Perform the following procedure to create and configure the Administrative user:

1. Open a browser and enter the default IP address in the URL field, 192.168.2.1. Most browsers display a warning about HTTP addresses being unsafe because of a self-signed certificate:
   • For Edge, click Advanced and then Continue to 192.168.2.1.
   • For Firefox, click Advanced and then click Accept the Risk and Continue.
   • For Chrome, click Advanced and then Continue to 192.168.2.1 (unsafe).
2. Enter a username for the Administrative User. Click OK. Follow on screen instructions for usernames.
3. Enter a password and click OK. Follow on screen instructions for a secure password.
4. Enter the password again to confirm. Click OK.
5. Log into the Conduit® AP 300 using the new username and password.

The First-Time Setup Wizard will then launch.

Perform the following procedure to configure the Conduit® AP 300 as a Network Router:

1. Configure Date & Time and Time Zone to reflect the Conduit® AP 300's location.
   
   
2. Click Next.
   Note: If the Conduit® AP 300 is not equipped with a radio modem (i.e., does not support Cellular operation,) click Finish.
3. Configure PIN and APN if required.
   
   
4. Click Finish.

The Dashboard tab provides a brief overview of the system state and configuration.

The Service Statistics tab lists the available services and their respective status.

The System Statistics tab provides the following system information:

• System details, memory and storage usage, system log
• Ethernet interfaces statistics and logs
• Cellular statistics and logs
• GRE tunnels statistics and logs
• IPSec tunnels statistics and logs
• OpenVPN tunnels statistics and logs

The set of network configuration parameters displayed depends on the selected LoRa Mode.

For Local Network Settings, after you change these fields, click Submit. Then, click Save and Apply to save your changes.

Join Server

Choose the location of your join server.

Add End Device Credentials

In order to use this section, you must choose Local Keys under Join Server and click on Add New to add new end-device credentials.

Settings (for Cloud Key Store)

Messages (available using Cloud Key Store)

Gateway Info (available using Cloud Key Store)

Traffic Manager (available using Cloud Key Store)

Local Network Settings

Spectral Scan Configuration

This section displays all active and configured gateways. The following information displays:

Packets Received

Network Statistics

Duty Cycle Time-On-Air Available (seconds - only available for EU)

This section allows users to add new end-devices. To add a new end-device:

1. Go to LoRaWAN > Devices.
2. Under End Devices, click Add New.
3. Enter the following fields:
   1. Dev EUI - the end-device EUI (Extended Unique Identifier)
   2. Name - the name of the end-device
   3. Class - LoRaWAN operating class of end-device. Is communicated to network server on Join. The end-device must be configured out-of-band for operating class. A, B, or C are currently supported. (A, B, or C).
   4. Serial Number - Serial number of end-device
   5. Product ID - Product ID for end-device
   6. Hardware Version - Hardware version for the end-device
   7. Firmware Version - Firmware version for the end-device
   8. LoRaWAN Version - Software version for LoRaWAN server
4. Click Finish.
5. The new end-device displays under the End Devices list including some device details and statistics.
6. To edit the device, click the pencil icon, or to delete it, click the X icon associated with that device.
7. To delete all devices, click the Delete All button.

The normal join process involving properly configured and registered gateways and end-devices creates sessions FOTA (Firmware Over-the-Air) automatically.

However, you can use the Device Sessions section, if you want to create a session manually, otherwise known as ABP (Activation by Personalization). The manual session includes only the gateway and end-devices. The server is not involved.

To add a new session manually:

1. Go to LoRaWAN > Devices.
2. Under Sessions, click Add New.
3. Enter the following fields:
   1. Dev EUI - End-device EUI (Extended Unique Identifier)
   2. Dev Addr - Network device address assigned to end-device
   3. Class - Device Class (B or C)
   4. App EUI - Application EUI
   5. Join EUI - Join Request EUI
   6. Net ID - Network ID
   7. App Session Key - Pre-shared application session key
   8. Net Session Key - Derived network session key based on pre-shared application key
   9. Multicast Session - Select from:
      • No (i.e., not a multicast session)
      • Class B
      • Class C
4. Click Finish.
5. The new session displays under the Sessions list including some device details and statistics.
   1. Dev EUI - End-device EUI (Extended Unique Identifier)
   2. Dev Addr - Network device address assigned to end-device
   3. Up FCnt - Packet counter of last received packet
   4. Down FCnt - Packet counter of last sent packet
   5. Last Seen - Time of last packet received
   6. Joined - What is the device joined to, Cloud or local version
   7. Details - Additional session information (click on info icon)
   8. Multicast Session - Select from:
      • No (i.e., not a multicast session)
      • Class B
      • Class C
6. To edit the session, click the pencil icon, or to delete it, click the X icon associated with that session.
7. To delete all sessions, click the Delete All button.

