A guide to deploying an EcoStruxure IT Gateway, including:   Initial administrator credentials and configuration Configuring device configuration settings Device discovery Connecting the Gateway to EcoStruxure IT   See What's new in EcoStruxure IT Gateway for information about the most current Gateway release. Also see Installing and setting up EcoStruxure IT Gateway       This video was created using Gateway version 1.24.0.  

security_icon_360012105013.png To reduce the attack surface, it is strongly recommended that you restrict access to the server and file system where EcoStruxure IT Gateway is installed.   On this page:   Prerequisites Sign up and create an EcoStruxure IT account Links to instructions for installing the Gateway on Windows or Linux Configure device credentials Discover devices Register and connect the Gateway to EcoStruxure IT   Prerequisites   A server or a PC that is always on with: English install of Microsoft® Windows® 10 and 11 64-bit, Server 2016, Server 2019, and Server 2022 Rocky Linux 8 and 9; Red Hat Enterprise Linux 8 and 9   At least 2GB hard disk space. See system requirements   The required CPU and memory depends on the number of monitored devices and the protocol. See system requirements   Network: Port 443 outbound for connecting to EcoStruxure IT Port 443 inbound locally for accessing the Gateway web interface See system requirements   Devices to be monitored must be accessible over the network from the EcoStruxure IT Gateway. The ports used to communicate with devices vary based on communication protocol and device settings.   Checklist to help you deploy your Gateway   1. Sign up and create an EcoStruxure IT account   Create a new EcoStruxure IT account here or log in if you already have an account.   Follow the on-screen instructions to download the EcoStruxure IT Gateway.   Installing the EcoStruxure IT Gateway   Installation instructions for Windows     Installation instructions for Linux   After you install the Gateway, open a browser on any computer with network access to the Gateway and go to https://<ip address or hostname>/gateway/index.html.   If the browser you are using is on the same system you installed EcoStruxure IT Gateway on, you can access the Gateway at https://localhost/gateway/index.html.    Set the password for the system administrator. The default username is admin.    GW18_set_admin_password_at_first_login_2_360012105013.PNG    Need to configure cloud connectivity settings?   The Gateway server must use the internet to communicate with EcoStruxure IT.   If the Gateway is not connected to EcoStruxure IT, messages and recommended actions are displayed on the Cloud connectivity page. Otherwise, the Device credentials page is displayed. See Configuring cloud connectivity in the Gateway   cloud-connection-failed_360012105013.png       2. Configure device credentials   Configuring the EcoStruxure IT Gateway        Discovery and polling   These settings are used by EcoStruxure IT Gateway to discover and poll devices. You can reuse these credentials for all your device discoveries and add additional credentials as needed.   Click New device credentials and select the communication protocol used by your devices. Specify a label that allows you to identify the credential along with the following settings depending on what protocol you selected:   SNMPv1: Specify the Read community name (public is default), the Write community name (private is default), and the port, (161 is default). SNMPv3: Specify the Username, Authentication type (MD5 or SHA), Authentication password, Encryption type (DES, DES3, AES128, AES192, AES256), Encryption password, and Port (161 is default). When AES is configured in the APC Network Management Card (NMC) interface, choose AES128 in the Gateway user interface. EcoStruxure IT Gateway versions older than 1.15 do not allow discovery of SNMPv3 devices with the Authentication type or Encryption type set to None. Need help configuring your APC NMC devices?  NetBotz: Specify the Username, Password, and Port (80 is default, or 443 with SSL enabled). Need help configuring your NetBotz devices? Redfish: Specify the Username, Password, and Port (443 is default).   Device configuration and firmware update   File transfer settings for the APC Network Management Card are required to allow the Gateway to transfer files to and from monitored APC SNMP devices.   These settings must be properly configured for device configuration, firmware update, and other EcoStruxure IT features to function properly.   Click New file transfer credentials and select SCP or FTP. Specify a name for the configuration, and the username, password, and port.  Note: The EcoStruxure IT Gateway does not support SCP on NMC1 devices.   When one or more file transfer credentials are configured, the Gateway uses the provided credentials to gather certain device information daily.   Some EcoStruxure IT features such as firmware update and device configuration also rely on additional file transfers to and from the device.   