Watchguard XTM 5 Series

dog2bert

@stephenw10 Installed pfSense-CE-2.3.5-RELEASE-4g-amd64-nanobsd.img to a CF card and then everything booted correctly.

Log: https://pastebin.com/uMMPaw3J

Now the issue is getting to the webGui.

The WatchGuard will ping to google just fine.

PF isn't giving the laptop I have plugged into EM1 an IP address. I thought I made sure the DCHP server was turned on.

stephenw10

em1 is still failing there you only have 5 em NICs:

em1: <Intel(R) PRO/1000 Network Connection 7.6.1-k> port 0xac00-0xac1f mem 0xfe7e0000-0xfe7fffff,0xfe7dc000-0xfe7dffff irq 17 at device 0.0 on pci3
em1: Using MSIX interrupts with 3 vectors
em1: The EEPROM Checksum Is Not Valid
device_attach: em1 attach returned 5

The NIC shown as em1 there is actually port 3 on the XTM5, what would normally be em2.

Steve

dog2bert

@stephenw10 Ok, I won't use em1.

Switched to em2 for LAN, computer gets an IP address, but can't get to the webGUI

stephenw10

Some route conflict?
Can you ping 192.168.5.1?
Can you ping the client IP from pfSense?

You need to be on 2.4.5 though. There is no path to get there from Nano.

Steve

dog2bert

@stephenw10 I was able to flash the image to CF and then install from the same CF.

I also flashed the new bios, so let me know if any settings I should change there.

SSD and HDD will still not boot all the way.

stephenw10

With the unlocked BIOS you can boot from USB which might enable you to try some other things. At least you could boot USB and install to CF giving you the full card size.

Steve

dog2bert

@stephenw10 Tried to boot from USB but am getting a message about needing to insert proper media.
I have a usb drive with pfSense-CE-memstick-serial-2.4.5-RELEASE-p1-amd64.img

stephenw10

You will probably need to enable it in the BIOS. It's been so long since I did that I've forgotten what the defaults are. It can be made to boot USB. Mine does.

Steve

dog2bert

@stephenw10 Here are all my bios screenshots:

stephenw10

I have Mass storage emulation type set to 'auto' otherwise it's the same.

Are you sure the image is on the USB drive correctly? I recommend writing it with Etcher.

Steve

dog2bert

@stephenw10 Not sure what happened, attached an SSD I had tried before and now it works

dog2bert

Has anyone upgraded the fans?

stephenw10

You can replace them with something from Noctua for example. There are some references in this thread. I never bothered once I could set the minimum fan speed with WGXepc, those Noctua fans are expensive!

Steve

DirkS

@dog2bert Noiseblocker BlackSilent Fan XM-2-40mm does the job for me, cheap and silent, even at full speed. The watchguard is in my living room.

dog2bert

@stephenw10 What value should I use for the fan speed?
Can you set it in the BIOS now that I have it unlocked?

Is 10 safe?

Looks like the -f command doesn't work on the 5 series only -f2

/conf/WGXepc64 -f2 10

stephenw10

I have the system fan set to 50. The CPU fan is connected to the other controller and WGXepc can't set that (yet). You can set it manually though.

Steve

donald_f

@it-supportidata-se

I have XTM 5 with the belwo BIOS
root@OPNsense:/conf # dmidecode | less

dmidecode 3.2

Scanning /dev/mem for entry point.
SMBIOS 2.5 present.
44 structures occupying 2148 bytes.
Table at 0x000FBCD0.

Handle 0x0000, DMI type 0, 24 bytes
BIOS Information
Vendor: American Megatrends Inc.
Version: 080015
Release Date: 04/26/2010
Address: 0xF0000
Runtime Size: 64 kB
ROM Size: 1024 kB

I am safe to use this image to update my BIOS from https://sites.google.com/site/pfsensefirebox/home/xtm5_83.rom

stephenw10

They should all be compatible AFAIK, I've yet to see one that was not. That's just the date from the gen2 models, there are a few posts here confirming it works. For example:
https://forum.netgate.com/post/797569

Of course flashing the BIOS is always inherently risky. You could lose power part way though etc...

And you're running the wrong OS...

Steve

donald_f

@stephenw10
Thanks Steve... BIOS flash was successfully...
Still playing around with different firewalls before going production... if that makes sense

DaveAngel

The original Watchguard CF card OS boot is able to start Recovery Mode (SysB) or Safe Mode (SysA Safe) from LCD Keys
I think is something embedded in MBR or in GRUB stage...

I had a crazy idea... how shall be hard making a multiboot like that to choice via LCD keys which disk / partition will have to start ?

Obviously i think who should be the right one for the answer...
Stephen i'm very cold about ASM or C coding...
I can only give an original Watchguard CF image and no more right now.