Inseego 5G SD EDGE Manager is a secure solution for the configuration, management, and monitoring of Inseego 5G SD EDGE routers and modems (CPE). You can deploy EDGE Manager on most private and public cloud virtualization platforms.
Use this guide to plan and set up your EDGE Manager.
Use the EDGE Manager planning worksheet to ensure you have everything you need when setting up your EDGE Manager.
Note: your environment will differ from examples in this Wiki. Be prepared to work with your network, hosting, cloud provider, partner, and/or Inseego Solutions Architecture/Professional Services teams.
EDGE Manager planning worksheet
Follow these steps in the order provided to set up your EDGE Manager.
Contact your Inseego Sales representative to obtain an OVA or AWS credentials.
Install the AWS CLI tool
If you already have the AWS credentials, you can pull down the OVA or VMDK. An older EM OVA can be upgraded to a newer version. Expect 5GB of data usage to pull the latest containers.
EM OVA:
aws s3api get-object --bucket exportimage-aws --key "exports/EM_2023.9.1.0.ova" "EM_2023.9.1.0.ova"
CBR VMDK:
aws s3api get-object --bucket exportimage-aws --key CBR_2023.9.1.0.vmdk CBR_2023.9.1.0.vmdk
Important: you are responsible for securing & patching your self-hosted EDGE Manager & underlying Operating System/packages! The OVA is based on Debian cloud image from AWS & is provided as a courtesy for turn-key operation. Take requisite maintenance windows & manage controls; see Security Controls & Defence in Depth. For patching, generally do: Upgrade & sudo apt update && sudo apt upgrade
Refer to the VM deployment guide.
Use the Port forwarding/firewall reference to configure port forwarding to EDGE Manager and set any necessary firewall rules on the enterprise network that is servicing EDGE Manager. Contact your network administrator for assistance.
Note: assuming public networks and EM behind firewall/NAT; if private APN, disregard NAT as there would be no distinction between LAN & WAN IP
Note: inbound can be restricted to devices (ZTP to API port, Wireguard for control tunnel, & ICMP) & management stations (HTTPS & API port), but HTTP is needed for Let's Encrypt challenges. Naturally, protect SSH & API ports according to your organization's risk management policies.
Note: outbound is required generally for 1. obtaining software (OS and EDGE Manager), 2. obtaining firmware updates, & 3. NTP time sync. Various other ports & protocols may be required for your use case. Make sure that your outbound rules do not break return inbound traffic; your firewall mileage will vary. Software/Firmware updates use DNS, various HTTPS repositiories, & AWS ECR thus we cannot provide an exhaustive list of URIs to whitelist. Consider unblocking outbound during upgrade windows.
Suggested Inbound Rules
| Source | 0.0.0.0/0 |
| Destination | WAN IP of EDGE Manager |
| Ports/protocols | HTTP (TCP 80), HTTPS (TCP 443) API (TCP 7001), Wireguard (UDP 51820), & ICMP (namely Echo request/reply) |
| NAT rule | Destination NAT to LAN IP of EDGE Manager |
Suggested Outbound Rules
| Source | LAN IP of EDGE Manager |
| Destination | 0.0.0.0/0 |
| Ports/protocols | Any, but specifically HTTPS (TCP 443), DNS (UDP 53), & NTP (UDP 123) |
| NAT rule | Source NAT to WAN IP of EDGE Manager |
Login to EDGE Manager via SSH, VM console, or serial console using the following credentials:
Default login: ma-admin
Default password: tE@Ts6K6H
Change ma-admin’s default password, using:
passwd
IMPORTANT: It is strongly encouraged to change your password, enable private key SSH authentication, disable password SSH authentication, & restrict SSH access (TCP 22) to only trusted subnets.
Get a root prompt.
sudo -i
Replace “debian” with your hostname, using:
nano /etc/hosts
nano /etc/hostname
TIP: Use CTRL-O to save, CTRL-X to exit, and Return to accept prompts at the bottom of the screen. The hostname change will not reflect until next reboot.
Prepare directories:
mkdir -p /ssl/certs
cd /ssl/certs
Pick either CA or Let's Encrypt.
Note: commercial CAs are supported; neither self-signed nor enterprise CAs are supported yet.
Generate then provide CSR to CA. Do not forget the passphrase.
openssl req -newkey rsa:2048 -keyout encrypted.key -out nginx-selfsigned.csr
cat nginx-selfsigned.csr
Decrypt the key with passphrase.
openssl rsa -in encrypted.key -out nginx-selfsigned.key
Upload signed certificate into /ssl/certs.
Put signed certificate into Base-64 encoded form and save it as nginx-selfsigned.crt.
NOTE: You may have to include the root & intermediate certificates.
cat CAroot.crt CAintermediate.crt mycert.crt > nginx-selfsigned.crt
This method is not recommended for production.