Make sure the Gateway has valid device file transfer credentials to prevent unnecessary unauthorized access attempt warnings from being triggered on your devices.   Your APC NMC3 devices might be configured to limit the number of failed login attempts. If the number of device file transfer credentials you provide in the Gateway exceeds the number of failed login attempts allowed on the NMC3 device, the device might be locked. See New cybersecurity requirements in NMC3   Web   To retrieve NetBotz 75x video clips in IT Expert, you must first configure Web credentials in the Gateway.   Once a NetBotz 75x appliance is discovered via SNMP,  these Web credentials are used to connect to its cameras.   Click New web credentials. Specify a name for the configuration, and the username, password, and port (443 by default).  IMPORTANT: NetBotz 75x video clips are available on the Physical Surveillance page in IT Expert when at least one of the Gateways in your organization is updated to version 2.1 or newer.       3. Discover devices   You can import a device list from Data Center Expert or another source to easily discover devices in EcoStruxure IT Gateway 1.8.0 and newer. See Import a device list to discover devices in EcoStruxure IT Gateway   Go to Discover devices. Click Configure Credentials to select specific device file transfer credentials to use in a device discovery. Otherwise, all configured credentials will be used.   To comply with stricter cybersecurity requirements across various product groups, it is recommended that you review your username/password lists in EcoStruxure IT Gateway and confirm that configured credentials are both active and accurate.   You can run multiple discoveries simultaneously.   You can import a device list that contains the IP address for each device.   To discover devices manually, specify an IP address or IP address range. Use an asterisk to search an entire subnet: 192.168.1.* Use a dash to search a range of IP addresses: 192.168.1.100-254.   You can specify multiple IP addresses or IP address ranges separated by commas.   idea_icon_360007070737.png Check out the on-screen device discovery tips!     Modbus discovery To discover Modbus devices, click Discovering a Modbus device?    To discover Modbus devices manually, specify the Device type, Device vendor, Device family, and Server address. For TCP, specify the IP address and Port (502 is default). For Serial (RTU), specify the Port, Baud rate, Data bits, Parity, Stop bits, and Flow control.   Importing a device list You can import a device list that contains the IP address and server address for each Modbus device. Each line must have both the IP address and server address.   IMPORTANT: On the Gateway Discover devices page, you must also specify the Device type, Device vendor, and Device family. For TCP, also specify the Port (502 is default). For Serial (RTU), you must also specify the Port, Baud rate, Data bits, Parity, Stop bits, and Flow control.   Discovery results If device discovery fails, there are messages and suggestions on how to fix the issue on the page.   GW18_Discover_Devices_360012105013.png    GW18_discover_devices_no_errors_360012105013.png   Click Go to devices to see all discovered devices listed on the Devices page. Click Discovery log to see additional discovery results.   GW18_Device_Discovery_Log_360012105013.png   Click View details under the count of unsupported devices to see the list of devices not yet supported in EcoStruxure IT, if any. To request device support, click Need device support? Submit a DDF Request.   GW18_device_not_supported_360012105013.png   4. Register and connect the Gateway   Click the Register Gateway button and follow the on screen instructions to connect your Gateway to your EcoStruxure IT organization. If you are not logged into EcoStruxure IT, log in to connect your Gateway. You might be prompted for the 2 factor authentication code you chose when you set up your EcoStruxure IT account. Note: The 2 factor authentication code you need to log in is not the same as the Gateway registration code.   idea_icon_360012105013.png If you have not yet signed up for an organization in EcoStruxure IT sign up here. Once you have an an account in EcoStruxure IT, click the Register Gateway button and follow the on screen instructions.   After you log in to EcoStruxure IT, you'll see the Connect Gateway dialog with the Gateway registration code pre-populated.   If the registration code isn't prepopulated, for example if you login to the Gateway using a different browser than you use to log in to EcoStruxure IT, you can go to Administration > Gateways > Connect Gateway in the EcoStruxure IT web interface and manually enter the Registration code.   GW18_register_Gateway_360012105013.JPG GW18_connect_Gateway_in_ITE_360012105013.png GW18_EIT_administration_page_360012105013.PNG   Return to the Gateway user interface and click Done. Note: The setup wizard appears each time you access the Gateway until you click Done. All settings you configure in the wizard are applied whether or not you click Done on the last page of the wizard.   See also Installing the EcoStruxure IT mobile app

