Troubleshooting

Common errors with possible causes and recommended actions to help you diagnose and solve issues connecting your Gateway to EcoStruxure IT   Connectivity error   Unable to resolve host name "{0}". Verify your DNS settings. Make sure the DNS settings are properly configured in your Gateway server's network preferences.   Other well-known sites are reachable. Verify that "{0}" is not blocked by a network filter. Consult with your IT department to ensure that the us.struxureon.com DNS entry or IP address is added to your firewall rules as they appear to be blocked.   Proxy configuration error   Proxy server "{0}" cannot be reached or is down. Double check your proxy configuration settings and contact your IT department to verify the status of the proxy server and its configuration settings.   Proxy server name "{0}" cannot be resolved. Check your proxy settings. Double check your proxy configuration settings and DNS settings and contact your IT department to verify the status of the proxy server and its configuration.   Auto-detection is enabled in your proxy settings but no proxies were detected. Try manually setting proxy. If there is a network proxy between your Gateway server and the outside internet, please configure the proxy settings manually. You'll need the IP address of the proxy server and potentially a username and password if required by your proxy configuration. Your IT department should be able to help you acquire those if they are not directly accessible. How to set up the EcoStruxure IT Gateway proxy settings   Proxy server authentication error   Proxy authentication failure. Check your proxy settings. Confirm that you entered the correct username and password settings for your proxy server.   Connection refused   Also unable to reach other well-known sites. Check your network connection, or, possible firewall misconfiguration. Consult with your IT department to ensure that your server is configured correctly to reach the outside internet. A network proxy or firewall could be blocking the connection.   Response timeout Make sure you have a working network connection. Make sure the DNS settings are properly configured in your Gateway server's network preferences.   Forbidden   Received a forbidden response pointing to a possible proxy misconfiguration. Double check your proxy configuration settings and contact your IT department to verify the status of the proxy server and its configuration settings. Verify that the time and date values of the operating system of the machine running the EcoStruxure IT Gateway server are properly set.    No route to host   Unable to reach configured router at {0}. Make sure you have a working network connection.   No route to host. Check your routing configuration. Make sure the DNS settings are properly configured in your Gateway server's network preferences.   Unknown host   Unable to resolve host names for any well-known sites: {0}. Verify your DNS settings. Make sure the DNS settings are properly configured in your Gateway server's network preferences.   Untrusted SSL certificate   Certificate is expired or untrusted. Common Name (CN) does not match the URL address. Check the certificate details to see if it has expired. The certificate might be in the wrong place in the file system. If the certificate was issued by a trusted authority, you may need to install one or more intermediate certificates. With assistance from your IT group, make sure the Certificate Authority used by the proxy is added to the Cloud connectivity > Proxy settings option in the Gateway user interface, or add us.struxureon.com to the exemption list so its traffic is not intercepted. How to solve the Gateway untrusted certificate chain error   Invalid SSL certificate   The Gateway appears to be configured to use a proxy that is using SSL interception, and the Gateway does not trust the certificate the Proxy is replacing. With assistance from your IT group, make sure the Certificate Authority used by the proxy is added to the Cloud connectivity > Proxy settings option in the Gateway user interface, or add us.struxureon.com to the exemption list so its traffic is not intercepted.

