Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense on Watchguard M370

    Scheduled Pinned Locked Moved
    Hardware
    39
    235
    70.7k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      As far as I know the boards are identical across the series so I would expect it to work on any. But that remains untested.

      H 1 Reply Last reply Reply Quote 1
      • H
        HangmansNoose001380 @stephenw10
        last edited by

        @stephenw10 The documentation from Watchguard indicates that the M670 will take a Xeon processor which I believe requires the Intel C236 series chipset and the M370 has a B150 series chipset. The microcode is there on the M370 but I was unable to get it to run the Xeon processor which makes me suspect that at least the M670 has a different chipset, hence the warning. This part is all speculation and should not be referred to as fact. I defer to @stephenw10 here as he has more experience with the Watchguard devices than I do.

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Well not really with this. 😉 If you've tried the same Xeon as fitted in the 670 and it doesn't work in the 370 that seems pretty conclusive evidence it must be different to me.

          Steve

          1 Reply Last reply Reply Quote 1
          • H
            HangmansNoose001380
            last edited by

            Same Xeon but the device wouldn't even boot. I don't have any solid evidence on what chipset is in the M470 and M570 but I suspect they may have the C236 chipset as well. I'm currently flashing one of my M370's back to the stock bios so I can document the flash process of the unlocked/modified Lanner bios. Should have Part 2 of this documented by the end of this weekend.

            1 Reply Last reply Reply Quote 0
            • S
              soupman @HangmansNoose001380
              last edited by

              @hangmansnoose001380

              Ok i need to get some stuff and then reflash it.

              As I remember the xeon microcode was not in the bios.

              Update you when I have some progress.

              THX

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                The m470 does appear to have a C230 series chipset but I've found that can be misleading:

                [2.6.0-RELEASE][admin@m470-2.stevew.lan]/root: pciconf -lv
hostb0@pci0:0:0:0:	class=0x060000 card=0x20158086 chip=0x190f8086 rev=0x07 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Xeon E3-1200 v5/E3-1500 v5/6th Gen Core Processor Host Bridge/DRAM Registers'
    class      = bridge
    subclass   = HOST-PCI
pcib1@pci0:0:1:0:	class=0x060400 card=0x20158086 chip=0x19018086 rev=0x07 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '6th-10th Gen Core Processor PCIe Controller (x16)'
    class      = bridge
    subclass   = PCI-PCI
pcib2@pci0:0:1:1:	class=0x060400 card=0x20158086 chip=0x19058086 rev=0x07 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = 'Xeon E3-1200 v5/E3-1500 v5/6th Gen Core Processor PCIe Controller (x8)'
    class      = bridge
    subclass   = PCI-PCI
pcib3@pci0:0:1:2:	class=0x060400 card=0x20158086 chip=0x19098086 rev=0x07 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = 'Xeon E3-1200 v5/E3-1500 v5/6th Gen Core Processor PCIe Controller (x4)'
    class      = bridge
    subclass   = PCI-PCI
xhci0@pci0:0:20:0:	class=0x0c0330 card=0x72708086 chip=0xa12f8086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family USB 3.0 xHCI Controller'
    class      = serial bus
    subclass   = USB
none0@pci0:0:20:2:	class=0x118000 card=0x72708086 chip=0xa1318086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family Thermal Subsystem'
    class      = dasp
ig4iic0@pci0:0:21:0:	class=0x118000 card=0x72708086 chip=0xa1608086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family Serial IO I2C Controller'
    class      = dasp
ig4iic1@pci0:0:21:1:	class=0x118000 card=0x72708086 chip=0xa1618086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family Serial IO I2C Controller'
    class      = dasp
ahci0@pci0:0:23:0:	class=0x010601 card=0x72708086 chip=0xa1028086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Q170/Q150/B150/H170/H110/Z170/CM236 Chipset SATA Controller [AHCI Mode]'
    class      = mass storage
    subclass   = SATA
pcib4@pci0:0:28:0:	class=0x060400 card=0x72708086 chip=0xa1108086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib5@pci0:0:28:4:	class=0x060400 card=0x72708086 chip=0xa1148086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib6@pci0:0:28:5:	class=0x060400 card=0x72708086 chip=0xa1158086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib7@pci0:0:28:6:	class=0x060400 card=0x72708086 chip=0xa1168086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib8@pci0:0:28:7:	class=0x060400 card=0x72708086 chip=0xa1178086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib9@pci0:0:29:0:	class=0x060400 card=0x72708086 chip=0xa1188086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib10@pci0:0:29:1:	class=0x060400 card=0x72708086 chip=0xa1198086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib11@pci0:0:29:2:	class=0x060400 card=0x72708086 chip=0xa11a8086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib12@pci0:0:29:3:	class=0x060400 card=0x72708086 chip=0xa11b8086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
isab0@pci0:0:31:0:	class=0x060100 card=0x72708086 chip=0xa1498086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'C236 Chipset LPC/eSPI Controller'
    class      = bridge
    subclass   = PCI-ISA
none1@pci0:0:31:2:	class=0x058000 card=0x72708086 chip=0xa1218086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family Power Management Controller'
    class      = memory
none2@pci0:0:31:4:	class=0x0c0500 card=0x72708086 chip=0xa1238086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family SMBus'
    class      = serial bus
    subclass   = SMBus
none3@pci0:1:0:0:	class=0x0b4000 card=0x00008086 chip=0x04348086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'DH89XXCC Series QAT'
    class      = processor
none4@pci0:1:0:1:	class=0x020000 card=0x0dc18297 chip=0x04368086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'DH8900CC Null Device'
    class      = network
    subclass   = ethernet
igb0@pci0:2:0:0:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb1@pci0:2:0:1:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb2@pci0:2:0:2:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb3@pci0:2:0:3:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb4@pci0:3:0:0:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb5@pci0:3:0:1:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb6@pci0:3:0:2:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb7@pci0:3:0:3:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb8@pci0:5:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb9@pci0:6:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb10@pci0:7:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb11@pci0:8:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb12@pci0:9:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb13@pci0:10:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb14@pci0:11:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb15@pci0:12:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet

