Configure the web administration service

The web administration service allows you to monitor and configure the IX14 device by using the WebUI, a browser-based interface.

By default, the web administration service is enabled and uses the standard HTTPS port, 443. The default access control for the service uses the Internal firewall zone, which means that only devices connected to the IX14's LAN can access the WebUI. If this configuration is sufficient for your needs, no further configuration is required. See Allow remote access for web administration and SSH for information about configuring the web administration service to allow access from remote devices.

Required configuration items

Additional configuration items

See Set the idle timeout for IX14 users for information about setting the inactivity timeout for the web administration services.

 

The web administration service is enabled by default. To disable the service, or enable it if it has been disabled:

  Web

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Services > Web administration.
  4. Click Enable.
  5. Click Apply to save the configuration and apply the change.

  1. Select the device in Remote Manager and click Actions > Open Console, or log into the IX14 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:
    > config
(config)>
  3. Enable or disable the web administration service:
    • To enable the service:
      (config)> service web_admin enable true
(config)>
    • To disable the sevice:
      (config)> service web_admin enable false
(config)>
  4. Save the configuration and apply the change:
    (config)> save
Configuration saved.
>
  5. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Services > Web administration.
  4. (Optional) For Port, enter the port number for the service. Normally this should not be changed.
    • To limit access to specified IPv4 addresses and networks:
      1. Click IPv4 Addresses.
      2. For Add Address, click .
      3. For Address, enter the IPv4 address or network that can access the device's web administration service. Allowed values are:
        • A single IP address or host name.
        • A network designation in CIDR notation, for example, 192.168.1.0/24.
        • any: No limit to IPv4 addresses that can access the web administration service.
      4. Click again to list additional IP addresses or networks.
    • To limit access to specified IPv6 addresses and networks:
      1. Click IPv6 Addresses.
      2. For Add Address, click .
      3. For Address, enter the IPv6 address or network that can access the device's web administration service. Allowed values are:
        • A single IP address or host name.
        • A network designation in CIDR notation, for example, 2001:db8::/48.
        • any: No limit to IPv6 addresses that can access the web administration service.
      4. Click again to list additional IP addresses or networks.
    • To limit access to hosts connected through a specified interface on the IX14 device:
      1. Click Interfaces.
      2. For Add Interface, click .
      3. For Interface, select the appropriate interface from the dropdown.
      4. Click again to allow access through additional interfaces.
    • To limit access based on firewall zones:
      1. Click Zones.
      2. For Add Zone, click .
      3. For Zone, select the appropriate firewall zone from the dropdown.

        See Firewall configuration for information about firewall zones.

      4. Click again to allow access through additional firewall zones.
  6. Multicast DNS (mDNS) is enabled by default. mDNS is a protocol that resolves host names in small networks that do not have a DNS server. To disable mDNS, or enable it if it has been disabled, click Enable mDNS.
  7. For SSL certificate, if you have your own signed SSL certificate, paste the certificate and private key. If SSL certificate is blank, the device will use an automatically-generated, self-signed certificate.
    • The SSL certificate and private key must be in PEM format.
    • The private key can use one of the following algorithms:
      • RSA
      • DSA
      • ECDSA
      • ECDH

        • Note Password-protected certificate keys are not supported.

    1. Generate the SSL certificate and private key, for example:

      # openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem

    2. Paste the contents of certificate.pem and key.pem into the SSL certificate field. The contents of the certificate.pem must be first. For example:

  8. For Allow legacy encryption protocols, enable this option to allow clients to connect to the HTTPS session by using encryption protocols older than TLS 1.2, in addition to TLS 1.2 and later protocols. This option is disabled by default, which means that only TLS 1.2 and later encryption protocols are allowed with HTTPS connections.
  9. View is set to Auto by default and normally should not be changed.
  10. Legacy port redirection is used to redirect client HTTP requests to the HTTPS service. Legacy port redirection is enabled by default, and normally these settings should not be changed. To disable legacy port redirection, click to expand Legacy port redirection and deselect Enable.
  11. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the IX14 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:
    > config
(config)>
  3. Configure access control:
    • To limit access to specified IPv4 addresses and networks:
      (config)> add service web_admin acl address end value
(config)>

      Where value can be:

      • A single IP address or host name.
      • A network designation in CIDR notation, for example, 192.168.1.0/24.
      • any: No limit to IPv4 addresses that can access the web administratrion service.

      Repeat this step to list additional IP addresses or networks.

    • To limit access to specified IPv6 addresses and networks:
      (config)> add service web_admin acl address6 end value
(config)>

      Where value can be:

      • A single IP address or host name.
      • A network designation in CIDR notation, for example, 2001:db8::/48.
      • any: No limit to IPv6 addresses that can access the web administratrion service.

      Repeat this step to list additional IP addresses or networks.

