Successful Install on Watchguard Firebox X700!

cologuy

Thanks, I was on a different sub-net so I never saw it on my network.

mleducxittel

This is a really interesting POST. However, following the WatchGuard Hardware Guide, I'm concerned about the performances. Did you know if somebody have proceed with some benchtests?

stephenw10

I guess people haven't really tested it's maximum possible throughput because the NICs are limited to 100Mbps. See this post though: http://forum.pfsense.org/index.php/topic,7458.msg164371.html#msg164371

Watchguard claim ~275Mbps firewall throughput. The throughput in pfSense is likely to lower since it's FreeBSD rather than Linux. That's not always the case though. That figure refers to the maximum summed throughput on all interfaces so it's complex to setup and not relevant for most cases. You could group some interfaces using LAGG if you have a suitable switch but that still won't help unless your test stream is multiple connections.

What are you looking for in terms of performance? What are you using the box for?

Steve

webspeed

Hello,

I want to install pfsense on a Firebox x700 but I don't have a serial cable and I can't therefore reach the console to go through the initial configuration.

Could someone be so kind to share an image of their working embedded 4g pfsense with LCD driver / WGXepc and post a download link?

Thanks

stephenw10

I could probably manage that sometime this weekend, I'll have to check the status of my X-Core box. However you should really have a serial console cable. Sometimes it's the only way of accessing the box, if you've accidentally locked yourself out for example. They are very cheap and easily available (in most places).

Steve

webspeed

@stephenw10:

I could probably manage that sometime this weekend, I'll have to check the status of my X-Core box. However you should really have a serial console cable. Sometimes it's the only way of accessing the box, if you've accidentally locked yourself out for example. They are very cheap and easily available (in most places).

Steve

Thanks Steve, the image would give me the instant gratification we all crave :) even though I guess buying a serial cable is inevitable…

drdyno

Steve,

Have you ever tried to use the 256mb CF card that came in the firebox to install pfsense or you just get bigger cf cards?

I hate going out to buy one if i dont have to.

I managed to pick up a x550e this week for $50

Jeff

stephenw10

The smallest pfSense Nano image is 512MB. The price of 2GB CF cards is pretty low but I agree I hate spending money unnecessarily. ;)

Steve

webspeed

@drdyno:

Steve, have you ever tried to use the 256mb CF card that came in the firebox to install pfsense or you just get bigger cf cards? I hate going out to buy one if i dont have to. I managed to pick up a x550e this week for $50. Jeff

Search eBay and you'll see Hitachi 4gb microdrives listed for $5 shipped, not a big investment :)

stephenw10

Careful with those. Not all microdrives support ATA mode on the interface.
http://doc.pfsense.org/index.php/Microdrive_embedded_installations

Steve

CuriousG

Today I had an issue with the webgui so I decided to reboot through the LCD, I did hear the speaker where it would indicate it was going to reboot but after about a minute I tried the procedure again and that didn't work. So I just manually flipped the switch. When I turned it back on, all I got on the LCD was a bunch of blocks on the top half the of the display.

Has anyone run into this issue where the CF fails to boot? I've had this in production for about 3 months running pfSense 2.03 upgraded from 2.02.

I'm not sure if I saved the configuration so is there a way for me to extract the configuration before rewriting the CF? This is using a 2GB Team CF rated 133X.

stephenw10

You can mount the card and read it on a FreeBSD system. The config.xml file is stored in the config slice which is the smallest of the three on the card.

The two X700 boxes I've had behaved differently. The one I have currently working shows the row of blocks exactly as you describe before booting correctly. The previous one showed various things during the boot stages but eventually stopped booting all together. I think it was a dead capacitor on the board but it also had transit damage. Before it died completely it would boot maybe every third try. You could tell it wasn't going to boot because the arm/disarm LED did something odd (I can't quite remember what).