                Steve

                H 1 Reply Last reply Reply Quote 0
                • H
                  HangmansNoose001380
                  last edited by

                  Part 2: Detecting and backing up chip

                  1. You’ll need SPI programmer software that can read the chip from the CH341A/Mobo SPI. Listed below are the 2 pieces of software that I have found that will read the chip:
                    a. AsProgrammer v2.0.3a -
                    b. NeoProgrammer V2.2.0.8
                  2. Note the following steps are for the AsProgrammer software. The steps are mostly same for both programmer software. Do not attempt the steps below unless the CMOS battery has been removed and the power cable has been disconnected from the M370.
                    a. Launch AsProgrammer
                    b. Click “Read ID” button and you should get a list of 3 chips (2 WINBOND W25Q128 chips and 1 Spansion. I believe you can select either of the WINBOND options but I used the W25Q128FV.
                    c8fe7910-40c1-47cd-a2df-6b3943fbb86a-image.png
                    81623040-2283-4aef-a4e9-2539457bc242-image.png

                  c. Next you’ll need to unprotect the chip by clicking the “Unprotect” button to the right of “Read ID”.
                  2cf0e271-4aaf-4a83-838c-8a9e63c54cd2-image.png

                  d. After Detecting/Selecting/Unprotecting the chip click the “Read IC” button. This reads the original bios from the chip.
                  adb2fefd-c571-41a8-a192-0fa4c62f5afd-image.png
                  5aa1bde1-e02f-4528-9794-9a410755b805-image.png

                  e. Once the read completes run a verification check by clicking the “Verify IC” button to make sure the image read into memory is clean.
                  89cc5e15-7e83-4825-908b-0ba449f75a1d-image.png
                  d4d26a57-f84e-454c-9cf4-fdb523c3c496-image.png

                  f. At this point, if the verification succeeded without errors, I would strongly suggest saving the original bios as a backup copy. If you receive an error either the chip is still protected, cables are not connected correctly, or USB port is not supplying enough power to the mobo. Do not proceed with Step 3 if you do not have a clean backup.

