Airshell (airsh) Command Reference

For Airwall Gateways that have a console port, and for Linux Airwall Servers you can deploy and configure them with the Airshell (airsh) command-line interface. It provides tab-completion, inline help, and the ability to deploy and configure directly without going into diagnostic mode.

Get started

Connect a computer to the console port on the back of the Airwall or Conductor hardware, and use a terminal (macOS, Linux) or terminal emulator (Windows) to open the console. See the platform guide for your Airwall for specific connection instructions.

To access Airwall Gateways with airsh remotely, see Set up Remote Access to Airshell via SSH.

At the console:
  • v2.2.8 and later: log in with name: airsh, and no password
  • v2.2.5 and earlier: log in with name: airsh, and password: airsh.
You can then enter commands at the airsh» prompt.
Advantech Note: To configure an Advantech machine, you can put it into diagnostic mode. See Put an Airwall Gateway into diagnostic mode and Set up Advantech hardware.

No Default Password in v2.2.8 and later

Starting with v2.2.8, the Airshell console default login has no default password. If you are concerned about securing physical access to Airshell, set a password by entering conf password and following the prompts to set and confirm a new password. Keep this password in a secure location, as it cannot be recovered. This password is only for Airshell physical console access and is not used when you access Airshell remotely.

CAUTION: If this password is lost, you will need to do a factory reset to clear the password.

Common Commands

help [command]
Show help for the specified command.
help [tree]
List available commands. Use help tree to list available commands with their options.
setup-ui
Open the setup wizard to set up an Airwall Gateway. See Configure an Airwall Gateway with the airsh Setup Wizard.
conf network
v2.2.10 and later – Configure port groups, see Configure Port Groups with Airshell. For example: to modify port group (pg) 2 with an IP of 192.168.1.1/24, enter:
conf net modify pg=2 ip=192.168.1.1/24

v2.2.8 and earlier – Set up static IP addresses.

ping
Test network connectivity
status
See Airwall status:
  • Hostname – Shows the Airwall Gateway's identity used when it connects to the Conductor. You use this name to confirm the provisioning request from the Airwall Gateway.
  • HIT – The Host Identity Tag is a hash of the Airwall Gateway's Host Identity, the public key identifier. This IPv6-like identifier is used for secure communication.
  • LSI –The Local Scoped Identifier is a shortened IPv4 version of the HIT, used for secure communication.
  • Device cert. – Present indicates the presence of a device certificate, which means the Airwall Gateway has been provisioned by the Conductor.
  • Device key – Present indicates the presence of the device identity private key.
  • Keystore – Indicates where the device identity private key is stored: TPM, Operating System, or file-based keystore.
  • Annunciator – Displays the status of the annunciator. On some models this affects LEDs and/or LCD display.
  • Run mode – Indicates the mode the Airwall Gateway is running in:
    • Protected – Normal operation mode.
    • Transparent – Running with non-encrypted bridging.
    • Diagnostic – In diagnostic mode.
    • Factory reset – In factory reset mode.
    • HA primary/secondary/active – Indicates the High Availability role of the Airwall Gateway.
  • Conductor – See status of the connection to the Conductor. For more details, see status conductor below.
  • IP address – Shows the active IP addresses for this Airwall Gateway. An IP address displayed in green indicates it has been selected as active.
status conductor
Shows the status of the Airwall Edge Service's connection to the Conductor. Disconnected indicates the Airwall Edge Service is not connected to the Conductor.
Note: For Airwall Agents and Servers that support it, if Disconnected mode is On, you can still access resources on the Airwall secure network, and your Airwall Agent or Server will reconnect at intervals for configuration and trust policy updates. If you want to reconnect manually, use conductor sync.
conductor set
Set or remove a Conductor IP address or URL and port (optional). For example: conductor set my-conductor.tempered or just conductor set to remove.
conductor sync
If an Airwall Agent or Server is set to Disconnected mode on the Conductor, this command manually reconnects to retrieve any changes to configuration or trust policies. In Disconnected mode, you can still access resources on the Airwall secure network. See Sync an Airwall Agent or Server in Disconnected Mode.
diag
Put the Airwall Gateway in diagnostic mode
factory-reset
Reset Airwall Gateway back to factory default settings. If you want to preserve the network configuration, use the keep-networking option:
airsh>> factory-reset keep-networking
exit or quit
Exit Airshell
history
See the history of commands entered into Airshell. Enter history clear to delete history.
color on|off
Turn on or off color on the text output from the serial console.
reboot
Restart the Airwall Gateway.
shutdown
Shut down the Airwall Gateway.

