WatchGuard Firebox T70

  • Hi everyone,

    I installed pfSense on a new WatchGuard T70, which is a tabletop form factor with 8 network interfaces, two of which are PoE.

    The first 3 interfaces are recognized by pfSense as igb0-2 and operate as expected. The last 5 interfaces are recognized by pfSense only as igb3 but none of these 5 interfaces work (the PoE voltage is present).

    Examining the PCB, the first 3 interfaces each have a dedicated Intel chip. The last 5 interfaces appear to be collectively driven by a one large chip with a heatsink. So, I'm thinking maybe a BSD driver is needed in order for the last 5 interfaces to work. At this point, I installed the developer version of pfSense thinking that this might automatically recognize the need for a driver and install the necessary driver, but nothing changed. I have no idea how to force pfSense to install the necessary driver.

    Maybe someone has some insight and can help me?

    Thank you,

  • Netgate Administrator

    Ah, I have wanted to get a look inside one of those for a while. Waaaay outside my curiosity price range though. 😉

    You have photos?

    The other 5 ports are almost certainly connected via a switch under the heatsink.

    Do you see link LEDs connecting to those ports?

    The switch is probably not configured by default and so not passing any traffic. It's far more secure to have the switch come up with it's ports disabled so that would be logical.
    However if you do see link it's possible the switch is configured with VLANs by default. Does igb3 show as linked and up?
    If so try running a packet capture on there with something on the external ports generating some traffic. You might see some tagged traffic come in. 🤞

    Otherwise you will need to configure the switch and that will depend on what the switch is. If you cannot remove the heatsink you might look at the Watchguard OS boot log for clues.


  • Watchguard T70 internal view 1.jpg Watchguard T70 internal view 2.jpg

  • Netgate Administrator

    Ooo, fun!

    Looks like there's decent labelling on things, including those dip switches. Not sure I can make it out but it looks like SW1 and SW5 are set in their 'default' positions? Slightly unclear if that's '2-wire eprom' or select between 2-wire or eprom.

    Were you able to get any sort of boot log?

    Did you install to mSATA in something else and move it across or boot from USB?


  • The mSATA is the boot disk (I had removed it temporarily when I took the photos). It boots quite fast from mSATA. Unfortunately, I made the mistake of overwriting the original mSATA that contained the Watchguard OS, so I destroyed the opportunity to observe the boot log.

    As a high-speed 3-interface pfSense box, this thing works very well. But I really would like to get the other ports working. I will do some more testing and report back, along with more photos.


  • Netgate Administrator

    Speculation time: I would guess that setting SW5 to it's alternate position allows the switch to pull it's config from the eeprom, rather than be programmed by the OS. There may not be any config in the there to pull of course.... And it might require the other DIP switches to be set also....
    The fact they are labelled MDC/MDIO implies they may allow/disallow programming the switch that way which is commonly how it's done on small switch chips.

    If the switch ports are all down by default, including the internal one, that may well be what's happening. It just has no config so defaults to disabling the ports.


Log in to reply