. Operational and performance issues with these modules that are found by customers will be evaluated and scoped to be fixed on a business case basis. Sierra Wireless: MC8780, MC8781, MC8775V, MC5725V, MC8755V, MC8765, MC8785V 4) NOT SUPPORTED These modules have never shipped in Digi products and are known to be incompatible. Sierra Wireless: EM3420, EM5625 ENHANCEMENTS As a debugging aid, improve the Python interpreter to report the filename of the calling code in tracebacks and other stack inspections. (32589) BUG FIXES Restore automatic link negotiation (MDI-X) functionality for the Ethernet link. This was inadvertently disabled in previous 2.9.0 firmware. (33523) Fix an initialization bug for the GlobalSat BU-353 USB GPS receiver and other SiRF III-based GPS receivers. (33635) KNOWN ISSUES Digi RealPort can only be used if the Modbus Bridge function is disabled. You cannot use RealPort with Modbus/RTU or ASCII to access the Modbus Bridge function. Do not attempt to "Port Forward" TCP 502 or UDP 502 to local Modbus/TCP servers while the Modbus Bridge is active - this causes NEITHER function to work. Disable the Modbus Bridge if you desire tradtional Router/NAT function for Modbus/TCP port 502. Problems have been encountered with some Linksys VPN appliance models when using different Diffie-Hellman group settings for phase 1 and phase 2. To work around this issue and successfully establish the VPN tunnel, use the same Diffie-Hellman group for both phase 1 and phase 2 settings. Although multiple SNTP Server entries may be configured as time sources in the Date and Time Settings, only the first one in the list is used. DOCUMENTATION ERRATA None. ADDITIONAL INFORMATION It is recommended that you perform a backup of your device's settings prior to upgrading your firmware. If you should need to revert back to a previous version of firmware, this will ensure that you will be able to restore your device to its previous settings in the event that some settings are not restored properly after downgrading the firmware. To backup your device settings, follow this simple procedure: 1) Open the web user interface and navigate to the "Administration" section and select "Backup/Restore". 2) Click the "Backup" button and select the location to where you want to save your backup file. To restore: 1) Navigate to the same section within the web UI. 2) Click the "Browse" button to select the backup file you saved in the previous steps. 3) Click the "Restore" button to upload the configuration settings contained in your backup file. On initial boot of this device, it will generate some encryption key material: an RSA key for SSL/TLS operations, and a DSA key for SSH operations. This process can take as long as 40 minutes to complete. Until the corresponding key is generated, the device will be unable to initiate or accept that type of encrypted connection. It will also report itself as 100% busy but, since key generation takes place at a low priority, the device will still function normally. On subsequent reboots, the device will use its existing keys and will not need to generate another unless a reset to factory defaults is done, which will cause a new key to be generated on the next reboot. HISTORY 82001912_C3 (2.9.0.13) - March 16, 2010 See ENHANCEMENTS and BUG FIXES information above. 82001912_C2 (2.9.0.11) - February 12, 2010 ENHANCEMENTS: Improve performance of cellular modems (primarily those using NDIS) by queuing more than one buffer with the USB host controller. Add support for Ericsson F3307 cell module. Eliminate excessive event logging for SMS activity. A two-level logging capability is now implemented this such that the original detailed event logging is still available, but the customer must enable it via the settings (CLI, web UI, RCI). By default the event logged SMS activity is now leaner than it was previously. (32265) Improve the Mobile Configuration Advanced Settings web page and the associated web help. The new text states that the mobile connection must be restarted (or the device rebooted) for the settings changes to take effect. The help information was updated with a more detailed discussion of issues for manual carrier selection. (25271) Improve iDigi (Connectware) client's connection backoff/retry logic in the case of failure to connect to the iDigi server. If SNTP Server use is configured as a time source in the Date and Time Settings, with a domain name specified for the time server, the time query could fail if the Access Control List (ACL) feature is enabled. The SNTP client has