This page allows you to create Device Groups in order to perform mass firmware upgrade OTA and multicast messaging to all devices in that group.

The Groups table displays existing groups. Use the View, Edit, or Remove buttons to see, modify, or delete an existing group in the table.

To create a new device group:

1. Go to LoRaWAN > Device Groups.
2. Click the Add New button.
3. The Add Group dialog box appears. Enter your desired Group Name.
4. You can also enter an optional Group EUI. If you do not provide one, the system generates a Group EUI automatically.
5. Select the desired end device(s) to include in your group by clicking the box next to each Device EUI.
6. Click Add.

To import your device group:

1. Click Import.
2. Click Choose File and browse to select your desired file.
3. Click Import.

To export all your device groups, click Export All.

Groups table fields

When connected to the LoRaWAN server, the profiles can be downloaded from the cloud. There are two-kinds of profiles: End-Device and Network.

Make profile changes in the Lens cloud and the device updates during a periodic check-in or when end-device associated with the profile joins or rejoins the network.

See existing profiles under the End-Device Profiles and Network Profiles lists. Refer to tables for profile details. Click Refresh to update the list.

Settings provided in the device profile must reflect the default settings of the end-device when it is first joined to the network. The end-device should be in this default configuration. Any deviation between the device profile and the actual default end-device settings may result in lost downlinks to the end-device due to non-matching Rx window parameters.

To add a new device profile:

1. Go to LoRaWAN > Profiles.
2. Under End-Devices Profiles, click Add New.
3. Configure the following parameters as required:
   1. Profile ID - Enter the desired profile name
   2. Max EIRP
   3. Max Duty Cycle - Select from the drop-down including DEFAULT or a range of options from 100% to 0.003%.
   4. MAC Version.
   5. RF Region - Select from the drop-down including DEFAULT, US915, AU915, AS923, KR920, EU868, IN865, and RU864.
   6. Region Version.
   7. Supports Class C (Check box to enable. If this is enabled, then you may enter a value for the following field.)
      1. Timeout Class C
   8. Supports Class B (Check box to enable. If this is enabled, the following fields appear and you may enter values for them.)
      1. Ping Slot Period
      2. Ping Slot Datarate
      3. Ping Slot Frequency
   9. Supports Join (check box to enable)
   10. Support 32 Bit FCnt (check box to enable)

End-Device Profiles (edit/add new)

Network Profiles

Settings provided in the network profile reflect the settings of the end-device to be received in MAC commands after it is first joined to the network. These are the desired settings for the end-device to operate with. Any deviation between the network profile and the default end-device settings are sent to the end-device in successive MAC commands until all settings have been relayed.

To add a new network profile:

1. Go to LoRaWAN > Profiles.
2. Under Network Profiles, click Add New.
3. Configure the following parameters as required:
   1. Profile ID – Enter the desired profile name
   2. Max Duty Cycle - Select from the drop-down including DEFAULT or a range of options from 100% to 0.003%
   3. Class- Select from the drop-down including A, B, or C
   4. Timeout Class C
   5. Rx1 Delay
   6. Rx1 DR Offset - Select from drop-down which varies with your selected channel plan.
   7. Rx2 DR Index - Select from drop-down which varies with your selected channel plan.
   8. Rx2 Frequency
   9. Channel Mask
   10. Redundacy

Network Profiles (edit/add new)

This section shows three lists: transmitted, recent join requests, and recently received packets on the LoRa network. Each packet includes relevant packet details.

Packets (Transmitted)

Recent Join Requests

Recent Rx Packets

Downlink packets can be manually sent to an end-device.

The packet remains in the queue until sent. Once it has been transmitted/received, the packet displays under Packets.

