Latest Cradlepoint Firmware Release Notes

ReleaseNotes_S3_6_5_4 (

Release Notes for Cradlepoint Rev 6.5.4 Firmware
Products supported/tested:
AER3100/AER3150
AER2200
AER2100
AER1600/AER1650
AP22
CBA850
IBR1700
IBR1100/IBR1150
IBR900/IBR950
IBR600B/IBR650B
IBR600C/IBR650C
IBR200
IBR350
Note1: Before upgrading to new firmware, it is always a good idea to save the configuration
file from your current version. This firmware version will remove a configuration for version 3.2
or lower and will not try to keep your settings.
New features added in this release (Not all features are in all products
– see their respective Data Sheets):
AutoVPN feature support
Secure salted & hashed admin/user account passwords. Only router user account passwords are
migrated to the salted hashed format.

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page: 2
Additional UI/Usability changes:
WAN Affinity has been moved and renamed to Traffic Steering. Find it as Networking > Routing
> Traffic Steering or by entering WAN Affinity in the UI search box. The functionality and settings
are unchanged, however the rule editor has been divided into Initial Match and Target tabs for
the traffic match criteria and target WAN, respectively.
Ability to configure STP path cost, forward delay timer, hello time, and max age
Ability to disable Client Time on WiFi radios on AER2200, IBR1700, and IBR900.
Auto Channel Select 1, 6, 11 by default.
DFS(Dynamic Frequency Selection) support on AP22.
600M only. When North America SIMs are provisioned for AT&T, T-Mobile, Bell Canada, Rogers
and Telus (and their affiliates), the AT&T image will continue to be used with these carriers. For
all other carriers in North America, the Generic image will be used.
600M, 150M-B, 150M-C. Added ability to enter modem username and passwords for those SIMs
which are credentialed for regional operators
150M-B. Added Force 2G setting
Aggressive No Carrier. This Advanced modem setting is designed to indicate to the modem, in a
more aggressive manner, that the registration with the tower should be terminated and the
scanning for better conditions to re-register should begin immediately.
On router platforms with USB ports that are under-powered to properly support cellular
modems, the modem still plugs, displays in the Connection Manager, and will attempt to operate
as normal. However, a warning will display in the Connection Manager as “Unsupported Port
(usbx)”.
Added Telstra LANES APNs to Auto APN table
Defects fixed:
Fixed an issue where client usage did not correctly report clients with ipv6 addresses
(IBR1700) On Board Diagnostics.
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page: 3
OBD-II fills logs with debug logging set with default 1 second polling
Support Battery Voltage
Battery Voltage and Trip Fuel Consumption PIDS were not reporting data in status
Setting timezone to non hour setting didn’t work
Serial console settings of 5- and 6-bits were removed from UI
Serial Redirection not allowing file transfers
Fixed issue in WiFi as WAN when disconnected from the Wan source and would not reconnect
Removed excessive GPS GNSSD debug logging
Modem Firmware upgrade enhancements. Better management of general modem firmware updates,
better enforcement of required minimum router FW to support new modem firmware releases
150M-B, 150M-C only. Improved modem firmware upgrade from getting stuck in Upgrade mode,
now displays proper modem model after file update
Modified timing of modem SMS messages to prevent duplicate responses or out-of-order responses
10M, 10M-B, 150M-B, 150M-C only. Now available in the Filter Criteria>Modem Template dropdown
list
600M only. Resolved issue where the modem was unable to obtain a GPS fix in some conditions
Multi-PDN devices (600M, 150M-B, 150M-C, 10M, 10M-B, LP6, LP5, LP3, LPE) only. Added more help
dialog to clarify how to manually enter and manage APNs for each PDN
10M, 10M-B. Connection Manager now displays multi-PDNs in a better, more intuitive view
Connection Manager Connection set interfaces now display when using IPv6
Enabling the IPS/IDS engine could cause the router to reboot under certain traffic loads.
In some instances, the router would respond to ping packets on the WAN interface when it shouldn’t
Filter Policies based on Application Identities in the Zone Firewall didn’t work correctly
Performance could be poor when Cloud-Based Filtering was enabled
IPS rule update schedules may not function as expected when multiple WANs are present
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page: 4
When Cloud-Based Filtering is enabled, requests using TCP are going out to upstream DNS servers
as UDP
VTI would fail to establish if more that 15 tunnels were configured
VRRP could fail in certain VPN configurations
IKEv1 IPSec would not recognize GRE keys greater than 2147483648
Routes would sometimes fail to populate correctly when a modem disconnected and reconnected
Security issues:
None
Known issues
CP Secure Web Filter
Previous versions of firmware had a defect that improperly allowed customers to enter more
than 5 items per category in a custom category. Custom categories with more than 5 items need
to be removed before upgrading to 6.5.x firmware and later. Failure to do this will lead to
unpredictable results. See Cradlepoint knowledge base for more detailed instructions.
http://knowledgebase.cradlepoint.com/articles/Support/Migration-Process-for-devicesupgrading-to-NCOS-6-5-or-newer-while-utilizing-Custom-CP-Secure-Web-Filter-Categories
PSE
AER2200 and AER31x0: PSE port status will not update if PSE is globally disabled.
GPS/OBD-II
IBR1700. Due to a 20-30ms delay in sampling, setting a configured reporting time to the
minimum of one second will give samples at 1.02-1.03 seconds apart.
IBR1700. Occasionally, PCPTOBD sentences will not be sent with other NMEA sentences (Sendto-Server, Send-to-Client)
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page: 5
LTE
Unless you have a specific service from your carrier, LTE modems will not generally provide an
externally-available IP address. Services, such as Remote Management, will not work.
Modem
Franklin U770. The Modem’s Ethernet address conflicts with the default address of the Guest
LAN. A warning message is placed in the log and the Guest LAN is disabled. If you change the
address of the Guest LAN to a non-conflicting address, this restriction will not occur.
Sierra Wireless 313U, 330U. When these modems connect on 2G or 3G bands, specifically on
GSM 850, they will sometimes cause interference on the USB bus, resulting in the modem not
plugging properly. If this occurs, attaching the modem to a USB extension cable will generally fix
the problem.
The following USB modems contain an embedded web server through which many modem
settings are configured. To access the modem’s web pages, you must be logged in as the router
administrator. Once logged in, you can then access the modem web pages at these given IP
addresses:
Franklin U770, U772 /
Sprint (USA)-> 192.168.10.1
Netgear AC341U */
Sprint (USA)-> 192.168.1.1(address is configurable)
Pantech UML295VW * /
Verizon (USA)-> 192.168.32.2
* The modem web pages are available only when the modem is operating in NAT mode.
Application Identities
For Application Identities to work properly the user needs to also enable Application ID Logging
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page: 6
Release Notes for Cradlepoint Rev 6.5.2 Firmware
Products supported/tested:
AER3100/AER3150
AER2200
AER2100
AER1600/AER1650
AP22
IBR1700
IBR1100
IBR900/IBR950
Note: Before upgrading to new firmware, it is always a good idea to save the configuration file
from your current version. This
firmware version will remove a configuration for version 3.2 or lower and will not try to keep yo
ur settings.
New features added in this release (Not all features are in all products
– see their respective Data Sheets):
No new features, defect fixes only
Additional UI/Usability changes:
No UI changes
Defects fixed:
IBR900 allows unfiltered ethernet packets across its LAN/WAN ports for a few seconds while
booting up
IBR1700. Quick Wifi Setup Wizard would not set the correct antennas for 2.4GHz operation
across a reboot

