ADVANTECH ICR-3231 4G Industrial Cellular Router Instructions

: June 12, 2024
: Advantech

Table of Contents

Abstract
Firmware Details
Firmware Update Instructions
Changelog
Known Issues
References
Read User Manual Online (PDF format)
Download This Manual (PDF format)

ICR-OS
Firmware 6.2.8
RELEASE NOTES

ADVANTECH ICR 3231 4G Industrial Cellular Router

ICR-3231 4G Industrial Cellular Router

Abstract

This document describes:

Firmware update instructions.
Description of all new features, ﬁxes and other changes implemented in the ﬁrmware.
Known issues related to a ﬁrmware version.

Firmware Details

Firmware version: 6.2.8
Release date: February 19, 2021
Hardware compatibility: applicable to the Advantech routers

Please note that not all new Advantech routers are produced and shipped with the latest release of the ﬁrmware. The reason for this is usually an existing certiﬁcation valid for a speciﬁc carrier or a region. For more information about the latest version of the ﬁrmware for your router, see the Firmware Distribution Overview document.
For current and detailed information about the router conﬁguration see the latest version of the Conﬁguration Manual for your router.
Product related documents and applications including the ﬁrmware can be obtained on Engineering Portal at https://ep.advantech-bb.cz/address.
Advantech Czech s.r.o., Sokolska 71, 562 04 Usti nad Orlici, Czech Republic This document was issued on February 19, 2021

Firmware Update Instructions

General Update Instructions and Notices
HTTPS certiﬁcates: The HTTPS certiﬁcate format in the router was updated in FW 5.3.5 to improve the security. Existing HTTPS certiﬁcates on previously manufactured routers will not automatically be updated with the ﬁrmware update! It is possible to update the HTTPS certiﬁcates by deleting the ﬁles within /etc/certs/https in the router (e.g. via SSH). The certiﬁcates will be re-created automatically during the router’s next start.
Speciﬁc Update Instructions
New ﬁlename: If the ﬁlename of ﬁrmware for your router was changed, you will meet with an issue during manual ﬁrmware updating or with automatic ﬁrmware update feature. This warning message will appear during the ﬁrmware updating process: “You are trying to upload ﬁle “xx.bin” but “yy.bin” is expected. Are you sure to continue?”
To proceed with the ﬁrmware updating please follow these steps: Check the table below for details about recent ﬁrmware ﬁlename changes and make sure you have the correct ﬁrmware ﬁle for your router. Go ahead with manual ﬁrmware updating and conﬁrm the displayed warning message.
To proceed with automatic ﬁrmware updating, rename new ﬁrmware ﬁles (.bin and *.ver) to ﬁlenames valid before the ﬁlename change. This should allow the router to pass through the process of automatic ﬁrmware updating. Next time, the automatic rmware update feature will work as expected with no need to rename the ﬁle.

Router model	FW ver	New ﬁlename	Original ﬁlename

Table 1: Recent Firmware Filename Changes
Updating Firmware of Version Less than 5.3.0
**** It is necessary to follow speciﬁc update instructions below only if you are updating from ﬁrmware older than 5.3.0.
Due to a bug in the ﬁrewall (now ﬁxed) when a WAN device is part of a bridged interface, caution should be taken when updating in following case:

Condition:| When a WAN device is part of a bridged interface, access to that WAN device (HTTPS, SSH) is always granted regardless of conﬁguration.
---|---
Problem:| If this is your conﬁguration, it is highly likely that you are not aware of this, so the undesired effect of the bridge ﬁrewall ﬁx may render
the router inaccessible.
Recommended Action:| Enable access to both the web and ssh services before updating
if you want to retain the current behavior (access to the WAN interface).
This can be done on the NAT page in the Conﬁguration section of the router’s Web interface.

Change the root’s password:
It is necessary to change the password for the root user when updating to the ﬁrmware version 5.3.0 or newer. The reason for this is an update of the authentication system (encryption algorithm crypt was changed to MD5; passwords are now stored in the etc/shadow ﬁle instead of /etc/passwd). The change of the password is required before setting up the remote access on the NAT Conﬁguration page.
Please note that when downgrading from 5.3.0+ to previous ﬁrmware versions, the password for the root user is reset to the default one, which is root.