                  1 Reply Last reply Reply Quote 0
                  • H
                    HangmansNoose001380
                    last edited by

                    Part 3: Erasing Chip

                    1. After saving the original bios the next step is the click the “Erase IC” button. This will completely erase the contents of the chip and can take a few minutes.
                      c849631a-4d9e-4f5a-ac7a-168357bb0492-image.png
                      dc0f88f0-84d9-43df-935e-c12fe5a88bcb-image.png
                      dc329a75-d812-4fd4-b2ef-ead0e0b1402f-image.png
                    2. After the Erase has completed, you’ll need to verify the chip was erased successfully by clicking the drop-down button next to the “Verify IC” button and selecting “Blank check”. Note whether the verification was successful or not before proceeding with the next step. Sometimes the chip must be erased twice before verification succeeds.
                      9b1b8c2d-0cd3-4e9b-8400-8928f153d030-image.png
                      d42d305d-4474-43f8-96e3-3f0fbb280a98-image.png
                    1 Reply Last reply Reply Quote 0
                    • H
                      HangmansNoose001380
                      last edited by HangmansNoose001380

                      Part 4: Reprogramming chip with modded bios

                      1. Open the modified bios file in AsProgrammer that you would like to flash to the chip.
                        3c9290b3-c435-4a59-93e6-9fe87cfc2eb4-image.png

                      2. Click the “Program IC” button to start the flash of the modified bios to the chip.
                        11f13714-781b-4267-bb63-6a930133d369-image.png

                      3. Click “Yes” in the pop-up window asking for confirmation to start the programming.
                        e4a0a1c7-5de4-44b7-9c8a-6e91eaadefd3-image.png

                      4. Programming can take several minutes to complete. There is a progress bar to show completion status.
                        11a9c048-8cd4-4b0f-be73-d37a47d33d30-image.png bolded text
                        8e709f9e-444b-4f7d-9aac-f549e9320741-image.png

                      5. Once complete click the “Verify IC” button to verify the modified bios was flashed successfully.
                        5c099454-75b2-4b78-97d5-02ed197d0c34-image.png
                        58011d10-d4ff-47aa-bdd4-c8954160297d-image.png
                        bcbef490-19fa-4a76-a441-974225e5a074-image.png

                      6. If all steps completed successfully you should be able to disconnect your SPI programmer from the mobo SPI header, insert your CMOS battery back in, plug the power cable back in and power it on. The machine takes about a minute or so to boot up and post, then it will reboot, power on and immediately power off and reboot again, and after that you should be able to access the bios menu at this point.

                      1 Reply Last reply Reply Quote 0
                      • H
                        HangmansNoose001380
                        last edited by

                        WatchGuard original post:
                        142ed77b-8b2a-4c89-b5f8-774b5380ce75-WG_OriginalBios.jpeg

                        WatchGuard original prompt to access bios:
                        e3ccb206-32ee-43b1-898f-e078054f3fc8-WG_OriginalBios_SetupPrompt.jpeg

                        Mod_Bios post:
                        d15ecabc-a652-42f6-bb91-064d174fa25d-Mod_boot.jpg

                        Mod_Bios Menu:
                        aa32d889-aa42-4cb9-9e64-d93fd805e91b-Mod_bios.jpg

                        1 Reply Last reply Reply Quote 0
                        • H
                          HangmansNoose001380
                          last edited by

                          Side note: I would not enable Turbo Mode option in the modified bios if you are running a 6th gen processor. pfSense will hang on boot if it's enabled with a 6th gen processor. Works fine with a 7th gen processor.

                          Example of my configuration with 6th gen processor:

                          8f70ddaa-85ea-4d38-b111-c277e56b6a78-image.png

                          1 Reply Last reply Reply Quote 0
                          • H
                            HangmansNoose001380 @stephenw10
                            last edited by

                            This post is deleted!
                            1 Reply Last reply Reply Quote 1
                            • H
                              HangmansNoose001380
                              last edited by

                              After comparing notes with @stephenw10 it does appear the M370 and M470 have different chipsets, so this guide should only be used for the M370 unless you're feeling adventurous.

