Searching...
Release Notes for AM/AMM 2.17.2
1 Release Information
AirLink Manager (AM)/AirLink Mobility Manager (AMM) 2.17.2 is a minor release of the AirLink Manager Platform that introduces significant new improvements to Security, general system improvements and Report updates. It also continues the evolution of the APIs for the AirLink Manager platform.
To continue to improve the security posture of the AM/AMM platform, we are introducing support for TLS 1.3 and enforcing the use of TLS 1.2 as the minimum version, fully deprecating support of the insecure TLS 1.0 and 1.1. Customers will need to upgrade all devices in the field to a supported version of the embedded software.
These release notes include the details for AM/AMM 2.17.2, AMMER 1.0.7 and UPLOADLOG 1.0.4.
1.1 Released Version
AM/AMM 2.17.2 was released to General Availability on April 25th, 2022.
1.2 Platform Support
AM/AMM 2.17.2 has been tested on Dell R240 and R630 servers and on VMWare ESXi.
1.3 Browser Support
AMM 2.17.2 has been tested on Google Chrome and Firefox. Users that attempt to use a browser that is not supported will get a warning and may experience some issues.
1.4 Sierra Wireless Gateway Support
For oMG gateways, AMM 2.17 supports up to oMG R3.15.1 and MG90 4.4+. For AirLink gateways, AMM 2.17 supports ALEOS firmware version 4.4.3 and higher. Some features of AM/AMM 2.17.2 require later versions of the ALEOS or MG software.
AMM 2.17.2 also supports:
GNX6: G604.09.05 and higher (limited support)
GNX3-UMTS: G303.08.83 and higher (limited support)
AirLink RV55 (new)
Calamp LMU2631CV model (limited support)
2 Key Features
Reboot of Multiple Devices from AM/AMM
The release provides the ability to reboot multiple devices from the AM/AMM. This feature has device-side firmware requirements.
MG90 (5G) must have MGOS version 4.4.1 or higher to reboot using this workflow. MG90 (4G,5G) must have MGOS version 4.4.2 or higher (expected to release later in 2022). If the MGOS version is lower, refer to Request Reboot via Gateway Tree to reboot devices individually. All ALEOS platforms and versions are supported.
Reboot operations will be created for each affected gateway, for the next communication with the management system. Reboot operations are created with configured expiration days (default 10 days).
LDAP User Authentication Improvements
LDAP authentication was first introduced on AMM version 2.8.5. AMM 2.17.2 introduces significant improvements to the LDAP feature that provides a more robust version of LDAP user authentication. Changes include support for secure LDAP and deeper integration into the AM/AMM that allows a remote user group to be configured.
This remote user group is configured using a service account with limited permissions, which allows the AMM to authenticate with the remote directory server.
The user will login to the AMM specifying the remote user group and their LDAP credentials. The AMM will validate the username and password combination with the directory server that was specified in the remote user group. If the directory server is able to correctly validate the user credentials, then access to the AMM will be granted.
Important: AM/AMM 2.17.2 does not support migrating old LDAP authentication to the new format. When LDAP customers on an earlier version upgrade to 2.17.2, users in their LDAP groups will be converted to use local authentication. The old LDAP configuration is no longer supported with the upgrade to 2.17.2.
Complete details are available here .
Multi-factor Authentication for AMM
Multi-factor authentication(MFA) has been implemented on the AMM starting from version 2.17.2. The 2-factor authentication will have username and password as the first authentication, and a one time pass code (OTP) as the second authentication. There are two methods available for the second authentication.
Email: an email is sent to the email address associated with the user account. The email will contain a one-time code that the user must enter within a set period of time.
Time-based One-time password (TOTP): The user must enter the one-time code that they receive from an Authenticator Application that has been configured for use with the AM/AMM.
Complete details are available here .
Dedicated Report Process
AM/AMM 2.17.2 includes a major architectural enhancement that separates the process for report generation from the AMM’s primary functions. This feature, configured during system installation, allows customers to decide how to allocate the system resources on their AMM, improving overall system performance.
