Configure a NEMO tunnel

Configuring an NEMO tunnel with a remote device involves configuring the following items:

Required configuration items

Enable the NEMO tunnel.
The NEMO tunnel is enabled by default.
The IP address of the NEMO virtual network interface.
The firewall zone of the NEMO tunnel.
The IP address of the NEMO home agent server. This is provided by your cellular carrier.
The home agent's authentication key. This is provided by your cellular carrier.
Home agent registration lifetime. This is provided by your cellular carrier.
The local network interfaces that will be advertised on NEMO.

Additional configuration items

The home agent Software Parameter Index (SPI).
Path MTU discovery.
Path MTU discovery is enabled by default. If it is disabled, identify the MTU.
Care of address: the local network interface that is used to communicate with the peer.
- If set to Interface, identify the local interface to be used. Generally, this will be the Wirelesss WAN (Modem).
- If set to IP address, enter the IP address.
The local network of the GRE endpoint negotiated by NEMO.
- If the local network is set to Interface, identify the local interface to be used.

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click VPN > NEMO.
The NEMO tunnel is enabled by default. To disable, toggle off Enable.
For Home IP address, type the IPv4 address of the NEMO virtual network interface.
For Zone, select Internal.
The Internal firewall zone configures the IX15 device to trust traffic going to the tunnel and allows it through the network.
For Home agent server IP address, type the IPv4 address of the NEMO home agent. This is provided by your cellular carrier.
For Key, type the key used to authenticate to the home agent. This is provided by your cellular carrier.
For Home agent SPI, type the Security Parameter Index (SPI) value, which is used in the authentication extension when registering. This should be normally left at the default setting of 256 unless your service provider indicates a different value.
For Home agent registration lifetime, in seconds, type the number of seconds number of seconds until the authorization key expires. This is provided by your cellular carrier.
For MTU discovery, leave enabled to determine the maximum transmission unit (MTU) size.
If disabled, for MTU, type the MTU size. The default MTU size for LANs on the IX15 device is 1500. The MTU size of the NEMO tunnel will be smaller, to take into account the required headers.
Click to expand Care of address to configure the local WAN interface of the internet facing network.
1. For Type, select the method to determine the local network interface that is used to communicate with the peer.
  - If Default route is selected, the network interface that is used will be the same as the default route.
  - If Interface is selected, specify the local network interface.
  - If IP address is selected, type the IP address.
  The default is Default route.
Click to expand GRE tunnel local endpoint.
1. For Type, select the local endpoint of the GRE endpoint negotiated by NEMO.
  - If Default route is selected, the network interface that is used will be the same as the default route.
  - If Interface is selected, specify the local network interface.
  The default is Default route.
Click to expand Local networks.
1. For Add Interface, click  to add a local network to use as a virtual NEMO network interface.
2. For Interface, select the local interface to use as a virtual NEMO network interface. Generally, this will be the a Local Area Network (LAN).
3. (Optional) Repeat for additional interfaces.
Click Apply to save the configuration and apply the change.

 Command line

Select the device in Remote Manager and click Actions > Open Console, or log into the IX15 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

Add a NEMO tunnel. For example, to add a NEMO tunnel named nemo_example:

(config)> add vpn nemo nemo_example
(config vpn nemo nemo_example)>

The NEMO tunnel is enabled by default. To disable:

(config vpn nemo nemo_example)> enable false
(config vpn nemo nemo_example)>

Set the IPv4 address of the NEMO virtual network interface:

(config vpn nemo nemo_example)> home_address IPv4_address
(config vpn nemo nemo_example)>

Set the IPv4 address of the NEMO home agent. This is provided by your cellular carrier.

(config vpn nemo nemo_example)> home_agent IPv4_address
(config vpn nemo nemo_example)>

Set the key used to authenticate to the home agent. This is provided by your cellular carrier.
```
(config vpn nemo nemo_example)> key value
(config vpn nemo nemo_example)>
```
Set the the number of seconds number of seconds until the authorization key expires. This is provided by your cellular carrier.
```
(config vpn nemo nemo_example)> lifetime integer
(config vpn nemo nemo_example)>
```
Allowed values are any integer between 1 and 65535.
MTU discovery is enabled by default, which allows the device to determine the maximum transmission unit (MTU) size. To disable:
```
(config vpn nemo nemo_example)> mtu_discovery false
(config vpn nemo nemo_example)>
```
If disabled, set the MTU size. The default MTU size for LANs on the IX15 device is 1500. The MTU size of the NEMO tunnel will be smaller, to take into account the required headers.
```
(config vpn nemo nemo_example)> mtu integer
(config vpn nemo nemo_example)>
```
Allowed values are any integer between 68 and 1476.
Set the Security Parameter Index (SPI) value, which is used in the authentication extension when registering. This should be normally left at the default setting of 256 unless your service provider indicates a different value.
```
(config vpn nemo nemo_example)> spi integer
(config vpn nemo nemo_example)>
```
Allowed values are any integer between 256 and 4294967295.

Set the firewall zone for the NEMO tunnel to internal:

(config vpn nemo nemo_example)> zone internal
(config vpn nemo nemo_example)>

The Internal firewall zone configures the IX15 device to trust traffic going to the tunnel and allows it through the network.

Configure the Care-of-Address, the local WAN interface of the internet facing network.
1. Set the method to determine the Care-of-Address:
```
(config vpn nemo nemo_example)> coaddress type value
(config vpn nemo nemo_example)>
```
  where value is one of:
  - defaultroute: Uses the same network interface as the default route.
  - interface
    If interface is used, set the interface:
    Use the ? to determine available interfaces:
    Set the interface. For example:
    (config vpn nemo nemo_example)> coaddress interface eth1 (config vpn nemo nemo_example)>
  - ip
    If ip is used, set the IP address:
    (config vpn nemo nemo_example)> coaddress address IP_address (config vpn nemo nemo_example)>
  The default is defaultroute.
Set the GRE tunnel local endpoint:
1. Set the method to determine the GRE tunnel local endpoint:
```
(config vpn nemo nemo_example)> tun_local type value
(config vpn nemo nemo_example)>
```
  where value is one of:
  - defaultroute: Uses the same network interface as the default route.
  - interface
    If interface is used, set the interface.
    Use the ? to determine available interfaces:
    Set the interface. For example:
    (config vpn nemo nemo_example)> tun_local interface eth1 (config vpn nemo nemo_example)>
  The default is defaultroute.
Configure one or more local networks to use as a virtual NEMO network interface. Generally, this will be a Local Area Network (LAN):
1. Add a local network to use as a virtual NEMO network interface:
```
(config vpn nemo nemo_example)> add network end eth
(config vpn nemo nemo_example)>
```
2. (Optional) Repeat for additional interfaces.
Save the configuration and apply the change.
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.