                              On the M370 when I run pciconf -lv I get this:
                              isab0@pci0:0:31:0: class=0x060100 card=0x72708086 chip=0xa1488086 rev=0x31 hdr=0x00
                              vendor = 'Intel Corporation'
                              device = 'B150 Chipset LPC/eSPI Controller'
                              class = bridge
                              subclass = PCI-ISA

                              For the M470 it says:
                              isab0@pci0:0:31:0: class=0x060100 card=0x72708086 chip=0xa1498086 rev=0x31 hdr=0x00
                              vendor = 'Intel Corporation'
                              device = 'C236 Chipset LPC/eSPI Controller'
                              class = bridge
                              subclass = PCI-ISA

                              1 Reply Last reply Reply Quote 0
                              • N
                                nicknitro
                                last edited by

                                Hi all, i hope you're doing great.
                                @HangmansNoose001380 @stephenw10 @soupman @all in the post.

                                What a great accomplishment have been made here, this is terrific!!! Thanks for the update info and hard work.
                                The fact that you can flash a generic image to the units brings more opportunities to improve computing capabilities and also made the units more Software Friendly.

                                With standard limitations i have manage to install, pFSense (obviously) and some Hypervisors (Proxmox, VMWare Esxi), also some routing software (VyOS, Mikrotik RouterOS, OpenWRT) and Debian, just checking what could be a good a way to take advantage more efficiently and effective on the units.

                                I have only tested some i3 6100 with up to 32Gb Ram plus Some SATA SSD, but can assure you that on M370 Neither e3-1225v5 or e3-1240v5 or e3-1275v3 will work in the units, this looks like a Chipset limitations, as comments above.

                                Right now, i have 5 units (M370) brand new that were sitting on my office shelf. Actually 6, that one is running our beloved pFSense.

                                This updates give me hopes to prepare them and take advantage to build, maybe a Small VM cluster or how knows, some kind off weird project.

                                I have some CPUs (i5 6th and 7th gen, also a i7 7700 that maybe would work, using the Generic BIOS.

                                I'll be following up and help in anything I can, let's take this units to the next level. 🚀

                                Thanks all for your hard work.

                                Regards.

                                H T 2 Replies Last reply Reply Quote 1
                                • H
                                  HangmansNoose001380 @nicknitro
                                  last edited by

                                  @nicknitro I can tell you that when I modded the bios I updated the Microcodes and the modules for video and network and I am currently running an i5-7500:

                                  2a166e38-12fc-4273-910e-bf64c421ac0a-image.png

                                  Q 1 Reply Last reply Reply Quote 0
                                  • M
                                    Mathias HH
                                    last edited by

                                    Hi,

                                    hast anyone a watchguard t70 or t30 running pfsense? I can get one of these and plan to start with pfsense on it.

                                    Mathias

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      The T30 is an ARM device so nope. The T70 can be used but there is no driver for the switch interfaces so it requires hardware mods to use those ports. Significant risk of destroying it! 😉
                                      https://forum.netgate.com/topic/151470/watchguard-firebox-t70

                                      Steve

                                      M 1 Reply Last reply Reply Quote 0
                                      • S
                                        soupman
                                        last edited by

                                        I recovered the bios of the m370 and it is indeed unlocked.

                                        My experience.
                                        Laptop
                                        usb-c (3.0 and 3.1) ---usb-c to usb a adapter---ch341A did not work. Drivers had to be installed manually. Still asprogrammer did not see the ch341a

                                        Desktop
                                        usb 3.0 -- ch341A worked, drivers loaded automatically after install.
                                        recovery done with the desktop.

                                        The ch341a is a risky board because of the 3.3v fault on it.
                                        Thanks to all for the hard work and insights.

                                        H 1 Reply Last reply Reply Quote 1
                                        • H
                                          HangmansNoose001380 @soupman
                                          last edited by HangmansNoose001380

                                          @soupman Thanks for the feedback. The earlier Ch341a's had a 3.3v issue that was corrected in the newer versions. It could also be possible to pull the 3.3v power connector (leave the ground) and just plug power into the box and program it with the it powered down, but I have not fully tested that method.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            Mathias HH @stephenw10
                                            last edited by

                                            @stephenw10 Thanks a lot for your Feedback, than i will try the T70

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post