been modified to temporary configure an ACL entry to permit the time server access, then remove the temporary ACL entry on either success or failure of the time server query. This avoids the need to explicitly configure the time server's IP address in the ACL. A possible stale name resolution condition also was eliminated. Enable IA/Modbus engine sending Modbus via XBee to bind on a source end-point other than 0xE8. This prevents conflict with Dia XBee serial drivers, allowing Modbus and Python/Dia to share the XBee network. The desired bind-end point is appended to the XBee Extended Address (such as 00:13:a2:00:40:3e:15:18!E9). The user must also force the DE in the XBee 232/485 to match this value. (32938) Add "disp ia" to "disp techsupport" command list. (32252) BUG FIXES: Modify SSH to prevent an initial false SNMP login failure trap when the SSH client connects with the "none" authentication method. (1278304). Fix issues in the SSH service implementation: - Eliminate possible memory leaks when loading DSA/RSA keys. - Fix a failure to disconnect and report the reason to the client when the maximum number of authentication failures is reached. Fix several reported VPN problems: - Some Digi products will not build VPN tunnels to other Digi products. (32256, 32257) - TheGreenBow VPN client will no longer build a connection with newer Digi firmware. (32255) - Correct/improve several misleading/incorrect VPN event log messages. - ISAKMP frames negotiating with certificates were being incorrectly generated. The bug caused garbage data to be added to the end of the frame. Also, verification of certificates from the peer would reject the frame if the cerificate was followed by a NAT-T discovery payload. (32834) Allow auto-IP addresses (169.254.0.0/16) to be used in IP packets and translated/forwarded by the NAT feature. This had been rejected by the network stack in previous firmware releases. With the Digi device operating in IP Pass-through mode, when working with a pass-through host whose IP settings are statically configured, communication from the mobile network to the pass-through host could be temporarily lost. The loss of communication could occur in as little as four minutes after a successful communication (although usually longer). The outage could continue until the pass-through host sends packets to the Digi device, to be forwarded to the mobile connection. The problem has been corrected. (30936) Fix a bug in the DHCP client that accumulates small network buffers on the DHCP client's internal information structure. This occurred for options received from a DHCP server that are unrecognized by the DHCP client. These buffers are now freed to avoid gradual memory depletion. Fix an issue where the Send Character Immediate IOCTL was not getting a response, causing a RealPort hang. (32061) Fix problems with RX/TX byte counts, activity LED and idle timers for some supported cell modules using USB network interface (NDIS) mode. Specifically, some packets exchanged between the operating system and the module are no longer reported in the RX/TX activity, since those are local packets are are not sent over the mobile connection. Also, the RX and TX idle times are now properly initialized when the mobile connection is established. Eliminate some unneeded information from the configuration backup file. (32511, 32512) Flush the DNS resolver cache when the DNS server list changes (servers are removed). This avoids a possible stale DNS resolver cache issue. Disallow an attempt to set the IP address for a network interface and the interface-specific gateway to the same value, which causes problems for routing in the network stack. 0.0.0.0 is substituted for the gateway so IP routing is not adversely affected. Disable NDIS support for the Ericsson cellular modems. The PPP support is supported as in the past. NDIS support for Ericsson modems will be enabled in the future after some technical issues have been resolved. (33202) 82001912_C1 (2.9.0.7) - October 30, 2009 ENHANCEMENTS: Add support for Short Message Service (SMS) capabilities for GSM cellular modems. This feature is available for all GSM cellular modems identified in the "Full Support" list under SUPPORTED CELLULAR MODEMS above. SMS may be used for remote command of the device, alarms, event monitoring and Python application interaction (send and receive). Python support is provided via the new Python module "digisms". The use of passwords and a sender control list (to filter messages that are received from unknown senders) provide user-configurable