From SpinetiX Support Wiki
The "Network" page of HMP Control Center allows configuring different network-related settings, grouped within the following sections:
- IP Configuration,
- HTTP Proxy,
- Trusted Certificates,
- Server Certificates ,
- Server Security,
- Network Watchdog,
- Port Security.
These sections are further detailed below.
On this section, you can find details about the current IP configuration and you can change that configuration as following:
- DHCP (default).
- The device has an IP address assigned by the DHCP server on the network.
- If no DHCP server is found, the player uses an auto-configured IP in the range 169.254.1.0-169.254.254.255.
- Fixed IP.
See also the Proxy settings page.
On this section, you can configure the proxy settings to be used by the player to connect to the Internet - for that follow these steps:
- Enable "Use Proxy" option.
- Enter the server hostname address (without the http part) and the port.
- Enable / disable bypassing the proxy server for local addresses.
- When enabled, the player first queries the hostname to find the corresponding IP address and then checks whether that IP address is located in the same subnet (according to the subnet mask); if so, the proxy is bypassed, otherwise (the IP is external or the hostname cannot be resolved) the proxy is used.
- Enter the username and password.
- Note that the HMP supports only basic and digest authentication mechanisms.
This section was named "HTTPS" prior to 4.2.0 firmware.
Trusted certificates are used to verify the authenticity of servers to which the player connects to via secure HTTP (https). The player already has a built-in database of the root certificates of public certification authorities matching those in web browsers. You only need to add extra root certificates if the player needs to connect to servers that use a certificate delivered by a private, or enterprise internal, certification authority. It may also be required if the player needs to access secure sites via a firewall with SSL inspection enabled.
On this section, you can upload additional root certificates to be trusted by the HMP and you can enable / disable the full verification of HTTPS certificates.
- To upload a new certificate, click the "Add Trusted Certificates" button and select the certificate file.
- To view a certificate info, click the i button.
- The root certificate of the active server certificate is automatically added to this list; by default, this is the player's auto-generated self-signed server certificate ("_auto_self_signed"). If you activate another server certificate, the list is automatically adjusted with the corresponding root certificate.
|Warning:||Disabling the full verification of HTTPS certificates renders all secure HTTPS (https) connections insecure and vulnerable to man in the middle attacks, thus this should only be used for testing and diagnosis, never in a production environment.|
Added in firmware 4.2.0.
Server certificates are used to secure connections to the player’s embedded web server, to access the player web interface via a browser and publish content. Several such certificates can be installed, but only one can be active at any time.
On this section, you can add HTTP server certificates onto the device - for that follow these steps:
- Click the "Add Server Certificate" button. The wizard dialog appears.
- Enter the certificate name then click "Next".
- This name is used to identify the certificate in the interface and by the <active-certificate> command. It must be between 4 and 32 characters and contains only number, letter and any of the following “.@_”.
- Select the certificate format between "PEM files" or "PCKS#12 file".
- Click the "Select File" button(s) to upload the certificate file(s).
- If "PEM files" format is selected, you need to upload the certificate, certificate private key, and (optionally) the certificate chain files individually; otherwise, you need to upload the pfx / p12 file containing the bundle of certificate, private key and certificate chain information.
- The certificate chain represents all the certificates from the certificate itself up to the root CA. This is necessary so that the embedded HTTP server can hand out a complete chain to the client, otherwise the verification might fail when the client does not have all the intermediate certificates, even if it has the root certificate.
- Click "Next".
- Enter the passphrase used to encrypt the certificate private key, if necessary.
- Click "Submit".
- To activate a certificate, click the button under the "Active" column. The currently active certificate is shown with a check sign over that button.
- To view a certificate info, click the i button next to it.
Added in firmware 4.2.0.
On this section, you can controls whether the player web server shall accept insecure HTTP connection.
- Server access
- The possible values for server access are:
- Allow insecure HTTP (default)
- Both secure and insecure HTTP connection are possible.
- Redirect insecure HTTP to secure HTTP
- All insecure HTTP connection are automatically redirected to the secure HTTP.
- Disable insecure HTTP
- Insecure HTTP connections are disabled. The player will not respond on port 80.
By default, all players accept insecure HTTP connection to the web interface.
On this section, you can control whether SSDP / UPnP discovery is enabled in the player.
- Enable SSDP / UPnP
- Enable SSDP / UPnP discovery of the player
The Network Watchdog is activated if any of the two conditions are set to a value other than 0 (0s by default). Both parameters can be configured using a time defined in seconds (e.g. 10s), minutes (e.g. 10m) or hours (e.g. 1h).
- When activated, the HMP will reboot if one of the condition is no longer valid. Link-local (i.e. Zeroconf) addresses are not taken into account.
By default, the access to SNMP is disabled (closed); it can be opened to a specific IPv4 addresses range or opened without restrictions (IPv6 is accepted in this case), and can be accessed via UDP and TCP.
This section is present only on HMP350.
On this section, you can control whether the secondary network port is disabled.