Networking

This page covers day-2 networking changes — how to swap an appliance between DHCP and a fixed IP, what the static-IP fields mean, how to set up an appliance connected to two networks at once, and how the apply / revert flow protects you from locking yourself out. The screen described here is Network Configuration in the operator TUI.

The networking mode is also chosen during installation, but on a running appliance you change it from this screen rather than reinstalling.

DHCP vs static — which to pick

The Network Configuration screen offers two modes at the top: DHCP (automatic) and Static IP. The screen always starts in whatever mode the appliance is currently using; move the highlight up or down to switch.

• DHCP is the default and is the right choice when the network already hands out addresses automatically. Most office LANs and many plant networks fit this pattern. You do not need to type anything else — DHCP mode has no extra fields.
• Static IP is for environments without a DHCP server, or when the appliance needs a fixed address. Two situations make static unavoidable: the mobile pairing flow stores the appliance's address in each phone, so a DHCP lease that changes silently breaks every paired device; and any external monitoring or reverse proxy that points at the appliance needs an address that does not move.

Switching modes is non-destructive — the previous configuration is snapshotted before anything is written, so you can flip from DHCP to static (or back) and revert if the new setting does not work. See Apply, revert, and backups.

The three static-IP fields

When Static IP is selected, three fields appear below the mode picker. Use tab (or the arrow keys) to move between them.

• IP Address — the appliance's address, written in CIDR notation: address plus subnet-mask length, separated by a slash. Example: 192.168.1.100/24. The /24 part is required — without a prefix length the appliance has no way to know which other hosts are on its subnet.
• Gateway — the IP address of the router that forwards traffic off the local subnet. Without this, the appliance can talk to other hosts on the same LAN but cannot reach the internet or any other network. Ask your LAN team for the gateway address if you do not already have it; it is usually the first or last usable address in the subnet (for example 192.168.1.1 or 192.168.1.254).
• DNS Server — the IP address of the resolver the appliance should use to translate hostnames into IP addresses. Internal DNS at the customer site is usually preferred when one exists, because it can resolve site-local names (file servers, plant systems) that public resolvers cannot. A public resolver like 8.8.8.8 works as a fallback when no internal resolver is available.

The TUI refuses obviously malformed input: an IP without a prefix length, or a gateway or DNS server that is not a valid IPv4 address (hostnames like dns.example.com are not accepted — use the resolver's IP). The error appears in red below the fields and the change is not applied — fix the value and press apply again.

Appliances with more than one network port

Some appliances are connected to two networks at once — typically one facing the office network, where people reach the web interface, and one facing the production network, where the machines are. When the appliance has more than one ethernet port, Network Configuration opens on a list of them rather than going straight to the mode picker:

> enp1s0     primary      static 192.168.1.100/24
  enp2s0     additional   static 10.10.0.5/24 · no services
  enp3s0     —            not configured

Move the highlight with the arrow keys and press Enter to configure the selected port. Esc returns to the list. An appliance with a single port skips the list entirely — there is nothing to choose between.

On an appliance that was installed before this screen could tell ports apart, no port is recorded as the primary one. The first time you open the screen Pulse works out which port that is, marks it, and says which port it picked and on what grounds:

• it holds the address the appliance is configured with, or
• it carries the default route — the port the appliance's traffic actually leaves by, which is what being the primary port means, or
• it is the only port with an address at all.

Nothing is written until you apply, and pressing p on a different port overrides the choice.

If none of those applies — several ports with addresses and no default route among them — no port is marked and the list says so. Additional ports cannot be configured until one is: highlight the port Pulse is reached on and press p.

Finding out which port is which

Ports are named by where their card sits in the machine, and that order does not have to match the order the sockets are laid out in. On a server with four identical sockets, the names on screen and the holes on the back can be in any correspondence.

Press d and the appliance works it out for you: unplug the cable from the port you mean, plug it back in, and that port is selected. The list updates within a second or two and confirms which one it found. You do not have to unplug anything else first — only the port that moves is detected.

If no cable is moved, the search gives up after about a minute and says so; Esc calls it off sooner. Either way you can still pick the port from the list by hand — each entry shows its hardware address, which usually matches a label on the card, and whether a cable is currently in it.

If a network card is replaced or moved

Interfaces are named for where their card sits in the machine, so moving a card to another slot — or replacing the mainboard — can change the name. Pulse records which card each configured interface is, and follows it: at the next start the configuration re-binds itself to whatever the card is now called, and the appliance comes back on the same address as before.

Nothing is renamed and nothing you configured changes. If you open Network Configuration afterwards, the list shows the new name against the same settings.

This works for interfaces configured from this screen or during installation. An appliance set up before this was recorded picks it up the next time you apply any network change.

Primary and additional ports

One port is the primary. It carries the gateway and the DNS server, and it is the address Pulse is reached on: the web interface, paired phones, and any collectors all use it. It always offers the web interface and SSH.

Every other port is additional. An additional port exists so Pulse can read machines on a second network. It takes an address but has no gateway and no DNS server of its own, because only one port can provide those. A second default route is the most common way an appliance on two networks loses contact with the first one.

To move the primary role to another port, highlight it and press p. The previous primary keeps its address and becomes an additional port. Fill in the gateway and DNS server for the new primary — the old values described the old port's network, so they are cleared.

