After you've purchased an M2M Cloud Cluster and it has been delivered, you need to set up your server and edge gateways to make proper use of your M2M Cloud Cluster.

This article addresses the necessary steps for M2M Cloud Clusters set up for Server to machine communication. Meaning that your server initiates the communication to your machine(s). After that, bidirectional traffic is possible.

For information about other use cases, see M2M Cloud Cluster explained.
For frequently asked questions, see M2M Cloud Cluster FAQ.

• Preparation
• Connect your edge gateways to the M2M Cloud Cluster
• Connect your server to the M2M Cloud Cluster
• Make your server be able to reach your machines

Preparation

1. Before you start, make sure to discuss the compatibility of your use case in detail with your IXON account manager or IXON distributor and check the top of this article to see if you meet the requirements.
2. If your use case is compatible with the M2M Cloud Cluster and you've then proceeded to purchase the M2M Cloud Cluster, you'll be sent a form to fill in, asking for details we need to set up your M2M Cloud Cluster.
3. Once we've received a filled in form, your M2M Cloud Cluster will be prepared and set up. Once it's finished, you'll be notified.
   • As mentioned in the M2M Cloud Cluster FAQ, the delivery time of the M2M Cloud Cluster can be up to 3 weeks. This is necessary to schedule sufficient time to make sure everything is set up and working correctly.

Connect your edge gateways to the M2M Cloud Cluster

All edge gateways in your IXON Cloud company will (eventually) automatically connect to the M2M Cloud Cluster. For reliable long-term communication between your server and the machines it is recommended to configure a static VPN address for each edge gateway.

4. Go to Fleet Manager > Devices and click on your device name.
5. Go to Network > VPN, and configure a fixed VPN address.
   • Make sure to choose an IP address in your VPN DHCP range.
   • Make sure that every edge gateway has a unique VPN address.
   • If your VPN range is 10.187.1.0 - 10.187.x.y, do not use the reserved IP address 10.187.1.1.
6. Turn VPN off, wait until the button's available again, and turn VPN back on.
   • This will effectively apply the fixed VPN address and have the edge gateway connect to your M2M Cloud Cluster.
   • If this edge gateway currently does not have a VPN connection. Don’t worry. The next time it connects it will be assigned the entered fixed VPN address automatically.
7. Repeat the previous steps for every edge gateway in your IXON Cloud company.

In the “Cloud connection status”-component on a device page in the Portal you should now see that that the edge gateway is connected to your M2M Cloud Cluster (e.g. “Connected to M2M Cloud Cluster Propack Machinery”).

Connect your server to the M2M Cloud Cluster

To connect your server to the M2M Cloud Cluster, it needs to be able to establish a VPN connection. IXON works with the OpenVPN protocol. This means your server will need the OpenVPN client or a VPN client that supports OpenVPN.

8. Install the OpenVPN client on your server.
   • On Windows, install the OpenVPN GUI: https://openvpn.net/community-downloads/
   • On Linux, install openvpn: https://ubuntu.com/server/docs/how-to-install-and-use-openvpn#simple-client-configuration

Now that your server can establish a VPN connection, you can continue with the OpenVPN config file (.ovpn) that you received from us. This config file contains the information and certificate that the OpenVPN client needs to connect to your M2M Cloud Cluster.

9. Place the OpenVPN config file (.ovpn) in the correct folder. There is likely a “config”-folder inside your OpenVPN installation folder.

Now your server has all the elements needed to connect, but you may still need to configure the OpenVPN client to use the OpenVPN config file on startup.

10. Make sure that the OpenVPN client starts automatically and uses the OpenVPN config file.
    • On Windows, create a task in Task Scheduler with:
      Trigger set to At log on.
      Action set to Start a program, browse for the OpenVPN GUI executable and at Add arguments you enter the following. Replace client.ovpn with your full OVPN file name:
      

      --connect "client.ovpn"

      The outcome should look like this:
      

11. If the OpenVPN client is not yet connected, you may need to restart it once or manually connect once.
12. if you have more than one server, repeat the previous steps on every server.
    • Every server needs their own unique OpenVPN config file (.ovpn).

Make your server be able to reach your machines

With everything connected to the M2M Cloud Cluster, all that remains is to make sure that your server can communicate with your machines. There are several methods to achieve this, depending on your exact use case.

