LAA connectivity

The Linaro Automation Appliance should be connected to the fleet management cloud service to operate properly.

The fleet management cloud service is responsible for keeping the LAA up-to-date with the latest software releases, connect the LAA to the right LAVA instance and configure the connected DUT.

In order to register on the fleet management cloud service, the LAA must be able to connect to the internet.

Network configuration

When connecting the LAA to your lab network, connect the Ethernet cable to the LAA Main Eth Ethernet port. This port is the public network port.

Public and Private network interfaces

The LAA provides 2 network interfaces:

Main eth: public ethernet port to connect the LAA to the lab network
DUT eth (facing upward): private ethernet port to connect the LAA to the DUT

With DHCP

By default, the LAA will request an IP address using DHCP. The IP address will be displayed on the OLED display.

IPv4 available

Without DHCP

In a lab network without a DHCP server, the OLED will display the message below and admins will have to update the LAA network configuration.

No IPv4

In order to configure the network, admins should browse to the LAA embedded web interface. By default the embedded web interface is only available on the public network interface. To access it from the private network interface, press the Soft Recoverybutton and wait for the OLED to display:

OLED setup

Connect the admin laptop to the private LAA network interface. The LAA will automatically assign an IP address using DHCP to the laptop. Then browse to the LAA private IP address at http://198.18.0.1

Private network interface

The private LAA network interface is the ethernet port facing upward and labeled DUT Eth.

Network access

When connected to the private network interface, a PC will be assigned the IP 198.18.0.2 but the PC will only be able to connect to the LAA at 198.18.0.1.

From this network, it’s not possible to have access to the local network nor the public internet.

To use the web interface, browse to http://198.18.0.1/.

login register

Start by creating the first user that will be automatically granted administration rights.

user register

Now you can browse to the network configuration page at http://198.18.0.1/appliance/network/settings/ and update the network configuration.

network configuration

The configuration is using systemd-network syntax.

To configure a static IP address, use:

[Match]
Path=platform-30bf0000.ethernet

[Network]
Address=10.10.10.2/24
Gateway=10.10.10.1

The LAA should now have an IPv4 and the OLED display will look like:

Connecting

Setup in Progress

In order to display the above content, press again the Soft Recovery button to disable access to the embedded web interface from the private network interface.

Cloud connectivity

Direct connection

The LAA should now automatically connect to the fleet management cloud service and display:

Registration

Cloud connectivity

The first connection to the cloud can take up to 20 seconds. If the LAA is not displaying the above message, then proceed to the next chapter about HTTP proxy.

If this isn’t the case, it’s likely that the LAA should use an HTTP Proxy to connect to the public internet.

HTTP Proxy

If the LAA should use an HTTP proxy to access internet, this should be configured in the LAA web interface.

Browse to the network configuration page and specify the http proxy address.

Public network interface

The LAA now has an IPv4, so you can directly browse to the LAA IPv4 printed on the OLED. You should connect your PC to the same lab network as the LAA public network interface.

The OLED should now display:

Registration

If this isn’t the case, it’s likely that the LAA should allow for SSL Interception.

SSL Interception

Some corporate networks terminate outbound HTTPS at the firewall and re-sign it with an internal certificate authority (CA). The LAA doesn’t trust that CA by default, so its connection to the fleet management cloud service fails and the OLED never reaches the registration message, even though the proxy is correctly configured.

The fix is to install your organisation’s root CA on the LAA.

Browse to the LAA web interface and open Appliance > Root CAs, or go directly to:

http://<laa-ip>/appliance/cas/

Custom root CAs

Pick the root CA certificate file used by the intercepting proxy and click Add CA. The certificate is then listed with its SHA-256 fingerprint and its issue and expiry dates, and is trusted immediately, without rebooting.

Which certificate?

Ask your IT department for the root CA of the intercepting proxy. It is the same certificate they already deploy to managed laptops, so it is usually available from an internal IT page.

Administrator rights

Only accounts with administrator rights can add or delete a root CA. A regular user sees the list but cannot change it.

The LAA should now connect and the OLED display the registration message. See the web interface page for more details.

Certificate expiry

A root CA has an expiry date, shown in the list. When it expires the LAA will stop being able to reach the cloud service until the replacement certificate is uploaded.