Changelog

Legend: Affected products are marked as shown below for every changelog item:

Affected product	Not affected product

Quectel Module Update

ADVANTECH ICR 3231 4G Industrial Cellular Router - Module
Update

Released router ﬁrmware supports the Quectel BG96 cellular module having the ﬁrmware of version R02A07+.
Enhanced OpenVPN Conﬁguration

ADVANTECH ICR 3231 4G Industrial Cellular Router -
Configuration

There is a new conﬁguration option Security Mode in the OpenVPN conﬁguration GUI. Here, for relevant authentication modes only, you can choose from two different security modes tls-auth and tls-crypt.
We recommend using the tls-crypt mode for the security reasons. In this mode, all the data is encrypted with a pre-shared key. Moreover, this mode is more robust against the TLS denial of service attacks.

Enhanced GRE Conﬁguration

ADVANTECH ICR 3231 4G Industrial Cellular Router - GRE
Configuration

We have enhanced the GRE tunnel conﬁguration GUI with Local IP Address conﬁguration option. This item is optional together with Remote IP Address and Pre-shared Key, but at least one of them must be conﬁgured.

HTTPS TLS Version Conﬁguration

ADVANTECH ICR 3231 4G Industrial Cellular Router - Version
Configuration

A minimal version of TLS protocol can now be conﬁgured in HTTP GUI settings to version 1.3. We recommend using the latest version of TLS. Support for other version persists due to compatibility with various web browsers.

Added ebtables Program

ADVANTECH ICR 3231 4G Industrial Cellular Router -
Program

We have added ebtables program, which can be used as an administration tool for ﬁrewall IP packets ﬁltering. It enables transparent ﬁltering of network trafﬁc passing through a Linux bridge. The ﬁltering possibilities are limited to link layer ﬁltering and some basic ﬁltering on higher network layers.
The ebtables tool can be combined with the other ﬁltering tools (iptables and ip6tables) to make a bridging ﬁrewall that is also capable of ﬁltering these higher network layers. Check the Commands and Scripts application note for more information about this program.

Added doas Program

ADVANTECH ICR 3231 4G Industrial Cellular Router - Program
1

There is a new program called doas which can be used to execute commands as another user. This program replaces the sudo command, which is not supported by the ﬁrmware from version 6.2.8 anymore. For compatibility reasons, the sudo command is just a symlink to the doas command. Check the Commands and Scripts application note for more information about this program.

Out-of-memory Reboot

ADVANTECH ICR 3231 4G Industrial Cellular Router - Out-of-memory
Reboot

We have changed the settings of the out-of-memory feature. It will now invoke the kernel panics compulsorily and reboot the router with no processes killed by the out-of-memory killer.

DHCP Authoritative Mode

ADVANTECH ICR 3231 4G Industrial Cellular Router - Authoritative
Mode

Conﬁguration of the DHCP server, running on our routers, was updated to act as the authoritative DHCP server for all WiFi clients. Authoritative DHCP server is a server which always responds to a DHCP request if no another DHCP server in the network responds. This conﬁguration prevents issue with obtaining the IP address for some WiFi clients having a valid address assigned in another WiFi network.

Fix for NB-IoT Networks

ADVANTECH ICR 3231 4G Industrial Cellular Router -
Networks We have extended the timeout for NB-IoT network registration from two to ﬁve minutes to let the cellular module scan all the channels.

Fixed WiFi Issue

ADVANTECH ICR 3231 4G Industrial Cellular Router - WiFi
Issue

We have made a ﬁx for transmit issues on the Laird SU60 WiFi module. This issue caused the WiFi to stop working. If required, this ﬁx will invoke reboot of the router.
Fixed OpenVPN Issue

ADVANTECH ICR 3231 4G Industrial Cellular Router - OpenVPN
Issue

We have ﬁxed an issue with resolving of IP address in OpenVPN version 2.4. The OpenVPN conﬁguration was updated to be compatible with OpenVPN of version 2.3.