The three modes for an additional port

• DHCP (automatic) — the second network hands out an address. Any gateway and DNS server it also offers are ignored.
• Static IP — you give the port a fixed address. Only the address field appears; there is no gateway or DNS field.
• No address (PROFINET only) — the port stays live but takes no address at all. PROFINET device discovery still finds controllers on that segment, because it does not need one. This is what a port starts as before you configure it, and it is the right choice for a segment you only want to scan for PROFINET devices.

Each port needs its own subnet. Two ports on the same subnet are refused when you apply: Pulse cannot tell which of them to use, and the second would not appear as a separate network to scan.

Reaching machines behind a router

An additional port reaches its own subnet without further configuration. If the machines sit on a different subnet, behind a router inside the production network, add a route so the appliance knows how to get to them. The Routes field appears when the port is set to a static address:

10.10.5.0/24 via 10.10.0.1

Read it as "to reach the network 10.10.5.0/24, hand the traffic to the router at 10.10.0.1". Separate several routes with commas. Leave the field empty when the machines are on the same subnet as the port — which is the common case.

The gateway of a route must itself be on the port's own subnet. A router the port cannot reach directly cannot forward anything for it, and the appliance refuses the route rather than accepting a setting that would do nothing.

You cannot enter a route to 0.0.0.0/0 here. That is a second default route, and only the primary port has one — see Primary and additional ports. Routes are also only available on a port with a static address: give the port a fixed address first if it needs them.

The web interface and SSH on an additional port

An additional port does not offer the web interface or SSH. That is deliberate — a port facing the production network should not put an administrative interface there. The list spells out which it is, no services or serves web UI and SSH, so you never have to assume.

If a site does need Pulse reachable from the second network, highlight the port and press s. Press s again to switch it back off. The primary port is unaffected; it always offers both.

What the appliance scans

Once an additional port has an address, the network it is on appears as a scannable network in the web interface, on the Assets > Discover devices page. You do not have to type the subnet — the appliance already knows it. A port set to No address does not appear there, but PROFINET discovery still reaches it.

Apply, revert, and backups

The bottom of the screen shows the available keystrokes:

tab navigate • ctrl+s apply • ctrl+r revert • esc back

Ctrl-S applies the change. Before writing the new configuration, the appliance takes a snapshot of the previous one. If everything looks good — gateway pings, DNS resolves, the web UI still loads — you are done. A short confirmation (Network configuration applied) appears under the form on success.

Ctrl-R reverts to the previous configuration. This is the safety net for the case where you locked yourself out. It restores the primary port, which is the one that can strand you; additional ports keep their current settings. A typical scenario: an operator switches to static IP, types the wrong gateway, and the appliance is no longer reachable from the workstation. The console TUI is still available locally — log in there, open Network Configuration, press Ctrl-R, and the previous (working) settings come back. The screen confirms the rollback with Reverted to previous network configuration.

Below the message area the screen prints how many previous configurations are kept for rollback (for example 2 previous config(s) available for rollback). The count climbs each time you apply a change, so a quick test of "did my change actually do anything" is to apply, see the count tick up, and confirm.

Press Esc to leave the screen without applying. Edits in the input fields are discarded — nothing is written until Ctrl-S is pressed.

A safe sequence for a static-IP change

When you do not have physical console access and are working over SSH, the revert path is the difference between a five-minute change and a site visit. The sequence we recommend:

1. Make sure you have a way to reach the console — either physically at the appliance, or via remote KVM/iLO/iDRAC if the hardware supports it. The TUI on the console always works regardless of the network configuration.
2. Note the current settings on a piece of paper before you start, so you know what "working" looked like.
3. Switch to static, fill in the three fields, and press Ctrl-S.
4. From a second workstation (not the one you are SSH'd in from), confirm the appliance is reachable on the new IP — pinging it, loading the web UI, or both.
5. If anything looks wrong, log in on the console and press Ctrl-R. The previous configuration is restored and the appliance is reachable again.

Where the configuration lives

Managed by the TUI — do not edit by hand

The networking settings are persisted in /var/pulse/site.env. Treat that file as TUI-managed: every change should go through the Network Configuration screen so the backup snapshot is taken and the dependent services (networkd, the web UI base URL) are reloaded in the right order. Editing the file directly bypasses both, and the next apply from the TUI will overwrite your changes anyway.

If you suspect the file is corrupt or out of sync, the safest recovery is the same revert path described above — Ctrl-R rolls back to the previous good snapshot rather than asking you to hand-edit the file.

Related screens

The Network Configuration screen handles IP-level settings only. Two adjacent concerns live elsewhere in the TUI:

• NTP Configuration — sets the time-synchronization server. Time and IP are independent: changing the network mode does not change the NTP setting, and vice versa.
• TLS Certificates — manages the certificate the web UI presents. The certificate's Subject Alternative Names (SANs) include the appliance's IP, so after a static-IP change you may want to regenerate or reinstall the certificate to match the new address. Additional ports with a fixed address are included automatically; for a port on DHCP, add its address to the SAN list on that screen.

See the TUI Reference for the full list of menu entries and the Installation page for the equivalent network step during first-boot setup.