Enables / disables the Network interface.

Mandatory name of the Network interface.

Range on Ethernet ports selected within the specific Network interface.

	Note
	If the Network interface has set up either a Radio interface or GRE L2 tunnel, it does not require any ETH ports.

Enables / disables unit management for the specific Network interface.

Adds defined subnet to the Network interface.

Optional comment.

Each Network interface can have one or more attached VLANs with one or more Subnets.

Enables / Disables ETH ports (1 – 5) SW control.

List box {possible values}, default = “RS232”

COM port can be configured to either RS232 or RS485.

List box {standard series of rates from 600 to 1152000 b/s}, default = “19200”

Select Baud rate from the list box: 600 to 1152000 b/s rates are available.

Serial ports use two-level (binary) signaling, so the data rate in bits per second is equal to the symbol rate in bauds.

List box {5; 6; 7; 8}, default = 8, for COM3 (optional) only 8

The number of data bits in each character.

List box: {None; Odd; Even}, default = “None”

Wikipedia: Parity is a method of detecting errors in transmission. When parity is used with a serial port, an extra data bit is sent with each data character, arranged so that the number of 1-bits in each character, including the parity bit, is always odd or always even. If a byte is received with the wrong number of 1-bits, then it must have been corrupted. However, an even number of errors can pass the parity check.

List box {1; 2 (1.5)}, default = 1, for COM3 (optional) only 1, for 5 data bits the 1.5 length of stop bits is used instead of 2

Wikipedia: Stop bits sent at the end of every character allow the receiving signal hardware to detect the end of a character and to resynchronize with the character stream.

Number {10 – 16383}, default = 20

This parameter defines the maximum gap (in milliseconds) in the received data stream. If the gap exceeds the value set, the link is considered idle, the received frame is closed and forwarded to the network.

Number {1 – 2047}, default = 1500

MRU (Maximum Reception Unit) — an incoming frame is closed at this size even if the stream of bytes continues. Consequently, a permanent data stream coming to a COM results in a sequence of MRU-sized frames sent over the network.

	Note
	2. This MRU and the MTU in Cellular settings are independent, however MTU should be greater or equal to MRU.

List box {None; RTS/CTS}, default = “None”

RTS/CTS (Request To Send / Clear To Send) hardware flow control (handshake) between the DTE (Data Terminal Equipment) and M!DGE3 (DCE – Data Communications Equipment) can be enabled in order to pause and resume the transmission of data. If RX buffer of M!DGE3 is full, the CTS goes down.

	Note
	RTS/CTS Flow control requires a 5-wire connection to the COM port.

Number {0 – 65535}, default = 0

This parameter can be used to prevent unwanted deadlock of the serial communication. The timer is reset by every received or transmitted packet over the COM port. When the timer expires, the protocol status is reset and the packet buffer is cleared. Setting parameter to 0 disables the feature. This parameter is available only via ADVANCED menu.

List box {None; Async Link; COMLI; DNP3; DF1; IEC101; Mars-A; Modbus RTU; PR2000; RDS; S3964R; SAIA S-BUS; UNI}, default = “None”

List box {Mask; Table}, default = “Mask”

SCADA protocol address is translated to the IP address using either Mask (common rule for all addresses) or Table (specific rule per address) type of conversion

A part of Base IP address defined by this Mask is replaced by ‘Protocol address’. The SCADA protocol address is typically 1 byte long, so Mask 24 (255.255.255.0) is most frequently used. This IP address is used as a destination IP address of the UDP datagram into which the serial SCADA packet received from COM is encapsulated.

List box {Manual; COM1 – COM3; TS1 – TS5}, default = “COM1”

The same UDP port will be used for all destination. This UDP port is used as the destination UDP port in UDP datagram in which serial SCADA packet received from COM is encapsulated. Default UDP ports for COM or Terminal servers can be used or UDP port can be set manually. If the destination IP address belongs to a M!DGE3 and the UDP port is not assigned to COM or to a Terminal server or to any other special SW module running in the destination M!DGE3, the packet is discarded.

	Note
	Default UDP port for serial interface in M!DGE2 is 8882. Keep this in mind if combining M!DGE2 with M!DGE3/RipEX2.

This is the address which is used by SCADA protocol.

The typical Protocol address length is 1 Byte. Some protocols, e.g. DNP3 are using 2 Bytes long addresses.

Several consecutive SCADA addresses shall be translated using one rule.

IP address to which Protocol address will be translated. This IP address is used as a destination IP address of the UDP datagram into which the serial SCADA packet received from COM is encapsulated. When several addresses are used, this will be the first IP address, the following one will have +1 etc.

List box {MANUAL; COM1 – COM3; TS1 – TS5}, default = “COM1”

This is UDP port number which is used as destination UDP port into UDP datagram in which the serial SCADA message, received from COM, is encapsulated. Different Destination UDP ports can be used in different rules.

The Address translation is defined in a table. There are no limitations such as when the “Mask” translation is used. If there are more SCADA units connected via the RS485 interface, their multiple “Protocol addresses” are translated to the same IP address and UDP port pair.

	Note
	You may add a note to each address with your comments (UTF8 is supported) for your convenience.

List box {LASTRCV; TARGET}, default = “LASTRCV”

Response for the incoming frame shall be directed to the IP address of the Master which sent the frame (LASTRCV) or to a specified IP address (TARGET).

IP address to which the response is sent when TARGET is chosen in the Response target mode.

Enables / Disables the cellular MAIN/EXT. When disabled (default), the module power is off.

List box {On; Off}, default = “Off”

Enables / Disables the SIM module PIN protection. It has to be switched on if the PIN is required. The parameter is ignored if the SIM does not require a PIN.

String {0000 – 9999}, default = “0000”

The PIN is used only when PIN protection is On and the module requires the PIN.

Parameters Input interface and Output interface can filter the traffic either coming to WWAN or leaving to WWAN (List box WWAN or EXT).