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page: 7
Fixed issue where sending GPS data to an incorrect destination could lead to failure.
IBR900. A GPIO connected to the external dock connector used for a modem connected signal
was fixed
AP22. Factory reset button worked on power-on but would not work while the AP was running
AER1600. Factory reset button would not wait for 10 seconds
Email alerts to Office 365 and Yahoo mail are undeliverable
Full NTP would not start SDK/NCP/AOOBM applications on boot.
SDK was not cleaning up temporary files after installation.
Analytics data was capturing internal traffic.
Analytics data was only keyed on IP address allowing analytics data from one client to be
attached to a different one.
Duplicating client usage data from previous day in reports to NCM.
CIDR notation for specifying IP address ranges in Web Access Filtering was not working
Interrupted SSH session can lead to a delayed router crash
AER2200. Added help text for the “Authorized MAC Addresses” section of the “Hotspot Services”
Networking page.
Security issues:
None
Known issues
CP Secure Web Filter
Previous versions of firmware had a defect that improperly allowed customers to enter more
than 5 items per category in a custom category. Custom categories with more than 5 items need
to be removed before upgrading to 6.5.0 firmware. Failure to do this will lead to unpredictable
results. See Cradlepoint knowledge base for more detailed instructions.

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page: 8
http://knowledgebase.cradlepoint.com/articles/Support/Migration-Process-for-devicesupgrading-to-NCOS-6-5-or-newer-while-utilizing-Custom-CP-Secure-Web-Filter-Categories
HotSpot
Ethernet Threshold feature not functional
GPS
Due to a 20-30ms delay in sampling, setting a configured reporting time tothe minimum of one
second will give samples at 1.02-1.03 seconds apart.
Zscaler
DynDNS mode does not work. Workaround is to configure the the Zscaler DNS servers as the
global static DNS servers
LTE
Unless you have a specific service from your carrier, LTE modems will not generally provide an
externally-available IP address. Services, such as Remote Management, will not work.
Modem
Franklin U770. The Modem’s Ethernet address conflicts with the default address of the Guest
LAN. A warning message is placed in the log and the Guest LAN is disabled. If you change the
address of the Guest LAN to a non-conflicting address, this restriction will not occur.
Sierra Wireless 313U, 330U. When these modems connect on 2G or 3G bands, specifically on
GSM 850, they will sometimes cause interference on the USB bus, resulting in the modem not
plugging properly. If this occurs, attaching the modem to a USB extension cable will generally fix
the problem.
The following USB modems contain an embedded web server through which many modem
settings are configured. To access the modem’s web pages, you must be logged in as the router
administrator. Once logged in, you can then access the modem web pages at these given IP
addresses:

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page: 9
Franklin U770, U772 / Sprint (USA)-> 192.168.10.1
Netgear AC341U */
Sprint (USA)-> 192.168.1.1(address is configurable)
Pantech UML295VW * /
Verizon (USA)-> 192.168.32.2
* The modem web pages are available only when the modem is operating in NAT mode.
Release Notes for Cradlepoint Rev 6.5.1 Firmware
Products supported/tested:
AER3100/AER3150
AER2200
AER2100
AER1600/AER1650
IBR1700
IBR900
Note1: Before upgrading to new firmware, it is always a good idea to save the configuration
file from your current version. This firmware version will remove a configuration for version 3.2
or lower and will not try to keep your settings.
New features added in this release (Not all features are in all products
– see their respective Data Sheets):
No new features in this release
Additional UI/Usability changes:
No changes to UI/Usability
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
10
Defects fixed:
HotSpot
Redirect page was not always displayed
Rate limiting is now functional
Webroot DNS handling improved to support many concurrent requests
Unstable WANs were causing the router firmware to deadlock
Router would hang when there was an error in an IPS callback event
IPS mode not correctly set when only App Analytics was licensed
Upgrade mode failure for some LP6 modems
Improved logging efficiency which was slowing down router services
Enhanced recovery of modems continuously plugging in upgrade mode
Safely switch modems to low-power mode prior to router reboot and shutdown
Improved network packet handling for 600M and 10M modems resulting in improved
performance
Security issues:
None
Known issues
CP Secure Web Filter
Previous versions of firmware had a defect that improperly allowed customers to enter more
than 5 items per category in a custom category. Custom categories with more than 5 items need
to be removed before upgrading to 6.5.0 firmware. Failure to do this will lead to unpredictable
results. See Cradlepoint knowledge base for more detailed instructions.

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
11
http://knowledgebase.cradlepoint.com/articles/Support/Migration-Process-for-devicesupgrading-to-NCOS-6-5-or-newer-while-utilizing-Custom-CP-Secure-Web-Filter-Categories
HotSpot
Ethernet Threshold feature not functional
GPS
Due to a 20-30ms delay in sampling, setting a configured reporting time to
the minimum of one second will give samples at 1.02-1.03 seconds apart.
Zscaler
DynDNS mode does not work. Workaround is to configure the the Zscaler DNS servers as the
global static DNS servers
Release Notes for Cradlepoint Rev 6.5.0 Firmware
Products supported/tested:
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
12
AER3100/AER3150
AER2200
AER2100
AER1600/AER1650
IBR1700
IBR1100/IBR1150
IBR900/IBR950
IBR600/IBR650
IBR600B/IBR650B
IBR600C/IBR650C
IBR350
IBR200/IBR250
AP22
Note1: Before upgrading to new firmware, it is always a good idea to save the configuration
file from your current version. This firmware version will remove a configuration for version 3.2
or lower and will not try to keep your settings.
New features added in this release (Not all features are in all products
– see their respective Data Sheets):
AP22 Connection note:
Install all of your Cradlepoint AP22s on the same VLAN. This is the only supported installation for
roaming.
Cradlepoint AP22s discover one another using a multicast protocol. Multicast packets are typically
not bridged across VLANs (Cradlepoint routers do not support this; customer switch vendors may or
may not). Since Cradlepoint is not deploying a controller or similar single point of configuration for
roaming, this discovery protocol is the only means to support roaming between AP22s.

