Watchguard XTM 5 Series

cyablo

Hi there, I just got my hands on a XTM 5 and wanted to play with pfSense, Strangely it has a newer BIOS Version WD0 from 04/26/2010. I found no info about that. Since I wanted to upgrade the Processor and enable Speedstep to reduce Power consumption, the BIOS mod surely will not work for my Device or can I simply downgrade the BIOS to the mod'ed Version?

maksimred

Hi, Any support for Watchguard XTM 5 series XTM 535? I know XTM 530 is supported, but cannot find any information on XTM 535. Picked up a XTM 535 for $100 and want to wipe watch guard OS and install pfsense.

stephenw10

As far as I know the 535 is just a spec update over the older models. Faster CPU, more ram perhaps but the board is the same.

The install procedure is identical. https://doc.pfsense.org/index.php/PfSense_on_Watchguard_Firebox#Installing_pfSense_5

What have you tried? What happened? What di you expect to happen?

Steve

stephenw10

@cyablo:

The BIOS mod surely will not work for my Device or can I simply downgrade the BIOS to the mod'ed Version?

The modified BIOS will probably run fine on your box though you may have a different ROM size which gives you a hard time getting it installed.

You should definitely backup your existing BIOS first and be prepared to recover somehow if there's a problem.

I never got speedstep to work in any useful way on my box even after enabling everything. The driver reports it's enabled but not recognised. You may have more luck with other CPUs.

Anyone have speedstep working as expected?

Steve

cyablo

Looks like I have to buy a SOIC8 Clip then :) Did you use the Celeron 440 while testing for SpeedStep? Regarding to Intel ARK, it has no SpeedSpeed capability. I have a Pentium E5800 lying around which does support it. WIll test further after the Clip arrived and I've done a Backup of the BIOS ROM.

cyablo

Alright, I just found out about the SPI header and dumped the ROM with a Arduino and level shifter (see attachment).

Can somebody please confirm that this is a successful dump or even mod the Version? I'm not skilled enough.

BTW: Pentium E5800 + 4 GB RAM working fine in my Box.

MD0.zip

blaxx

Hi !

I don't know if this is a pfsense or XTM5 problem but I'll give it a try.

I have two XTM5 (510 and 525) with original BIOS and hardware except for hard drives that I have installed latest pfsense 2.3.4-p1 on. I have never used pfsense before so I installed it on these firewalls to see if it works. No changes are made on the config after first boot.

The problem is that after a couple of days both of the firewalls stops routing all traffic. Cant reach them from webgui and cant connect to internet at all anymore.
The only solution I've found is to pull the plug. After that it works for a couple of days again.

I read an old thread regarding a bug when using multicore cpu so I tried that fix by disabling all but one core but that didn't help.

Anyone have an idea regarding what might be the problem?

Kind regards

Stellan

chpalmer

Im going towards another problem. Such as a bad switch or interface card on your computer or..

There is no problem running multiple cores. Im on 4 here on my XTM and many others with other boxes more than that.

Do you have a console cable so you can monitor with a program like Putty? Id be curious about what dmesg shows as this happens..

blaxx

@chpalmer:

Im going towards another problem. Such as a bad switch or interface card on your computer or..

There is no problem running multiple cores. Im on 4 here on my XTM and many others with other boxes more than that.

Do you have a console cable so you can monitor with a program like Putty? Id be curious about what dmesg shows as this happens..

Thanks for your reply.

The "issue" is that both of the firewalls have the same problem and they ran fine with Watchguard OS on them. I have a hard time believing that there should be faulty hardware on both of them but I can't be certain.

I have a console cable I can plug in and connect with putty but I'm very new to pfsense and linux in general so I don't know what you want me to test.

Do you have a command I should write when the error occurs?

A Former User

This post is deleted!

chpalmer

@blaxx:

The "issue" is that both of the firewalls have the same problem and they ran fine with Watchguard OS on them. I have a hard time believing that there should be faulty hardware on both of them but I can't be certain.

I have a console cable I can plug in and connect with putty but I'm very new to pfsense and linux in general so I don't know what you want me to test.

Do you have a command I should write when the error occurs?

choose option 8 and type dmesg after a failure.