EcoStruxure IT Gateway supports Red Hat Enterprise Linux 8 and 9 and Rocky Linux 8 and 9   RHEL 7 is not supported in Gateway versions 1.23 and newer.   For existing Gateway installations, deploy the current Gateway version on a supported Linux operating system. To retain sensor history, follow these instructions: How to replace your EcoStruxure IT Gateway with a new installation System requirements for EcoStruxure IT Gateway        IMPORTANT: The user running the Gateway installer must have file system privileges set to umask 0022 or 0002. Otherwise, the installer cannot initialize the database.   See more User permissions requirements in System requirements for EcoStruxure IT Gateway      Install the Gateway from the Linux terminal via SSH. Installing using the Linux GUI is not supported; it will cause a crash and require a reboot.     Download the EcoStruxure IT Gateway install package to the server. Navigate to the directory where the install package is located.  Type cd and then the directory, for example:  cd /tmp/EcoStruxureITGateway-<version>-linux-x64.run  Give executable rights to the install package. Type: chmod 755 EcoStruxureITGateway-<version>-linux-x64.run Install the EcoStruxure IT Gateway. Type: ./EcoStruxureITGateway-<version>-linux-x64.run Continue through the prompts to finish the install. Open a web browser and go to https://your_server_ipaddress/ Enter a password for the admin user.  Follow the prompts to configure settings and register the Gateway with EcoStruxure IT. For detailed instructions, see Installing and setting up EcoStruxure IT Gateway In EcoStruxure IT, go to Administration > Gateways. You can see the Gateway is now connected to your account.   

  Modbus.org now uses client/server to describe Modbus communication   Note: Modbus.org announced it is expunging all occurrences of inappropriate language of the query and response paradigm of Modbus communications. The organization is using "client-server" instead of "master-slave" to describe Modbus communications. More...         Log in to the Gateway and go to the Device discovery page. Click Discovering a Modbus device? To discover Modbus devices manually, enter the Device type, Device vendor, and Device family. For TCP, specify the IP address, Server address, and Port (502 is default). For Serial (RTU), enter the Port, Baud rate, Data bits, Parity, Stop bits, and Flow control.   GW_Modbus_discovery_2020_360024034633.png   Importing a device list   You can import a device list that contains the IP addresses and server addresses. Each line must be of the same type, vendor, and family.  Each line must have both the IP address and Server address.   IMPORTANT: When you import a device list, you must also specify the Device type, Device vendor, and Device family, and the Port (502 is default), on the Gateway Discover devices page.  

The EcoStruxure IT Gateway must be at a minimum of version 1.18 to update to the latest Gateway version. If your Gateway version is older than 1.18, contact support for assistance.   When you update the Gateway to the latest version, the software update performs a backup that is stored in the install directory. It is important that you have a back up before you update EcoStruxure IT Gateway.    To manually run a Gateway backup, see Configure Gateway backup Take a snapshot via VM.   Do not uninstall the previous version of the Gateway software.   Update from IT Expert   Gateway software update is available from IT Expert.   Log in to IT Expert. Go to Administration > Gateways. Click the Update button on each Gateway you want to update the software on.        The Gateway software update runs in the background.   New Gateway versions can be installed with minimal downtime, and are deployed in parallel with the currently running instance. You can actively monitor your devices while data migration and new version deployment completes. If there is a failure to migrate data and deploy the new version, the current Gateway install will continue to run unaffected, reporting errors to our engineering team for review.   If a device library update is also available, it will be presented after the Gateway software is updated. The Gateway software update is always presented first.   Manual update and installation   Log in to IT Expert. Go to Administration > Gateways. Click Download Gateway software. Run the installer.   OR   Download the Gateway software for Windows or Linux here.   You must also manually update the device library.  Device library updates are released frequently, independent of Gateway software releases. See How to update the Gateway device library   Auto-update in IT Expert   You can enable automatic Gateway software updates in IT Expert. When you enable auto-update on a Gateway connected to IT Expert, you allow Schneider Electric to automatically update it when a new software version is available.   In IT Expert, go to Administration > Gateways. Click Enable auto-update on the Gateway tile(s).       You can also double click a Gateway tile and check the box to enable auto-update, or uncheck the box to disable it.       About the Gateway Device Library   Device library updates are released frequently, independent of Gateway software releases.   When auto-update is enabled in IT Expert, the device library is also auto-updated if an update is available. The Gateway software is always updated first.   If a new version of the device library is available independent of a Gateway software release, you must manually update it in IT Expert. See How to update the Gateway device library    

