Digi DAL User Manual
DIGI INTERNATIONAL
9350 Excelsior Blvd, Suite 700
Hopkins, MN 55343, USA
+1 (952) 912-3444 | +1 (877) 912-3444
www.digi.com
Digi Accelerated Linux (DAL) Release Notes
Connect IT Console Servers
Version 20.11.32.138
INTRODUCTION
This is a major firmware release for all DAL supported products. This is a mandatory production
firmware release
SUPPORTED PRODUCTS
· Connect IT 4
· Connect IT 16
· Connect IT 48
· Connect IT Mini
KNOWN ISSUES
· non-primary DNS servers are still queried through the wrong interface when use_dns
configuration option is set to primary (resolved by changing use_dns to either always or never)
[DAL-3156]
· Cellular metrics are not shown under the Settings → Status → Communications section of Digi
Remote Manager, but are shown under the Data Streams for the device. [DALP-768]
· Health metrics are uploaded to Digi Remote Manager unless the Monitoring > Device Health >
Enable option is de-selected and either the Central Management > Enable option is de-
selected or the Central Management > Service option is set to something other than Digi
Remote Manager [DAL-3291]
UPDATE BEST PRACTICES
Digi recommends the following best practices:
1. Test the new release in a controlled environment with your application before you update
production devices.
2. Unless otherwise noted, apply updates in the following order:
a. Device firmware
b. Modem firmware
c. Configuration
d. Application
Digi recommends Digi Remote Manager or Digi aView for automated device updates. For more
information, follow the instructions for Digi Remote manager or Digi aView in the links below:
96000472_C Release Notes Part Number: 93001322_R Page 1
1. Instructions for Digi Remote Manager:
https://www.digi.com/resources/documentation/digidocs/90001436-13/default.htm#tasks/t_update_device_firmware.htm
2. Instructions for Digi aView:
https://www.digi.com/resources/documentation/digidocs/acl-kb/default.htm#Subsystems/kb-6300-cx/update-firmware.htm
If you prefer manually updating one device at a time, follow these steps:
1. Download the firmware file from the Digi firmware support page.
2. Connect to the device’s web UI by connecting your PC to the LAN Ethernet port of the device
and then going to http://192.168.210.1.
3. Select the System tab on the top navigation bar of the page, then select Firmware Update.
4. Select the Browse button in the Upload file section..
5. Browse for and select the downloaded firmware file.
6. Click the Update Firmware button.
TECHNICAL SUPPORT
Get the help you need via our Technical Support team and online resources. Digi oers multiple
support levels and professional services to meet your needs. All Digi customers have access to
product documentation. firmware, drivers, knowledge base and peer-to-peer support forums.
Visit us at https://www.digi.com/support to find out more.
CHANGE LOG
VERSION 20.11.32.138 (December 2, 2020)
This is a mandatory release
ConnectITmini-20.11.32.138.bin
SHA256:
8aa6206f0957f2c2c739ca7fa2c0791c9d01d42503f0d7e7b5e7b6dddd6bd1e1de23a767
40a194557fcb7bf88078ef0ac2908d5f3df9d8545de1ac2cf2216b75
MD5: 5b85b919a0824e083f6cbc683385c373
ConnectIT4-20.11.32.138.bin
SHA256:
4dd5d927bea5cdb091393bf2aa91cc06670960bf54b4ca2885741c758f9c25aa3d399146
01903a0c0c39f23d193e6b6b7a5b213f80aba58892d2f9487de33e27
MD5: 93b8e5b3b9edf8a8e54e22518c0fe4be
ConnectIT16-20.11.32.138.bin
SHA256:
6fdb0d0d75364253f1ea7eae328f7ee0d999c021b2bcb5a353e13aa299fe052bbcd6519
4352ea43a6ecf0585166dd55b641590d0412a62cccea141a96a07d9
MD5: 40c04f4e978117146ef1a134b032
ConnectIT48-20.11.32.138.bin
SHA256:
3befaf4ea4d9a5263f5595f910fcc44a35745431689a90535112e326efe8b51bbc205f5706
4204fa57a02507da65cc6df5c6b5c9c78eaee44133cca410efe6ac
MD5: f15d325b2eaf90d03178c861da448d82
96000472_C Release Notes Part Number: 93001322_R Page 2
FEATURES
1. Add ssh and telnet commands to Admin CLI [DALP-664]
2. Add new modem firmware CLI commands for performing local or over-the-air remote
firmware updates to the cellular modem(s) in the device [DAL-2811]
3. Add new configuration options under Network → Devices for setting the link speed/duplex
of the device's Ethernet port(s) [DALP-135]
4. Add options for starting, stopping, and viewing serial port activity logs through the CLI, web
UI, or Digi Remote Manager [DALP-458]
5. Support for the Sierra EM9190/9191 5G modems [DALP-686]
6. Support for the Sierra EM7411 LTE CAT7 modem [DALP-608]