To manually send a downlink packet:

1. Go to LoRaWAN > Downlink Queue. Click on Add New.
2. Configure the following information for the new Queue Item:
   1. Dev EUI - receiving end-device EUI (Extended Unique Identifier)
   2. App Port - port field set in the downlink packet
   3. Data Format - encoding scheme for the packet (select either Hex or Base64).
   4. Data - the payload (data being transmitted)
   5. Ack Attempts - number of allowed downlink request ack retries
   6. RxWindow - specify the Rx Window to use for downlink. Valid values are:
      • 0: no priority
      • 1: First Rx window
      • 2: Second Rx window
3. Click Finish.
4. The new Queue Item displays under the Downlink Queue list including some device details and statistics.
   1. Dev EUI - receiving end-device EUI (Extended Unique Identifier)
   2. App Port - port field set in the downlink packet
   3. Size - total packet minus header
   4. Ack - number of retries to receive ACK from end-device
   5. RxWnd - the Rx Window to use for downlink:
      • 0: no priority
      • 1: First Rx window
      • 2: Second Rx window
   6. Queued - Time packet has been added to the queue
   7. Details - additional statistics displayed related to the packet
5. To edit the item, click the pencil icon, or to delete it, click the X icon associated with that item.
6. To delete all items, click the Delete All button.

The device offers the option of FOTA using your LoRaWAN network. To use this feature, you must properly configure your LoRa network and end-devices (must be joined to the network). You may set a countdown for an immediate update or schedule the upgrade for a specific time. You can also update multiple devices on your LoRa network.

The device also offers the option of Multicast Messaging over the LoRaWAN network.

To perform FOTA:

1. Go to LoRaWAN > Operations.
2. Under Operations Settings, select FOTA in the Operation Type drop-down.
3. Click Browse and select your Firmware Upgrade File (.bin).
4. Under the Fragment Description field, enter the fragment description for the FOTA session in HEX format.
5. You have the option to specify a Setup Time In by clicking Change. Setup time specifies how long from the time scheduled before the Multicast Setup Process begins. Under Setup Time Input from the drop-down, select either:
   1. Countdown to Setup from Now: Enter Number of Days plus hours, minutes and seconds in HH:MM:SS (default: 30 seconds) OR
   2. Specify Future Date and Time: Select your desired Date and Time.
6. Otherwise, click Hide to hide Setup Time Input details. Click Change to show and modify.
7. You have the option to specify a Launch Time In. Launch time specifies how long the Multicast Process runs before starting firmware transmission. Under Launch Time Input from drop-down, select either:
   1. Countdown to Launch from Setup: Enter Number of Days plus hours, minutes and seconds in HH:MM:SS (default: 90 seconds) OR
   2. Specify Future Date and Time: Select your desired Date and Time.
8. Choose the desired Target End-Devices to receive the upgrade. Select either a previously-saved End-Device Group or Individual Devices from the drop-down on the right. Check the box near your desired device or group to designate it for upgrade. You can also check Select/Deselect All box to select or deselect all groups in the list.
9. Click the Settings tab, if you wish to change the defaults for the following FOTA parameters
   1. Delete Successful Logs (default: checked)
   2. Multicast Group ID
   3. Number of Parity Fragments per Session (default: 100)
   4. Sleep Delay between Setup Messages (default: 1000 microseconds)
   5. Sleep Delay between Data Fragments (default: 1500 microseconds)
   6. Sleep Delay between Parity Fragments (default: 3000 microseconds)
   7. Maximum Packet Size
10. After configuring FOTA, click Schedule to finalize your FOTA update.
11. Once the scheduled upgrade is submitted, you can track its progress through the Progress tab. A progress bar appears at the top of the page. The progress bar shows the transfer of the file from the PC to the device. Once completed, the page switches to the Progress tab. The job displays in either Scheduled, Active, or Completed Jobs lists depending on the job phase and timing.