A technical support representative might ask you to gather logs for troubleshooting.   Gateway Logs   Log into the Gateway user interface. Go to Settings > Advanced > Download server logs and click Download to download a zip file of the logs. If Gateway services are down, please provide the logs from the following folder locations: C:\Program Files\EcoStruxureITGateway\<version>\log C:\Program Files\EcoStruxureITGateway\<version>\pgsql\data\pg_log   Installation Logs   Gather these logs for installation or software update issues:   Gateway 1.10 and newer installbuilder_installer_*.log install_helper_*.log Older Gateway versions EcoStruxure* bitrock*   Windows    If you downloaded and installed the Gateway software, gather logs from:   C:\Users\<username>\AppData\Local\Temp C:\Users\<username>\AppData\Local\Temp\<number folder>   If you updated the Gateway software from the IT Expert web application, or the update was automatically run by Schneider Electric, gather logs from:   C:\Windows\Temp C:\Windows\Temp\<number folder>   Linux   Gather logs from:   /tmp/   Service Settings   There are several setting that can affect running and/or upgrading the Gateway service, only gather these if requested by customer support.   Windows   Gather the Gateway settings from the Registry.   Run regedit.exe Navigate to HKEY_LOCAL_MACHINE>SOFTWARE>JavaSoft>Prefs>com>se Right click the se folder and select Export. Navigate to HKEY_LOCAL_MACHINE>SOFTWARE>Schneider Electric. Right click the se folder and select Export. Send these two files to Customer Support  

A Gateway device discovery can fail for various reasons. After you run a discovery, open the Discovery Log to see the results for each device that was scanned.   Connection Failure The Gateway was unable to communicate with the device. Check that the device and the discovery settings match for:   Protocol (SNMP vs Modbus) IP Address Port Credentials (username, password, etc.)    APC network-enabled devices are being updated to improve security and comply with regulations.  New versions of APC Network Management Card (NMC) firmware will have the SNMP protocol disabled by default. Devices that have these cards cannot be discovered by EcoStruxure IT Expert or Data Center Expert until SNMP is enabled.  More information on specific changes     The <type> device was detected but is not supported The Gateway was able to communicate with the device, but did not find a device definition file (DDF) that supports the device. Request support for a new device   <type> device was detected but could not be uniquely identified The device was detected and the Gateway has a DDF, but cannot get a unique identifier for the device.    Typically the Gateway tries to use the device's serial number as a unique identifier. For some devices, the serial number field is available but not set, such as: Easy UPS 3s Galaxy 5000 & 5500 device dependent   If possible, work with Technical Support to help you set the serial number. In Gateway 1.7.0, these devices will fall back to using the device MAC Address as a unique identifier if serial number is not available.   The <type> device has been successfully discovered The device was discovered and will appear on the Devices page. 

If you have created a device support ticket and have been asked to enable targeted reads for a device, you set the permission to do so in the Gateway server's web user interface in the Settings > Advanced > Targeted reads option.   To create a Device Support ticket to allow EcoStruxure IT Gateway to discover an unsupported device:   If unsupported devices are listed on the Device discovery page in the Gateway user interface, click View details. Click Need device support? Submit a DDF Request to request support for a device you are unable to discover. To set the permission to perform a targeted read, check the appropriate box based on how you are trying to discover the device:   In the Gateway user interface, go to Settings > Advanced > Targeted reads. If you are trying to discover a serial Modbus device, check the first box, Allow Schneider Electric to perform targeted reads on devices serially connected to your EcoStruxure IT Gateway. If you are trying to discover a Modbus TCP device, check the second box, Allow Schneider Electric to perform targeted reads on the following IP addresses or IP address ranges. List the IP addresses individually or specify a range.   When you confirm with device support that you have given your permission for a targeted read in the Device Support option in the Gateway, be sure to provide the following information for the devices you are trying to discover:   For a Modbus TCP device IP address Port number Server address For a Modbus serial device Communication port Server address Baud Rate Data Bits Parity Stop Bits Flow Control