Security Improvements
As with all releases, AM/AMM 2.17.2 incorporates the latest security patches and bug fixes to ensure the AM/AMM remains secure. In addition, this release includes three other major enhancements:
Upgrade to Rocky Linux 8.4: In mid-2021, the CentOS community announced the end of support for the CentOS Linux distribution that AM/AMM is developed on top of. The consensus in the community is that Rocky Linux is the best replacement distribution. AM/AMM 2.17.2 upgrades to Rocky Linux 8.4, ensuring full support into the future.
Support TLS 1.3: This release adds support for TLS 1.3 and sets the minimum supported version to TLS 1.2. We are enforcing the use of TLS 1.2 as the minimum version, fully deprecating support of the insecure TLS 1.0 and 1.1. Customers will need to upgrade all devices in the field to a supported version of the embedded software.
Disable FTP by Default: In this release we are disabling FTP by default, as all devices should use the management tunnel by default. A new parameter has been added to disable FTP firewall rules for ports 20, 21, and 4152-4252. By default, these ports will be disabled. Users can re-enable these ports. For customers running an older version of ALEOS, this change will disrupt the functioning of the UPLOADLOG AAF app until ALEOS is upgraded to ALEOS 4.15.0.004 or later. We recommend upgrading devices prior to upgrading to AM/AMM 2.17.2.
Automatic Logout of SSH Sessions: SSH sessions are automatically logged out if the session is idle for more than 900 seconds. This value is not configuarable.
HA Keys Obtained over HTTPS: The process for the primary HA server to obtain the keys from the secondary server is transitioned to use HTTPS instead of HTTP.
“Customer Support” hyperlink Configurable from the Master Config File: The “Reset password” and “Enter email” pages display a customer support link to assist the user. This link is now configurable per AM/AMM, allowing customers to set their own internal references for their end users. This value is configurable by the administrator upon setting up an AMM server as a global setting.
API Improvements
Based on feedback from users of the API features, there are a number of new features and improvements to the APIs in AM/AMM 2.17.2.
Enable API Feature by Default: In AM/AMM 2.17.1, we released the API feature as “Beta” and chose to disable it by default in that release. The API feature is enabled by default starting in AM/AMM 2.17.2.
Do not Reuse Refresh Token (OAuth2): In the previous release, AM/AMM APIs used the default Refresh Token configuration, where refresh token can be reused before expiration. In AM/AMM 2.17.2, we have disabled reuse refresh token to improve the security of the AM/AMM APIs.
Revoke Access Token when Client is Deleted from the AM/AMM: When an API client is deleted from the AM/AMM, its access token can remain valid for up to 24 hours (default token lifetime). AM/AMM will revoke the access tokens at the time a client is deleted. This prevents applications developed with a deleted client from accessing AM/AMM data immediately.
API Demo App – Android Mobile Client: We have developed several demo applications to help customers with the use of the AM/AMM APIs. In this release, we have added an Android mobile API client that can demonstrate how to authenticate a user with OAuth2 Implicit Flow, how to refresh an access token, how to access AM/AMM data via APIs and how to logout user secured session. You can access this demo app from our GitHub repository. https://source.sierrawireless.com/airvantage/amm/reference/API/api_examples/
Reporting Improvements
This release addresses a series of bugs in AM/AMM reports and also includes some feature improvements:
Add Support for ALEOS and GNX Devices on the Four Zone Reports: This release adds support for ALEOS and GNX devices for the Zone Summary, Zone Times, Zone Map and Zone Crossing Summary reports.
Add Report Owner Name in Report Templates: We have added the report owner name on the Report Templates page, similar to what exists for the Generated Reports page, where there is a User Login Name column that serves the same purpose.
Add a Loading Progress Bar when Opening a Saved Report: In previous releases, when the user opens a saved report, there is no indication if the report is being loaded or not. If the report takes a long time to load, this causes confusion. This release adds a progress bar to indicate to the user that the report is loading.
Client History: Add the host IP as a search option on the report.
Cellular Technology Trail: In the Cellular Technology Trail report, the cursor incorrectly appears clickable when near the trail on the map, which can be frustrating to someone who expects a certain behaviour based on the cursor. This update ensures that the clickable hand icon is only displayed when in the vicinity of the start and end points, as they are the only points on the map that are clickable for an info box.