Automatic rules of MASQUERADE do not overwrite the source address of packets, which are encapsulated into IPsec.

It is recommended for IPsec to enable MOBIKE, if guided through Cellular.

List box {On; Off}, default = “On”

Optional comment.

IP address, default = 0.0.0.0

Defines the IP address which will be set on the loop-back interface. The mask is automatically /32.

Enables/disables the Link manager

List box {Off; On}, default = “Off”

Enables / disables binding between a link and particular IPsec tunnel. This option is available only when IPsec is enabled and configured. Configuration parameter: SETTINGS > VPN > IPsec > IPsec associations > Management mode provides two options:

Enables / disables individual link

String {a..z A..Z 0..9 @ _ -}, max 42 char, default = “LINK”

Name of the link that’s used in the Status info and System logs

List box {Static; WWAN (MAIN); WWAN (EXT)}, default = “Static”

IP address, default = 0.0.0.0

Next-hop (gateway) address for the Static type of the link

Enables / Disables checking of individual interface.

When all checked interfaces are down, the link state is down

ETHx Link status is checked for ETH1-ETH5 options. Successful establishment of Radio interface is checked for the Radio option

List box {list of available Peer IDs}, default = first Peer ID

When IPsec control is On, the individual link is paired with an individual IPsec tunnel defined by its Peer ID. In such a case the individual IPsec tunnel is activated/deactivated together with the respective link. It is automatically switched back to the higher priority link once it is restored..

List box {Off; On}, default = “Off”

Enables active link testing. Links are tested using ICMP echo packets

Number {3 – 3600}, default = 60

Testing period of a link that is in the up state

Number {3 – 3600}, default = 10

Testing period of a link that has to be tested (above the active link) and it is normally not tested or the test failed

Number {1 – 60}, default = 5

ICMP ping reply timeout

Number {1 – 20}, default = 1

Uninterrupted number of successful tests (pings) after which the link status is up

Number {1 – 20}, default = 3

Uninterrupted number of failed tests (pings) after which the link status is test failed

IP address, default = 0.0.0.0

Primary tested IP address

List box {Off; On}, default = “Off”

Enables / Disables testing of the second IP address

IP address, default = 0.0.0.0

Secondary tested IP address.

List box {One address succeeds; Both addresses succeed}, default = “One address succeeds”

List box {Off; On}, default = “Off”

Enables active link testing of a link having lower priority compared to active link

String {0–42 char}, default = <empty>

IP address, default = 0.0.0.0

M!DGE3 unit acts in the Babel network as a dynamic router. Every router is identified by an ID having the format of IP address. This IP address does not have to be ‘real’.

Router ID is shared across all dynamic protocols.

List box {On; Off}, default = “Off”

Advanced feature: Enables randomization of the upper 4 Bytes of the router identification. The lower 4 Bytes are set by a Router ID parameter. This feature might be used in a case the Babel node is often restarted resulting in refusing its messages by its neighbors.

List box {On; Off}, default = “On”

Enables propagation of routing rules acquired from the neighbors. When disabled, the incoming rules are not propagated to other routers and this router behaves as an end point terminal – network paths are started or terminated in such a point, but do not travel through.

List box {On; Off}, default = “Off”

Enables / disables the interface.

String {a..z A..Z 0..9}, max 16 char, default = <empty>Interfaces which will be used by Babel for searching the available connections. Name of an existing unit interface has to be used. Following interfaces can be used:

Interface MTU must be 1280 Bytes or bigger in order to operate Babel protocol correctly.

List box {Wired; Wireless}, default = “Wireless”

Type of network interface and also the type of link status evaluation. “Wired” link status is evaluated by checking the limit of received Hello packets – if not met, the link is considered down. “Wireless” link is status is evaluated using ETX criteria – each lost Hello packet gradually decreases the link metric.

Number {1 – 65534}, default = 128

The cost of using this interface to receive packet from a neighbor. It is added to Babel path metric.

Number {1 – 16}, default = 12

For “Wired” interface only: limit of received Hello packets from the 16 expected; if not met, the link is considered down.

Number {0.1 – 327.0}, default = 4.0

Interval (in seconds) of sending Hello packets.

Number {2 – 30}, default = 4

Interval of sending the routing table update packets – to share the network topology information across the Babel network. The update interval is calculated as a multiplication of this parameter and Hello interval. The maximum length of the update interval (after the multiplication) is 655 seconds.

IP address, default = 0.0.0.0

This is the Next hop address which is announced to neighbors to be routed over this interface. Should this interface serve more IP addresses, this parameter enables selection of which of the addresses should be used for this station in the network neighbors routing tables.

List box {None; Full; Only sign}, default = “None”

Enables packets authentication of Babel protocol.

List box {HMAC SHA256; HMAC SHA384; HMAC SHA512; BLAKE2s-128; BLAKE2s-256; BLAKE2b-256; BLAKE2b-512}, default = “HMAC SHA256”

Selects the authentication algorithm. This parameter occurs only, if parameter Authentication is set either to “Full” or “Only sign”.

Each algorithm has its own password length limit.

String {up to 128 char}

Defines the password for packets authentication.

Optional comment.

List box {On; Off}, default = “On”

Enables / disables the static routing rule.

IP address, default = 0.0.0.0/0

IP address and mask defining the exported routing rule address range.

Number {0 – 65534}, default = 0

Routing rule metric value. The higher the value, the more “expensive” the path is.

Optional comment.

List box {On; Off}, default = “On”

Enables / disables the filter rule.

List box {Off; Match; Not match}, default = “Off”

Method of the routing rule target range comparison.

IP address / mask, default = 0.0.0.0/0

IP address and mask defining the network range to be compared.

Number {0 – 32}, default = 0

Number {0 – 32}, default = 32

Definition of the enabled range of the mask length of the processed routing rule.