There are a number of reasons EcoStruxure IT may not be able to communicate with a device during discovery, or communication could be lost some time later. There are things you can check to verify proper SNMP communication.   EcoStruxure IT is vendor neutral. Configuration options may differ from device to device. For information about APC devices and Data Center Expert, see here.   Initial configuration for discovery The devices you want to monitor must first have SNMP enabled. Only one SNMP version should be enabled on a device at a time, either SNMPv1 or SNMPv3.    SNMP v1 Once enabled, specify the read community name to access information on the device. You may also need to specify the write community name.   If you specify an IP address or an address range, only those systems will be allowed to use the community names. For troubleshooting purposes, it is best to leave the IP address at all zeroes (0.0.0.0) to allow the community name to be read by any system. After communication is established, you can change these options.   SNMP v3 Security for SNMPv3 includes User Name, Authentication Passphrase, Privacy Passphrase, Authentication Protocol, and Privacy Protocol. These must be noted and are required to communicate with EcoStruxure IT using SNMPv3. Once configured, you can enable each profile individually and associate it with a specific IP address or address range.   When AES is configured on the APC Network Management Card (NMC), choose AES-128 in the Gateway user interface.   EcoStruxure IT Gateway versions older than 1.15 do not allow discovery of SNMPv3 devices with the Authentication Passphrase and Privacy Passphrase set to None.   Device library files The EcoStruxure IT Gateway needs one or more files in its device library to communicate with a device and display device information. These are XML files that contain the SNMP OID information for specific sensors in the proper format.   The Gateway device library contains files for APC devices, many other well-known manufacturers, and one for a generic UPS. If EcoStruxure IT does not have the file for a device you want to monitor, you can contact Device Support to request that one be created.    Troubleshooting Failed Discoveries The most common reason for a failed discovery is incorrect security parameters. Verify that the SNMP read community name matches the device you are trying to discover. In SNMPv3, all parameters must match the settings on the device. The Authentication Passphrase and Privacy Passphrase can be set to None on the device, supported in Gateway version 1.15 and newer. Be sure to verify there is no specific NMS IP address associated with the security profiles or community names. An incorrect IP or any type of Network Address Translation could cause this feature to block SNMP traffic. Device logs may indicate if a system tried to access the device with incorrect security parameters, including the IP address of the system that attempted this action. Make sure the port used during the discovery matches the port configured on the device. discovery will probably fail. The default port is 161. Device configuration may vary. If all your security and port configurations match, and you have ruled out ports, profiles, and community names being the issue, try to simplify the settings. For example, if you are using a long, complex community name with special characters, try using something simple for testing purposes. For SNMPv3, try using a different set of security options. If SNMPv3 continues to fail, try testing with SNMPv1 first to rule out configuration issues.   If failure continues, check the network. A packet capture can be helpful in this case. You can use tools like WireShark to capture network traffic and help determine if the SNMP packets are actually getting to the device, and, if the device is responding properly.   A system running a packet capture near the computer running EcoStruxure IT Gateway will show if EcoStruxure IT is sending and receiving; a packet capture closer to the device you are trying to monitor will show if the network is allowing the SNMP packets from EcoStruxure IT to get to the device.   Keep in mind that utilities like ping will show if basic network traffic can get from one system to another, but do not rule out the possibility of networks blocking specific ports or protocols.    Troubleshooting lost communication after discovery If the IP address of an SNMP device has changed, the device will go into a lost communication state. When you rediscover a device using a different IP address, all historical data from the device will be lost. To maintain communication and keep historical data, do not change device IP addresses after discovery.   Changes in security settings also cause a device to lose communication. If the community names have been changed on the device after it was discovered, the systems will fail to communicate. You must rediscover the device using the correct community name. All historical data from the device will be lost. To maintain communication and keep historical data, do not change community names after discovery.   Lost communications issues can also be caused by a change in the network configuration. Firewalls can sometimes be reconfigured without notice to block ports or traffic from specific IP addresses. A packet capture can come in handy here.    Intermittent lost communications issues Intermittent communication issues can usually be attributed to traffic issues, either network related or on the device itself. If there is too much network traffic, or too many systems are trying to poll a single device at the same time, the UDP packets used by SNMP may not be able to get through to the device or be answered by the device. You can increase timeouts and retries in the gateway's Device Polling menu option under SNMP to allow the system to regain communication caused by such traffic.   If it is available on the device, you can also specify an NMS IP. address. Setting a specific IP address or address range will stop other systems from being able to poll the device in question. This may or may not be a permanent fix, but can be useful for testing.