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
13
Furthermore, if the APs are getting their IP addresses via DHCP from a router, the router (or APs)
must be configured so that their primary LANs don’t conflict.
Networking -> Local Networks -> AP Discovery. Added AP22 discovery to all AER products. If AP
discovery is enabled, the AER router will be able to discover the AP22 and report back to NCM any
AP22 that is attached. An AER2200 will also be able to participate in 802.11r Fast Roaming with the
AP22.
(IBR1700) System -> Administration -> OBD. On-Board Diagnostics support. Using an accessory
OBD-II cable (LD3IC-S from B&B Advantec) attached to a serial port, the router can provide Vehicle
Diagnostics. Specific Parameter IDs can be selected and reported through the UI.
(IBR1700) System -> Administration -> OBD-II. On-Board Diagnostics support. Using an accessory
OBD-II cable (LD3IC-S from B&B Advantec) attached to the serial port or USB port (with a supported
FTDI USB to Serial adapter), the router can provide vehicle telemetry. While most vehicles since
2008 are supported, not all parameters are available on all vehicles. Parameters can be enabled and
reported through the UI. Optionally, all enabled and supported parameters can be reported in a
custom NMEA sentence (PCPTOBD) and sent with other NMEA sentences to destinations in GPS’s
“Send-to-Client” and “Send-To-Server”.
(IBR1700) GPS with Dead Reckoning. With the optional OBD-II adapter connected and the vehicle
speed PID enabled, Automotive Dead Reckoning (ADR) support is enabled when GPS signals are
unavailable.
600M, 10M, 10-B, 150M-B, 150M-C modems. Added support for multiple PDNs as supported by
certain carrier operators and SIMs. With appropriately provisioned SIMs, multiple PDNs allow a single
modem to simultaneously support multiple WAN interface/connections (PDNs) each with their own
unique IP address. SIMs of this type is used for split billing, public/private network traffic, and other
features.
Secure Threat Management Upgrade
Improved performance
Improved memory footprint
Bug fixes
No need to choose between Fast and Thorough modes
Added detection of Anomalies
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
14
Persistent Logging. Previously when the Service Manager would crash, logs would be lost. Now
they can be retrieved after the router reboots and examined to find the cause of the crash.
When Application Analytics is entitled, the user can now use Application Sets with the Firewall and
QoS.
StrongSwan upgraded to version 5.5.3
Increased the number of Custom Categories in CP Secure Web Filter to 15 and the number f URLs
per category to 64
Updated the Zscaler certificate. The old one expires in May.
Removed support for Secure Threat Management from IBR600C and IBR650C
Added a packet capture feature to aid in troubleshooting network problems
System>Diagnostics
VTI now supports ‘anonymous’ mode allowing simpler Hub/Spoke configurations
Added ‘Peer List Name’ to NHRP interface configuration pages as well as \IPSec VPN phase 2
configuration pages.
A Peer List Name can be used in BGP neighbor configuration to dynamically add BGP
neighbors learned from NHRP or IPSec
MBR1200B. Removed WPS support from all products, this was the last remaining product with that
feature.
Basic Authentication support
Take care in parsing the WWW-Authenticate field as there is now both more than one
WWW-Authenticate header field provided–Basic & Digest.
WiFi-as-WAN and WiFi Client changes.
Known issues. IBR1100 WiFi-as-WAN does not detect loss of connectivity if the IBR1100’s
connected router/AP is lost. The workaround is enabling WAN Verify in Connection Manager.
IBR series: WiFi-as-WAN and WiFi Client reliability and connect speed
is greatly improved. The Cradlepoint router will connect to its targeted
router/AP more quickly and more reliably.

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
15
IBR900. WiFi-as-WAN and WiFi Client roaming functionality greatly improved. The router
will move between multiple BSS of same ESS (Extended Service Set) without disconnecting. (802.11r
is not supported.)
IBR1100. WiFi Client roaming functionality greatly improved. The router will move between
BSS of same ESS without disconnecting. Unfortunately, WiFi-as-WAN does not support seamless
roaming. (802.11r is also not supported.)
Additional UI/Usability changes:
(AER2200, IBR1700, IBR2x0) Added a visual (LED) alert as well as alerts in the UI and to NCM if the
SIM door is left open and the modem is disabled.
System -> SNMP Configuration. The requirement to have both Get and Set community strings was
removed. Only a Get community string is mandatory.
Networking -> Local Networks -> WiFi Radios. SSID Duplication convenience feature is available for
SSIDs. Select the SSID that has settings that you want to duplicate, and then use the Duplicate
Settings button and select the SSIDs you want the settings duplicated for. The dialog will also
require you to set a new password for the new SSIDs.
(IBR Series). Networking -> WiFi as WAN, or Client. For those products that support WiFi Enterprise
authentication, the setting was removed from under the Extended Enterprise License. It is no longer
a licensed feature.
Accelerated router system time establishment
Present a warning notification on router platforms unable to support external USB modems due to
insufficient USB port power
AER22x0, IBR17x0, IBR2x0. Added SIM door open warning message.
Profile criteria filtering options not correct for type Ethernet
Embedded Modems. Extended SMS functionality to manage multiple APNs and PDNs
New tab in the Threat Management->Signature Settings page to configure Anomalies.
New button in the Status->System Logs page to retrieve the saved log file after a crash
Enabled band steering by default. It can be disabled at the CLI.
Packet Capture UI under System>Diagnostics
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
16
Defects fixed:
IBR900 and AP22: WiFi Transmit power settings were not correct.
Connection Manager>Dual SIM>Prefer Primary SIM no longer ignores the primary interface
when Standby is enabled. Additionally, the Prefer Primary SIM selection now remains saved in the
GUI.
AP22: WAN connection information was left off of the Dashboard UI page.
LP5 Telstra. Restored multiple PDN support with Always On feature
Resolved carrier connection issues when a SIM requires a PIN in a dual SIM platform
Established a GNSS default so to obtain well-formed NMEA output
Fully enabled GLONASS NMEA sentences
Embedded Modems. Extend Connect operation extended for wider use cases
Fixed an issue where traffic bound for NetCloud was not routed correctly. This would cause
devices to get stuck in the installing state.
Fixed and issue with Webroot that would cause the router to reboot if it was not configured on
one of the default LANs.
Fixed an issue where remote telnet and http connections would be dropped.
Fixed an issue affecting MAC Address Web Filter Defaults. Whitelisting should now work as
expected
Upstream Proxy was failing randomly when trying to load https pages
Tunnel Status shows a tunnel still exists after it is cleared from the NetCloud configuration
If the RADIUS server IP address is mistakenly set to a black hole route it would cause an
exception in firmware.
When Webroot and Threat Management were enabled, DNS traffic was mistakenly classified as a
UDP Port scan attack
One category of website was left out of the CIPA profile in CP Secure Web Filter
Configurations containing NHRP in firmware versions earlier than 6.3.0 were not properly being
migrated