Examples:

List box {Accept; Reject; Pass}, default = “Accept”

Type of action to be performed when the filter rules above matches the incoming routing rule. When “Pass” is selected, the packet processing continues.

List box {On; Off}, default = “Off”

When enabled, the Preference (see next parameter) will be set to this rule.

Number {0 – 65535}, default = 210

Routing rule preference in the routing table (to be used when Set preference is enabled). The higher the number the better the preference.

IP address, default = 0.0.0.0

Preferred source IP address for the locally generated packets. When disabled (default value 0.0.0.0 is used), the source IP address is set according to the outgoing interface.

Optional comment.

List box {On; Off}, default = “On”

Enables / disables the filter rule.

List box {Off; Match; Not match}, default = “Off”

Method of the routing rule target range comparison.

IP address / mask, default = 0.0.0.0/0

IP address and mask defining the network range to be compared.

Number {0 – 32}, default = 0

Number {0 – 32}, default = 32

Definition of the enabled range of the mask length of the processed routing rule.

List box {Off; Match; Not match}, default = “Off”

Selects the way how the routing rule source protocol is compared.

List box {System; BGP; BGP external; BGP internal; OSPF}, default = “System”

Selection of the protocol origin. “System” – stands for rules from the ordinary routing table.

List box {Off; Is empty; Not empty}, default = “Off”

Compares BGP routing rule path if it is empty (i.e. the rule originates in this AS).

List box {Off; Match; Not match}, default = “Off”

Selects the way how the routing rule from the OSPF protocol is compared.

List box {Internal; Inter-area; External type 1; External type 2}, default = “External type 2”

OSPF sources. “Internal” – stands for internally generated rule (e.g. interface range). “Inter-area” – stands for rule generated on the area borders.

List box {Off; Match; Not match}, default = “Off”

OSPF tag based filtering method.

Number {0 – (2³²-1)}, default = 0

OSPF tag to be compared.

List box {Accept; Reject; Pass}, default = “Accept”

Defines what action is taken on the routing rule. When “Pass” is selected, the packet processing continues.

List box {Off; BGP MED; OSPF Metric 1; OSPF Metric 2; OSPF Metric Sum}, default = “Off”

Defines source of metric.

Number {0 – 65534}, default = 0

Routing rule metric value. The higher the value, the more “expensive” the path is.

Optional comment.

List box {On; Off}, default = “Off”

Enables the dynamic routing and the OSPF protocol.

IP address, default = 0.0.0.0

M!DGE3 unit acts in the OSPF network as a dynamic router. Every router is identified by an ID having the format of IP address. This IP address does not have to be ‘real’. Router ID is shared across all dynamic protocols.

Number {0 – 255}, default = 0

OSPF protocol instance number. This number is needed in case of running multiple OSPF protocols (for example on the border of 2 independent OSPF networks).

List box {On; Off}, default = “Off”

Enables / disables the static routing rule.

IP address, default = 0.0.0.0/0

IP address and mask defining the exported routing rule address range.

List box {Type 1; Type 2}, default = “Type 1”

Metric type of the routing rule. Metric 1 is added to the path cost. Metric 2 stays apart and compared to metric 1 is always bigger.

Number {1 – 65535}, default = 1000

Routing rule metric value.

Number {0 – (2³²-1)}, default = 0

OSPF tag is added to a rule at the moment of its insertion to the network. The tag travels through the OSPF without any modification so it can be used to distinguish the rule in the filters.

Optional comment.

List box {On; Off}, default = “Off”

Enables / disables the filter rule.

List box {Off; Match; Not match}, default = “Off”

Method of the routing rule target range comparison.

IP address / mask, default = 0.0.0.0/0

IP address and mask defining the network range to be compared.

Number {0 – 32}, default = 0

Number {0 – 32}, default = 32

Definition of the enabled range of the mask length of the processed routing rule.

Examples:

List box {Off; Match; Not match}, default = “Off”

Method of the OSPF routing rule source comparison.

List box {Internal; Inter-area; External type 1; External type 2}, default = “External type 1”

Source types comments:

List box {Off; Match; Not match}, default = “Off”

Method of the OSPF routing rule OSPF tag comparison

Number {0 – (2³²-1)}, default = 0

OSPF tag to be compared.

List box {Accept; Reject; Pass}, default = “Accept”

Type of action to be performed when the filter rules above matches the incoming routing rule.

List box {On; Off}, default = “Off”

When enabled, the Preference (see next parameter) will be set to this rule.

Number {0 – 65535}, default = 200

Routing rule preference in the routing table (to be used when Set preference is enabled). The higher the number the better the preference.

IP address, default = 0.0.0.0

Preferred source IP address for the locally generated packets. When disabled (default value 0.0.0.0 is used), the source IP address is set according to the outgoing interface.

Optional comment.

List box {On; Off}, default = “Off”

Enables / disables the filter rule.

Optional comment.

List box {Off; Match; Not match}, default = “Off”

Selects a method of the routing rule destination range comparison.

IP address / mask, default = 0.0.0.0/0

IP address and mask defines the network prefix to be compared.

Number {0 – 32}, default = 0

Number {0 – 32}, default = 32

Definition of the enabled range of the mask length of the processed routing rule.

List box {Off; Match; Not match}, default = “Off”

Selects the way how the routing rule source protocol is compared.

List box {System; BGP; BGP external; BGP internal}, default = “System”

Selection of the protocol origin. “System” – stands for rules from the ordinary routing table.

List box {Off; Is empty; Not empty}, default = “Off”

Compares BGP routing rule path if it is empty (i.e. the rule originates in this AS).

List box {Accept; Reject; Pass}, default = “Accept”

Defines what action is taken on the routing rule. “Pass” continues in processing.

List box {On; Off}, default = “Off”

Enables the dynamic routing and the BGP protocol.

IP address, default = 0.0.0.0

RipEX unit acts in the BGP network as a dynamic router. Every router is identified by an ID having the format of an IP address. This IP address does not have to be ‘real’. Router ID is shared with the OSPF protocol.