There is a known issue updating Gateway 1.8.1 to the current Gateway version.   Only the update from version 1.8.1 is affected. Updating from Gateway 1.7.0 and earlier or from 1.8.2 and later is not affected.   Windows Due to an issue with 1.8.1, the software update from 1.8.1 to the current version appears to fail when performing an upgrade from the EcoStruxure IT web application.   This failure message is erroneous.   It can take up to 30 minutes for the Gateway to start running the new version and to clear the message. If the message doesn't clear, contact support for assistance.   Linux Due the same issue in 1.8.1, the update from the EcoStruxure IT web application will always fail.   If you have installed Gateway version 1.8.1 on a computer, updating to the current version requires that you manually download and install the installation file from EcoStruxure IT.    To update the software on a Gateway appliance, contact support for assistance.

New versions of the APC Network Management Card (NMC) firmware have the SNMP protocol disabled by default.  You cannot discover devices with this new NMC firmware in EcoStruxure IT Expert or Data Center Expert until SNMP is enabled.  Connect to the device using HTTPS or SSH. Enable SNMPv1 or SNMPv3 on the device. Run the device discovery in the Gateway or DCE. Note: The SNMP settings on previously discovered devices are not affected by a firmware update to a version that contains these security updates. Read more about these security updates to APC devices.  

The Gateway is prevented from being installed or starting up when the web server port 443 is being used by another application. ?name=inline-1165840792_360007940277.png To find the application using port 443: On Windows, type the command: netstat -aon | findstr 443 mceclip0_360007940277.png On Linux, type the command: sudo netstat -tulpn | grep :443  The last column of the output tells you which PID is listening on that port.  

Schneider Electric has the ability to remotely initiate walks and polls of devices that are online and connected to a Gateway that is also online and registered with an EcoStruxure IT Expert organization.  Note: Before you request device support, try to discover the device in the Gateway. The Gateway must be registered on EcoStruxure IT and online, and the device you want to monitor must be online. When filing a ticket, make sure to provide the organization name or ID, and the IP address of the device so Schneider Electric support can locate the device. For Modbus devices, you need to enable Schneider Electric's access to the device.  Those instructions are here.

NetBotz devices in the 300, 400, and 500 series are not supported using SNMP in the EcoStruxure IT Gateway. You must use the NetBotz protocol to discover these devices in the Gateway. When you discover NetBotz 300, 400, and 500 devices using SNMP, they are listed as unsupported devices in the Gateway. When you run a discovery that includes both SNMP and NetBotz protocols, these devices are added as a new device (using the NetBotz protocol), and appear as unsupported (using SNMP) at the same time. Note: To discover NetBotz 250 and 750 devices, use SNMP, not the NetBotz protocol.

The EcoStruxure IT Gateway fails to discover NetBotz 4.x devices on the public network. A connection issue appears in the logs. NetBotz 4.x devices use HTTP(S) to communicate with the Gateway. The Gateway's proxy settings apply to all HTTP traffic that leaves the Gateway. Even if the NetBotz 4.x device is on your company network, the Gateway sends its traffic to the proxy first. NOTE: This issue does not apply to NetBotx 4.x devices connected to the Gateway appliance private network. This issue will be addressed in a future release. Resolution Verify that: Your Gateway and NetBotz 4.x device are on the same network segment. The Gateway can reach the NetBotz 4.x device via ping and in a web browser. Your Gateway can communicate with your proxy server to reach the EcoStruxure cloud. Workaround IMPORTANT: This workaround does not persist through a Gateway software update. Open the net.properties file in the EcoStruxure IT Gateway installation folder: EcoStruxureITGateway version/jre/conf/net.properties Find the line http.nonProxyHosts. Add the IP address you want to exclude from the proxy settings at the end of line. Example: http.nonProxyHosts=localhost|127.*|[::1]|192.168.1.15 Restart the EcoStruxure IT Gateway service or process.

