What are some best practices when implementing WR11 XT?

We are in the process of placing our first WR11 XT into service to remote support a server. Any best practices as to what to turn on or off etc?

Hello!

Best practices depends on the type of Cellular connection you are utilizing.

If you have a public static IP address, then we recommend enabling the firewall:
https://www.digi.com/resources/documentation/digidocs/90001019/default.htm#references/r_firewall.htm?Highlight=firewall

Changing the SSH and HTTPS ports:
https://www.digi.com/resources/documentation/digidocs/90001019/default.htm#references/r_first_settings_group.htm?Highlight=https%20port

And enable Digi SureLink for automatic recovery:
https://www.digi.com/resources/documentation/digidocs/90001019/default.htm#tasks/t_use_surelink_wizard.htm?Highlight=surelink

If you have private static or dynamic IP address from your carrier, enabling Digi SureLink should be enough since the device is not reachable from the greater WAN.