security for this new feature. Add "Paged Connection" support to the Remote Management settings. This may be used in conjunction with the SMS feature. Add SNTP Client as a time source for time source management. This new feature adds SNTP client as a source for time management. It allows the device to synchronize its clock with NTP/SNTP servers. Configuration for this feature is available through RCI, the web UI and the command line "set clocksource" command. Add an "offset" from UTC to time source management. This new feature adds the ability to modify Coordinated Universal Time (UTC) by increments that correspond with time zones. Configuration for this feature is available through RCI, the web UI and the command line "set time" command. Add logging for time events such as changes to offset or time "jumps". Add SSL connection support and simple password authentication for device connections to the iDigi Server (Connectware Manager Server). Add support for RealPort authentication. Add numerous commands to "display techsupport" for improved reporting. (31539, 31689) Reduce the amount of alarm data sent at the start of a connection to an iDigi Server (Connectware Manager Server) by sending only the active alarms. This improvement is coupled with a server change to not request the current state of all alarms. Add support to flush the ARP table and DNS resolver cache on demand. Enhance "display dnsserver" to display resolver cache entries. Automatically flush the DNS resolver cache when the DNS server list changes, removing possibly stale cache entries. Add support for USB cellular modems using a network interface (NDIS) instead of PPP for improved performance. This is supported for the Option GTM382 and Ericson F3507g modems. Add GPS support for the Ericsson F3507g modem. Add setting and UI to enable/disable antenna diversity on Sierra Wireless cellular modems. (25728) Add the ability to set the SIM PIN for GSM modems to the command line interface: set mobile sim_pin=. If the cellular module can determine and report the location of the cellular base station, the latitude and longitude are reported in the device Event Log. This change applies to some CDMA modems. (26706) Add units to ambiguous measures on the GPS position web page. (29856) Allow fully qualified domain names (FQDN) instead of only IP address for a number of features. These features are: AutoConnect, UDP Serial, SNMP trap destinations, and the alarms e-mail server. For UDP Serial, a lookup of the FQDN (typically in the DNS resolver's cache) is done for each packet sent, with a full name resolution occurring only when the cached entry's time-to-live expires (or the cache is flushed). This supports dynamic destination IP addresses. (19517, 30637) Add options to CLI, web UI and RCI to save encrypted passwords and keys in the configuration backup file. Configuration restore accepts either encrypted or plain text passwords and keys. (15108) Add event logging for IPSEC (VPN). (20170) Improve the web UI to make it more intuitively clear how to configure a VPN tunnel for responder mode, The user is now explicitly prompted to select one of: responder only, or client and responder with an address. (26348) VPN support: Improve the CLI to set a default value for the local tunnel when host mode is selected. (30995) The CLI commands for configuring a VPN tunnel have been changed. Older firmware versions allowed you to set the local peer ID of a tunnel using the local_peer_id option in the "set vpn tunnel" command line. This option has been removed from the "set vpn tunnel" command line. You must now use the "set vpn interface" command line to set the local peer ID for all tunnels that use a particular interface. (30994) Add a new configuration option into the VPN Global Settings web page which allows users to select support for dynamic DNS. This feature is useful if the remote VPN peer does not have a static IP address (i.e., its IP address may change). In this case, the remote peer should register its DNS host name using dynamic DNS, and update the DNS entry whenever its IP address changes. When the dynamic DNS option is selected in the VPN Global Settings web page, the VPN client will periodically check the remote peer's DNS entry to see if its IP address has changed. It will renegotiate the VPN tunnel when the address does change. Change the signature method on the self-generated, self-signed certificate from MD5 to SHA1. Although MD5 is not generally unsafe, SHA1 is deemed to be the most secure. All browsers or SSL clients recognize SHA1 instead