Configuration Commands

activate [activation_code]
Activate a profile, and optionally, enter an activation code to connect an Airwall Gateway to the Conductor. For example:
airsh» activate 8z130f85eed9
Entering an activation code means the Airwall Edge Service can connect to the Conductor without an administrator needing to provision it.
conf
Configure Airwall Gateway or Conductor. You can configure these settings
  • conf conductor URL|IP_address – Set Conductor URL. Same as conductor set above.
  • conf cell [apn=auto|<apn>] [carrier=auto|<carrier>] [mode=3g|4g][pin=<code>][auth=none|pap|chap|both] [user=<user>] [pw=<password>][ip-type=<default,ipv4,ipv6,ipv4v6>] [roaming=<0|1>] – Get or set cellular modem configuration. Supported cellular carriers are: "AT&T", "Bell", "GCI", "Generic", "Rogers", "T-Mobile", "Telus", "VTel", and "Verizon". See also – U.S. Cellular Carrier Certifications
    • When you set the carrier to “auto”, the Airwall Gateway looks up the operator ID from the SIM card.
    • If your carrier name is not listed, use “Generic”.
    • When you set the APN to “auto”, the Airwall Gateway uses a default APN from the detected or specified carrier, or you can specify the APN provided to you.
  • conf cell2 [apn=auto|<apn>] [carrier=auto|<carrier>] [mode=3g|4g][pin=<code>][auth=none|pap|chap|both] [user=<user>] [pw=<password>][ip-type=<default,ipv4,ipv6,ipv4v6>] [roaming=<0|1>] – Get or set second cellular modem configuration.
  • conf network
    v2.2.10 and later – Configure port groups, see Configure Port Groups with Airshell. For example: to modify port group (pg) 2 with an IP of 192.168.1.1/24, enter:
    conf net modify pg=2 ip=192.168.1.1/24

    v2.2.8 and earlier – Set up static IP addresses.

  • conf password [delete] – Set (or delete) the password for the current Airshell user. Use conf password delete to remove the password. (conf password delete not available remotely)
  • conf ssh on|off|status – Enable, disable, or see the status of remote log in through SSH. See Set up Remote Access to Airshell via SSH for full details.
  • conf ssh-key add ssh_public_key – Add or remove public SSH keys you use to log in remotely. See Set up Remote Access to Airshell via SSH for full details.
  • conf ssh-key remove – Remove the public SSH key you use to log in remotely. See Set up Remote Access to Airshell via SSH for full details.
  • conf wifi – On WiFi-enabled Airwall Gateways, walks you through the steps to configure a WiFi connection.
setup-ui
v2.2.10 and later – Open the setup wizard to set up an Airwall Gateway. See Configure an Airwall Gateway with the airsh Setup Wizard.

Diagnostic commands

conductor status
Show Conductor settings and status.
conductor set
Set or remove a Conductor IP address or URL and port (optional). For example: conductor set my-conductor.tempered or just conductor set to remove.
diag
Put the Airwall Gateway in diag mode.
diag_report
Get a diagnostic report.
factory-reset [clear-identity]
Reset the Airwall Gateway to factory settings. Use with clear-identity to remove the device identity and licensing, and re-licensing the Airwall Gateway.
firmware-upgrade
Update the Airwall Gateway firmware from a file hosted on a reachable file server.
network-restart
Restart the network interfaces on the Airwall Gateway.
ping IP_address [-I interface ]
Ping the IP address, optionally with the interface specified with -I.

Status Commands

log [follow]
Show the latest lines of the system log. Use follow to follow the log output until you quit with CTRL+C.
status [<option>]
Display the status of the Airwall Gateway, or with an option, display the status of one of the following:
  • conductor – Get the status of connection to the Conductor
  • linkmanager – Get Linkmanager status.
  • cell – Get Cellular information
  • wifi – Get Wifi information
  • network – Get Network information
  • macs – Get the MAC addresses for all of the network interfaces on this Airwall Gateway.
  • routes – Get routing tables
  • peers – Get a list of peer Airwall Edge Services
  • ps – Get the running processes on this Airwall Gateway.
  • tunnels – Get a list of tunnels on this Airwall Gateway
  • relays – Get relay probe information
  • hip – Get HIP state
  • hipvars – Get additional HIP state