The device name is polled during the discovery process only, not during a regular polling period. If you change the name of a device after it has been discovered in the Gateway, the new name will not appear in the device list automatically. To manually update device atrributes in Gateway versions 1.8.1 and later: Log in to the Gateway. Go to the device and click the Details tab. Click Retrieve details. In previous Gateway versions, rediscover the device to update its name. In general, static values for device attributes are only polled at discovery, for example, the items on the device details page. Sensor measurements are polled during the regular polling period.

There is an intermittent issue in Gateway 1.4.0 where some or all devices report The <device> is not responding when they are actually online. If you see this error, and you have confirmed the devices are online, check the log to confirm the error. To confirm the error: Go to C:\Program Files\EcoStruxureITGateway\1.4.0\log on the computer where the gateway is installed, or log in to the gateway and download the console logs. Unzip the file and look at the newest console log. This entry will appear in the gateway logs: softwareVersion=1.4.0.68, originalMessage=protocol mapping error com.se.dcl.ddf.MappingException: no protocol type: PreCompiledMapping{resource=URL [jar:file:C:\ProgramData\EcoStruxureITGateway\1.4.0\ddfs/ddf_bundle/default/se-ddf.jar!/ddf/SNMP/protocol.xml], signed=true} Solution: Restart the EcoStruxure IT Gateway Service. 1. Go to Control Panel > Administrative Tools > Services. 2. Restart the EcoStruxure IT Gateway Server service. This issue will be addressed in the next release.

Network or proxy configuration changes can disrupt connectivity to EcoStruxure IT. To restore the Gateway's connection to EcoStruxure IT, verify that: The computer the Gateway is installed on is available. The Gateway is installed on a computer that is always on, and it is connected to the internet. You can log into the EcoStruxure IT Gateway. Once you have verified the Gateway is connected to the internet: Restart the Gateway Service. See how Check the EcoStruxure IT mobile app to verify the connection to EcoStruxure IT. Restart the computer running the Gateway if possible. Check the EcoStruxure IT mobile app to verify the connection to EcoStruxure IT. Navigate to well-known domain names to verify DNS is working. Check your network settings with your IT team. If the Gateway still cannot connect to EcoStruxure IT, contact your IT team to verify they have not made network infrastructure changes that block outbound traffic. Ask them to check the configuration of the computer running the Gateway against the System requirements for EcoStruxure IT Gateway.

These instructions apply to Gateway version 1.8 and newer. An error occurs because the Gateway server does not trust the certificate for EcoStruxure IT. mceclip0_360012170853.png Cause For security reasons, the EcoStruxure Gateway validates that the certificate used to secure communication between EcoStruxure IT and the Gateway was issued by a well known trusted certificate authority. An error occurs when you use a TLS/SSL interception proxy, which is indistinguishable to the Gateway from a man-in-the-middle attack. If your organization uses a TLS/SSL interception proxy to inspect the encrypted network communications between the Gateway and EcoStruxure IT, the Gateway must be configured to trust the certificate authority that the TLS/SSL interception proxy uses to issue certificates. SECURITY WARNING: Only install CA certificates that you and your organization trust. Never install certificates that were obtained from an untrusted source. Solution  Obtain the correct certificate, and add it to the EcoStruxure Gateway trust store. You can either obtain the correct certificate directly from your organization's IT department or from a trusted system that has the correct certificate already installed. Note: The web browser on the system the Gateway software was installed on may already have the certificate installed. See How to locate a certificate used by the web browser. How to locate a certificate used by the web browser From the Gateway server, try to reach the EcoStruxure IT registration endpoint. Go to: https://us.struxureon.com/ingester/v2/test/registration  IMPORTANT: If the URL returns a connection error, stop here. Contact your IT department to get the root certificate your proxy is using. You can then resume and import that certificate. If this test URL returns {"status":"UNREGISTERED"} your browser can successfully reach the endpoint. Click the lock in the address bar of the browser and view the certificate used by us.struxureon.com. Note the certification path. GW_cert_1_360012170853.png GW_cert_2_360012170853.png In the Windows Control Panel, go to Internet Options > Content > Certificates.  GW_cert_3_360012170853.png Click Trusted Root Certification Authorities. Select the certificate used by us.struxureon.com.   GW_cert_4_360012170853.png Click Export. Select the Base-64 encoded X.509 (.CER) option in the export. GW_base64_360012170853.png Name the certificate the name shown in the Issued By column. Add certificate to EcoStruxure Gateway trust store Log in to the Gateway user interface and go to Cloud Connectivity > Add root certificate. GW18_untrusted_cert_1_360012170853.jpg Click Import certificate… and then choose the certificate you exported.  GW18_untrusted_cert_2_360012170853.jpg Click Add certificate. Note: To view or remove certificates in the Gateway, go to Settings > Trust Store. Important: You should manually restart the Gateway service after adding or removing certificates.