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
17
Improved the accuracy of the client usage statistics
Hot Spot terms of service page would appear blank in some cases
Changed the default Threat Tolerance value for CP Secure Web Filter to 42 from 80. This will
improve page load times when this feature is enabled.
Fixed a memory leak when application analytics was enabled that would cause the router to
reboot periodically
10/100 Client devices are not getting an address from DHCP on Port 1.
BSSID control was not visible on the Profile page for Wireless Client
DHCP doesn’t work over Wireless Bridge. This is fixed, but please note the Security warning
below.
The dashboard showed LAN information instead of WAN information.
Security issues:
WPA2 security issues known as “KRACK” (Key Reinstallation Attacks). We updated client drivers
and WPA supplicants to remove the security vulnerabilities documented
at
http://knowledgebase.cradlepoint.com/articles/Support/WPA-and-WPA2-VulnerabilitiesKRACK
Additional changes for the IBR1100, IBR600, IBR600b, MBR1200b, and IBR200 were added
based on chipset manufacturer recommendations
NOTE: The KRACK fixes disable the ability for these products to support WiFi
Bridge. If you need to use WiFi Bridge mode on these products, the KRACK fixes will be disabled
and WiFi Bridge will continue to work but you will be vulnerable to a Key Reinstallation
Attack. There is no fix for this as they are mutually exclusive.

