Firewall Rules: Device and network requirements

Alert: Cisco has made the end-of-life (EOL) announcement for the Cisco Edge Device Manager (EDM).

Note: In the onboarding process: This procedure comes after Supported network devices and firmware.

Supported browsers

Use the latest version of a supported web browser to access the admin console.

DHCP and DNS requirements

• Devices on your network must be able to connect to your IoT OD cloud cluster at either https://us.ciscoiot.com/ or https://eu.ciscoiot.com/.
• The network that the device connects to for uplink traffic must provide:
  • A DHCP address to the device.
  • Default route and DNS server information. Domain Name System (DNS) server information: eu.ciscoiot.com/.
  • The DNS must be able to resolve public names with private IP addresses such as eu-int.ciscoiot.com and us-int.ciscoiot.com. If not, the gateway is not able to register to IoT OD.

Network ports and protocols

The following TCP/UDP network ports and IP protocols must be opened on the network firewall to allow the edge devices to communicate with Cisco IoT OD.

We recommend using a Dynamic Domain Name Service (DDNS) firewall, where possible.

Note: When you set up IoT OD cloud for a new organization, depending on your access, you can go to either https://us.ciscoiot.com/ or https://eu.ciscoiot.com/  to create an account. These two links represent IP address clusters established for the Cisco IoT Cloud. Each cluster has nine IP addresses. The complete list of IP addresses for each cluster is listed in this table.

Note:

1. These settings are subject to change and will need to be updated in future releases.
2. If the IP address being used in the WAN IP SLA is outside the firewall, it must be allowed to get through the firewall.

Configuring an IR829 device for IoT OD with a static uplink IP address

DHCP is widely used to provide network parameters for network equipment, but there are still situations where static IPs are being used in the Industrial IoT space. The following information explains how to deal with a static IP address and still use PnP Connect and IoT OD.

Prerequisites

Cisco PnP expects the network device to receive an IP address to start the PnP process. This is typically provided by DHCP. You have to manually provision DHCP parameters. In IoT OD, all templates are expecting the uplink Ethernet interface to use DHCP. That is true for the bootstrap that will need to be modified. It is also true for the configuration that needs to be changed. These changes deviate from recommended best practices for templates and devices and can cause maintenance events to be more tedious and manually intensive over the long term. You will need:

1. IP address of the network device to be used
2. Network of the device to be used
3. Default device for the network where the device will be installed
4. DNS IP address that you know will work in this location

Getting PnP to work with static IPs on an IR829 device

• PnP only starts when there is no startup config. In this case, we want to use a static IP and therefore we need a config.
• PnP becomes part of the config after the static IP configuration. 
• We want the ability to factory reset the device in case of an issue. If an issue arises, the device comes back with the same static IP address even after a factory reset.

On the IR829 device, you can create a configuration file flash:router-confg that loads before PnP starts to run. In this case, we want to prevent PnP from starting automatically. Instead we want to configure the uplink interface and configure PnP profile manually in the config. You can create this configuration on a computer and upload it to the device because this device is brand new.

From a Cisco exec prompt, type this command sequence:

tclsh
puts [open "flash:router-confg" w+]{
ip name-server 8.8.8.8
vlan 10
interface vlan 10
   ip address 192.168.2.100 255.255.255.0
   no shut   
 ip route 0.0.0.0.0.0.0.0 192.168.2.1   
int gi1   
  switch access vlan 10
ntp server ntp.pool.org
pnp profile pnp_cco_profile
  transport https host devicehelper.cisco.com port 443
do-exec write memory
tclquit

Note: Make sure you change the values: 8.8.8.8, 192.168.2.100 255.255.255.0, 0.0.0.0.0.0.0.0 192.168.2.1 for the print to match your network. You will need those values later.

Your device now boots with this fixed (static) IP and starts the PnP process. This also happens even if the device is factory reset. For the device to stop using that static IP address, remove the file flash:router-confg and reset the device with “pnpa service reset”.

Modifying IoT OD bootstrap template

Edit the bootstrap in the configuration group for this device. In the bootstrap template, we assume that DHCP is being used as an uplink, which causes the device to island if we let that happen. Modify the bootstrap using Freemarker “variables” that can be entered in IoT OD:

WAN static IP -> ${far.ipaddrProperty1}

WAN netmask -> ${far.ipaddrProperty2}

default gateway -> ${far.ipaddrProperty3}

To make this work in the bootstrap template, make the changes in the table below.

Modifying IoT OD configuration template

The eCVD configuration also assumes that DHCP is being used on the uplink interface which causes issues with S2S VPN (Virtual Private Network) and potentially other areas.

To make this work in the configuration template, make the changes in the table below.

Configuring the variables in IoT Operations Dashboard

In Cisco IoT OD, when you edit a specific device configuration, edit the static IP address, netmask, and default device.

These values can match the one in the initial configuration, but you can also initially start with a given static IP and switch to another static IP address when the bootstrap configuration is pushed.

Refer to Modifying the IoT OD bootstrap template for the meaning of each of the three parameters.

Supported device interfaces for onboarding

The following interfaces are supported for IoT OD PnP onboarding using the default-configuration template. Only these supported interfaces provide monitoring data in the Operations Dashboard page and in the device details Monitoring tab (Inventory > device > Monitoring).

Note: Currently, dual active/active LTE or failover of management tunnel is not supported on IR800 and IR1800 devices.

Cellular requirements

For network devices that use cellular for the WAN connection:

• Verify that the device has a Cisco-approved antenna, and that it can receive a signal from the network.
  • Refer to the installation guide for your network device model and the Cisco Industrial Router Antenna Guide for more information.
• Cellular connections also require a SIM card and APN provided by your cellular carrier. Ask your cellular provider for assistance.
• If using a private APN, obtain the configuration details for
• manual configuration.

Latest supported eCVD template versions

The following configuration template updates are available and supported for this release.

Standard Config groups:

• IR829 - 2.05
• AP803 - 1.84
• IR1101 - 2.10
• IR1800 - 2.86

Legacy Config groups:

• IR829 - 2.05
• AP803 - 1.84
• IR1101 - 2.10
• IR1800 - 2.86

Existing tenants will reflect the correct and latest eCVD version with the latest changes.

Next step

Go to Get Started with Operations Dashboard, Step 3: Cloud infrastructure and Operations Dashboard readiness.