To perform the Multicast Messaging:

1. Go to LoRaWAN > Operations.
2. Under Operations Settings, select Message in the Operation Type drop-down.
3. Select from either Textbox or File under Payload Source.
4. Select from either Hexadecimal or Base64 under Payload Format.
5. Enter the message contents under Payload.
6. Enter the Port from a range of 1-220 (default: 1).
7. Under Transmission Setup, you have the option to specify a Setup Time Input by clicking Change. Setup time specifies how long from the time scheduled before the Multicast Setup Process begins. Expand the Setup Time Input drop-down and select from the following options:
   1. Countdown to Setup from Now: Enter Number of Days plus hours, minutes, and seconds formatted as HH:MM:SS (default value: 30 seconds)
   2. Specify Future Date and Time: Configure the desired Date and Time.
8. Otherwise, click Hide to hide Setup Time Input details. Click Change to show and modify.
9. You have the option to specify a Launch Time Input. Launch time specifies how long the Multicast Process runs before starting message transmission. Expand the Launch Time Input drop-down and select from the following options:
   1. Countdown to Launch from Setup: Enter Number of Days plus hours, minutes, and seconds formatted as HH:MM:SS (default value: 90 seconds)
   2. Specify Future Date and Time: Configure the desired Date and Time.
10. Choose the desired Target End-Devices to receive the message. Select either a previously-saved End-Device Group or Individual Devices from the drop-down on the right. Check the box near the desired device or group to designate it to receive the message. You can also check Select/Deselect All box to select or deselect all groups in the list.
11. Click the Settings tab to change the defaults for the following message parameters:
    1. Delete Successful Logs (default value: checked)
    2. Multicast Group ID
    3. Sleep Delay between Setup Messages (default value: 1000 microseconds)
    4. Sleep Delay between Data Fragments (default value: 1500 microseconds)
    5. Maximum Packet Size
    Note: The following parameters are constants for Multicast Messaging and cannot be modified:

    • Number of Parity Fragments per Session: value is 100
    • Sleep Delay between Parity Fragments value is 3000 microseconds
12. After configuring Multicast Messaging, click Schedule to schedule your message.
13. Once the message is submitted, you can track its progress through the Progress tab. A progress bar appears at the top of the page. The progress bar shows the transfer of the message from the PC to the device. Once completed, the page switches to the Progress tab. The job displays in either Scheduled, Active, or Completed Jobs lists depending on the job phase and timing.

The BACnet Configuration page is illustrated here:

The Definitions and Templates page lists information for all sensors that have been defined in the Conduit® AP 300.

A typical WAN Configuration page is illustrated here:

Any VLANs added to the system will also be displayed as shown here:

Each WAN interface can be configured for Active or Passive failover with a timeout interval to trigger failover to the next prioritized WAN interface.

Hostname must be specified and Mode Type selected (for example: ICMP for ping, TCP for an actual TCP connect attempt) to verify connectivity. The number of failures is controlled by the ICMP Count setting.

DNS configuration parameters for the Conduit® AP 300 are accessed via tabs included in this section as illustrated here:

The Conduit® AP 300 supports the configuration of IPv4 and IPv6 DHCP servers for all network interfaces that are configured as LAN, include new, user-created VLAN interfaces.

Typical LLDP configuration settings for eth0 are illustrated here:

The SMTP client is used to send notifications via email to a configured server.

A typical SMTP configuration page is illustrated here:

Typical SMTP configuration values are illustrated here:

The Mail Log displays:

• Messages that are queued for sending
• Deferred messages
• Sent messages

For example, the Mail Log illustrated here shows two messages have been sent.

To view the details of a message, click on the icon in the OPTIONS column that corresponds with the desired message. A dialog similar to the following will include the message details.

A typical SNMP Configuration page is illustrated here:

The time synchronization feature sets up device time according to the specified system settings. Two different options are used to get the correct time:

• NTP Synchronization
• Cellular Synchronization

A typical Time Configuration page is illustrated here:

Cellular Diagnostics includes the following tabs:

• Radio Status
• Diagnostics
• Cell Radio Firmware Upgrade

A typical SMS Configuration page is illustrated here:

Firewall Rules and Port Forwarding configuration and status is performed on the following tabs:

• Settings
• Status

Trusted IP is a simplified interface to create nftables rules to allow or block specific IPs, IP ranges, or subnets. This feature allows users to create whitelists (which are allowed or trusted IPs) or black lists (which are blocked or unwanted IPs). You can add, edit, and delete IP addresses as needed.