Number {0 – (2³²-1)}, default = 65000

Local Autonomous System identification number. AS numbers are assigned by IANA. Part of the range is reserved for private network usage: 64512 – 65534 and 4200000000 – 4294967294. AS numbers from this range can be safely used by anyone.

Number {0 – (2³²-1)}, default = 100

Router preference within the local AS. The higher the number, the higher the preference.

List box {Off; Static; OSPF metric 1}, default = “Off”

Setting of MED (Multi-Exit Discriminator) on the routing rules being exported to other AS. MED makes it possible to advertise which of the routers in the local AS is the preferred input point to the AS. “Static” option sets the fixed value for all rules (Static MED). “OSPF metric 1” copies the OSPF metric to MED; for the rules which are not from the OSPF it enters the fixed value Static MED.

Number {0 – (2³²-1)}, default = 0

Metric to be used for the preferred input point to the AS selection (see MED (Multi-Exit Discriminator) description). The higher the number the lower the preference.

List box {Off; On}, default = “Off”

Enables the Route reflector function on this router. iBGP requires connection in between all routers under normal circumstances. Route reflector makes it possible to avoid this requirement by distributing routing updates to all its clients. Such clients do not need any other connection except connection to this Route reflector. Route reflector and its clients form a ‘cluster’. See more details at the beginning of the BGP chapter.

List box {Router ID; Manual}, default = “Router ID”

Controls the iBGP cluster identification. Cluster identification must be the same inside the cluster and it has to be different in another cluster. If the “Router ID” is selected, the Router ID value is used as a cluster id.

IP address, default = 0.0.0.0

Cluster identification in the format of an IP address. This IP address does not have to be ‘real’ (valid).

List box {On; Off}, default = “On”

Enables the specific neighbor.

Optional comment.

List box {Internal; External}, default = “External”

Neighbor router type selection. “Internal” neighbor belongs to the same AS (iBGP). “External” belongs to other AS (eBGP).

Number {0 – (2³²-1)}, default = 65000

Neighbor AS number.

IP address, default = 0.0.0.0

Neighbor router IP address.

IP address, default = 0.0.0.0

Local IP address of the connection. Default value 0.0.0.0 provides automatic set up of this address – from the routing.

List box {Direct; Multihop}, default = “Direct”

Network connection type between the neighbors. “Direct” means direct – one hop – connection. This is typical for eBGP routers. “Multihop” means connection over the multiple routers. This is typical for iBGP routers.

List box {On; Off}, default = “Off”

Enables BGP packets authentication using TCP MD5 Signature extension.

String {up to 128 char}

Password for the MD5 authentication.

List box {On; Off}, default = “Off”

Passive BGP router does not initiate connection to a neighbor, it is waiting for the neighbor activity.

Number {3 – 10800}, default = 240

Time (in seconds) to wait for the keepalive message from the neighbor. It is negotiated with the neighbor. When it expires, the connection is treated as interrupted.

Number {1 – 3600}, default = 80

Period (in seconds) of sending keepalive messages. It should not be longer than 1/3 of the Hold interval.

Number {1 – 3600}, default = 120

Time (in seconds) to wait before trying to re-connect the interrupted connection.

List box {On; Off}, default = “On”

Protection against BGP packets spoofing. [PP1] The Generalized TTL Security Mechanism (GTSM – RFC 5082) is used. BGP transmits packets with known TTL value. Incoming packets having lower than expected value (expected number of hops) are discarded.

Number {2 – 32}, default = 2

Number of expected hops between the neighbors.

List box {On; Off}, default = “Off”

Defines if this neighbor is a client of this Route reflector.

List box {On; Off}, default = “Off”

Enables to set a specific Cost of the BGP connection.

Number {0 – (2³²-1)}, default = 10

The cost of connection to this neighbor. The higher the number the higher the cost. It enables to make decisions inside the router between multiple paths from the same neighbor.

List box {Off; Always; Internal; External}, default = “Off”

Defines it the exported routing rules should have ‘next hop’ addresses overwritten to the address of this router. “Internal” overwrites only the rules from the local AS. “External” overwrites only the rules from the other AS.

List box {On; Off}, default = “Off”

Enables / disables the static routing rule.

IP address, default = 0.0.0.0/32

IP address and mask defining the exported routing rule destination address range.

Optional comment.

List box {Accept; Reject}, default = “Reject”

Defines what action is taken on the routing rules which were not captured (i.e. fallback) in the Import IGP filter.

List box {On; Off}, default = “On”

Enables / disables the filter rule.

Optional comment.

List box {Off; Match; Not match}, default = “Off”

Selects a method of the routing rule destination range comparison.

IP address / mask, default = 0.0.0.0/0

IP address and mask defines the network prefix to be compared

Number {0 – 32}, default = 0

Number {0 – 32}, default = 32

Definition of the enabled range of the mask length of the processed routing rule.

List box {Off; Internal; External}, default = “Off”

Selection based on the routing rule source. “Internal” selects rules received from the internal (iBGP) connection. “External” selects rules received from the other AS (eBGP).

List box {Off; Is empty; Not empty; Contain; Not contain}, default = “Off”

Filtering based on the BGP Path (routing rule path over different AS). “Is empty” – defines an empty path (routing rule from the local AS). “Contain” – defines paths containing specific AS.

List box {Any; Neighbor; Source}, default = “Any”

Selects position of the specific AS (Path AS). “Any” – anywhere on the path. “Neighbor” – the path was received from this AS (last on the path). “Source” – routing rule was originated from this AS (first on the path).

Number {0 – (2³²-1)}, default = 65000

The number of the AS searched for.

List box {Accept; Reject; Pass}, default = “Accept”

Defines what action is taken on the captured [PP1] routing rule. “Pass” continues in processing.

