Connect a Basics Station gateway

After you add a gateway, you configure the gateway itself once. It then connects by itself and stays connected; nothing else has to be set on it. This page describes the settings in general terms. Gateway makers name the menus differently, so look for the equivalent fields on your gateway’s own configuration page.

What the gateway needs

Gateway setting	Basics Station file	Value from Hermetry
Network server mode	—	Basics Station (LNS). Not the UDP packet forwarder.
Server address (LNS URI)	`tc.uri`	Your LNS address, for example `wss://acme.<network server host>`
Server certificate	`tc.trust`	The downloaded `tc.trust` file, or the gateway’s system certificate store
Authorisation	`tc.key`	The token header line: `Authorization: Bearer <token>`

Hermetry uses only the LNS connection. It does not use the configuration-update service (CUPS) some gateways offer: there are no cups.uri or cups.key files. Configure the gateway once by hand, and again by hand if you rotate its token.

Step by step

On the gateway, choose the LoRaWAN network server mode Basics Station (LNS), not the UDP packet forwarder.
Set the server address (LNS URI, tc.uri) to your LNS address. If the gateway asks for a discovery or router-info address instead, use the Discovery address, which ends in /router-info.
Set the server certificate (tc.trust): upload the downloaded tc.trust file, or choose the system’s certificate store if the gateway offers it.
Set the authorisation token (tc.key) to the token header line. Some gateways take the whole line Authorization: Bearer <token>; others have a token field and add the Authorization: Bearer part themselves. If you downloaded tc.key, upload it as is.
Save and restart the gateway’s packet forwarder.

The gateway shows as Online on its LoRaWAN tab within a minute.

The three files

If your gateway takes files, download them from the drawer right after adding the gateway (or after rotating its token). Each file is plain text ending with a newline:

# tc.uri
wss://acme.lns.example.com

# tc.key
Authorization: Bearer 3q2-7…

# tc.trust
-----BEGIN CERTIFICATE-----
…
-----END CERTIFICATE-----

The files are downloaded straight from your browser; Hermetry never puts the token in a link.

What happens when the gateway connects

The gateway opens a secure websocket to your address and presents its token.
The network server checks the token and that the gateway EUI in the connection matches the gateway the token belongs to.
The gateway sends its version. The network server answers with the EU868 radio configuration (channels, data rates and your network’s NetID), so you do not set channels on the gateway yourself.
Uplinks start to flow. The gateway’s device goes online and its health is recorded once a minute.

Frames that a gateway sends before its version message are ignored. A gateway that sends three malformed messages within 60 seconds is disconnected.

Check the connection

Open the gateway on the Devices page and its LoRaWAN tab:

The status badge says Online.
Round trip shows the time a message takes to the gateway and back. Above 800 ms the value is marked: Slow link: devices with a short RX delay fall back to RX2.
Connected since shows when the current connection opened.
Frames this gateway heard fills as devices send.

Troubleshooting

Symptom	Likely cause	What to do
The gateway never comes online	It still runs the UDP packet forwarder.	Switch it to Basics Station.
The gateway never comes online	The token line is wrong or incomplete.	Copy the whole Token header again, or rotate the token and use the new one.
The gateway never comes online	The token belongs to another gateway (EUI mismatch).	Each gateway has its own token. Use the token issued for this EUI.
The gateway never comes online	It does not trust the certificate.	Use the `tc.trust` file, or the gateway’s system certificate store.
The gateway never comes online	It points to an old address after your web address changed.	Copy the current LNS address from the gateway’s LoRaWAN tab.
It was online, then stopped after a token rotation	The old token stops at once.	Put the new token on the gateway.
It is Disabled	Someone disabled it.	Select Enable on its LoRaWAN tab.
Online, but no frames	No device in range, or devices use another band.	Check the frames log and that your devices are EU868 devices.

Refusal reasons the network server uses: no_credential (no token or certificate sent), bad_token (unknown or wrong token), eui_mismatch (the token or certificate belongs to another EUI), revoked (the gateway is disabled), mode_not_supported (the gateway is not in cloud mode). Your gateway’s own log may show one of these as the close reason.