When you say you can't reach the gui- are you using a host name or an IP address?

I don't think your boxes are bad.. I think you have a switch or other device on you network going south. But some troubleshooting is in order.

blaxx

@chpalmer:

@blaxx:

The "issue" is that both of the firewalls have the same problem and they ran fine with Watchguard OS on them. I have a hard time believing that there should be faulty hardware on both of them but I can't be certain.

I have a console cable I can plug in and connect with putty but I'm very new to pfsense and linux in general so I don't know what you want me to test.

Do you have a command I should write when the error occurs?

choose option 8 and type dmesg after a failure.

When you say you can't reach the gui- are you using a host name or an IP address?

I don't think your boxes are bad.. I think you have a switch or other device on you network going south. But some troubleshooting is in order.

Connecting through IP to the gui.

I dont have any switches attached to the firewalls. One of them is just powered up with nothing connected to it and the other one has a DSL-line in WAN and one PC in LAN0.

I will try dmesg and reply here next time it happens.

stephenw10

@blaxx
Yeah, if the console responds at all then it's probably not a hardware problem. Just hitting return there should re-draw the console menu. Something should be logged.

@747Builder
Do you see Speedstep working correctly on any of those?

I have a feeling it could just be the CPU (E4500) I have here but it's the only one I've tested it with so….

Steve

A Former User

This post is deleted!

stephenw10

On the dashboard it will report the Current vs Max frequency, that's probably easiest. See screenshot.

You can also see the current and available levels in the sysctls:

[2.4.0-BETA][root@8860.stevew.lan]/root: sysctl dev.cpu.0
dev.cpu.0.temperature: 32.0C
dev.cpu.0.coretemp.throttle_log: 0
dev.cpu.0.coretemp.tjmax: 98.0C
dev.cpu.0.coretemp.resolution: 1
dev.cpu.0.coretemp.delta: 66
dev.cpu.0.cx_method: C1/hlt
dev.cpu.0.cx_usage_counters: 2723221
dev.cpu.0.cx_usage: 100.00% last 47776us
dev.cpu.0.cx_lowest: C1
dev.cpu.0.cx_supported: C1/1/0
dev.cpu.0.freq_levels: 2400/8 2200/0 2000/0 1800/0 1600/0 1400/0 1200/0
dev.cpu.0.freq: 1200
dev.cpu.0.%parent: acpi0
dev.cpu.0.%pnpinfo: _HID=none _UID=0
dev.cpu.0.%location: handle=\_PR_.CPU0
dev.cpu.0.%driver: cpu
dev.cpu.0.%desc: ACPI CPU

And you can see the est driver loader against the cpu cores:

[2.4.0-BETA][root@8860.stevew.lan]/root: cat /var/log/dmesg.boot | grep est
est0: <enhanced speedstep="" frequency="" control="">on cpu0
est1: <enhanced speedstep="" frequency="" control="">on cpu1
est2: <enhanced speedstep="" frequency="" control="">on cpu2
est3: <enhanced speedstep="" frequency="" control="">on cpu3</enhanced></enhanced></enhanced></enhanced>

Steve

Selection_277.png_thumb

SONiQz

Hi All,

I have an XTM505 and an XTM330 which we've pulled from active service…. So now I have some new desk ornaments!

Anyway, I've pulled the 505 apart and had aimed to see what pfSense can do for me. So I've thrown a new Kingston 4GB CF in with a 2GB image of "pfSense 2.3.4 NanoBSD" as I was hoping to run from the CF, however I seem to run into a somewhat inconsistent issue. If I reboot the device the CF seems to sometimes crap itself and I get dumped into a Single User Mode prompt (if it gets past POST) and errors when I try to remount the CF as R/W so then I need to reflash..... Hardly ideal.

I do see errors like: "DMA limited to UDMA33, controller found non-ATA66 cable" when it does successfully boot, but other than that there's nothing out of the ordinary. I have dropped the original 1GB CF back in and that seems fine so I don't think there is a board issue. And the 4GB CF is new and seems to write and verify so I am a bit baffled as I wasn't really planning on dropping a HDD in it as I don't have a cradle spare.

Has anyone else had similar issues or suggestions as to what may be causing the problem I'm all ears!