Redundant EcoStruxure IT Gateways can reduce latency for organizations that have multiple locations or in large installations. There is no charge for additional Gateways. Install redundant Gateways GW_redundant_configuration_360005182398.png Install and configure two EcoStruxure IT Gateways the same way on two different servers that are always on, or on two Gateway Appliances.  See Installing and setting up EcoStruxure IT Gateway. Discover the same devices on each Gateway. Connect both Gateways to your EcoStruxure IT account.  Note: Devices that are monitored by two Gateways appear the EcoStruxure IT Inventory only once. Verify redundancy On one server where the Gateway is installed, stop the Gateway service: For Windows, in Computer Management > Services and Applications > Services, select EcoStruxureITGateway Server x.x.x.x and then click Stop. For Linux, type sudo systemctl stop EcoStruxureITGateway-x.x.x.x.service at the command line. Note: Replace x.x.x.x with the Gateway version number. Cause an alarm on a device that is monitored by both Gateways. Log into your EcoStruxure IT account. Verify that the alarm is displayed there and in the mobile app. Once you have verified redundancy, restart the Gateway service: For Windows, in Computer Management > Services and Applications > Services, select EcoStruxureITGateway Server x.x.x.x and then click Start. For Linux, type sudo systemctl start EcoStruxureITGateway-x.x.x.x.service at the command line. Note: Replace x.x.x.x with the Gateway version number. Repeat on the second Gateway server.   GW_verify_redundant_configuration_360005182398.png

The EcoStruxure IT app is available worldwide for iOS and Android, in English only.   1. Create an account   Go to https://app.ecostruxureit.com/manage/ from a computer, not your mobile device. Click Sign up. If you have already created an EcoStruxure IT account, click Log in.   ITE_signup_360012004814.JPG      Once you sign up, you'll see a confirmation message that your account was created.   2. Log in and download the EcoStruxure IT app   Enter your EcoStruxure IT account credentials (email address and password) and log in.   ITE_log_in_1_360012004814.jpg   Download the EcoStruxure IT app if you haven't already done so.    Google_Play_Badge-200x70_360012004814.png downloadonapp-200x62_360012004814.png 3. Two-factor authentication   EcoStruxure IT authentication complies with the latest security standards. You must select a two-factor authentication method: EcoStruxure IT app, SMS, or Google Authenticator app.   The recommended authentication method is the EcoStruxure IT app. SMS is not the safest authentication method and is not recommended. SMS is not reliable in locations where the cellular connection is poor.   Also see EcoStruxure IT authentication method Google, Duo, Auth0, or other authentication SMS authentication

CentOS 7 (end of life June 2024) is not supported in Gateway 1.23 and newer. System requirements for EcoStruxure IT Gateway    For existing Gateway installations, deploy a new Gateway 1.23 on a supported Linux operating system:   Rocky Linux 8 and 9 Red Hat Enterprise Linux 8 and 9   To retain sensor history, follow these instructions: How to replace your EcoStruxure IT Gateway with a new installation   Red Hat/Rocky Linux installation instructions are here.  