If the computer where EcoStruxure IT Gateway is installed uses a proxy server to connect to the internet, you must configure proxy settings in the Cloud connectivity >  Proxy Settings option in the Gateway user interface. Use the option to Automatically detect proxy settings first. If detection is successful, the window will close and you can proceed to register with EcoStruxure IT.  If detection fails, you can verify the proxy settings in a browser. Verify the gateway’s connection to the EcoStruxure IT server Open a browser and type the URL for the EcoStruxure IT registration endpoint. https://us.struxureon.com/ingester/v1/adssd/registration If the connection to the server is unsuccessful, a ‘no internet connection’ error is displayed. If the connection to the server is successful, the page displays status, supported country, and link information if any. {"status":"UNREGISTERED","supportedCountry":true,"link":{"url":null,"text":null}} Go to the proxy settings for the browser If there is an IP address listed in the browser, use that address in the gateway’s proxy settings. If there is a URL for a pac file listed in the browser, you can find the proxy settings by looking at the information in the file. Type the URL into a browser to download and view the pac file. In the pac file, there are rules and IP addresses for various proxy servers. Find the proxy IP address that fits your EcoStruxure IT Gateway’s parameters, including one or more of the following: HTTP/HTTPS protocol IP subnet Geographic location   The complexity of the pac file can vary. An example section from a pac file might look like this: /*--------------------FTP PROXY--------------------*/                if ( url.substring(0,4) == "ftp:" )                return "PROXY 10.12.123.223:80; PROXY 20.12.123.223:80; DIRECT"; /*--------------------HTTPS PROXY--------------------*/                if ( url.substring(0,6) == "https:" )                return "PROXY 2.5.84.23:443; PROXY 1.168.1.131:443; DIRECT"; /*--------------------DEFAULT PROXY--------------------*/                return "PROXY 9.5.4.3:80; PROXY 1.168.51.131:80; DIRECT"; In this case, the gateway communicates using HTTPS, so you would choose one of the HTTPS PROXY IP addresses and enter it in the gateway’s proxy settings.   In some cases, the pac file might look like this: /*---HTTPS PROXY---*/                if (url.substring(0,6) == "https:")                return return_httpsProxy;   The “return_httpsProxy” is a variable or “var”, usually set near the beginning of the document:                var return_Proxy = "PROXY 165.225.38.37:10912; PROXY 104.129.194.40:10912; PROXY 165.225.38.37:80; PROXY 104.129.194.40:80; DIRECT";                var return_httpsProxy = "PROXY 165.225.38.37:10912; PROXY 104.129.194.40:10912; PROXY 165.225.38.37:443; PROXY 104.129.194.40:443; DIRECT";                var return_SpecifProxy = "PROXY 165.225.38.37:10912; PROXY 104.129.194.40:10912; PROXY 165.225.38.37:80; PROXY 104.129.194.40:80; DIRECT";

WARNING This procedure will temporarily stop the service. Some sensor or alarm updates might be missed until the service restart is complete. This should only be done under the direction of Customer Support.  In the examples below, replace X.X.X with your Gateway version number.   Windows Go to Control Panel > Administrative Tools > Services. Restart the "EcoStruxureITGateway Server - X.X.X" service. Linux Open Terminal and run:  sudo systemctl restart EcoStruxureITGateway-X.X.X.service NOTE: The systemctl command can be run from any directory by sudo users.

