Configure a Wide Area Network (WAN)

Configuring a Wide Area Network (WAN) involves configuring the following items:

Required configuration items

A name for the interface.
Note If the interface name is more than eight characters, the name will be truncated in the underlying network interface to the first six characters followed by three digits, incrementing from 000. This affects any custom scripts or firewall rules that may be trying to adjust the interface or routing table entries.
The interface type: Ethernet.
The firewall zone: External.
The network device or bridge that is used by the WAN.
Configure the WAN as a DHCP client.

Additional configuration items

Active recovery configuration. See Configure SureLink active recovery to detect WAN/WWAN failures for further information.
Additional IPv4 configuration:

The type being the way to control how the modem in the Digi device obtains an IP address from the cellular network.
The metric for IPv4 routes associated with the WAN.
The relative weight for IPv4 routes associated with the WAN.
The IPv4 management priority of the WAN. The active interface with the highest management priority will have its address reported as the preferred contact address for central management and direct device access.
The IPv4 Maximum Transmission Unit (MTU) of the WAN.
When to use DNS: always, never, or only when this interface is the primary default route.

When to use DNS servers for this interface.
Whether to include the EX12 device's hostname in DHCP requests.

IPv6 configuration:
- The type being the way to control how the modem in the Digi device obtains an IP address from the cellular network.
- The metric for IPv6 routes associated with the WAN.
- The relative weight for IPv6 routes associated with the WAN.
- The IPv6 management priority of the WAN. The active interface with the highest management priority will have its address reported as the preferred contact address for central management and direct device access.
- The IPv6 Maximum Transmission Unit (MTU) of the WAN.
- When to use DNS: always, never, or only when this interface is the primary default route.
- When to use DNS servers for this interface.
- Whether to include the EX12 device's hostname in DHCP requests.
MAC address denylist and allowlist.

To create a new WAN or edit an existing WAN:

 Command line

Select the device in Remote Manager and click Actions > Open Console, or log into the EX12 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```
Create a new WAN or edit an existing one:
- To create a new WAN named my_wan:
```
(config)> add network interface my_wan
(config network interface my_wan)>
```
- To edit an existing WAN named my_wan, change to the my_wan node in the configuration schema:
```
(config)> network interface my_wan
(config network interface my_wan)>
```

Set the appropriate firewall zone:

(config network interface my_wan)> zone zone
(config network interface my_wan)>

See Firewall configuration for further information.

Select an Ethernet device or a bridge. See Bridging for more information about bridging.

Enter device ? to view available devices and the proper syntax.

(config network interface my_wan)> device ?

Device: The network device used by this network interface.
Format:
  /network/device/eth1
  /network/device/eth2
  /network/device/loopback
Current value:

(config network interface my_wan)> device

Set the device for the LAN:

(config network interface my_wan)> device device
(config network interface my_wan)>

Configure IPv4 settings:
- IPv4 support is enabled by default. To disable:
```
(config network interface my_wan)> ipv4 enable false
(config network interface my_wan)>
```
- Configure the WAN to be a DHCP client:
```
(config network interface my_wan)> ipv4 type dhcp
(config network interface my_wan)>
```
1. Optional IPv4 configuration items:
  1. Set the IP metric:
    (config network interface my_wan)> ipv4 metric num (config network interface my_wan)>
    
    See Configure WAN/WWAN priority and default route metrics for further information about metrics.
  2. Set the relative weight for default routes associated with this interface. For multiple active interfaces with the same metric, the weight is used to load balance traffic to the interfaces.
    (config network interface my_wan)> ipv4 weight num (config network interface my_wan)>
  3. Set the management priority. This determines which interface will have priority for central management activity. The interface with the highest number will be used.
    (config network interface my_wan)> ipv4 mgmt num (config network interface my_wan)>
  4. Set the MTU:
    (config network interface my_wan)> ipv4 mtu num (config network interface my_wan)>
  5. Configure how to use DNS:
    (config network interface my_wan)> ipv4 use_dns value (config network interface my_wan)>
    where value is one of:
    always: DNS will always be used for this WAN; when multiple interfaces have the same DNS server, the interface with the lowest metric will be used for DNS requests.
    primary: Only use the DNS servers provided for this interface when the interface is the primary route.
    never: Never use DNS servers for this interface.
  6. Enable DHCP Hostname to instruct the EX12 device to include the device's system name with DHCP requests as the Client FQDN option. The DHCP server can then be configured to register the device's hostname and IP address with an associated DNS server.
    (config network interface my_wan)> ipv4 dhcp_hostname true (config network interface my_wan)>
    See RFC4702 for further information about DHCP server support for the Client FQDN option.
    See Configure system information for information about setting the EX12 device's system name.

(Optional) To configure 802.1x port based network access control:
Note The EX12 can function as an 802.1x authenticator; it does not function as an 802.1x supplicant.
1. Enable the 802.1x authenticator on the EX12 device:
```
(config network interface my_wan)> 802_1x authentication enable true
(config network interface my_wan)>
```
2. Set the frequency period for reauthorization:
```
(config network interface my_wan)> 802_1x authentication reauth_period value
(config network interface my_wan)>
```
(Optional) Configure the MAC address deny list.
Incoming packets will be dropped from any devices whose MAC addresses is included in the MAC address denylist.
1. Add a MAC address to the denylist:
```
(config network interface my_wan)> add mac_denylist end mac_address
(config network interface my_wan)> 
```
  where mac_address is a hyphen-separated MAC address, for example, 32-A6-84-2E-81-58.
2. Repeat for each additional MAC address.
(Optional) Configure the MAC address allowlist.
If allowlist entries are specified, incoming packets will only be accepted from the listed MAC addresses.
1. Add a MAC address to the allowlist:
```
(config network interface my_wan)> add mac_allowlist end mac_address
(config network interface my_wan)> 
```
  where mac_address is a hyphen-separated MAC address, for example, 32-A6-84-2E-81-58.
2. Repeat for each additional MAC address.
See Configure SureLink active recovery to detect WAN/WWAN failures for information about configuring SureLink for active recovery.

Save the configuration and apply the change.

(config network interface my_wan)> save
Configuration saved.
>

Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.