Release 2.0.20 introduces the following new software features:

• Support of FPGA Version 61 and HAL 5.1.0 based on Semtech 2.3.0 SDK for Cisco LoRaWAN gateway.

• Support SHA512 password encryption.

• Support to use dual ISR4221 with software version 16.5.1b or later as HERs.

• Support Active/Backup VPN tunnels between two HERs.

• Support CSR1000V with software version of CSR1000v-universalk9.16.03.05 or later as the CA server for IXM to enroll RSA certificate from ISR4221.

• Removed the limitation of reboot on LXC or IXM when SSH parameters change.

• Support to disable SSH access from core network to LAN IP address.

• Support to not store IPsec secrets in the file system.

• Support unprivileged LXC.

• Restrict access to a root shell inside LXC. The system password is needed to get into LXC from Host.

• Support to mount tmpfs and removable media with appropriate access rights.

• Removed tcpdump, telnet, and telnetd from the firmware.

• Added security options in kernel configuration.

• Support to display the total number of satellites used in standalone mode only.

• Support to show IPsec log.

This section contains new and changed commands for this release. For more information, see the Cisco LoRaWAN Gateway Software Configuration Guide and the "Configuring Virtual-LPWA" chapter of the Cisco IR800 Integrated Services Router Software Configuration Guide.

• The following commands are changed in this release for the standalone mode:

  • The ipsec cert install local enable command has replaced the ipsec cert install usb enable command, to support both flash and usb.

  • The ipsec install local command has replaced the ipsec install usb command.

• The following commands are added in this release for the standalone mode:

  • ip ssh limit-local - Disable SSH on LAN interface or fastethernet 0/1.

  • Behavior change of the request shell container command - Need password. If you have changed the system admin password, you need to use the new password.

    Note	Admin can change the password by using the sysadmin security password command.

  • ipsec lxc-restart-disable - Disable lxc restart whenever tunnel goes up or down.

  • ipsec subnet lock - Allow only subnet related traffic.

  • ipsec cert scep - Add support for xpki.

    Example

    
    Gateway(config)#ipsec cert scep http://172.27.163.69/cgi-bin/pkiclient.exe US CA Milpitas Cisco iot CSR1K true 
    
    

    xpki - Use a Cisco Router as the CA server

    ndes - Use a Window server as the CA server

• The following command is updated in this release for the virtual mode:

  • IPsec RSA between IXM and IR809. Added a new option "profile" to the lpwa modem scep command.

    
    IR800(config-if)#lpwa modem scep ?
    flash:   Location of scep parameter file
    nvram:   Location of scep parameter file
    profile   Configure scep parameters              <<< new profile option 
    
    

    The following is an example of configuring lpwa modem scep profile:

    Example

    
    interface Virtual-LPWA3
     no ip address
     ip nat inside
     ip virtual-reassembly in
     lpwa packet-forwarder public-key flash:lrr-opk.pubkey
     lpwa packet-forwarder firmware flash:lrr-2.2.60-ciscoms-noconfig.cpkg auto-install unconditional
     lpwa modem password root $1$045802150C2E
     lpwa modem ntp server address 172.27.74.9
     lpwa modem timezone America/Los_Angeles
     lpwa modem ipsec enable
     lpwa modem isakmp cisco cisco 192.168.111.1 group strongswan cisco123 72000
     lpwa modem scep profile
      country US
      province CA
      locality Milpitas
      organization Cisco
      unit iot
      name LORA
      persistent true
      url http://172.27.126.60/CertSrv/mscep/mscep.dll
     lpwa modem gps ubx
    end