Thanks in advance

stephenw10

I didn't think it was required on that board but you may need to disable UDMA for CF card if yours is particularly fussy:
https://doc.pfsense.org/index.php/Boot_Troubleshooting#pfSense_2.2_and_later

Steve

DeLorean

@SONiQz:

Hi All,

I have an XTM505 and an XTM330 which we've pulled from active service…. So now I have some new desk ornaments!

Anyway, I've pulled the 505 apart and had aimed to see what pfSense can do for me. So I've thrown a new Kingston 4GB CF in with a 2GB image of "pfSense 2.3.4 NanoBSD" as I was hoping to run from the CF, however I seem to run into a somewhat inconsistent issue. If I reboot the device the CF seems to sometimes crap itself and I get dumped into a Single User Mode prompt (if it gets past POST) and errors when I try to remount the CF as R/W so then I need to reflash..... Hardly ideal.

I do see errors like: "DMA limited to UDMA33, controller found non-ATA66 cable" when it does successfully boot, but other than that there's nothing out of the ordinary. I have dropped the original 1GB CF back in and that seems fine so I don't think there is a board issue. And the 4GB CF is new and seems to write and verify so I am a bit baffled as I wasn't really planning on dropping a HDD in it as I don't have a cradle spare.

Has anyone else had similar issues or suggestions as to what may be causing the problem I'm all ears!

Thanks in advance

If you use the Kingston 4GB standard type, that's without doubt your cause of problems.
These cards are so slow that they cause all kinds of ATA errors.
Disabling UDMA will not help for this issue.
I have seen this behaviour the first time on a x750e , and there was UDMA disabled and still ATA errors.
Switching to another brand or use the 16Gb High Speed version of Kingston and your problem is vanished :-)

Grtz
DeLorean

A Former User

This post is deleted!

Billyboy

Hi all,
I have two XTM5 (505 and 515) with the BIOS:

Vendor: American Megatrends Inc.
Version: 080015
Release Date: 02/03/2010

and upgraded hardware on both:

CPU: Intel E5800 @ 3.2 Ghz
RAM: 2 GB
SSD: 60 GB

running on the latest pfsense 2.3.4-p1.

I have configured the boxes for HA failover through CARP and with MultiWAN.

While I was testing the failover, I recognized problem:

When I pull a cable out of any of the em ports, Pfsense needs more than 5 Minutes to change the interface to down (both in the GUI DASHBOARD as well as on the Interfaces status page). However the port LEDs are switched off imediatelly.

I found the following in the syslog:

Aug 24 16:24:35 php-fpm[55068]: /rc.dyndns.update: MONITOR: WAN5_1GW is down, omitting from routing group WAN_GWG_654_LB 199.7.83.42|192.168.245.101|WAN5_1GW|17.248ms|4.241ms|24%|down
Aug 24 16:31:24 kernel: em4: Watchdog timeout Queue[0]– resetting
Aug 24 16:31:24 kernel: Interface is RUNNING and ACTIVE
Aug 24 16:31:24 kernel: em4: TX Queue 0 ------
Aug 24 16:31:24 kernel: em4: hw tdh = 61, hw tdt = 21
Aug 24 16:31:24 kernel: em4: Tx Queue Status = -2147483648
Aug 24 16:31:24 kernel: em4: TX descriptors avail = 40
Aug 24 16:31:24 kernel: em4: Tx Descriptors avail failure = 39
Aug 24 16:31:24 kernel: em4: RX Queue 0 ------
Aug 24 16:31:24 kernel: em4: hw rdh = 518, hw rdt = 517
Aug 24 16:31:24 kernel: em4: RX discarded packets = 0
Aug 24 16:31:24 kernel: em4: RX Next to Check = 518
Aug 24 16:31:24 kernel: em4: RX Next to Refresh = 517
Aug 24 16:31:24 kernel: carp: demoted by 240 to 240 (interface down)
Aug 24 16:31:24 kernel: em4: link state changed to DOWN

On the first entry (16:24:35), the Gateway goes down because of the disconnected cable.
More than 6 Minutes later, at 16:31:24 the system changed the link state to down.

On the fxp0 port, everything works fine.

Anyone have an idea regarding what might be the problem?

Kind regards