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
18
Modems tested: (new 6.5.0 modems / modem platforms
are in blue text
)
Cradlepoint Cellular Devices (Embedded & USB Modems)
Cradlepoint AER16x0LPE-AT / AT&T (USA)
Cradlepoint AER16x0LPE-GN / T-Mobile, US Cellular (USA); Generic (North America)
Cradlepoint AER16x0LPE-SP / Sprint (USA)
Cradlepoint AER16x0LPE-VZ / Verizon (USA)
Cradlepoint AER16x0LP4 / AT&T, T-Mobile, Verizon (USA)
Cradlepoint AER22x0-600M / AT&T (USA, Canada); T-Mobile, Verizon (USA); Generic (Europe, Australia, NZ)
Cradlepoint IBR2x0-10M-VZ / Verizon (USA)
Cradlepoint IBR2x0-10M-B-AT / AT&T (USA)
Cradlepoint IBR350L / Verizon (USA)
Cradlepoint IBR350LPE-AT / AT&T (USA)
Cradlepoint IBR350LPE-GN / T-Mobile (USA); Generic (North America)
Cradlepoint IBR350LPE-SP/ Sprint (USA)
Cradlepoint IBR350LPE-VZ / Verizon (USA)
Cradlepoint IBR350P2 / AT&T (USA); Generic GSM-compatible locations (World)
Cradlepoint IBR6x0B-LP4 / AT&T, T-Mobile, Verizon (USA)
Cradlepoint IBR6x0C-LPE-AT / AT&T (USA)
Cradlepoint IBR6x0C-LPE-GN / T-Mobile (USA); Generic (North America)
Cradlepoint IBR6x0C-LPE-SP/ Sprint (USA)
Cradlepoint IBR6x0C-LPE-VZ / Verizon (USA)
Cradlepoint IBR6x0C-150M-B-EU / Generic operators (Europe)
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
19
Cradlepoint IBR6x0C-150M-C-AU / Generic operators (Australia)
Cradlepoint IBR6x0LPE-AT / AT&T (USA)
Cradlepoint IBR6x0LPE-GN / T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic (North
America)
Cradlepoint IBR6x0LPE-SP/ Sprint (USA)
Cradlepoint IBR6x0LPE-VZ / Verizon (USA)
Cradlepoint IBR6x0LP3-EU / Generic (Europe)
Cradlepoint IBR900LPE-VZ / Verizon (USA)
Note: Also certified on AT&T (USA), Sprint (USA), and Generic (North America)
Cradlepoint IBR9x0LP5 / Generic (APAC)
Cradlepoint IBR9x0LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe)
Cradlepoint IBR9x0-600M / AT&T (USA, Canada); T-Mobile, Verizon (USA); Generic (Europe, Australia, NZ)
Cradlepoint IBR11x0LPE-AT / AT&T (USA)
Cradlepoint IBR11x0LPE-GN / C-Spire, T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada);
Generic (North America)
Cradlepoint IBR11x0LPE-SP / Sprint (USA)
Cradlepoint IBR11x0LPE-VZ / Verizon (USA
Cradlepoint IBR11x0LP3-EU / Generic (Europe), Telstra (Australia)
Cradlepoint IBR11x0LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe)
Cradlepoint IBR17x0-600M / AT&T (USA, Canada); T-Mobile, Verizon (USA); Generic (Europe, Australia, NZ)
Cradlepoint MC400L2 / Public Safety Band 14 only (USA)
Cradlepoint MC400LPE-AT / AT&T (USA)
Cradlepoint MC400LPE-GN / T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic (North
America)
Cradlepoint MC400LPE-SP / Sprint (USA)
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
20
Cradlepoint MC400LPE-VZ / Verizon (USA)
Cradlepoint MC400LP3-EU / Generic (Europe)
Cradlepoint MC400LP4 / AT&T, T-Mobile, Verizon (USA)
Cradlepoint MC400LP5 / Generic (APAC)
Cradlepoint MC400LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Vodafone (Worldwide), Generic (North
America, Europe)
3rd Party USB Cellular Modems
Franklin U770 (“Sprint Plug-In-Connect Tri-Mode USB Modem”) / Sprint (USA)
Franklin U772 (“Franklin U772 USB Modem”) / Sprint (USA
Huawei E3276 / Telus (Canada)
Huawei E368 (“AT&T USBConnect Force 4G”) / AT&T (USA)
Netgear AC340U (“AT&T Beam”) / AT&T (USA)
Netgear AC341U (“NETGEAR® 341U USB Modem”) / Sprint (USA)
*supports Netgear firmware 4.07.01.11 and MR2 firmware 45.04.20.00
Novatel 551L LTE (“Verizon USB551L”) / Verizon (USA)
Novatel U620L (“Verizon MiFi© 4G LTE Global USB Modem U620L”) / Verizon (USA)
Novatel U679 (“4G LTE Novatel Wireless U679 Turbo Stick”) / Bell Mobility (Canada)
Novatel USB730L (“Verizon Global Modem USB730L”) / Verizon (USA)
Pantech UML295VW (“Verizon 4G LTE USB Modem UML2954G LTE”) / Verizon (USA)
*requires Pantech firmware version L0295VWD821F.B4 or later
Portsmith PSA1U1M (“Portsmith USB Client to Analog Modem Adapter”) / POTS phone providers
Sierra Wireless 308 USB (“AT&T USBConnect Shockwave”) / AT&T (USA)
Sierra Wireless 313U (“AT&T USBConnect Momentum 4G”) / AT&T (USA)
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
21
Sierra Wireless 320U (“Telstra USB 4G (Sierra AirCard 320U)”) / Telstra (Australia)
Sierra Wireless 330U (“4G LTE Sierra Wireless U330 – Turbo Stick”) / Bell Mobility (Canada)
Sierra Wireless 330U (“LTE Rocket Stick – Sierra Wireless AirCard 330U”) / Rogers (Canada)
ZTE MF683 (“T-Mobile Rocket 3.0 4G Laptop Stick”) / T-Mobile (USA)
Analog Modems
Portsmith PSA1U1M (“Portsmith USB Client to Analog Modem Adapter”) / POTS phone providers
Portsmith PS6EX1M (“Portsmith ExCard to Analog Modem Adapter”) / POTS phone providers (ExpressCard
format, compatible with MBR1400s, MBR1200B, & CBA750B only)
Known issues
CP Secure Web Filter
Previous versions of firmware had a defect that improperly allowed customers to enter more
than 5 items per category in a custom category. Custom categories with more than 5 items need
to be removed before upgrading to 6.5.0 firmware. Failure to do this will lead to unpredictable
results. See Cradlepoint knowledge base for more detailed instructions.
http://knowledgebase.cradlepoint.com/articles/Support/Migration-Process-for-devicesupgrading-to-NCOS-6-5-or-newer-while-utilizing-Custom-CP-Secure-Web-Filter-Categories
HOTSPOT
Do not upgrade to this version of firmware if you require HotSpot functionality in conjunction with
either CP Secure Web Filter or Zscaler Internet Security. This limitation will be addressed in an
upcoming release.
The Bandwidth (upload/download) settings in the Networking>Local Networks>Hotspot Services
page do not function correctly on IBR900, IBR1700, IBR2200 routers. Set these to 0 when
configuring hotspot.

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
22
GPS
IBR1700. Due to a 20-30ms delay in sampling, setting a configured reporting time to
the minimum of one second will give samples at 1.02-1.03 seconds apart.
LTE
Unless you have a specific service from your carrier, LTE modems will not generally provide an
externally-available IP Services, such as Remote Management, will not work.
Modem
Franklin U770. The Modem’s Ethernet address conflicts with the default address of the Guest
LAN. A warning message is placed in the log and the Guest LAN is disabled. If you change the
address of the Guest LAN to a non-conflicting address, this restriction will not occur.
Sierra Wireless 313U, 330U. When these modems connect on 2G or 3G bands, specifically on
GSM 850, they will sometimes cause interference on the USB bus, resulting in the modem not
plugging properly. If this occurs, attaching the modem to a USB extension cable will generally fix
the problem.
The following USB modems contain an embedded web server through which many modem
settings are configured. To access the modem’s web pages, you must be logged in as the router
administrator. Once logged in, you can then access the modem web pages at these given IP
addresses:
Franklin U770, U772 /
Sprint (USA) -> 192.168.10.1
Netgear AC341U * /
Sprint (USA) -> 192.168.1.1 (address is configurable)
Pantech UML295VW * /
Verizon (USA) -> 192.168.32.2
* The modem web pages are available only when the modem is operating in NAT mode.