General System Improvements
System Status: The System Status panel provides an overview of the AM/AMM, allowing the administrator to see how the AMM is performing at a glance. Administrators can see CPU, RAM, AM/AMM disk usage, services, VPNs, and High Availability (HA) status on the new page.
Moving Groups: This release adds distinct User Activity log messages when moving a Group to/from another Group. This include source and destination information when a Group is moved, allowing an administrator to see changes to Group structures. We have changed the Move Group confirmation popup to appear only if the Parent Group in edit group menu is changed.
Action Buttons: This release improves the functionality of the Action Buttons to be “sticky”, on all pages where the list of items can exceed the displayed page. This allows the buttons to “float” on the page, so the user does not need to continually scroll to the bottom of the page after selecting the required item(s).
High Availability – SNMP Trap for AM/AMM HA Failure Alerts: The HA Alert Script can be configured to provide an SNMP trap for HA failure alerting, rather than being reliant upon email.
Option to Require a Secondary Ping Monitor for HA Failover: The default HA failover mechanism found in AM/AMM 2.17+ assumes that two HA peers can always communicate with each other via network, unless hardware, power or network failure occurs at either HA peer. This design works well for two HA peers co-exist on the same local area network where network connectivity is reliable. This new feature allows the HA system to be configured to add a secondary ping monitor to the current HA design where HA backup server would ping to the router/gateway where HA primary server connects to. HA would only fail over to HA backup when HA heartbeat is down, and secondary ping monitor is up.
User Activity Log: With this release, user activity logs include details about Tab updates from Users and Remote user groups.
AMM Workflow and Usability Improvements
This release includes new features that improve the overall workflow processes in the AMM and enhance the usability of the product.
User Logout Timer Configured at the User Level: In previous releases, the user logout time limit was configured at the server, requiring all users to have the same logout time limit. This release makes this feature configurable at the user level, allowing for different profiles for different users.
Auto-delete Workflow Items After 90 Days: The new Workflow capabilities introduced in AM/AMM 2.17.1 can create a lot of Operations. The original implementation allowed users to delete Operations manually. This release adds an automated deletion after 90 days (default value). The feature is configurable at the “server” level.
Gateway Tree Selection Options: This release adds the ability to configure the gateway tree to display devices based on the identifier that means the most to the end user. The user can choose to display the Friendly Name (Default), Friendly Name + ESN or ESN (ID). ESN (ID) is the default if Friendly Name is not available. This setting is configured by the user in their user preferences.
Use Parent Group Authentication Settings: In AM/AMM 2.17.1, if all authentication settings are disabled, the Group is treated as having no authentication setting and the users of this Group will skip the Group settings and inherit the settings from its parent Group. In 2.17.2 a new configurable option Use parent group authentication settings is added on Groups. If the option of a Group is disabled, the users of this group will use the Group’s authentications settings even if they are all disabled. The Administrator is able to disable all authentication settings in a fleet by making this change.
Operation Model Improvements
Operations were added to AM/AMM in 2.17. This release addresses known issues and improvements to Operations based on customer and field feedback.
Template Improvements
AM/AMM 2.17 introduced template management to improve the process of managing device configurations. Based on feedback from the field, we have addressed a significant number of known issues and the following improvements:
Renamed “Working” Status: In the configuration template revision process, “Working” is renamed to “Draft” for templates that have not yet been published.
Unlinking Templates from a Group: This release adds a new feature where unlinking a Template from a Group automatically removes the link from gateways within that Group. This significantly improves the ease of managing Groups and Templates.
Hide Default Values in the AMM Template User Interface: This release provides an easy way to hide all default values, so that the user can easily know which fields they need to focus on when building a new Template. This release adds a button to “show/hide” fields whose current value is a default value.
Confirmation for Large Deployments: When a user tries to deploy a Template to a Group or to a number of individually selected gateways, the “Deploy Configuration” window displays the affected and unaffected devices at the bottom. As the user needs to scroll down to the bottom of the window to see these lists, this release adds a pop-up message when deploying a template to a large number of devices.
Deploy Configuration Window Messaging Improvements: When deploying a template, we currently display “
Provide Option for Unscheduled Software Upgrade as Part of Template Deployment: Users can deploy configuration templates and choose to auto upgrade gateways to a compatible firmware version. During this process, the user can choose to create scheduled or non-scheduled software upgrade as part of the Template deployment, which will create Operations for each step of the process.