Prepare the directories:
mkdir -p /letsencrypt
mkdir -p /root/ssl-letsencrypt
IMPORTANT: Set domain & email:
FQDN=my-em.corp.com
EMAIL=[email protected]
Make NGINX configuration:
cat <<EOF >/root/ssl-letsencrypt/nginx.conf
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
#include /etc/nginx/conf.d/*.conf;
events {
worker_connections 1024;
}
http {
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
server_name $FQDN;
location /.well-known/acme-challenge/ {
root /letsencrypt;
}
location / {
gzip off;
root /usr/share/nginx/html/;
index index.html;
}
}
}
EOF
Start NGINX container:
docker run -it -d --name nginx -v /root/ssl-letsencrypt/nginx.conf:/etc/nginx/nginx.conf -v /letsencrypt:/letsencrypt -v /letsencrypt/certs:/etc/letsencrypt -p 80:80 -p 443:443 nginx
Login to ECR:
aws ecr get-login-password --region us-west-2 | docker login --username AWS --password-stdin 836891784212.dkr.ecr.us-west-2.amazonaws.com
Request certificate from Let’s Encrypt:
docker run -it --rm --name certbot -v /letsencrypt:/letsencrypt -v /letsencrypt/certs:/etc/letsencrypt 836891784212.dkr.ecr.us-west-2.amazonaws.com/longship:certbot bash -c "certbot certonly --webroot --webroot-path /letsencrypt --no-eff-email --email $EMAIL --domain $FQDN"
By the way, here's the command to manually renew:
docker run -it --rm --name certbot -v /letsencrypt:/letsencrypt -v /letsencrypt/certs:/etc/letsencrypt 836891784212.dkr.ecr.us-west-2.amazonaws.com/longship:certbot bash -c "certbot renew --webroot --webroot-path /letsencrypt"
Some common troubleshooting: check for typos in the nginx.conf & CLI; check firewall rules both on the Linux OS (UFW) and network/cloud provider.
Clean up:
docker kill nginx
docker rm nginx
Copy certificates and key:
cd /ssl/certs
cp /letsencrypt/certs/live/*/* ./
cp fullchain.pem nginx-selfsigned.crt
cp privkey.pem nginx-selfsigned.key
cd /opt/inseego/bin/edge_manager
python3 em_initialise.py
Example for EM w/ TLS behind NAT
Please choose DHCP or Static Deployment
Enter 1 for DHCP or 2 for Static: 1
Is your EM behind NAT? (Y/N): y
Please enter VM details
##IP address would work instead as long as TLS cert is valid SAN for IP address.
#FQDN is recommended as it allows flexibility to re-IP the EM.
Enter VM ip address: my-em.corp.com
Do you want to use NTP pool (pool.ntp.org)? Y/N: y
Is HTTPS enable? Y/N: y
Please enter 1 to use default port (7001) for device service or press 2 to enter your port number for device service: 1
Enter your Domain Name: my-em.corp.com
Note :: Please place your TLS certificates at /ssl/certsAllow up to 15 minutes or so for the database/apps to initialize. If the containers are not local yet, time will vary depending on your connection speed. Expect 5GB of data usage. Consider docker-compose pull to manually download then docker-compose up -d to fire up. If it takes longer, consider top; perhaps there is a resource bottleneck.
Verify EDGE Manager is up via browsing out to your EDGE Manager, using https:// and public domain you created.
Prepare the upgrade directory:
mkdir /home/ma-admin/upgrade
Obtain the upgrade TAR from the repositiory.
scp upgrade.tar [email protected]:~/upgrade/
Extract the archive to the server and make the scripts executable:
cd /home/ma-admin/upgrade
tar -xvf upgrade.tar
chmod +x *.sh
Backup the state.
bash backup.sh
Upgrade EM.
bash upgrade.sh
Remove the old container images as needed.
docker image ls
docker image rm XXXXXXXXXX
Log in to EDGE Manager, using https:// and the public domain you created.
Important: if you receive a TLS/certificate warning (e.g. no locked padlock in browser), please fix the certificate issue before proceeding. Make sure the domain or IP values provided during initialization match the CN or SAN of certificate.
Defaults:
Username: sdwan_admin
Password: PassWord@123
The Reset Password pop-up appears. Enter a username and the password and click Confirm. The interface login screen appears again. Enter your login and the password you set and click Login.
The Dashboard Home page displays.
NOTE: You can onboard up-to five devices before activating a license. If you are onboarding more than five devices, you need to activate a license.
To onboard devices to EDGE Manager, you need to perform a ZTP registration using the device Admin web UI before onboarding in EDGE Manager.
A list of devices currently onboarding appears. NOTE: Use the buttons in the upper right to refresh the list, filter, sort columns or approve or delete a device.
The Add New Device dialog appears.
Adding devices manually:
Adding devices with Auto Approve:
Refer to the VM deployment guide.
Refer to the ZTNA Broker quick start guide.