7. IPv6 IPsec tunnel support for full IPv6 tunnels, IPv6-over-IPv4, or IPv4-over-IPv6 tunnels
[DALP-581]
8. IPsec XFRM interfaces for enhanced control over IPsec tunnels and the network interfaces
associated to them. This allows users to select tunnels for multiple networking features,
including static routes, policy-based routes, access control lists, and routing priority based
on metric. [DAL-490]
9. Inclusion of the Python pip for installing external modules/libraries [DAL-4078]
ENHANCEMENTS
1. Add Services → Location options for configuring GPS or GNSS location communication
[DALP-724]
2. GPS/GNSS support for the Quectel EG25-G modem [DALP-713]
3. Add cellular technology icon to the Dashboard in the web UI [DAL-3673]
4. Add link to product User Guide under the User drop-down menu at the top-right of the web
UI [DALP-569]
5. Added help button to System → File System page of the web UI [DALP-569]
6. Added new Status → Modbus Gateway service page to the web UI to display information
about modbus clients and servers connected to the gateway [DALP-671]
7. Added show modbus-gateway CLI command to view the status of Modbus gateway service
[DALP-671]
8. Updated show modem CLI command to display historical information about the modem if
it is in the process of updating firmware [DAL-1504]
9. Added new Services → Ping responder configuration settings for controlling what
interfaces and firewall zones the DAL device responds to ICMP requests on [DAL-1565]
10. Enhance IPSec tunnels to wait for passing Surelink tests (if configured) before initiating
outbound tunnels [DAL-3878/DAL-3774]
11. Add m2m.telus.iot Telus APN to fallback list [DAL-3911]
12. Add psmtneorm and edneopate010.dpa AT&T APNs to fallback list [DAL-4041/DAL-4045]
13. Add reseller and tracfone.vzwentp Tracfone APNs to the AT&T and Verizon fallback lists
DAL-4098]
14. Add new 890103 and 890141 ICCID prefixes and 31030 PMND ID matchers to AT&T APN
fallback list [DAL-3934/DAL-4041]
15. Add service.qcdm.secure option to enable/disable encrypted QXDM access to the cellular
modem in the DAL device [DAL-3964]
16. Add missing modem firmware and SIM details to datapoints uploaded to Digi Remote
Manager [DAL-4040]
17. Show uptime for connection to Digi Remote Manager on the Dashboard web UIpage in
days/hours/minutes/seconds instead of just minutes [DAL-3691]
96000472_C Release Notes Part Number: 93001322_R Page 3
18. Updated network bridges to use the MAC address of the first device listed in Network →
Bridges → [bridge_name] → Devices as the MAC address for the bridged interface [DAL3949]
19. Add link in the firmware update window on the Status → Modem page to direct users to the
configuration options to schedule a modem firmware update [DALP-725]
20. Updated the help text on the login page to provide a more generic image [DAL-3916]
21. Added option when copying serial port settings on the System → Serial Configuration page
to optionally copy the label of the serial port [DAL-3842]
22. Removed duplicate modem signal information from the Modem → Status page [DAL-3680]
23. Added a DSCP option to policy-based routes to allows users to match the routing rule by
the type of DSCP field in the packet [DAL-3867]
24. Added a defaultroute option for matching policy-based routes to the device's active
default route [DAL-4130]
25. Hide the Monitoring → Device Health configuration options if the device is not enabled for
Digi Remote Manager central mangement [DAL-3825]
26. Update header types for the cellular modem name and network type on the Dashboard
page
27. Create system log when Surelink DNS tests are skipped because the interface doesn't have
any DNS servers [DAL-4224]
28. Added python to the ConnectIT4 product [DAL-4061]
29. Hide main/aggressive mode option when using IKEv2 [DAL-4142]
BUG FIXES
1. Fixed missing default settings in configuration profiles created in Digi Remote Manager (bug
aects firmware versions 20.8.x and older) [DALP-658]
2. Fixed missing option for setting the SIM Slot Preference in configuration profiles in Digi
Remote Manager (bug aects firmware versions 20.8.x and older) [DAL-3912]
3. Fixed format of user passwords when displayed in Digi Remote Manager (bug aects
firmware versions 20.8.x and 20.5.338.58) [DAL-3889]
4. Fixed issue with policy-based routing not working in conjunction with multiple IPsec
tunnels (bug aects firmware versions 20.8.x and older) [DAL-3515]