    • To limit access to hosts connected through a specified interface on the IX14 device:
      (config)> add service web_admin acl interface end value
(config)>

      Where value is an interface defined on your device.

      Use ... network interface ? to display interface information:

      (config)> ... network interface ?

Interfaces

 Additional Configuration
 -------------------------------------------
 defaultip              Default IP
 defaultlinklocal       Default Link-local IP
 lan                    LAN
 loopback               Loopback
 modem                  Modem

config)>

      Repeat this step to list additional interfaces.

    • To limit access based on firewall zones:
      (config)> add service web_admin acl zone end value

      Where value is a firewall zone defined on your device, or the any keyword.

      Type ... firewall zone ? at the config prompt:

      (config)> ... firewall zone ?

Zones: A list of groups of network interfaces that can be referred to by packet
filtering rules and access control lists.

 Additional Configuration
 -------------------------------------------------------------------------------
  any
  dynamic_routes
  edge
  external
  internal
  ipsec
  loopback
  setup

(config)>

      Repeat this step to list additional firewall zones.

  4. (config)> service web_admin cert "ssl-cert-and-private-key"
(config)>
    • If SSL certificate is blank, the device will use an automatically-generated, self-signed certificate.
    • The SSL certificate and private key must be in PEM format.
    • The private key can use one of the following algorithms:
      • RSA
      • DSA
      • ECDSA
      • ECDH

        • Note Password-protected certificate keys are not supported.