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
23
Release Notes for Cradlepoint Rev 6.5.2 Firmware
Products supported/tested:
AER3100/AER3150
AER2200
AER2100
AER1600/AER1650
AP22
IBR1700
IBR1100
IBR900/IBR950
Note: Before upgrading to new firmware, it is always a good idea to save the configuration file
from your current version. Thisfirmware version will remove a configuration for version 3.2 or lo
wer and will not try to keep your settings.
New features added in this release (Not all features are in all products
– see their respective Data Sheets):
No new features, defect fixes only
Additional UI/Usability changes:
No UI changes
Defects fixed:
IBR900 allows unfiltered ethernet packets across its LAN/WAN ports for a few seconds while
booting up

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
24
IBR1700. Quick Wifi Setup Wizard would not set the correct antennas for 2.4GHz operation
across a reboot
Fixed issue where sending GPS data to an incorrect destination could lead to failure.
IBR900. A GPIO connected to the external dock connector used for a modem connected signal
was fixed
AP22. Factory reset button worked on power-on but would not work while the AP was running
AER1600. Factory reset button would not wait for 10 seconds
Email alerts to Office 365 and Yahoo mail are undeliverable
Full NTP would not start SDK/NCP/AOOBM applications on boot.
SDK was not cleaning up temporary files after installation.
Analytics data was capturing internal traffic.
Analytics data was only keyed on IP address allowing analytics data from one client to be
attached to a different one.
Duplicating client usage data from previous day in reports to NCM.
CIDR notation for specifying IP address ranges in Web Access Filtering was not working
Interrupted SSH session can lead to a delayed router crash
AER2200. Added help text for the “Authorized MAC Addresses” section of the “Hotspot Services”
Networking page.
Security issues:
None
Modems tested: (new 6.4.3 modems / modem platforms are in blue text)
Cradlepoint Cellular Devices (Embedded & USB Modems)
Cradlepoint AER16x0LPE-AT / AT&T (USA)
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
25
Cradlepoint AER16x0LPE-GN / T-Mobile, US Cellular (USA); Generic (North America)
Cradlepoint AER16x0LPE-SP / Sprint (USA)
Cradlepoint AER16x0LPE-VZ / Verizon (USA)
Cradlepoint AER16x0LP4 / AT&T, T-Mobile, Verizon (USA)
Cradlepoint AER22x0-600M / AT&T (USA, Canada); T-Mobile, Verizon (USA); Generic (Europe, Australia,
NZ)
Cradlepoint IBR2x0-10M-VZ / Verizon (USA)
Cradlepoint IBR2x0-10M-B-AT / AT&T (USA)
Cradlepoint IBR350L / Verizon (USA)
Cradlepoint IBR350LPE-AT / AT&T (USA)
Cradlepoint IBR350LPE-GN / T-Mobile (USA); Generic (North America)
Cradlepoint IBR350LPE-SP/ Sprint (USA)
Cradlepoint IBR350LPE-VZ / Verizon (USA)
Cradlepoint IBR350P2 / AT&T (USA); Generic GSM-compatible locations (World)
Cradlepoint IBR6x0B-LP4 / AT&T, T-Mobile, Verizon (USA)
Cradlepoint IBR6x0C-LPE-AT / AT&T (USA)
Cradlepoint IBR6x0C-LPE-GN / T-Mobile (USA); Generic (North America)
Cradlepoint IBR6x0C-LPE-SP/ Sprint (USA)
Cradlepoint IBR6x0C-LPE-VZ / Verizon (USA)
Cradlepoint IBR6x0C-150M-B-EU / Generic operators (Europe)
Cradlepoint IBR6x0C-150M-C-AU / Generic operators (Australia)
Cradlepoint IBR6x0LPE-AT / AT&T (USA)
Cradlepoint IBR6x0LPE-GN / T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic
(North America)
Cradlepoint IBR6x0LPE-SP/ Sprint (USA)
Cradlepoint IBR6x0LPE-VZ / Verizon (USA)
Cradlepoint IBR6x0LP3-EU / Generic (Europe)
Cradlepoint IBR900LPE-VZ / Verizon (USA)
Note: Also certified on AT&T (USA), Sprint (USA), and Generic (North America)
Cradlepoint IBR9x0LP5 / Generic (APAC)
Cradlepoint IBR9x0LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe)
Cradlepoint IBR9x0-600M / AT&T (USA, Canada); T-Mobile, Verizon (USA); Generic (Europe, Australia, NZ)
Cradlepoint IBR11x0LPE-AT / AT&T (USA)
Cradlepoint IBR11x0LPE-GN / C-Spire, T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada);
Generic (North America)