5. Fixed issue preventing OpenVPN server-managed certificates from being re-generated if the
process was interrupted (bug aects firmware versions 20.8.x and older) [DAL-3803]
6. Fixed issue preventing OpenVPN client from using an autogenerated config file from a tap-
bridge openvpn server (bug aects firmware versions 20.8.x and older) [DAL-3881]
7. Fixed some formatting output of the show system verbose CLI command (bug aects
firmware versions 20.8.x and older) [DAL-3805]
8. Fixed issue preventing VRRP interoperability between DAL devices and SarOS devices (bug
aects firmware versions 20.8.x and older) [DAL-4130]
9. Update VRRP+ to properly handle changes in network interface statuses bug aects
firmware versions 20.8.x and older) [DAL-4274]
10. Removed poorly formatted script contents from the show scripts CLI command output
[DAL-3315]
11. Fixed non-working system disable-cryptography CLI command [DAL-4169]
12. Fixed second-stage erase functionality on devices not enabled for aView management [DAL-
3944]
13. Fixed issue preventing multicast traic from being sent through a GRE tunnel [DAL-3879]
14. Fixed issue preventing a firewall rule from being setup for OSFPv2 entries [DAL-3869]
15. Fixed rare crash caused when a Quectel modem disconnected [DAL-3867]
96000472_C Release Notes Part Number: 93001322_R Page 4
16. Fixed behavior of the WWAN Service LED to blink when a modem firmware update is in
progress (bug aects firmware versions 20.8.x and older) [DAL-3963]
17. Fixed issue preventing ConnectIT-Mini devices and Quectel EG25-G modules from
connecting with Verizon private APNs (bug aects firmware versions 20.8.x and older) [DAL3605/DAL-3276]
18. Removed SIM slot 2 references and options from the configuration settings in the
ConnectIT-Mini [DAL-3930]
SECURITY FIXES
The highest level vulnerability that has been fixed in this release is listed as a Critical CVSS score of
9.1
1. Disallow TCP forwarding from incoming SSH connections [DAL-3938]
2. Remove sensitive information from HTTP GET requests (CVSS score: 5.7 Medium CVSS:3.1/
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) [DAL-3938]
3. Update to linux kernel 5.8 (CVSS score: 3.7 Low CVE-2020-16166 CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:L/I:N/A:N) [DALP-678]
4. OpenSSH updated to version 8.3p1 (CVSS score: 2.2 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) [DAL-3299]
5. OpenSSL updated to vesion 1.1.1h (CVSS score: n/a) [DAL-4037]
6. OpenVPN updated to version 2.4.9 (CVSS score 9.1 Critical CVE-2018-7544
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) [DAL-3862]
7. Linux shell/bash updated to version 5.0 (CVSS score: n/a) [DAL-3763]
8. jQuery updated to version 3.5.1 (CVSS Score: 6.1 Medium CVE-2020-11022 CVE-2020-11023)
[DAL-3547]
9. Updated WebU session token to use AES-256-GCM cipher (CVSS score: n/a) [DAL-4000]
10. Prevent web asset access from unauthorized logins (CVSS score: 5.3 Medium CVSS:3.1/AV:N/
AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) [DAL-3835]
11. Add script CSP headers to the web UI (CVSS score: n/a) [DAL-3629]
12. Added extra layer of firmware verification to ensure the firmware matches the target
hardware variant and prevent firmware modifications (CVSS score 1.9 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) [DAL-3511]
13. Prevent command injection through modemadvanced, modem_install, and firmware
webpages (CVSS score: 6.8 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) [DAL4093/DAL-4104/DAL-4046]
14. Prevent manual addition of files to an encrypted filesytem outside of the device itself (CVSS
score: 6.1 Medium CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) [DAL-4149]
15. Restrict memory allocation of tcpdump (CVSS score: 7.5 High CVE-2020-8037
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) [DAL-4226]
16. Removed expired aView and AVWOB certificates [DAL-3467]
17. Encode MAC address in URL used to sync with aView to prevent privileged escalation [DAL-
4304]
VERSION 20.8.22.32 (August 28, 2020)
This is a mandatory release
ConnectITmini-20.8.22.32.bin
SHA256: 9c21f9662754e77def26af3ea0804f84267f17c28e2ce40bfad5bce655a1add3
MD5: 926608bbdeff50c962f034ecd71c65f4
ConnectIT4-20.8.22.32.bin
SHA256: ab46ac98bc661fa5e56559c6328229d18b10e2c76960ad077c464fb1e75a03f3
96000472_C Release Notes Part Number: 93001322_R Page 5
MD5: 4d519c4318a4eac129739ae82cdef244
ConnectIT16-20.8.22.32.bin