• If you select White List as Trusted IP Mode and do not set any IP range, no traffic will be allowed.
• If you select Black List as Trusted IP Mode and do not set any IP range, all traffic will be allowed.

Typical Trusted IP settings are illustrated here:

Configuring static routes adds persistent routes to remote devices that are automatically recreated when the Conduit® AP 300 is rebooted.

A typical Static Route settings page is illustrated here:

Generic Routing Encapsulation (GRE) is a tunneling mechanism that uses IP as the transport protocol and can be used for carrying many different passenger protocols.

The tunnels behave as virtual point-to-point links that have two endpoints identified by the tunnel source and tunnel destination addresses at each endpoint. Configuring a GRE tunnel involves creating a tunnel interface, which is a logical interface, then configuring the tunnel endpoints for the tunnel interface.

The device supports site-to-site VPNs via IPsec tunnels for secure network-to-network communication. Both tunnel endpoints should have static public IP addresses and must be able to agree on the encryption and authentication methods to use.

Setting up an IPsec tunnel is a two-stage negotiation process.

For endpoints that do not have public static IP addresses, additional options may help such as NAT Traversal and Aggressive Mode.

By default, based on the encryption method chosen, the device negotiates ISAKMP hash and group policies from a default set of secure algorithms with no known vulnerabilities. This allows flexibility in establishing connections with remote endpoints. There is an ADVANCED mode that provides a way to specify a strict set of algorithms to use per phase, limiting the remote endpoint's negotiation options.

The default Encryption Method is: AES-128.

The default set of DH Group Algorithms is:

• DH2(1024-bit)
• DH5(1536-bit)
• DH14(2048-bit)
• DH15(3072-bit)
• DH16(4096-bit)
• DH17(6144-bit)
• DH18(8192-bit)
• DH22(1024-bit)
• DH23(2048-bit)
• DH24(2048-bit)

There is the option to add multiple local and remote networks. These additional subnets can provide more complexity, flexibility, efficiency, and redundancy to the VPN. Using multiple networks allows different endpoints in different LAN subnets to securely communicate through the same tunnel. Users do not have to configure an additional tunnel for those subnets saving time and effort.

The Local User Accounts page supports activities to add, remove, and update user accounts on the device including changing passwords.

SSH Key Management

SSH public keys are managed in this section of the Users page.

Users with an administrator role can view, add, and delete public keys for themselves as well as all other users with the following roles:

• Engineer
• Monitor
• Custom role

Only users with a local administrator role can add a public key for themselves.

Public keys that have been added to a user's account are listed in this section as well.

Add a New Public Key

To create a new public key associated with a user account click Add Public Key as shown here:

Paste the key into the Key field and assign a Title to the key:

Note: The maximum length for a Public Key is 3000 characters.

The system will not allow a public key to be added/created for a user if one has already been added.

View a Public Key

To view a public key, click on the icon associated with the key to be viewed.

Delete a Public Key

To delete a public key, click on the icon associated with the key to be deleted.

Note: When a user account is deleted, all public keys associated with that account are also deleted by the system.

Access Configuration settings allow users to configure a variety of services on the device such as:

• The Web Server for the mPower API used by the mPower Web UI
• Responsiveness to Pings to the device on the LAN and WAN interfaces
• The SNMP server
• The Modbus server
• Enabling and limited configuration of:
  • DoS prevention
  • Ping Limiting
  • Brute Force Prevention to lock out user accounts that exceed the password failure limits
• SSH Authentication
• Reverse SSH Tunnel

A typical Access Configuration landing page is illustrated here:

The following sections provide detailed information about each parameter used to configure device services.

The RADIUS protocol supports authentication, user session accounting, and authorization of users to the device.

This authentication, accounting, and authorization is independent of the local users created on the device. The user can enable Authentication, Accounting, or both options.

RADIUS user details:

• Access to device if role is one of those in the provided list (Administrator, Engineer, or Monitor).
• All RADIUS users do not have SSH access to the device.
• RADIUS creates a temporary session instead of a local account like local users.
• RADIUS uses shared key encryption.
• Local users shall take priority over RADIUS user (if a RADIUS user has the same username as a local user, the RADIUS user cannot log in even if the local user is disabled).
• RADIUS user with Administrator role can view and modify all local users (but cannot delete a local Administrator if it is the only local admin user on the device).
• RADIUS users with Engineer and Monitor role cannot view or modify user details. They do not have access to the User Accounts page.
• RADIUS users cannot change their own password in the Web UI.