  You can import a device list from Data Center Expert or another source to easily discover devices in EcoStruxure IT Gateway.   Note: Gateway versions older than 1.15 do not allow discovery of SNMPv3 devices with the Authentication Passphrase and Privacy Passphrase set to None. Note: APC NMC 4 (AP9644) devices are not yet supported.     File format   IP addresses to discover must be in a single column. For Modbus, IP addresses in one column and Server addresses in a second column for multiple Modbus devices of the same type, vendor, and family. The columns do not need to be in any specific order. Any extra columns are ignored. The first row can optionally be a header row describing the contents of each column. A header row is not required. The file extension must be .csv, .tsv, .txt The column delimiter must one of the following: colon, comma, tab, pipe, semi-colon, space. The character encoding on the file must be UTF-8.   Example IP address 192.168.1.12 192.168.1.25 192.168.1.32 192.168.1.42     On the Gateway Device discovery page, drag and drop a device list in .csv, .tsv, .txt format or click Import.   GW18_discover_devices_1_import_360007175377.jpg   Check the box if the first row in the file is a header row.   Select the IP address column from the list. For Modbus discoveries, also select the Server address column from the list.   Click show in the results section to verify that the file was imported as expected.   Click Discover devices to begin the discovery.   SNMP, NetBotz, and Redfish   GW18_import_discovery_360007175377.png   Modbus  You can import a device list that contains the IP addresses and server addresses for multiple Modbus TCP devices of the same type, vendor, and family.   GW_discover_Modbus_devices_from_import_360007175377.png  

Use this procedure to replace an EcoStruxure IT Gateway and maintain sensor history.   Replace a Gateway appliance due to its end-of-life in December, 2023   Replace a Gateway software installation on CentOS 7 CentOS 7 end of life is June, 2024 CentOS 7 is not supported on Gateway 1.23 and newer.   Replace a software Gateway installation on RHEL 7 RHEL 7 is not supported on Gateway 1.23 and newer.   Replace a Gateway for disaster recovery   Any other scenario where a new Gateway must be deployed   IMPORTANT: Do not remove the existing installation of the Gateway from your organization until you have discovered all your devices in the new installation and connected the new Gateway to IT Expert.   To replace your Gateway:   Set up a new software Gateway according to system requirements.  System requirements for EcoStruxure IT Gateway   Install the Gateway software. Installing and setting up EcoStruxure IT Gateway    Discover your devices. 10743026713501_10582437370781.png Export your device list to CSV from the EcoStruxure IT cloud, then import the list in Gateway discovery.  See how...   Log in to IT Expert as an existing customer. Go to Administration > Gateways to connect the new Gateway to your organization.   Delete the old Gateway from your organization.   Decommission your old Gateway installation.   See also Replacing your EcoStruxure IT Gateway appliance

Note: The EcoStruxure IT Gateway Windows installer requires the Windows Management Instrumentation Command line (WMIC) utility. WMIC is not preinstalled by default on Windows 11 24H2. More...        Installing the EcoStruxure IT Gateway on Windows         Screens for a custom install   EcoStruxure_IT_Gateway_installer_screens_4407763234961.gif

You can verify the EcoStruxure IT Gateway installer SHA1 checksum on a Mac, Windows, or Linux computer. DO NOT run the installer if your calculated value does not match the published checksum for your Gateway version and operating system.   Verify from Windows PowerShell   Download the EcoStruxure IT Gateway installer to your Windows machine. Open PowerShell. The PowerShell.exe command starts a session in a command window.  Navigate to the directory containing the downloaded file. Use the Get-FileHash PowerShell command to calculate the SHA1 checksum of the installer and compare it against the published value in the table. Get-FileHash -Path .\EcoStruxureITGateway-x.x.x.x-windows.exe -Algorithm SHA1   Verify from a Linux terminal   Download the EcoStruxure IT Gateway installer to your CentOS or RHEL machine. Open a terminal window. Navigate to the directory containing the downloaded file. Use the sha1sum terminal command to calculate the SHA1 checksum of the installer and compare it against the published value. sha1sum EcoStruxureITGateway-x.x.x.x-linux-x64.run   Verify from a Mac terminal   Download the EcoStruxure IT Gateway installer to your Mac OS machine. Open a terminal window. Navigate to the directory containing the downloaded file. Use the shasum terminal command to calculate the installer SHA1 checksum and compare it against the published checksum in the table. shasum EcoStruxureITGateway-x.x.x.x-windows.exe   System requirements for EcoStruxure IT Gateway   

Discovering Smart-UPS using a Network Management Card (NMC)   If the Smart-UPS connects to your network using a Network Management Card (NMC), you can discover it in the EcoStruxure IT Gateway using SNMPv1 or SNMPv3. Do not use the ethernet port on the UPS to connect to EcoStruxure IT if the UPS uses an NMC.   Discovering Smart-UPS via Modbus   Smart-UPS models starting with SMT, SMTL750, and SMTL1000 support Modbus TCP using the ethernet port on the UPS with firmware version 4.2 and greater.   NOTE: Modbus TCP discoveries are supported on EcoStruxure IT Gateway version 1.9.0 and newer. See Installing and setting up EcoStruxure IT Gateway

