---
title: "LAA connectivity"
description: >-
  The Linaro Automation Appliance should be connected to the fleet management
  cloud service to operate properly.
---

The Linaro Automation Appliance should be connected to the fleet management
cloud service to operate properly.

The fleet management cloud service is responsible for keeping the LAA up-to-date
with the latest software releases, connect the LAA to the right LAVA instance
and configure the connected DUT.

In order to register on the fleet management cloud service, the LAA must be
able to connect to the internet.

## Network configuration

When connecting the LAA to your lab network, connect the Ethernet cable to the
LAA `Main Eth` Ethernet port. This port is the public network port.

```{admonition} Public and Private network interfaces
:class: tip
The LAA provides 2 network interfaces:

- `Main eth`: public ethernet port to connect the LAA to the lab network
- `DUT eth` (facing upward): private ethernet port to connect the LAA to the DUT
```

### With DHCP

By default, the LAA will request an IP address using DHCP. The IP address will
be displayed on the OLED display.

![IPv4 available](/_images/oled-connecting.png){align=center}

### Without DHCP

In a lab network without a DHCP server, the OLED will display the message below
and admins will have to update the LAA network configuration.

![No IPv4](/_images/oled-no-ipv4.png){align=center}

In order to configure the network, admins should browse to the LAA embedded
web interface.
By default the embedded web interface is only available on the
public network interface. To access it from the private network interface,
press the `Soft Recovery`button and wait for the OLED to display:

![OLED setup](/_images/oled-setup.png){align=center}

Connect the admin laptop to the private LAA network interface. The LAA will
automatically assign an IP address using DHCP to the laptop. Then browse to the
LAA private IP address at [http://198.18.0.1](http://198.18.0.1)

```{admonition} Private network interface
:class: tip
The private LAA network interface is the ethernet port facing upward and
labeled `DUT Eth`.
```

```{admonition} Network access
:class: warning
When connected to the private network interface, a PC will be assigned the IP
`198.18.0.2` but the PC will only be able to connect to the LAA at
`198.18.0.1`.

From this network, it's not possible to have access to the local network nor
the public internet.
```

To use the web interface, browse to [http://198.18.0.1/](http://198.18.0.1/).

![login register](/_images/login-register-alert.png){align=center}

Start by creating the first user that will be automatically granted
administration rights.

![user register](/_images/user-register.png){align=center}

Now you can browse to the network configuration page at
[http://198.18.0.1/appliance/network/settings/](http://198.18.0.1/appliance/network/settings/)
and update the network configuration.

![network configuration](/_images/network-configuration.png){align=center}

The configuration is using [systemd-network syntax](https://www.freedesktop.org/software/systemd/man/latest/systemd.network.html).

To configure a static IP address, use:

```ini
[Match]
Path=platform-30bf0000.ethernet

[Network]
Address=10.10.10.2/24
Gateway=10.10.10.1
```

The LAA should now have an IPv4 and the OLED display will look like:

![Connecting](/_images/oled-connecting.png){align=center}

```{admonition} Setup in Progress
:class: warning
In order to display the above content, press again the `Soft Recovery` button
to disable access to the embedded web interface from the private network
interface.
```

## Cloud connectivity

### Direct connection

The LAA should now automatically connect to the fleet management cloud service
and display:

![Registration](/_images/oled-register.png){align=center}

```{admonition} Cloud connectivity
:class: tip
The first connection to the cloud can take up to 20 seconds. If the LAA is not
displaying the above message, then proceed to the next chapter about HTTP
proxy.
```

If this isn't the case, it's likely that the LAA should use an HTTP Proxy to
connect to the public internet.

### HTTP Proxy

If the LAA should use an HTTP proxy to access internet, this should be
configured in the LAA web interface.

Browse to the network configuration page and specify the http proxy address.

```{admonition} Public network interface
:class: tip
The LAA now has an IPv4, so you can directly browse to the LAA IPv4 printed on
the OLED.
You should connect your PC to the same lab network as the LAA public network
interface.
```

The OLED should now display:

![Registration](/_images/oled-register.png){align=center}

If this isn't the case, it's likely that the LAA should allow for SSL Interception.

### SSL Interception

Some corporate networks terminate outbound HTTPS at the firewall and re-sign it
with an internal certificate authority (CA). The LAA doesn't trust that CA by
default, so its connection to the fleet management cloud service fails and the
OLED never reaches the registration message, even though the proxy is
correctly configured.

The fix is to install your organisation's root CA on the LAA.

Browse to the LAA web interface and open `Appliance > Root CAs`, or go directly
to:

```text
http://<laa-ip>/appliance/cas/
```

![Custom root CAs](/_images/custom-ca.png){align=center}

Pick the root CA certificate file used by the intercepting proxy and click
`Add CA`. The certificate is then listed with its SHA-256 fingerprint and its
issue and expiry dates, and is trusted immediately, without rebooting.

```{admonition} Which certificate?
:class: tip
Ask your IT department for the root CA of the intercepting proxy. It is the
same certificate they already deploy to managed laptops, so it is usually
available from an internal IT page.
```

```{admonition} Administrator rights
:class: warning
Only accounts with administrator rights can add or delete a root CA. A regular
user sees the list but cannot change it.
```

The LAA should now connect and the OLED display the registration message. See
the [web interface](/software/web-ui.md#root-cas) page for more details.

```{admonition} Certificate expiry
:class: warning
A root CA has an expiry date, shown in the list. When it expires the LAA will
stop being able to reach the cloud service until the replacement certificate is
uploaded.
```