A typical Radius Configuration page is illustrated here:

A typical X.509 Certificates configuration page is illustrated here:

The following Remote Device Management operations are supported:

• Check-in based on a specified interval, and repeated at a particular time and day(s) of the week
• Upload device configuration to the remote server
• Commands execution:
  • Configuration upgrade
  • Firmware upgrade
  • Device Logs Upload
  • Reboot

A typical Remote Device Management tab is illustrated here:

The Notification tab includes settings for users to manage the following:

• Notifications Configuration
• Notifications Sent

The device can send alerts via:

• email

  To send alerts via email, the SMTP server must be enabled.

• SMS

  To send alerts via SMS, refer to SMS Configuration and Commands.

• SNMP

  To enable SNMP traps, refer to SNMP Configuration.

Users can configure the following on the Web UI Customization tab:

• Footer Customization allows the user to add custom organization details to the footer.
• Dashboard Customization allows the user to upload a new image and specify Device Name and Custom ID that will be shown on the Dashboard page.
• UI Customization allows the user to modify the color schema of the buttons, and upload a custom logo and favicon.

A typical Web UI Customization tab is illustrated here:

Firmware from MultiTech is signed by MultiTech’s private key and the signatures on the artifacts in the firmware must verify successfully for the firmware to be applied to the device flash.

Migration from mPower 6.x/DeviceHQ to mPower 7.x/MultiTech Cloud Device Manager - Starting in December 2025, MultiTech will roll out self-service device migration through MultiTech Cloud Device Manager (MTCDM). This option empowers you to handle your own device migrations with minimal intervention and provides a single portal to manage and upgrade your devices to the latest mPower firmware.

A typical Firmware Upgrade screen is illustrated here:

The Package Management feature supports importing and installing packages from the MultiTech online mLinux feeds.

A typical Package Management tab is illustrated here:

Save/Restore supports restoring from a uploaded configuration file, saving the current configuration to a file, and defaulting the device back to factory settings. The RESET button can be configured to enable it, disable it, or disable factory reset so that the device only resets when the button is pressed.

A typical Save/Restore page is illustrated here:

The Debug Options tab contains a miscellaneous set features and options for debugging and rebooting the device:

• When enabled, the Auto Reboot Timer feature will reboot per the configured timeout.
• When enabled and configured, the Remote Syslog feature will stream the syslog output to the remote server.
• Logging is a global setting to increase or decrease the device logging level.
• The Data Traffic Statistics feature controls the periodicity and data threshold when statistics are saved to persistent storage.
• The Ping feature pings or connects via TCP to the target remote host.
• The Continuous Ping feature pings the target remote host continuously.

A typical Debug Options tab is illustrated here:

A typical Usage Policy tab is illustrated here:

1. Go to Administration > License.
2. Click Add New in the upper right corner.
3. Add the License Key and Password.
4. Click OK.

The system allows installing custom applications and uploading configuration files for the installed custom apps.

A typical Custom Apps page is illustrated here:

Note: When a user disables the Enabled option and selects Save and Apply, the system does not stop any applications that are already running. To halt an application manually, locate the application in the list of installed applications and click the button associated with the application to be stopped. For additional information, refer to Installed Applications.

Perform the following procedure to install a custom application:

1. Go to the Custom Apps page, select Add Custom App.
2. Specify an App ID and an choose an application file in the pop up. The App ID must be a hexadecimal value with a maximum length of 32 characters.
   
   

When adding a custom app, the following information applies:

• The application name must be unique. The system does not allow installing two different apps with the same name. The system retrieves the App Name value from the manifest.json.
• The installed application has a corresponding unique App ID. When installing an app, the system verifies if the app with the same name is already installed. If this is true, the system does not allow specifying a different App ID.
• If a user installs a new version of the application that is already installed, the user has to specify the App ID of the installed application. If the user specifies a different App ID, the application installation will fail and corresponding error message will be displayed.
• When installing an app, the system does not allow specifying an App ID that is already used by another application.