Improve the “Deploy and Link” Feature in Admin -> Groups Page: The “Deploy and Link” workflow on Admin/Groups page is updated, allowing the user to deploy and link templates for each selected Group individually.
GNX Feature Support
AM/AMM 2.17.2 provides extended support for GNX devices, providing a better level of integration with the AMM server. These features require MGOS 4.4.2 or later.
GNX Companion Mode: In AM/AMM 2.17.2, the AMM now provides support for the addition of a GNX “companion” device that receives connectivity via the MG90. The companion device provides telemetry from the vehicle to the AMM in place of the current scanners. In this configuration, the GNX Companion device is hidden from the user (i.e. there is only one device in the AMM presenting data), but there is a view that shows the GNX Companion serial number and firmware version. From this view in the AMM, the user is able to configure the GNX and upgrade the firmware on the GNX Companion device. The AMM supports all the reports that the MG90 supports today on telemetry with the GNX.
Additional Telemetry Stats in AMM Dashboard: This release adds support for an additional 14 new Stats from the GNX device. For a complete list of the Stats available from a default configuration, please refer to: https://source.sierrawireless.com/airvantage/amm/appendix/gnx_support/
Support Custom Configurations: The GNX can support collection of over 150 data elements. This release adds support on the AMM for a customer-specific configuration of up to 60 data elements, evolving from a fixed configuration of 30 data elements in previous releases. This will allow us to map the GNX data elements to Stats in the AMM. There is a list of required AMM data elements that must be part of every customer configuration, for compatibility with the AMM.
Set Odometer Value on AMM for GNX Devices: This release supports setting the GNX odometer as part of a GNX configuration template. The feature requires a GNX device running GNX 9.05 or later firmware for this feature to work.
New Port Required: An additional port (TCP 9494) needs to be opened on the firewall to allow GNX to operate in the AMM environment and to support custom configurations. Previously only UDP 9494 and UDP 9495 were required.
Hosted AMM EULA
Once upgraded to AM/AMM 2.17.2, the Hosted AMMs operated by Sierra Wireless will display Terms of Service for Hosted AMM servers to all users of the system. This is a requirement to use the Hosted AMM service, and presents the same Terms of Service that are accepted by customers when they agree to purchase AirLink Support (which provides access to the Hosted AMM).
All Local Users or Remote LDAP Users on the Hosted AMM servers will be presented with the Terms of Service at their first login after the server is upgraded to 2.17.2. Each time the Terms of Service are updated, the new terms will be presented on first login. New users will also need to accept the Terms of Service on their first login.
This feature only applies to Hosted AMM systems operated by Sierra Wireless. It is not for use by on-premises customer deployments.
Changed Behaviour
Note: Updated June 27, 2022
HTTPEnabled=no Behaviour Change: The master config parameter HTTPEnabled=no behaviour has changed. The prior behaviour for this setting was to drop the HTTP proxy configuration, but leave port 80 open.
The new behaviour closes port 80 to all external traffic.
Warning: After upgrading to AMM 2.17.2 with HTTPEnabled=no, ALEOS and MGOS software upgrades and app installation/upgrades will FAIL if the management tunnel is not available.
The MGOS management tunnel is normally configured and functions “out of the box”, and so it is likely that the management tunnel is active for MGOS gateways.
This is not the case for ALEOS gateways. It is highly recommended to verify that the management tunnel is active on all gateways, particularly ALEOS, prior to upgrade, otherwise the software installation will fail after upgrade.
Prior to upgrade, please take the following steps to ensure a smooth upgrade:
- Ensure that each gateway is entered in the authunits file (if AuthunitsEnabled = yes), and that the AMM has had a suitable certificate installed for ALEOS gateways.
- Ensure that all ALEOS gateways are running at least version ALEOS 4.13.
- Ensure that all ALEOS gateways have management tunnel enabled. This can be done by ensuring AMMER is installed on each gateway, which enables the management tunnel upon first start. Alternatively, it can be enabled by setting parameter 10033 to 1 in msciconfig on AMM (in either case, the tunnel will be enabled after rebooting the gateway).