List box {Off; On}, default = “Off”

Defines if the specific Preference will be set up for this rule.

Number {0 – 65535}, default = 100

Routing rule preference in the routing table. The higher the number the higher the preference.

IP address, default = 0.0.0.0

Preferred source IP address for the locally generated packets. When disabled (default value 0.0.0.0 is used), the source IP address is set according to the outgoing interface.

List box {Accept; Reject}, default = “Reject”

Defines what action is taken on the routing rules which were not captured (i.e. fallback) in the Export IGP filter.

List box {On; Off}, default = “On”

Enables / disables the filter rule.

Optional comment.

List box {Off; Match; Not match}, default = “Off”

Selects a method of the routing rule destination range comparison.

IP address / mask, default = 0.0.0.0/0

IP address and mask defines the network prefix to be compared

Number {0 – 32}, default = 0

Number {0 – 32}, default = 32

Definition of the enabled range of the mask length of the processed routing rule.

List box {Off; Match; Not match}, default = “Off”

Selects the way how the routing rule source protocol is compared.

List box {System; OSPF}, default = “System”

Selection of the protocol origin. “System” – stands for rules from the ordinary routing table. “OSPF” stands for rules from the OSPF protocol.

List box {Off; Match; Not match}, default = “Off”

Selects the OSPF routing rule source comparison mode.

List box {Internal; Inter-area; External type 1; External type 2}, default = “External type 2”

OSPF sources. “Internal” – stands for internally generated rule (e.g. interface range). “Inter-area” – stands for rule generated on the area borders.

List box {Off; Match; Not match}, default = “Off”

Selects the way of filtering based on OSPF tag.

Number {0 – (2³²-1)}, default = 0

OSPF tag to be compared. The tag is added to a rule when inserted to OSPF.

List box {Accept; Reject; Pass}, default = “Accept”Defines what action is taken on the routing rule. “Pass” continues in processing.

List box {Accept; Reject}, default = “Accept”

Defines what action is taken on the routing rules which were not captured (i.e. fallback) in the Import OUT filter.

Number {1 – 65535}, default = 1024

Limit of the accepted routing rules from the neighbor. The limit applies before this Import OUT filter. Excess rules are dropped.

List box {On; Off}, default = “On”

Enables / disables the filter rule.

Optional comment.

List box {Off; Match; Not match}, default = “Off”

Selects a method of the routing rule destination range comparison.

IP address / mask, default = 0.0.0.0/0

IP address and mask defines the network prefix to be compared

Number {0 – 32}, default = 0

Number {0 – 32}, default = 32

Definition of the enabled range of the mask length of the processed routing rule.

List box {Off; Is empty; Not empty; Contain; Not contain}, default = “Off”

Filtering based on the BGP Path (routing rule path over different AS). “Is empty” – defines an empty path (routing rule from the local AS). “Contain” – defines paths containing specific AS.

List box {Any; Neighbor; Source}, default = “Any”

Selects position of the specific AS (Path AS). “Any” – anywhere on the path. “Neighbor” – the path was received from this AS (last on the path). “Source” – routing rule originates from this AS (first on the path).

Number {0 – (2³²-1)}, default = 65000

The number of the AS searched for.

List box {Accept; Reject; Pass}, default = “Accept”

Defines what action is taken with the matching routing rule. “Pass” continues in processing.

Number {0 – 8}, default = 0

Enables to append (even multiple times) local AS number to the BGP path end – making the path virtually longer. The longer path is handicapped during the comparisons and selections.

List box {Accept; Reject}, default = “Accept”

Defines what action is taken on the routing rules which were not captured (i.e. fallback) in the Export OUT filter.

List box {On; Off}, default = “On”

Enables / disables the filter rule.

Optional comment.

List box {Off; Match; Not match}, default = “Off”

Selects a method of the routing rule destination range comparison.

List box {Off; Match; Not match}, default = “Off”

IP address and mask defines the network prefix to be compared

Number {0 – 32}, default = 0

Number {0 – 32}, default = 32

Definition of the enabled range of the mask length of the processed routing rule.

List box {Off; Match; Not match}, default = “Off”

Selects the way how the routing rule source protocol is compared.

List box {System; OSPF; BGP; BGP external; BGP internal}, default = “System”

Selection of the protocol origin. “System” – stands for rules from the ordinary routing table.

List box {Off; Match; Not match}, default = “Off”

Selects the way of filtering based on OSPF tag.

Number {0 – (2³²-1)}, default = 0

OSPF tag to be compared. The tag is added to a rule when inserted to OSPF.

List box {Off; Is empty; Not empty; Contain; Not contain}, default = “Off”

Filtering based on the BGP Path (routing rule path over different AS). “Is empty” – defines an empty path (routing rule from the local AS). “Contain” – defines paths containing specific AS.

List box {Any; Neighbor; Source}, default = “Any”

Selects position of the specific AS (Path AS). “Any” – anywhere on the path. “Neighbor” – the path was received from this AS (last on the path). “Source” – routing rule was originated from this AS (first on the path).

Number {0 – (2³²-1)}, default = 65000

The number of the AS searched for.

List box {Accept; Reject; Pass}, default = “Accept”

Defines what action is taken on the routing rule. “Pass” continues in processing.

Enables / disables L3 firewall; default = “Off”

Each individual firewall rule is described by following parameters:

List box {All; ICMP; UDP; TCP; GRE; ESP; Other}, default = “All”

The rule with narrower mask has higher priority. The rule’s order does affect priority.

Interval of source ports. This parameter occurs only when parameter Protocol is set either to “UDP” or “TCP”.

List box {All; WWAN; All ETH; EXT; ETH1..ETH5; GRE L2; GRE L3; Other}, default = “All”

Defines the destination IP subnet.

Interval of destination ports.

List box {All; WWAN; All ETH; EXT; GRE L3; Other}, default = “All”

List box {Off; On}, default = “Off”

Relates to the first packet when a TCP connection starts (Request from TCP client to TCP server for opening a new TCP connection). Used e.g. for allowing to open TCP only from M!DGE3 network to outside.