SHA256: 4ae37b9d855c87afd767d02a89121a49cbe95e857df6fd4cd220cb838a7ac790
MD5: f89c26333c0a346e7635e082db92c639
ConnectIT48-20.8.22.32.bin
SHA256: 3235a52e53cd7a27cf04badf66f4cc7bd5aa1fdd2415ae1fe705e1c4a7f9093d
MD5: 926ae9e13ee56d080bec471f064761f6
FEATURES
1. Add new System → Scheduled taks → Allow scheduled scripts to handle SMS
configuration option to allow custom python scripts to handle sending/receiving SMS
messages [DALP-488]
2. Add digidevice.sms python module for sending/receiving SMS messages in a custom python
script [DALP-488]
3. Add ability to load custom factory config file from the local filesystem, which if present is
loaded when the device is reset to default settings [DALP-394]
1. The config file is the same as what can be downloaded when a user saves/exports the
configuration from the Configuration Maintenance page in the local web UI. That .bin
config file can be placed in /opt/custom-default-config.bin
4. DMNR Verizon Private Network support with new settings under VPN → NEMO [DALP-457]
5. Added Serial Modbus Gateway service for utilizing the Modbus protocol to communicate
with serial ports [DALP-573]
1. Configuration settings for the Modbus Gateway are found under Services → Modbus
Gateway
6. MQTT client support via Paho Python module [DALP-590]
1. Note: not available on the ConnectIT4
7. Added Ethernet network bonding to allow the same MAC address and IP configuration to be
shared for multiple physical Ethernet ports in either active/backup or round-robin mode
[DALP-589]
1. Configuration options found under Network → Interfaces → Ethernet bonding. Bond
devices created here can then be assigned to network interfaces
2. Note: not available on the ConnectIT4 or ConnectIT-Mini
8. VRRP+ options added under Network → VRRP → VRRP+ for validating primary or backup
connectivity and automatically changing VRRP priority [DALP-289]
1. Note a SureLink test must also be enabled for the network interface the VRRP entry is
assigned to
9. Cisco Umbrella content filtering options added under Firewall → Web filtering service
configuration section [DALP-524]
ENHANCEMENTS
1. Disable voice services on Quectel EC25-AF when using T-Mobile SIMs [DAL-3707]
2. Add -I source address option to the ping CLI command [DAL-3682]
3. Add service.modbus.debug config option to enable debug logging on Serial Modbus [DAL3561]
4. Add Central management configuration options for any DAL product to sync with aView,
ARMT, or AVWOB [DALP-626]
5. Add 4GM and 4GT options to the Network->Modems→Access technology settings to
specify a CAT-M modem to only connect on LTE CAT-M1 or NB-IoT, respectively [DALP-472]
6. Add options under System → Log → Server list to allow users to specify the TCP/UDP
96000472_C Release Notes Part Number: 93001322_R Page 6
protocol and port of the remote syslog server [DALP-593]
7. Added configuration option under Serial → TCP connection to specify encrypted vs nonencrypted connection types
8. Added configuration option under Serial → TCP/Telnet/SSH connections to enable/disable
TCP keep-alive messages and nodelay
9. Added new Base settings checkbox on custom serial configuration page in the web UI to
allow users to specify whether they want to copy the base serial settings or not [DAL-3775]
10. Added new Monitoring→Device Health→Data point tuning configuration options to fine
tune what datapoints are uploaded as health metrics to Digi Remote Manager
11. Added new Monitoring→Device Health → Only report changed values to Digi Remote
Manager option to control sending metrics to Digi Remote Manager on the basis of whether
the values have changed since they were last reported [DAL-3386]
12. Reduced data usage by 80% (based on default settings) for reporting health metrics to Digi
Remote Manager [DAL-3394]
13. Fade Configuration saved pop-up window 5 seconds aer clicking the Apply button [DAL3451]
14. Added new Status → Scripts page in the web UI to view custom scripts and applications
configured in the device, along with their status (running vs idle) [DALP-533]
15. Add options in CLI to show and manually stop any custom scripts or applications [DALP533]
16. Added Duplicate firmware option on the Firmware Update page in the local web UI to copy
the active firmware to the secondary firmware partition [DALP-565]
17. Add system duplicate-firmware CLI command to copy active firmware to the secondary
firmware partition [DALP-565]