of MD5. Expose 'rmdir' and 'rename' calls to Python through POSIX wrapper. Update the web UI for IP Forwarding Settings to show the maximum number of entries for Static routes and "Forward TCP/UDP/FTP connections...". (31866) Add support for the u-blox 5 USB GPS receiver. Change the GPS priority so an external or PCIe GPS receiver is given preference over the integrated cellular GPS receiver (if there is one) for sending NMEA output to the /gps/0 device. ENHANCEMENTS in 82001912_C1 subsequent to 82001912_C: Add support to send login success and failure traps via SNMP when a user logs into the device using HTTP or HTTPS. On the Alarms Settings web page and in associated help, clarify that the SMS feature must be enabled to successfully send alarms via SMS. Improve the information sent for some alarm conditions when e-mail or SMS is the configured method for sending the alarm. BUG FIXES: Fix a problem in which the reported VPN status is incorrect. (30201) When cellular PPP instance settings are set via RCI, mobile PPP settings are set instead to maintain backward compatibility. Change this to also enable the cellular PPP instance, which allows cellular connections to be fully enabled via RCI. (31946) Fix Modbus IA engine support of 802.15.4 radios. (30733) Remove reference to GSM from RSSI alarms in web UI. (25830) Modbus Web UI misaligns the Master to Table Relationship. (31803) Check if enough free memory is available to handle a firmware update from the iDigi Server (Connectware Manager) and return an appropriate error response if not. (31321) Fix a bug that limited length of the primary SNMP destination field in the SNMP Settings web UI. (31895) Add a change to work around a problem in which Digi products do not accept gateways from Apple's Airport Extreme when the Digi product is configured as a DHCP client and the Apple is the DHCP server. (31166) Add Mobile System Information help text to the web UI help information. (31839) Improve a condition under which client-initiated connections to the iDigi Server (Connectware Manager Server)) won't start unless the "Reconnect after..." box is checked. (31885) Eliminate several memory leaks. BUG FIXES in 82001912_C1 subsequent to 82001912_C: Fix a bug in which login success and failure traps were not being sent via SNMP when a user logs into the device using SSH. (32161) Fix a bug that could cause the device to reboot when an alarm is sent via SMS. Fix a condition in which some specific characters could not be sent in SMS messages sent by Python. The characters are: [ \ ] ^ { | } ~ 82001912_C (2.9.0.5) - October 17, 2009 Not released for customer use. See ENHANCEMENTS and BUG FIXES information for 82001912_C1 EOS. 82001912_B3 (2.8.4.16) - August 28, 2009 ENHANCEMENTS: None. BUG FIXES: Fix a memory leak that may occur when DNS lookups are performed. Although the leak is small, it can lead to memory exhaustion in systems that perform many DNS operations, such as some iDigi client configurations. (30870) 82001912_B2 (2.8.4.14) - July 1, 2009 ENHANCEMENTS: None. BUG FIXES: Fix a problem in which the Ericsson F3507g modem cannot successfully unlock the SIM with its PIN. 82001912_B1 (2.8.4.13) - May 20, 2009 ENHANCEMENTS: Add support for new cellular modules: - Ericsson F3507g - Option Wireless GTM382 Add support for the Digi Connect WAN 3G IA NEMA product. Improve event log messages for the DHCP Server feature. (29931) Improve a timing condition to reduce by up to five seconds the time it takes before the first mobile PPP connection is established when the Digi device boots. Eliminate some timing dependencies when mobile band and carrier selection options are used with GSM modems. Eliminate a condition that could result in a false indication that the mobile call has dropped when establishing a PPP connection. This avoids unnecessary modem resets and decreases the time that the mobile PPP connection is unavailable. Add the ability to enable/disable incoming dynamic VPN configurations, and to display all incoming dynamic VPN tunnels. (28912) BUG FIXES: Fix a bug that could result in a USB stall condition when accessing some USB devices. Part of this fix eliminates a possible USB resource leak that could be recovered only by rebooting the Digi device. Clear some SIM-related information between modem resets on Digi devices that support two SIMs, to avoid posible confusion that can result when switching between SIMs. The correct information is read from the SIM following the modem reset. 