Select the method that was recommended to you:

• Routing
• VPN 1:1 NAT

Routing

Using this method you’ll add routes in the OpenVPN config file (.ovpn) on your server for every machine that you want to access remotely. In case some machine networks have the same or overlapping IP ranges, you'll need to add a route for each individual device. After having added the routes, you’ll need to restart your server’s VPN connection to apply the changes.

13. Make sure that each machine network has a unique IP range or, in case some machine networks have the same or overlapping IP ranges, each individual device behind the edge gateway has a unique IP address.
14. Open the OpenVPN config file (.ovpn) and add a new line at the bottom of the file with the following syntax:

    route machine_IP_range  machine_subnet_mask  edge_gateway_fixed_vpn_address

    For example:

    route 192.168.145.0 255.255.255.0 10.187.100.3

    • If some machine networks have the same or overlapping IP ranges, enter the individual device's IP address instead of the machine IP range, with subnet mask 255.255.255.255.
15. Repeat the previous step for every edge gateway in your IXON Cloud company.
    • If some machine networks have the same or overlapping IP ranges, repeat the previous step for every individual device behind an edge gateway.
16. Restart your server’s VPN connection.

To communicate with your machines, your server needs to communicate to the machine’s local IP address.

17. On your server, when connecting to or communicating with your machines, make sure that you communicate to the machine’s local IP address.

VPN 1:1 NAT

Using this method you’ll add a VPN 1:1 NAT rule in your edge gateways, one for every device behind that edge gateway. Your server will then communicate with the virtual IP address entered in the 1:1 NAT rule. The edge gateway will then forward the requests it receives from your server to the destination machine.

You’ll need to configure a VPN 1:1 NAT rule in each edge gateway.

13. Go to Fleet Manager > Devices and click on your device name.
14. Go to Network > Firewall.
15. Under VPNLAN, add a 1:1 NAT rule.
16. Enter the requested information (details below) and click on Add.

    Field	Description
    Virtual IP address	If you only need to configure a single 1:1 NAT rule, enter the VPN address of the edge gateway. If you need to configure multiple 1:1 NAT rules, enter a VPN address from the part of the VPN IP range that is intended for use in VPN 1:1 NAT rules. This is the designated part of your VPN IP range that is outside of your VPN DHCP range.
    Source IP address	(optional) Recommended to leave empty, unless you have multiple servers and wish to only allow access from specific servers, in which case you need to enter the server's VPN address. To allow traffic from multiple servers, create an identical 1:1 NAT rule with a different source IP address. To allow traffic from all servers, leave empty.
    Destination IP address	Enter the IP address of the device behind the edge gateway.
    Protocol	Select the allowed communication protocol.
    Destination port	(optional and only available if protocol "tcp" or "udp" is selected) Only allow network traffic that uses this communication port. This prevents devices from being able to access your machine using other communication ports. Leave empty to allow traffic over all ports. To allow traffic over multiple ports, create an identical 1:1 NAT rule with a different destination port.
    Description	(optional) Enter a description for this specific 1:1 NAT rule.

17. Repeat the previous steps for every device behind the edge gateway.

You have now made the changes in the IXON Cloud, but these are not yet active in your device. You will need to push your changes to your device for them to take effect.

18. Click on Push device config in the top right corner.
19. Repeat the previous steps for every edge gateway in your IXON Cloud company.

If you only configured a single VPN 1:1 NAT rule per edge gateway, skip the following set of steps and go to the final step. If instead you configured multiple VPN 1:1 NAT rules per edge gateway, continue below. In that case, the edge gateways are now configured correctly, but your server can’t yet reach the virtual IP addresses in the VPN 1:1 NAT rules. For each VPN 1:1 NAT rule, a route needs to be added to your OpenVPN config file.

20. Open the OpenVPN config file (.ovpn) and add a new line at the bottom of the file with the following syntax:

    route 1_to_1_nat_virtual_ip_address  255.255.255.255  edge_gateway_fixed_vpn_address

    For example:

    route 10.187.100.4 255.255.255.255 10.187.100.3

21. Repeat the previous step for each VPN 1:1 NAT rule.
22. Restart your server’s VPN connection.

To communicate with your machines, your server needs to communicate to the virtual IP addresses used in the VPN 1:1 NAT rules.

23. On your server, when connecting to or communicating with your machines, make sure that you communicate to the virtual IP address used in the corresponding VPN 1:1 NAT rule.