18. Move update firmware CLI command to be under system [DAL-3092]
19. Add show vrrp CLI command to display the status of any configured VRRP instances [DAL2953]
20. Use a random unprivileged port for performing ntp time syncs if standard port 123 fails
[DAL-3650]
21. Added new Authoritative option under TACACS+, RADIUS, and LDAP user authentication
methods to prevent falling back to additional authentication methods if enabled [DAL-3314
& DALP-540]
22. Update to ModemManager 2020-05-19 [DAL-3254]
1. libqmi: updated to 1.25.4+
2. ibmbim: updated to 1.20.4+
3. libgudev: updated to version 233
4. Improved support for Quectel EC25/EG25 modules
BUG FIXES
1. Fix LED behavior to account for Surelink pass/fail results [DAL-3688]
2. Fixed issue preventing RADIUS/TACACS+ authentication from working unless local-user
authentication was also configured [DAL-3701]
3. Fixed issue preventing 1002-CMG4 modem from connecting with Verizon private APN SIMs
[DAL-3276]
4. Fixed issue where device would remain connected to Digi Remote Manager even aer
cloud.service was changed to aView or disabled. Rebooting the device previously resolved
the issue [DAL-3504]
5. Fixed bug where IPsec tunnels with multiple policies would only properly route traic for
the last policy configured [DAL-3448]
96000472_C Release Notes Part Number: 93001322_R Page 7
6. Fixed missing CPU usage stats in show system CLI output [DAL-2540]
7. Fixed improper value of the active SIM slot in the modem sim-slot show CLI command
output when SIM slot 2 was in use [DAL-3569]
8. Fixed issue preventing network interfaces from initializing if the interface name was longer
than 7 characters [DAL-2327]
9. Fixed issue preventing WAN passthrough mode if WAN was configured with a static IP [DAL3097]
10. Fixed errors displayed in CLI when configuring a USB serial port in remote access mode
[DAL-3207]
11. Fixed issue preventing users from configuring an IP address as a remote syslog server [DAL3433]
12. Handle incorrect value occasionally returned by by Telit LM940/LM960 module when
querying to see which SIM slot is in use [DAL-3481]
13. Fixed issue preventing cellular modem connectivity if a custom gateway/subnet was
configured but the modem wasn't in passthrough mode [DAL-3585]
14. Fixed issue causing aView IPsec tunnel (if enabled) to randomly fail when device was in
passthrough mode [DAL-3657]
15. Fixed permission issue on /opt/custom/ directory preventing users from setting up custom
CSS and logos [DAL-3710]
SECURITY FIXES
The highest level vulnerability that has been fixed in this release is listed as a High CVSS score of 6.7
1. Update to Linux kernel 5.7 (CVE-2020-10732 CVSS Score: 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) [DAL-3322]
2. Added local user login rate limiting to default lockout additional login attempts for 15
minutes aer 5 login failures per user (Score: 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) [DAL-3390 and DAL-3505]
1. New configuration options are under the Login failure lockout section for each user in
the Authentication → User settings
3. Prevent /etc/config/start from running when shell is disabled (Score: 5.2 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L) [DAL-2846]
4. Prevent file path expansion on Firmware Update and File System pages in the local web UI
(Score: 3.2 Low CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) [DAL-3513, DAL- 3471, &
DAL-3518]
5. Obfuscate text when showing the SIM PIN (Score: 3.2 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) [DAL-3462]
6. Set HTTP Auth Cookie as secure in the local web UI (Score: 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) [DAL-3393]
7. Fixed leaked file descriptors on serial connections [DAL-3202]
VERSION 20.5.38.58 (July 20, 2020)
This is a recommended release
ENHANCEMENTS
1. Increased minimum password complexity to at least 10 characters containing at least one
uppercase letter, one lowercase letter, one number, and one special character [DAL-3491]
1. Note: Devices that were running older firmware that had user passwords that do not
meet these minimum requirements aer upgrading to 20.5.38.58 will still be able to use
that password to authenticate with the device. However, if the user attempts to update
user's password in the DAL device's configuration settings aer upgrading to 20.5.38.58,
96000472_C Release Notes Part Number: 93001322_R Page 8
Loading...