82001912_B (2.8.4.7) - March 31, 2009 Initial release. Changes since the unreleased Revision A follow. ENHANCEMENTS: CELLULAR ENHANCEMENTS: Add support for new cellular modules: - Sierra Wireless MC5727 - Sierra Wireless MC8790 Add support for new Sprint provisioning method (OMA-DM). Add support for on-board GPS receivers on some modules (MC5727, MC8790). Add configuration capabilities in CLI, web UI and RCI. Add capability to report ICCID of the SIM cards. Improve mobile band and carrier selection for GSM modules. Add warning and informational text to web UI, carrier scan wizard and web help. For carrier selection, indicate discovery of 2G and 3G carriers when displayed in the carrier scan wizard. (25271, 28118, 29251) Add information to the event log and the UI (CLI, web and RCI) that indicates the user's choice of manual or automatic cellular band and carrier selection. (24942) Improve the CDMA module provisioning wizard: - Enable PPP on successful provisioning. (29078) - If network provisioning fails, offer a choice of retrying network provisioning, instead of manual provisioning. Choice of manual is available only at the start of the provisioning wizard. Add support to SNMP for mobile link up/down traps. (25003) GENERAL/OTHER ENHANCEMENTS: Add support for higher memory platforms (32MB RAM and 16MB Flash). Add configuration web page for MEI in all MEI-capable products. Update "display techsupport" to include new and additional commands. Add the current date/time to the device status display (CLI and web UI), in addition to the uptime value for the device. Modbus requests/responses for vendor-specific function code 100 are now speculatively estimated as Scattered Read Command (as used by Schneider Electric). Previously, function 100 was treated as not possible to estimate, thus the idle-gap (time with no more data) was the only method to detect end-of-packet. This change should be transparent to other vendors using function 100 for other purposes. First, this estimate is only applied if the 3rd byte of the PDU is the constant 0x04. Second, even packets which are incorrectly estimated will be properly handled by the fall-back detection of the idle-gap. Failure to estimate properly does not cause packet failure; it merely speeds up handling when the end-of-packet estimation succeeds. For event logging, add the device uptime to end-of-log display line (both CLI and web UI), if the timestamp display for logging is other than the uptime (such as date/time). Add simple CLI to manipulate the time source management settings. See CLI command "set clocksource". Use NMEA 0183 default settings for GPS profile. These settings are: 4800,8,N,1,no flow control. (29439) BUG FIXES: CELLULAR BUG FIXES: Fix a panic in the mobile carrier scan thread in the web UI. (26476) Fix a bug in which PPP statistics may display as negative values in "display pppstats". (related to 22844) Correct a bug in which e-mail alarms and snmp traps are not working for a mobile configuration change event. (26810) Fix a problem in which GSM manual carrier selection would always force that connection to have 2G service, even if 3G service is available and supported by the cell modem. (28118) Fix a high CPU utilization issue that occurs while PPP is bringing up a connection. (29771) GENERAL/OTHER BUG FIXES: Implement RFC-specified validation for a hostname, per the requirements for DHCP option 12. The RFCs consulted include 952, 1035, 1123 and 2132. The maximum length of the hostname is increased to 127, increased from 31. Support for a FQDN also has been implemented. Web UI help has been updated to describe a valid hostname construction. (27588) Strip carriage returns from TFTP loaded Python scripts. (26971) Add a very basic stat call for FAT FS, so we can report st_size. (22785) Add a check to the DHCP server to accept datagrams only if received on the interface being served by the DHCP server. Affects only devices with multiple LAN interfaces Fix a bug that occurs when restoring a public key: the value is set to the key plus additional bytes, resulting in a corrupt key. (27780) Add option value ranges to CLI "udpserial" command help. (29034) Fix a bug in which the event log includes one or more messages that specify the wrong (misleading) system time value when the device boots. Affects devices with a real time clock. (29804) If a public key has been enabled for SSH, allow authentication based on the key regardless of the password setting. Dynamically generate a list of accepted authentication methods based on the configuration of the device. (27834) 82001912_A (2.8.1.8) - October 21, 2008 Not released.