Contact support for information about Gateway versions older than 1.16. Note: An imported SSL certificate signed by a trusted certificate authority or a CA certificate imported to the keystore will not persist through an EcoStruxure IT Gateway update. You must import the certificate again after you update your Gateway software. Windows These command examples are formatted for use in the Windows command prompt. Using PowerShell requires using single quotes instead of the double quotes displayed below. EcoStruxure IT Gateway stores the user interface SSL certificates in two Java keystore files in the C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore\ directory: dcos.keystore (PrivateKeyEntry) dcos.truststore (trustedCertEntry) Verify the contents of the Java keystores Open C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\application-installer.yaml  In the server: > ssl: section, find the line key-store-password and remember the password for the keystores. Open a command prompt window and change the directory to C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore Type the command  "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe” -list -v -keystore dcos.keystore Enter the password you remembered in step 2. Verify the keystore contents are displayed without error. Type the command  "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -list -v -keystore dcos.truststore Enter the password you remember from step 2 when prompted. Verify the keystore contents are displayed without error.  Create a new keystore for the trusted SSL certificate Stop the EcoStruxureITGateway-x.x.x.x service. Delete the existing keystore file, C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore\dcos.keystore. Open a command prompt and change the directory to C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore Type the command "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -genkey -alias dcos -keyalg RSA -keystore dcos.keystore -keysize 2048 The other values might need to match the values present on the CA. Some values are required by the CA, and others might be optional. This depends on the CA configuration. Use the .csr file to create a new certificate signed by the Trusted CA. This could be a CA run by your company, or it might need to be sent to a third-party Certificate Authority. Use the same password you remembered in step 2 of the ‘Verify the contents of the Java keystores” section. Verify that the file dcos.keystore now exists in the keystore folder. Start the EcoStruxureITGateway-x.x.x.x service.  Create a certificate signing request and a new SSL certificate signed by a trusted CA Type the command:   "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -certreq -alias dcos -keystore dcos.keystore -file newSxOnGW.csr Enter the required values when prompted. The first value must match the hostname or FQDN (Fully Qualified Domain Name) of the server where EcoStruxure IT Gateway is installed. Import the Root CA and Web Server SSL certificates to the EcoStruxure IT Gateway keystore Copy rootca.crt and newSxOnGW.crt to the machine where EcoStruxure IT Gateway is installed. Stop the EcoStruxureITGateway-x.x.x.x service. Open a command prompt and change the directory to C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore Import the root CA certificate. Type the command   “C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -importCert -trustcacerts -alias root -file rootca.crt -keystore root.truststore Import the Web Server SSL certificate. Type the command "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -importCert -trustcacerts -alias dcos -file newSxOnGW.crt -keystore dcos.keystore Make sure the root CA certificate is imported to the internet browser on all the computers that will be used to access the Gateway user interface. Start the EcoStruxureITGateway-x.x.x.x service. EcoStruxure IT Gateway will now use the new signed certificate, and no SSL Certificate security warning will be displayed by the browser when the Gateway user interface is launched. C:\Program Files\EcoStruxureITGateway\<version>\gateway\conf\keystore\dcos.keystore (PrivateKeyEntry) C:\Program Files\EcoStruxureITGateway\<version>\gateway\conf\keystore\dcos.truststore (trustedCertEntry) Linux EcoStruxure IT Gateway stores the user interface SSL certificates in two Java keystore files in the /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore directory: dcos.keystore (PrivateKeyEntry) dcos.truststore (trustedCertEntry) Verify the contents of the Java keystores Open /opt/EcoStruxureITGateway</current Gateway install version>/gateway/conf/application-installer.yaml  In the server: > ssl: section, find the line key-store-password and remember the password for the keystores. Open a command prompt window and change the directory to /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore Type the command  '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool.exe' -list -v -keystore dcos.keystore Enter the password you remembered in step 2. Verify the keystore contents are displayed without error. Type the command  'opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -list -v -keystore dcos.truststore Enter the password you remember from step 2 when prompted. Verify the keystore contents are displayed without error.  Create a new keystore for the trusted SSL certificate Stop the EcoStruxureITGateway-x.x.x.x service. Delete the existing keystore file, /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore/dcos.keystore. Open a command prompt and change the directory to /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore Type the command '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -genkey -alias dcos -keyalg RSA -keystore dcos.keystore -keysize 2048 The other values might need to match the values present on the CA. Some values are required by the CA, and others might be optional. This depends on the CA configuration. Use the .csr file to create a new certificate signed by the Trusted CA. This could be a CA run by your company, or it might need to be sent to a third-party Certificate Authority. Use the same password you remembered in step 2 of the ‘Verify the contents of the Java keystores” section. Verify that the file dcos.keystore now exists in the keystore folder. Start the EcoStruxureITGateway-x.x.x.x service.  Create a certificate signing request and a new SSL certificate signed by a trusted CA Type the command:   '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -certreq -alias dcos -keystore dcos.keystore -file newSxOnGW.csr Enter the required values when prompted. The first value must match the hostname or FQDN (Fully Qualified Domain Name) of the server where EcoStruxure IT Gateway is installed. Import the Root CA and Web Server SSL certificates to the EcoStruxure IT Gateway keystore Copy rootca.crt and newSxOnGW.crt to the machine where EcoStruxure IT Gateway is installed. Stop the EcoStruxureITGateway-x.x.x.x service. Open a command prompt and change the directory to /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore Import the root CA certificate. Type the command   '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -importCert -trustcacerts -alias root -file rootca.crt -keystore root.truststore Import the Web Server SSL certificate. Type the command '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -importCert -trustcacerts -alias dcos -file newSxOnGW.crt -keystore dcos.keystore Make sure the root CA certificate is imported to the internet browser on all the computers that will be used to access the Gateway user interface. Start the EcoStruxureITGateway-x.x.x.x service. EcoStruxure IT Gateway will now use the new signed certificate, and no SSL Certificate security warning will be displayed by the browser when the Gateway user interface is launched. /opt/EcoStruxureITGateway/<version>/gateway/conf/keystore/dcos.keystore (PrivateKeyEntry) /opt/EcoStruxureITGateway/<version>\gateway/conf/keystore/dcos.truststore (trustedCertEntry)