- Ensure ALEOS gateways have correct NTP settings (if NTP is not working, ALEOS will not/cannot establish a management tunnel).
One way to check if management tunnels are successfully established, is to create a threshold based on the stat ManagementTunnel-IPAddress. Gateways with no management tunnel will be shown as N/A on the Dashboard.
Note: Updated June 29, 2022
Report Generation Times: In making improvements to the processing logic and doing bug fixes during this release, our testing has indicated that the processing time on the Availability Details, Zone Summary, Zone Times and Statistics Graph reports has increased with this release. The generation times have increased to improve the accuracy of the data being presented in the reports.
Note: Updated July 22, 2022
KML report output file using Windows Google Earth app: When generating a KML report output file, our testing has shown that it is being generated with a suffix of “.kml.vm”. When opening this file using the Windows Google Earth app, it does not show an error but displays no data points. This file needs to be renamed to remove the “.vm” part of the suffix and then will display successfully in the Windows Google Earth app. If using the web version of Google Earth, this issue does not occur.
KML report output file name changes: The output file names have been changed from _sierrawireless_reportsheet.csv or _sierrawireless_reportsheet.kml to reportsheet.csv or reportsheet.kml.
3 Minor Feature Enhancements
Support for AirLink RV55
Adds support for this new AirLink model.
Support for Inheriting Zones to Sub-groups
AM/AMM 2.17.2 adds support for inheriting Zone to sub-groups. Zones that are created for a parent group are now visible to the child group users. They are not modifiable by the child group users.
New ALEOS Application Framework ((AAF) Applications
AMMER 1.0.7
AMMER 1.0.7 is an incremental update to the AMMER AAF application that is needed to support advanced features on the AM/AMM for ALEOS devices. There were two primary features added to this release:
AMMER to report additional Telemetry Stats from ALEOS devices for Fuel Rate and Tire Pressure (where available).
MSCIID_STS_PP_GPS_SAT_CNT (901) is mapped to the field Satellites in View on AMM. This is incorrect as the MSCIID reports the number of acquired satellites. It is updated to be mapped to the Satellites in Use statistic. Currently there is no value on ALEOS that corresponds to Satellites in View.
uploadlog 1.0.4
UPLOADLOG 1.0.4 is an incremental update to the UPLOADLOG AAF application that provides more robust log management features for ALEOS devices on the AM/AMM. There were a number of changes made in this release to ensure the use of the management tunnel for transferring log files.
UPLOADLOG requires ALEOS version 4.15.0.005 or later to upload logs via the management tunnel.
Addressed Problems
Customer Reported Field Issues
| Reference | Problem Description |
| 10703⁄10633/10158 |
Add support for new RV55/RV50X/LX40/LX60/ PIDs |
| 10643 |
API can stop unexpectedly, all requests timeout, require services restart to recover |
| 10383 |
Software Distribution Dashboard not showing all results when filtering |
| 10026 |
Threshold “is not between” condition triggers UI error. |
| 10022 |
Bandwidth consumption report cannot be saved via “Run Now” as HTML. |
| 9829 |
New HFSN prefixes in 2.17.2. |
| 9638 |
Broken image links on certain scheduled/background reports on HTTPS only AMM configuration. |
| 9580 |
API performance evaluation based on the usage data from Beta customers. |
| 9475 |
Coverage Trails stop icons (i.e. circles) have same size regardless of stop duration. |
| 9297 |
ALEOS devices report incorrect Satellites in Use information on AMM. |
| 9265 |
Scalability test environment pre-processor process runs endlessly and consumes heavy resources. |
| 9062 |
AMM Configuration CSV template includes extraneous information. |
| 7192 | Bandwidth report is not showing results for all gateways selected. |
| 7098 | Suppress stuffing ALEOS dels.txt with unchanging stats at every check-in interval. |
| 7028 | Event Viewer report memory estimate is way too low for ALEOS with 1-min check-in. |
| 6645 | Vehicle icon sometimes does not show when clicking gateways in Map over slow network. |
| 5947 | Operational State should update based on ignition on event. |
| 5640 | AMM needs to self-recover from memory exhaustion. |
| Reference | Problem Description |
| 10555 | User without access to a feature can visit its page directly by URL. |
| 10338 | User authentication activity logs could expose user name information among different group. |
| 10337 | Login / Logout activity logs shall be put under user’s owner group instead of “All Gateways”. |
| 10317 | System Status UI can only be accessed when assigned by “admin” user. |
| 10176 | Non-admin user can see activity and remote IP address from other users. |
| 10175 | User Activity shows non-admin user the IP addresses and userids from failed login attempts. |
| 10160 | Password update prompt triggered for wrong user. |
| 10156 | Password reset is skipped at login if user has no email. |
| 9911 | Upgrade Jetty to address multiple security vulnerabilites. |
| 9341 | Restricted IP in User settings allow wildcard char in any octet position. |
| 9281 | Wrong number of users shown in Authentication Settings window when all users selected. |
| 9218 | HA to avoid using http to fetch public key from primary to secondary. |
| 8772 | ACEManager passwords are stored in plaintext on Templates Page. |
Each AM/AMM release addresses any security vulnerabilities discovered since the previous release. This release addressed vulnerabilities as identified in 72 CVE tickets.