Device credentials During the initial setup of your Gateway, you specify credentials to communicate with the SNMPv1, SNMPv3, NetBotz, Redfish, or Modbus devices you want to discover. To modify these settings later, go to Settings > Device credentials.   See Installing and setting up EcoStruxure IT Gateway   Note: When AES is configured in the APC Network Management Card (NMC) interface, choose AES128 in the Gateway user interface.   Note: The EcoStruxure IT Gateway does not support SCP on APC NMC1 devices. How to identify APC Network Management Card 1 (NMC1) devices   Note: When you discover NetBotz 300, 400, and 500 devices using SNMP, they are listed as unsupported devices in the Gateway. Use the NetBotz protocol to discover these devices in the Gateway.   Your APC NMC3 devices might be configured to limit the number of failed login attempts. If the number of device file transfer credentials you provide in the Gateway exceeds the number of failed login attempts allowed on the NMC3 device, the device might be locked.   See New cybersecurity requirements in NMC3       Learn about how to discover Modbus Devices in IT Expert.   Discover devices To discover devices after the initial setup of your Gateway:   Go to Discover devices. Click Configure Credentials to select specific device file transfer credentials to use in a device discovery. Otherwise, all configured credentials will be used. Click Manage credentials to view the credentials you have configured in the Gateway. To comply with stricter cybersecurity requirements across various product groups, it is recommended that you review your username/password lists in EcoStruxure IT Gateway and confirm that configured credentials are both active and accurate. Specify the IP addresses or address range of the devices, or import a device list.  You cannot import a device list for serial Modbus discoveries.   idea_icon_360021184553.png Check out the on-screen device discovery tips.     Discovery results are displayed in the summary including discovered devices and unsupported devices that were not discovered. You can view details about unsupported devices, and see discovery results in the discovery log.   If you find that one or more of your devices is not supported, you can request device support. All discovered devices are listed on the Devices page.   Need help configuring your APC NMC devices?  Need help configuring your NetBotz devices?      

The Gateway server must use the internet to communicate with EcoStruxure IT. If cloud connectivity fails during the Gateway setup, messages and recommended actions are displayed on the Cloud Connectivity page. Note: If the Gateway has connected to the cloud, the Device credentials page is displayed. The Cloud connectivity page includes options to set up a proxy server and add a trusted SSL certificate. These options are also available in the Gateway user interface after you exit the set up wizard. GW18_cloud-connection-failed_360009189117.png Set up a proxy server If your organization requires you to use a proxy server for internet connectivity, specify the settings. Click Proxy Settings Choose to automatically detect proxy settings, or to configure the settings manually, specify the proxy server address, the HTTP port and HTTPS port used to communicate with the proxy server. You may also supply a username and password if they are required by the proxy server. Click Save and confirm the connection to EcoStruxure IT was successful. Follow the on-screen recommendations if the Gateway server cannot access the proxy server using those settings. IMPORTANT: You must manually restart the Gateway service after changing proxy settings. GW18_proxy_dialog_360009189117.png Add trusted SSL certificate If your organization requires HTTPS traffic to pass through an SSL inspection proxy, you may need to install the root CA certificate used by the proxy. An untrusted SSL certificate error can occur if your organization operates an SSL inspection proxy and EcoStruxure IT Gateway does not trust the issuing CA. Your IT department can provide the correct root certificate. The certificate must be in PEM format with one of the following extensions: cer, crt, or pem. To add an untrusted certificate authority's (CA) root certificate to the EcoStruxure IT Gateway trust store:  Click Import certificate, drag and drop the certificate file, or copy and paste the root certificate contents into the box.  GW18_add_certificate_360009189117.JPG See How to solve the Gateway untrusted certificate chain error Once you finish setting up the Gateway, you can see and manage trusted certificates in Settings > Trust store. IMPORTANT: You must manually restart the Gateway service after adding or removing certificates. See also Installing and setting up EcoStruxure IT Gateway