List box {Off; On}, default = “Off”

Relates to an already existing TCP connection. Used e.g. for allowing to get replies for TCP connections created from M!DGE3 network to outside.

List box {Off; On} default = “Off”

A connection related to the “Established” one, e.g. FTP typically uses 2 TCP connections control and data, where data connection is created automatically by using dynamic ports.

	Note
	Management connection to a remote M!DGE3 may be lost, when another M!DGE3 acts as a router along the management packets path and TCP port 8889 (Remote Access) is disabled (DENY rule) in L3 firewall settings of that routing M!DGE3 (FORWARD chain).

List box {Deny; Allow}, default = “Deny”

Enables / disables L3 firewall; default = “Off”

Each individual firewall rule is described by following parameters:

Rules, that open management access through service interfaces.

List box {Other; COM1; COM2; COM3; TS1; TS2; TS3; TS4; TS5; SSH; HTTP; HTTPS; Remote access; SNMP; NTP}, default = “Other”

List box {All; ICMP; UDP; TCP; GRE; ESP; Other}, default = “All”

Source IP address and mask. The rule with narrower mask has higher priority. The rule’s order does affect priority.

Interval of source ports. This parameter occurs only when parameter Protocol is set either to “UDP” or “TCP”.

List box {All; WWAN; All ETH; EXT; ETH1..ETH5; GRE L2; GRE L3; Other}, default = “All”

Interval of destination ports.

List box {Off; On}, default = “Off”

Relates to the first packet when a TCP connection starts (Request from TCP client to TCP server for opening a new TCP connection). Used e.g. for allowing to open TCP only from M!DGE3 network to outside.

List box {Off; On}, default = “Off”

Relates to an already existing TCP connection. Used e.g. for allowing to get replies for TCP connections created from M!DGE3 network to outside.

List box {Off; On} default = “Off”

A connection related to the “Established” one. e.g. FTP typically uses 2 TCP connections control and data, where data connection is created automatically by using dynamic ports.

	Note
	Management connection to a remote M!DGE3 may be lost, when another M!DGE3 acts as a router along the management packets path and TCP port 8889 (Remote Access) is disabled (DENY rule) in L3 firewall settings of that routing M!DGE3 (FORWARD chain).

List box {Deny; Allow; Deny, Add to Blocklist}, default = “Deny”
Deny, Add to Blocklist – all traffic from the particular address will be automatically dropped. Blocklist has limited capacity of 512 addresses. Once its capacity is exceeded, the oldest address is overwritten. Addresses added to the blocklist remain in for one week (604,800s) and are deleted from it afterwards. Change of configuration including firewall, or unit reboot will delete those addresses as well.

Enables / disables L3 firewall; default = “Off”

Each individual firewall rule is described by following parameters:

Rules, that allow returning management packets (replies) through service interface.

List box {Other; COM1; COM2; COM3; TS1; TS2; TS3; TS4; TS5; SSH; HTTP; HTTPS; Remote access; SNMP; NTP}, default = “Other”

The rule’s order does affect priority.

List box {All; ICMP; UDP; TCP; GRE; ESP; Other}, default = “All”

Interval of source ports. This parameter occurs only when parameter Protocol is set either to “UDP” or “TCP”.

Defines the destination IP / subnet.

Interval of destination ports.

List box {Off; On}, default = “Off”

Relates to the first packet when a TCP connection starts (Request from TCP client to TCP server for opening a new TCP connection). Used e.g. for allowing to open TCP only from M!DGE3 network to outside.

List box {Off; On}, default = “Off”

Relates to an already existing TCP connection. Used e.g. for allowing to get replies for TCP connections created from M!DGE3 network to outside.

List box {Off; On} default = “Off”

A connection related to the “Established” one. e.g. FTP typically uses two TCP connections control and data, where data connection is created automatically by using dynamic ports.

	Note
	Management connection to a remote M!DGE3 may be lost, when another M!DGE3 acts as a router along the management packets path and TCP port 8889 (Remote Access) is disabled (DENY rule) in L3 firewall settings of that routing M!DGE3 (FORWARD chain).

List box {Deny; Allow}, default = “Deny”

Optional comment.

List box {Enable; Disable}, default = “Disable”

Enables / disables all Source NAT rules.

List box {All; ICMP; UDP; TCP; GRE; ESP; Other}, default = “All”

Filters selected protocol. If none of the mentioned values suits, select “Other”.

Number {0 – 255}, default = 1

This parameter occurs only, if parameter “Protocol” is set to “Other”.

IP address, default = 0.0.0.0/0

Defines the source IP subnet.

Number {0 – 65535}, default = 0

Defines the range of values of source port. Value 0 means, that it is not filtered according to the source port. If only one port is required, set both parameters to the same number. These parameters occur only, if parameter “Procotol” is set to “UDP” or “TCP”.

IP address, default = 0.0.0.0/0

Defines the destination IP subnet.

Number {0 – 65535}, default = 0

Defines the range of values of destination port. Value 0 means, that it is not filtered according to the destination port. These parameters occur only, if parameter “Procotol” is set to “UDP” or “TCP”.

List box {All; ; ;WWANAll ETH; EXT; GRE L3; Other}, default = “All”

Filters selected interfaces.

Has to be set as one of existing interfaces (the name of LAN (or VLAN) interface, the name of GRE tunnel, etc.). This parameter occurs only, if parameter “Output Interface” is set to “Other”.

List box {Off; IP address to IP address}, default = “Off”

Off – Source address and (or) port will be replaced by values from parameters “Rewrite source IP” and “Rewrite source port”. This applies only if those parameters are set (they are not set as 0.0.0.0).

IP address to IP address (NETMAP) – Rewriting the Range mapping of source IP address. New source address will contain prefix from parameters “Rewrite Source IP” and “Rewrite Source IP / Mask”. Rest of the source address will be filled by the original source address.