    1. Generate the SSL certificate and private key, for example:

      # openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem

    2. Paste the contents of certificate.pem and key.pem into the service web_admin cert command. Enclose the contents of certificate.pem and key.pem in quotes. For example:
      (config)> service web_admin cert "-----BEGIN CERTIFICATE-----
MIID8TCCAtmgAwIBAgIULOwezcmbnQmIC9pT9txwCfUbkWQwDQYJKoZIhvcNAQEL
BQAwgYcxCzAJBgNVBAYTAlVTMQ8wDQYDVQQIDAZPcmVnb24xDjAMBgNVBAcMBUFs
b2hhMRMwEQYDVQQKDApNY0JhbmUgSW5jMRAwDgYDVQQLDAdTdXBwb3J0MQ8wDQYD
VQQDDAZtY2JhbmUxHzAdBgkqhkiG9w0BCQEWEGptY2JhbmVAZGlnaS5jb20wHhcN
MjAwOTIyMTY1OTUyWhcNMjEwOTIyMTY1OTUyWjCBhzELMAkGA1UEBhMCVVMxDzAN
BgNVBAgMBk9yZWdvbjEOMAwGA1UEBwwFQWxvaGExEzARBgNVBAoMCk1jQmFuZSBJ
bmMxEDAOBgNVBAsMB1N1cHBvcnQxDzANBgNVBAMMBm1jYmFuZTEfMB0GCSqGSIb3
DQEJARYQam1jYmFuZUBkaWdpLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAOBn19AX01LO9plYtfRZq0bETwNwSCYGeEIOGJ7gHt/rihLVBJS1woYv
u1Oq1ohYxIawBY1iIPBD2GtzyEJXzBZdQRhwi/dRyRi4vr7EkjGDr0Vb/NVT0L5w
UzcMeT+71DYvKYm6GpcWx+LoKqFTjbMFBIze5pbBfru+SicId6joCHIuYq8Ehflx
6sy6s4MDbyTUAEN2YhsBaOljej64LNzcsHeISbAWibXWjOSsK+N1MivQq5uwIYw/
1fsnD8KDS43Wg57+far9fQ2MIHsgnoAGz+w6PIKJR594y/MfqQffDFNCh2lJY49F
hOqEtA5B9TyXRKwoa3j/lIC/t5cpIBcCAwEAAaNTMFEwHQYDVR0OBBYEFDVtrWBH
E1ZcBg9TRRxMn7chKYjXMB8GA1UdIwQYMBaAFDVtrWBHE1ZcBg9TRRxMn7chKYjX
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALj/mrgaKDNTspv9
ThyZTBlRQ59wIzwRWRYRxUmkVcR8eBcjwdBTWjSBLnFlD2WFOEEEnVz2Dzcixmj4
/Fw7GQNcYIKj+aIGJzbcKgox10mZB3VKYRmPpnpzHCkvFi4o81+bC8HJQfK9U80e
vDV0/vA5OB2j/DrjvlOrapCTkuyA0TVyGvgTASx2ATu9U45KZofm4odThQs/9FRQ
+cwSTb5v47KYffeyY+g3dyJw1/KgMJGpBUYNJDIsFQC9RfzPjKE2kz41hx4VksT/
q81WGstDXH++QTu2sj7vWkFJH5xPFt80HjtWKKpIfeOIlBPGeRHvdH2PQibx0OOt
Sa+P5O8=
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDgZ9fQF9NSzvaZ
WLX0WatGxE8DcEgmBnhCDhie4B7f64oS1QSUtcKGL7tTqtaIWMSGsAWNYiDwQ9hr
c8hCV8wWXUEYcIv3UckYuL6+xJIxg69FW/zVU9C+cFM3DHk/u9Q2LymJuhqXFsfi
6CqhU42zBQSM3uaWwX67vkonCHeo6AhyLmKvBIX5cerMurODA28k1ABDdmIbAWjp
Y3o+uCzc3LB3iEmwFom11ozkrCvjdTIr0KubsCGMP9X7Jw/Cg0uN1oOe/n2q/X0N
jCB7D56ABs/sOjyCiUefeMvzH6kH3wxTQodpSWOPRYTqhLQOQfU8l0SsKGt4/5SA
v7eXKSAXAgMBAAECggEBAMDKdi7hSTyrclDsVeZH4044+WkK3fFNPaQCWESmZ+AY
i9cCC513SlfeSiHnc8hP+wd70klVNNc2coheQH4+z6enFnXYu2cPbKVAkx9x4eeI
Ktx72wurpnr2JYf1v3Vx+S9T9WvN52pGuBPJQla3YdWbSf18wr5iHm9NXIeMTsFc
esdjEW07JRnxQEMZ1GPWT+YtH1+FzQ3+W9rFsFFzt0vcp5Lh1RGg0huzL2NQ5EcF
3brzIZjNAavMsdBFzdc2hcbYnbv7o1uGLujbtZ7WurNy7+Tc54gu2Ds25J0/0mgf
OxmqFevIqVkqp2wOmeLtI4o77y6uCbhfA6I+GWTZEYECgYEA/uDzlbPMRcWuUig0
CymOKlhEpx9qxid2Ike0G57ykFaEsKxVMKHkv/yvAEHwazIEzlc2kcQrbLWnDQYx
oKmXf87Y1T5AXs+ml1PlepXgveKpKrWwORsdDBd+OS34lyNJ0KCqqIzwAaf8lcSW
tyShAZzvuH9GW9WlCc8g3ifp9WUCgYEA4WSSfqFkQLA09sI76VLvUqMbb31bNgOk
ZuPg7uxuDk3yNY58LGQCoV8tUZuHtBJdrBDCtcJa5sasJZQrWUlZ8y/5zgCZmqQn
MzTD062xaqTenL0jKgKQrWig4DpUUhfc4BFJmHyeitosDPG98oCxuh6HfuMOeM1v
Xag6Z391VcsCgYBgBnpfFU1JoC+L7m+lIPPZykWbPT/qBeYBBki5+0lhzebR9Stn
VicrmROjojQk/sRGxR7fDixaGZolUwcRg7N7SH/y3zA7SDp4WvhjFeKFR8b6O1d4
PFnWO2envUUiE/50ZoPFWsv1o8eK2XT67Qbn56t9NB5a7QPvzSSR7jG77QKBgD/w
BrqTT9wl4DBrsxEiLK+1g0/iMKCm8dkaJbHBMgsuw1m7/K+fAzwBwtpWk21alGX+
Ly3eX2j9zNGwMYfXjgO1hViRxQEgNdqJyk9fA2gsMtYltTbymVYHyzMweMD88fRC
Ey2FlHfxIfPeE7MaHNCeXnN5N56/MCtSUJcRihh3AoGAey0BGi4xLqSJESqZZ58p
e71JHg4M46rLlrxi+4FXaop64LCxM8kPpROfasJJu5nlPpYHye959BBQnYcAheZZ
0siGswIauBd8BrZMIWf8JBUIC5EGkMiIyNpLJqPbGEImMUXk4Zane/cL7e06U8ft
BUtOtMefbBDDxpP+E+iIiuM=
-----END PRIVATE KEY-----"
(config)>

  5. mDNS is a protocol that resolves host names in small networks that do not have a DNS server. mDNS is enabled by default. To disable mDNS, or enable it if it has been disabled:

    • To enable the mDNS protocol:
      (config)> service web_admin mdns enable true
(config>
    • To disable the mDNS protocl:
      (config)> service web_admin mdns enable false
(config)>

  6. The default setting of 443 normally should not be changed.

    (config)> service web_admin port 444
(config)>

  7. Legacy encryption protocols allow clients to connect to the HTTPS session by using encryption protocols older than TLS 1.2, in addition to TLS 1.2 and later protocols. This option is disabled by default, which means that only TLS 1.2 and later encryption protocols are allowed with HTTPS connections.

    To enable legacy encryption protocols:

    (config)> service web_admin legacy_encryption true
(config)>

  8. Legacy port redirection is used to redirect client HTTP requests to the HTTPS service. Legacy port redirection is enabled by default, and normally these settings should not be changed.

    To disable legacy port redirection:

    (config)> service web_admin legacy enable false
(config)>

  9. Save the configuration and apply the change:
    (config)> save
Configuration saved.
>
  10. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.