|
|
|
|
|
|
Outstanding Problems
There are a number of known issues discovered after code freeze that will be addressed in a future AM/AMM release.
| Reference | Problem Description |
| 10239 | Wrong memory estimate for CSV AssetTEmperature Stats Graph report. |
| 10147 | Users in a Group can see their parent Group. |
| 10737 | Repeated warning messages are displayed on HA configuration. We plan to address this issue in AM/AMM2.17.3. |
| 10342 | Configuration templates are missing ALEOS “General” settings for Wi-Fi SSID 2 through 4. This issue requires ALEOS 4.16 to address. |
| 10553 | Users in child Groups cannot see activity logs for their gateways when generating reports with parent Group selected. |
| 10591 | The AM/AMM UI does not show the correct inherited authentication settings for a child Group. |
| 10650 | Templates get linked to Groups but not gateways when deployment fails. |
| 10713 | The MG90 cancelled upgrade status changed to “Failed” on Software Distribution but remained “Cancelled” on the Operations page after areboot. |
| 10560 | AM/AMM APIs: We are unable to assign rate limit to top-level “All gateways” group in AM/AMM We plan to address this issue in AM/AMM2.17.3. |
| 10697 | Configuration sync error does not cause template deployment operation to fail. We plan to address this issue in AM/AMM2.17.3. |
| 10710 | There is a logic error in HA detection of MySQL replication problems. We plan to address this issue in AM/AMM2.17.3.. |
| 9750 | Software Distribution page - “Cancel Software Upgrade” does not cancel all outstanding software upgrades. |
| 9090 | Cannot rename a LAN Segment Networking Rule via configuration template. |
| 9882 | The DSA key used in git sync is deprecated. A new key has been added, but old key is not yet removed. Removal of the old key will be done in a future release (TBC). |
| 9398 |
Dashboard right pane group selection doesn’t work. |
| 9290 | Special character in zone name prevented zone maps from being displayed. |
| 9273 | Conflicting validation / help text with template. |
| 7216 |
Unexpected Directories found in /home/inmotion/ftp/MHS_logs/ with GNX device connected. |
| 6523 | Some gateways do not show up on Dashboard in AMM due to pagination issues. When the page size is changed from 250 to a number greater than all of the gateways available, the devices will reappear. |
| 6522 |
There is a known issue where inconsistent gateway data can be displayed when multiple LCI windows are opened to different MGOS devices. It is recommended that only one MGOS LCI screen be opened at a time. |
| 6225 |
The Main Battery “link” on the dashboard does not allow you the flexible report change that the Statistical Graph report does. |
| 5718 |
Due to errors in handling daylight savings, the Bandwidth Consumption reports display high data usage during daylight savings. |
| 5647 |
The Configuration Audit report shows different settings due to different Friendly Names. |
| 5569 |
The Configuration Audit report generates confusing/misleading VPN information. |
| 4989 |
When the Statistics Graph report is generated for stats whose values depend on the user’s measurement units setting (i.e., Imperial or metric), the actual display units may not agree with those displayed in the graph’s title, which makes the report confusing. |