If you need to replace a device that is monitored by the Gateway (RMA, for example), and you want to use the same IP address and credentials, you must log in to the Gateway and do the following: Delete the existing device. See how Run a discovery for the new device.  Wait about 10 minutes for the device to start reporting data.  Change the location of the device if necessary. NOTE: The Gateway does not retain the sensor history for the device you replace. It is important to delete the existing device first before you discover the new device because: The Gateway may show the existing device as online even though it is no longer accessible because the new device will respond at that IP address. The Gateway will show two devices at the same IP address, but only the new device updates sensor values. When the next Gateway update is performed, the new device may be discovered automatically, and then the old device will show that it is offline.

Reconnect a Gateway to EcoStruxure IT Log in to the Gateway you want to reconnect to EcoStruxure IT. Click EcoStruxure IT, and then click Register. GW_register_with_EcoStruxure_IT_360012117154.png Log in to https://app.ecostruxureit.com/manage. Your registration code will be automatically entered. ITE_connect_Gateway_360012117154.png Specify a name for the Gateway and click Connect. Disconnect a Gateway from EcoStruxure IT Go to https://app.ecostruxureit.com/manage and log in to EcoStruxure IT. Click Administration > Gateways and click the Gateway you want to disconnect. GW_disconnect_GW_in_ITE_1_360012117154.JPG Click Disconnect, and confirm.  GW_disconnect_GW_in_ITE_2_360012117154.JPG