Watchguard XTM 5 Series

samtap

In my experience, you have to flash the modified bios since the official bios is locked and many options can't be changed i.e. the boot device preferences, by default it only boots from CF even if nothing else is attached. I was able to run the pfSense installer from CF and install to SATA disks, but it still refused to boot. You'll need the bios firmware, flash tool and some OS, boot that from CF just to flash the bios (you could likely even use the factory firmware and serial console for it, if you can find a compatible flash tool binary). After flashing lots of options that used to be read-only can now be changed and you can boot from SATA, USB etc. In addition with the modified bios pfSense can use front LCD to display some useful stats.

shawl01

@samtap Ok, I thought that may be thew case, but many people on here have said to flash the bios from within pfsense, but mine will not even get that far.

@stephenw10 As you were asking about the image i tried making it on a Win7 PC incase it was the mac no writing it correctly to the CF but I get exactly the same response and it freezes in the same spot. Could my putty settings be wrong and it freezes once it goes into the setup program??

Thanks

samtap

I think there must be subtle differences between different xtm series and maybe even hardware revisions. For example people claim it boots USB/SATA once you disconnect CF reader, I believe them but for my xtm5 it didn't work like that.

By the way, are you sure it freezes during boot? It might be just the serial console settings that change after it gets through POST and starts booting the OS...

shawl01

Ok.

So I went a step further and used my CF card and HDD connected to a VM and installed pfsense onto the hdd.

Tried hdd in xtm and hdd booted fine unto the exact same point.

So put the hdd back into the vm and booted the hdd and completed the setup with the network card configuration. and then restarted pfsense a couple of times to make sure it was booting all the way through with no questions hoping up. Then put hdd back into xtm and it boots up still to the exact same point, but I have my laptop plugged into port one to see if it gets an IP with the thought that maybe the console is freezing but it isn't getting an IP. And before you think it, yes I did remove the CF card.

Have removed the encryption card in case that was causing an issue but with no joy

So am now not sure what to do next?

Do I have a broken box or do I just need to find a way to flash the bios? I did note at the bios screen I have a date of 04/26/2010 which seems different from the date previously mentioned with bios flashes.

Thanks again
Luke

stephenw10

It's an odd place in the boot to stop. It's well after the loader variables are set, which is where it would break if you had the wrong baud rate configured. It's before it mounts the root filesystem, which is where it stops writing to all consoles so is thas last thing you see if you have the VGA console set as primary.
Does it still boot the WG OS correctly? Or, say, the OpenWRT x86 image if you don't have the original OS?

Steve

shawl01

@stephenw10 Haha, I did power it up before I started and from what I could tell it booted normally. However in the messing about between writing images to CF cards I have overwritten the CF card that came in the unit so now can't check again :-(

Thanks
Luke

shawl01

@stephenw10 I down loaded openwrt-18.06.4-x86-generic-combined-ext4.img and the unit boots with it but the serial port settings must be different as it comes up with garbage while booting looking around it seems to be 115200/8/1/None which is what I have set.

Thanks
Luke

stephenw10

Hmm, I thought that was the default now in OpenWRT too. Try 9600 though.

Maybe you have a bad serial cable? Trying to use the extended serial lines and failing?

Steve

shawl01

@stephenw10 Tried 9600 - no joy different garbage but still garbage. I am starting to wonder about the serial cable too but I need to look and see if I have any others with the rj45 end on them.

Thanks
Luke

stephenw10

With any half recent serial terminal you only need three connections. More than that might just break stuff if it's not wired correctly. Certainly to connect to pfSense you only need 3 pins connected.
Some older stuff like the X-e bios and FreeDOS required more.

Steve

shawl01

@stephenw10 Have tried three different cables now and all with the same results, lost

Luke

stephenw10

If you can find one you might try an old NanoBSD serial image directly on the CF card. There are still some mirrors out there hosting them even though they shouldn't be.

Steve

shawl01

I have now tried versions 2.3.5 in both amd64 and i386 and both freeze at the same point as version 2.4.4 I have also tried removing some memory and moving it between banks.

I have also tried to boot the old CF card I used to flash the x550 bios, not to use on this bios but just to see if I can get a dos prompt but again all I get is garbage once past the post screen.

I suspect I need to flash the bios but how can I do this if nothing will load? Failing that I think my box may be a dud :-(

Can't think of anything else left to try now.

Luke

shawl01

@stephenw10 Would this be the right one to try pfSense-CE-2.3.5-RELEASE-4g-i386-nanobsd.img.gz it doesn't say serial but some of the others do say VGA?

The previous versions I have tried have all been memstick versions

Thanks
Luke

stephenw10

Yes, that would do it. As long as the CF card is 4GB or bigger.

stephenw10

It's an odd place to stop. For reference on mine at that point:

fxp0: Ethernet address: 00:90:7f:87:dc:74
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel ICH7 UDMA100 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xffa0-0xffaf at device 31.1 on pci0
ata0: <ATA channel> at channel 0 on atapci0
ahci0: <Intel ICH7 AHCI SATA controller> port 0x7c00-0x7c07,0x7880-0x7883,0x7800-0x7807,0x7480-0x7483,0x7400-0x740f mem 0xfe4ffc00-0xfe4fffff irq 19 at device 31.2 on pci0
ahci0: AHCI v1.10 with 4 3Gbps ports, Port Multiplier supported
ahcich0: <AHCI channel> at channel 0 on ahci0
ahcich1: <AHCI channel> at channel 1 on ahci0
ahcich2: <AHCI channel> at channel 2 on ahci0
ahcich3: <AHCI channel> at channel 3 on ahci0
acpi_button0: <Power Button> on acpi0
uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
uart0: console (115200,n,8,1)
uart1: <16550 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
ppc0: <Parallel port> port 0x378-0x37f irq 7 on acpi0

The SATA controller is running in AHCI mode so it shows slightly differently to yours.
The next thing that shows is the power button (is yours stuck maybe?) but then the console....

Can you interrupt it at the boot loader menu to reach the loader prompt?

If it has some console problem you might try forcing VGA console. You will get no output but it should still boot completely allowing you webgui access.

Steve

shawl01

@stephenw10 Hi Steve, I tried the nanobsd last night and it stuck it exactly the same place, can you give a little more detail on how to force the VGA method please.

Thanks
Luke

shawl01

@stephenw10 Should have added both internal and external power buttons can turn the unit on and off ok. Could you clarify what jumpers you have in place please?

Thanks
Luke

stephenw10

Booting to VGA console as primary:
https://docs.netgate.com/pfsense/en/latest/hardware/boot-troubleshooting.html#booting-with-an-alternate-console

You should still hear the boot tune if it is able to fully boot using that.

Steve

shawl01

@stephenw10 Hi Steve, apologies for the delay in coming back to you. Well I have tried the VGA boot with no joy I have also tried all the other settings such as safe mode, verbose, single user, all with no joy and all stop at the same place. I have also tried booting with no console cable attached, nothing good.

The seller I bough from ebay has other units for auction so have contacted him about purchasing a second unit to confirm if unit number one is faulty as they have a returns policy so could return it.