IP address, default = 0.0.0.0/0

Defines a new source address. Value 0.0.0.0/0 means, that the source address is not changed.

Number {0 – 65535}, default = 0

Defines a new source port (rewriting multiple defined ports into one). Value 0 means, that the source port is not changed.

Optional comment.

List box {Enable; Disable}, default = “Disable”

Enables / disables all Destination NAT rules.

Filters selected protocol. If none of the mentioned values suits, select “Other”.

Number {0 – 255}, default = 1

This parameter occurs only, if parameter “Protocol” is set to “Other”.

IP address, default = 0.0.0.0/0

Defines the source IP subnet.

Number {0 – 65535}, default = 0

Defines the range of values of source port. Value 0 means, that it is not filtered according to the source port. If only one port is required, set both parameters on the same number. These parameters occur only, if parameter “Procotol” is set to “UDP” or “TCP”.

IP address, default = 0.0.0.0/0

Defines the destination IP subnet.

Defines the range of values of destination port. Value 0 means, that it is not filtered according to the destination port. These parameters occur only, if parameter “Procotol” is set to “UDP” or “TCP”.

List box {All; WWAN; All ETH; EXT; GRE3; Other}, default = “All”

Filters selected interfaces.

Has to be set as one of existing interfaces (the name of LAN (or VLAN) interface, the name of GRE tunnel, etc.). This parameter occurs only, if parameter “Input Interface” is set to “Other”.

List box {Off; IP address to IP address}, default = “Off”

IP address, default = 0.0.0.0/0

Defines a new destination address. Value 0.0.0.0/0 means, that the destination address is not changed.

Number {0 – 65535}, default = 0

Defines a new destination port (rewriting multiple defined ports into one). Value 0 means, that the destination port is not changed.

Optional comment.

{On; Off}, default = “Off”

This parameter is valid for all IKE SA using IKEv2 with re-authentication. A temporary connection breaks during IKE_SA re-authentication is suppressed by this parameter. This function may not operate correctly with some IPsec implementations (on peer side).

Every item in the table represents one IKE SA. There can be a maximum of 24 active IKE SA (limited by system resources).

Parameters related to IKE SA (IKE Security Association) provide SA keys exchange with the peer.

Certain parameters are shared by all subordinate CHILD SA. IPsec Security Association provides packet encryption (user traffic encryption).

PSK (Pre-shared key) authentication is used for IKE SA authentication. The relevant peer is identified using it’s “Peer ID”. The key must be the same for both local and peer side of the IPsec.

Default = 0.0.0.0

IKE peer IP address.

IP address or FQDN (Fully Qualified Domain Name) is used as the Local side identification. It must be the same as “Peer ID” of the IKE peer.

IP address or FQDN (Fully Qualified Domain Name) is used as the IKE peer identification. It must be the same as “Local ID” of the IKE peer. The “Peer ID” must be unique in the whole table.

Switches all L2 tunnels On or Off.

Enables particular L2 tunnel. Maximum number of configurable tunnels is 256.

Optional comment.

IP address of the equipment with the second end of the tunnel. This address is the expected source address of incoming GRE packets from the peer.

Has to be set as one of existing bridge’s name in SETTING/Interfaces/Ethernet/ Network interface Name.

Enables using key identification of the tunnel from/to the same peer.

Identification number of the tunnel Number {0 – 4,294,967,295}, default = 0

MTU of the L2 tunnel. Number {74 – 1500}, default = 1430 B

Overhead of the L2 tunnel is 38 B, so it should be GRE MTU = Path MTU – 38.

Minimum MTU value to establish TCP between M!DGE3 units = 576 B.

	Note
	For traffic in bridged network (e.g. when using Transparent protocol), it is necessary to set the MTU to a proper value, otherwise there is a risk of packet fragmentation and thus compromising efficiency and reliability of the transfer.

Switches all L3 tunnels On or Off.

Enables particular L3 tunnel. Maximum number of configurable tunnels is 256.

Optional comment.

IP address of the equipment with the second end of the tunnel. This address is the expected source address of incoming GRE packets from the peer.

IP address and mask of the GRE tunnel interface

Enables using key identification of the tunnel from/to the same peer.

Identification number of the tunnel Number {0 – 4,294,967,295}, default = 0

MTU of the L2 tunnel. Number {70 – 1476}, default = 1476

Overhead of the L3 tunnel is 24 B, so it should be GRE MTU = Path MTU – 24. If the MTU is bigger than is allowed along the route, the GRE packets will be discarded and ICMP report will be send back to the source of the original packet (Path MTU discovery).

Minimum MTU value to establish TCP between M!DGE3 units = 576 B.

String {1–128 char}, default = <empty>

New Username. Every username in the unit must be unique.

String {5–128 char}, default = <empty>

Password is stored in a secure way.

List box {Admin; Security Technician; Technician; Guest}, default = “Admin”

	Note
	It is highly recommended to create a new administrator type of account and delete the default “Admin” account.

Number {5 – 64}, default = 5

The minimum length of the password for all users.

Number {0 – 5}, default = 0

The minimum number of lowercase letters (English letters) which are required in the user password.

Number {0 – 5}, default = 0

The minimum number of uppercase letters (English letters) which are required in the user password.

Number {0 – 5}, default = 0

The minimum number of number characters (0 to 9) which are required in the user password.

Number {0 – 5}, default = 0

The minimum number of special characters (not English upper or lower cases or numbers) which are required in the user password. Non-English letters (like Greek, Russian, Arabic) are counted as special characters.

	Note
	The settings are applicable for new passwords only, already existing passwords will not be affected.

Unique identifier used to reference Repository in configuration.

Validated according to regular expression: [a-zA-Z0-9\_]\\{1,128\\}. IDs starting with underscore “_” are reserved for Read Only keys.