Fixed Possible XSS Attack

ADVANTECH ICR 3231 4G Industrial Cellular Router - XSS
Attack

We have ﬁxed possible reﬂected XSS attack (medium severity) in the web administration.

Updated curl Program

ADVANTECH ICR 3231 4G Industrial Cellular Router -
Updated

We have updated the curl program to version 7.74.0. This update has ﬁxed NVD – CVE-2020-8285 (nist.gov) (high), NVD – CVE-2020-8169 (nist.gov) NVD – CVE-2020-8177 (nist.gov) (medium) and NVD – CVE-2020-8284 (nist.gov)(low). For more details about this curl release, see https://curl.haxx.se/changes.html#7_74_0.

Updated dnsmasq Software

ADVANTECH ICR 3231 4G Industrial Cellular Router -
Software

We have updated the dnsmasq software to version 2.84. This update has ﬁxed NVD – CVE-2020-25681 (nist.gov) , NVD – CVE-2020-25682 (nist.gov) (high), NVD – CVE-2020-25683 (nist.gov), NVD – CVE-2020-25687 (nist.gov) (medium), NVD – CVE-2020-25684 (nist.gov), NVD – CVE-2020-25685 (nist.gov) and NVD – CVE-2020-25686 (nist.gov) (low). For more details about the release, see the webpage at http://www.thekelleys.org.uk/dnsmasq/CHANGELOG.

Updated OpenSSL Library

ADVANTECH ICR 3231 4G Industrial Cellular Router -
Library

We have updated the OpenSSL library to version 1.1.1j. This update has ﬁxedNVD – CVE-2021-23839 (nist.gov),NVD – CVE-2021-23840 (nist.gov) and CVE-2021-23841.

Known Issues

Firmware Update – Unexpected Filename
If the ﬁlename of ﬁrmware for your router was changed, you could have an issue during manual ﬁrmware updating or with Automatic Update feature. This warning message will appear: “You are trying to upload ﬁle “xx.bin” but “yy.bin” is expected. Are you sure to continue?” To ﬁx this issue follow instructions in Part I – Firmware Update Instructions.
Automatic Update – Update to Version 6.1.10
The feature of automatic ﬁrmware update will not recognize the ﬁrmware version 6.1.10 as a new version in case the installed version of ﬁrmware is from 6.1.0 to 6.1.8. To ﬁx this issue, either update the ﬁrmware by the automatic update to version 6.1.9 ﬁrst or pdate it manually directly to the version 6.1.10.
WiFi Conﬁguration – Lost After Firmware Downgrade
If the ﬁrmware is downgraded to the version less than 6.2.0, the WiFi conﬁguration will be lost completely.
ICR-3200 – Country Code for WiFi
The ﬁrst version of the ﬁrmware for the WiFi module does not support the settings of the country code. Due to this issue, the settings of the country code made on the conﬁguration page has no effect at all. The country code is set up during the manufacturing process according to
the product destination region.
SmartStart – Cellular Network Registration
It is necessary to use router’s ﬁrmware version 6.1.5 or higher if the Telit cellular module installed in your SmartStart router has following version of the ﬁrmware:

Telit LE910-EU V2 cellular module with ﬁrmware version 20.00.403 or newer,
Telit LE910-NA1 cellular module with ﬁrmware version 20.00.014 or newer.

Note: The model name and ﬁrmware version of the cellular module can be found on router’s web GUI at Mobile WAN Status page in Mobile Network Information section.

SmartStart SL302 – Cellular Network Authentication
It is not possible to use username and password when connecting to Mobile WAN network (on Mobile WAN Conﬁguration page) if your SmartStart SL302 router has the 20.00.522 ﬁrmware version inside the Telit LE910-NA1 cellular module. The version of cellular module ﬁrmware can be found at Mobile WAN Status page in Mobile Network Information section.
SmartStart SL302 – SMS in Verizon Network
SmartStart SL302 router (equipped with the Telit modules LE910-SV1 or LE910-NA1) supports sending and receiving of SMS in Verizon cellular network since the ﬁrmware version 6.1.4. Please note that to support SMS receiving, cellular module with Verizon ﬁrmware version higher than 20.00.012 is required.