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
26
Cradlepoint IBR11x0LPE-SP / Sprint (USA)
Cradlepoint IBR11x0LPE-VZ / Verizon (USA
Cradlepoint IBR11x0LP3-EU / Generic (Europe), Telstra (Australia)
Cradlepoint IBR11x0LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe)
Cradlepoint IBR17x0-600M / AT&T (USA, Canada); T-Mobile, Verizon (USA); Generic (Europe, Australia,
NZ)
Cradlepoint MC400L2 / Public Safety Band 14 only (USA)
Cradlepoint MC400LPE-AT / AT&T (USA)
Cradlepoint MC400LPE-GN / T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic
(North America)
Cradlepoint MC400LPE-SP / Sprint (USA)
Cradlepoint MC400LPE-VZ / Verizon (USA)
Cradlepoint MC400LP3-EU / Generic (Europe)
Cradlepoint MC400LP4 / AT&T, T-Mobile, Verizon (USA)
Cradlepoint MC400LP5 / Generic (APAC)
Cradlepoint MC400LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Vodafone (Worldwide), Generic (North
America, Europe)
3rd Party USB Cellular Modems
Franklin U770 (“Sprint Plug-In-Connect Tri-Mode USB Modem”) / Sprint (USA)
Franklin U772 (“Franklin U772 USB Modem”) / Sprint (USA)
Huawei E3276 / Telus (Canada)
Huawei E368 (“AT&T USBConnect Force 4G”) / AT&T (USA)
Netgear AC340U (“AT&T Beam”) / AT&T (USA)
Netgear AC341U (“NETGEAR® 341U USB Modem”) / Sprint (USA)
*supports Netgear firmware 4.07.01.11 and MR2 firmware 45.04.20.00
Novatel 551L LTE (“Verizon USB551L”) / Verizon (USA)
Novatel U620L (“Verizon MiFi© 4G LTE Global USB Modem U620L”) / Verizon (USA)
Novatel U679 (“4G LTE Novatel Wireless U679 Turbo Stick”) / Bell Mobility (Canada)
Novatel USB730L (“Verizon Global Modem USB730L”) / Verizon (USA)
Pantech UML295VW (“Verizon 4G LTE USB Modem UML2954G LTE”) / Verizon (USA)
*requires Pantech firmware version L0295VWD821F.B4 or later

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
27
Portsmith PSA1U1M (“Portsmith USB Client to Analog Modem Adapter”) / POTS phone providers
Sierra Wireless 308 USB (“AT&T USBConnect Shockwave”) / AT&T (USA)
Sierra Wireless 313U (“AT&T USBConnect Momentum 4G”) / AT&T (USA)
Sierra Wireless 320U (“Telstra USB 4G (Sierra AirCard 320U)”) / Telstra (Australia)
Sierra Wireless 330U (“4G LTE Sierra Wireless U330 – Turbo Stick”) / Bell Mobility (Canada)
Sierra Wireless 330U (“LTE Rocket Stick – Sierra Wireless AirCard 330U”) / Rogers (Canada)
ZTE MF683 (“T-Mobile Rocket 3.0 4G Laptop Stick”) / T-Mobile (USA)
Analog Modems
Portsmith PSA1U1M (“Portsmith USB Client to Analog Modem Adapter”) / POTS phone providers
Portsmith PS6EX1M (“Portsmith ExCard to Analog Modem Adapter”)
/
POTS phone providers (ExpressCard format, compatible with MBR1400s, MBR1200B, & CBA750B only)
Known issues
CP Secure Web Filter
Previous versions of firmware had a defect that improperly allowed customers to enter more
than 5 items per category in a custom category. Custom categories with more than 5 items need
to be removed before upgrading to 6.5.0 firmware. Failure to do this will lead to unpredictable
results. See Cradlepoint knowledge base for more detailed instructions.
http://knowledgebase.cradlepoint.com/articles/Support/Migration-Process-for-devicesupgrading-to-NCOS-6-5-or-newer-while-utilizing-Custom-CP-Secure-Web-Filter-Categories
HotSpot
Ethernet Threshold feature not functional
Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
28
GPS
IBR1700. Due to a 20-30ms delay in sampling, setting a configured reporting time tothe
minimum of one second will give samples at 1.02-1.03 seconds apart.
Zscaler
DynDNS mode does not work. Workaround is to configure the the Zscaler DNS servers as the
global static DNS servers
LTE
Unless you have a specific service from your carrier, LTE modems will not generally provide an
externally-available IP address. Services, such as Remote Management, will not work.
Modem
Franklin U770. The Modem’s Ethernet address conflicts with the default address of the Guest
LAN. A warning message is placed in the log and the Guest LAN is disabled. If you change the
address of the Guest LAN to a non-conflicting address, this restriction will not occur.
Sierra Wireless 313U, 330U. When these modems connect on 2G or 3G bands, specifically on
GSM 850, they will sometimes cause interference on the USB bus, resulting in the modem not
plugging properly. If this occurs, attaching the modem to a USB extension cable will generally fix
the problem.
The following USB modems contain an embedded web server through which many modem
settings are configured. To access the modem’s web pages, you must be logged in as the router
administrator. Once logged in, you can then access the modem web pages at these given IP
addresses:

Global Leader in 4G LTE Network Solutions
1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page:
29
Franklin U770, U772 / Sprint (USA)-> 192.168.10.1
Netgear AC341U */
Sprint (USA)-> 192.168.1.1(address is configurable)
Pantech UML295VW * /
Verizon (USA)-> 192.168.32.2
The modem web pages are available only when the modem is operating in NAT mode.



Leave a Reply