Defines the type of Key the Repository can contain.

Optional comment.

There are several operations, that can be performed on a repository:

Displays Key info including checksums.

Generates a new Key using local Certification authority (see below).

Updates the Key with a new one. Both file and text, encrypted and unencrypted Keys are supported.

Allows download of the Key. Both encrypted and unencrypted downloads are supported, according to Setting (see below).

Generates and downloads CSR from eligible Keys.

Signs CSR. Both file and text certificates are supported. Signed certificate is automatically downloaded. It is possible to add “extended key usage” Certificate modifier for OpenVPN client/server.

Type: SSH Key (PRI)

The SSH host key used to authenticate the server on the client. If missing, it is generated when the station boots.

Type: RMTACCESS Key (PRI)

Host key for the Remote access server (QSSH). It is used to authenticate the server.

If missing, it is generated when the station starts.

Type: RMTACCESS Key (PRI)

Key for Remote access (QSSH) client login to the server. Must be present on both sides.

Obtained from FW. If it differs from the version in FW, it is updated.

Type: Certificate (PRI)

Web server private key (default).

Obtained from FW. If it is different from the version in FW, it is updated.

Type: Certificate Key (PUB)

Web server certificate (default).

Obtained from FW. If it is different from the version in FW, it is updated.

Type: CA Chain (PUB)

The certificate string of the authority that signed the Web server certificate. If self-signed, it will be empty.

Retrieved from FW. If it differs from the version in FW, it is updated.

Type: DH Parameters (PUB)

Parameters for the Diffie-Hellman key exchange in the Web server.

Retrieved from FW. If it differs from the version in FW, it is updated.

Type: UFTP Key (PRI)

Key for authenticating stations in the “File distribution” (UFTP) service.

Obtained from FW. If it differs from the version in FW, it is updated.

Private key used for local certification authority.

Public certificate used for local certification authority.

Algorithm used for certificate signing. It depends on the Certification Authority key algorithm and may not be used in case CA uses a specific algorithm.

Expiration period in days. Default 7300.

Number {5 – 64}, default = 5

The minimum length of the password.

Number {0 – 5}, default = 0

The minimum number of lowercase letters (English letters) which are required in the password.

Number {0 – 5}, default = 0

The minimum number of uppercase letters (English letters) which are required in the password.

Number {0 – 5}, default = 0

The minimum number of number characters (0 to 9) which are required in the password.

Number {0 – 5}, default = 0

The minimum number of special characters (not English upper or lower cases or numbers) which are required in the password. Non-English letters (like Greek, Russian, Arabic) are counted as special characters.

Each of the ETH or WiFi service can be enabled or disabled separately. When the WiFi is enabled, the unit acts as a WiFi Access Point (AP).

IP address, default = 0.0.0.0/0

IP address of the DHCP server. This is the IP address to be used when accessing the unit management via this serial interface.

Default = IP address of the DHCP server + 1

DHCP Server assigns addresses to connected clients starting from this address.

DHCP server assigns IP addresses to connected clients in the range defined by DHCP pool start and DHCP pool end (inclusive).

WiFi AP parameters can be customized.

List box {On; Off}, default = “On”

When automatic definition of SSID is enabled, the SSID contains unit Serial number.

WiFi AP SSID. When entered manually, it must follow SSID naming conventions.

List box {802.11g; 802.11g }, default = “802.11g ”

WiFi AP mode.

Selected WiFi channel.

List box {Off; WPA2-PSK}, default = “Off”

It is a good practice to use WPA2-PSK secured connection together with a strong password. It is highly recommended in case of permanent WiFi adapter installation.

This name is used as a real name of the Linux router, so the allowed characters are strictly limited to:

Text; default = _a..zA..Z0..9

Text; default = _a..zA..Z0..9

Longer unit name without special characters restrictions.

Text; default = _a..zA..Z0..9

Additional SNMP information. All the fields above are typically used in the NMS systems to identify the specific unit.

The Status field provides information about NTP synchronization status.

Refresh button is used to update the Status information.

Enable / disable, default = disable

Enables / disables Sleep mode. When enabled, the unit will periodically go into Sleep mode depending on conditions defined by the following configuration.

Enables / Disables the GNSS (GPS).

String {2–16 ASCII char}, default = “public”

Sets an SMS password, which serves as an authentication to send SMS from defined phone number(s). The range of length of the password is between 2–16 characters. SMS password must not contain any unsupported characters. Unsupported characters are: “, `, \, $, ;.

{Enable; Disable}, default = “Enable”

Enables / Disables phone number. When enabled, defined phone number can either send or receive (or both) SMS. Amount of phone numbers, which can receive and send SMS is limited to 10.

Optional comment.

{On; Off}, default = “On”

Allows to accept commands from defined phone number.

	Note
	This parameter will work only if parameter SMS commands MAIN/EXT is enabled.

{On; Off}, default = “On”

Allows to send notifications to defined phone number.

	Note
	This parameter will work only if parameter SMS notifications MAIN/EXT is enabled.

Example: public cellstatus

Request for SMS with extract of Cellular status of the module, which received the SMS.

Reply of command “cellstatus”:

Station: <station_name>

<module_type> <SIM> Profile <profile_id>

Status: <connection_state>

Reg: <registration_state>

Net: <PLMN>

Svc: <service_type>

Band: <band>

Signal: <signal_strength>

APN: <username_APN>

IP: <assigned_IP>

Example of reply for command “cellstatus”:

Station: Alef

EXT SIM2 Profile 1

Status: CONNECTED

Reg: RegHome

Net: 23002

Svc: 2G_EDGE

Band: ARFCN 77

Signal: RSSI: >=-48 dBm

APN: internet

IP: 100.110.103.173

Example: public smsevent raise

This command is used to turn on/off alarms which can be set in Section 7.6.3, “Events” by using its parameters (“raise”, “clear”).

This command does not generate an automatic reply.