Steve

webspeed

I need some help with two pesky issues:

Getting hyper terminal to connect to Firebox x700 console. I bought a Cisco console cable (same that Watchguard provides) and I can't see any output either with Hyper Terminal or Putty, check the configuration, etc. to no avail. I installed pfsense both on a CF card and on a PATA drive, and tested it on a laptop, it worked fine. I also check that the Firebox x700 is in working order by installing the original 64mb CF card back in, booted fine.
Removing the heatsink, it's one of those bright orange copper things and I don't see how to remove it, I downloaded Watchguard's manual and it says "Remove CPU by disconnecting heatsink clip and lifting socket arm" but I don't see how to disconnect said clip, it's embedded in the center of the clip like a tight belt.

Any help would be greatly appreciated.

stephenw10

Do you see any output from the console when you boot the Watchguard OS? The console speed is 115200 for the original OS and 9600 for pfSense. You will have to change the speed to avoid the serial port at some point.
https://doc.pfsense.org/index.php/PfSense_on_Watchguard_Firebox#Serial_Port_Quirk
If you don't see any output then you probably have the wrong cable.

Steve

webspeed

@stephenw10:

If you don't see any output then you probably have the wrong cable.
Steve

Can you point to an example of the right console cable? I bought a "RJ45 to DB9 Cisco Console Management Cable", same as provided by Watchguard, it should work.

Regards

stephenw10

Hmm, how have you connected this? The console port on the x-core is db9 not rj45.
I would expect to use something like this:
http://www.amazon.com/Tripp-Lite-Modem-Cable-P450-006/dp/B000067SCH
I haven't tried that cable personally.

Steve

webspeed

Thanks for your answer and the link. The cable I bought has DB9 on one end (to the Firebox) and a RJ45 on the other (to ethernet on my laptop). Hyperterminal says it's "connected" but I never get any output

doktornotor

@webspeed:

Thanks for your answer and the link. The cable I bought has DB9 on one end (to the Firebox) and a RJ45 on the other (to ethernet on my laptop). Hyperterminal says it's "connected" but I never get any output

Oh… lol. This cannot work. You need DB9 -> USB. Like http://www.ebay.co.uk/itm/230584255185

stephenw10

Exactly. You can't use an ethernet port to talk serial. If your laptop, or any other machine you have, doesn't have a serial port then you will need a USB to serial converter in addition to the null modem cable. The one Doktornotor linked to above is what I'm using since most modern computers don't have a serial port.

Steve

stephenw10

A short while ago I ran some tests on the SafeXcell encryption card in most X-Core boxes. I was inspired by this thread in which it is claimed the card not only works but speeds up a VPN connection significantly.

There isn't any doubt that the card is supported to some extent by the safe(4) driver. If you run cryptotest from the console it reports the crypto framework correctly using the card and gives some test figures.
A simolar result can be seen by running openssl speed:

Without the Safenet card

[2.0.3-RELEASE][root@pfSense.localdomain]/root(1): openssl speed -evp aes-128-cbc

Doing aes-128-cbc for 3s on 16 size blocks: 4443103 aes-128-cbc's in 2.89s
Doing aes-128-cbc for 3s on 64 size blocks: 1258138 aes-128-cbc's in 2.91s
Doing aes-128-cbc for 3s on 256 size blocks: 318359 aes-128-cbc's in 2.87s
Doing aes-128-cbc for 3s on 1024 size blocks: 80907 aes-128-cbc's in 2.89s
Doing aes-128-cbc for 3s on 8192 size blocks: 10450 aes-128-cbc's in 2.98s
OpenSSL 0.9.8y 5 Feb 2013
built on: date not available
options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) aes(partial) blowfish(idx) 
compiler: cc
available timing options: USE_TOD HZ=128 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc      24627.37k    27709.88k    28411.35k    28646.12k    28707.23k

With the Safenet card:

[2.0.3-RELEASE][root@pfSense.localdomain]/root(13): openssl speed -evp aes-128-cbc

Doing aes-128-cbc for 3s on 16 size blocks: 117285 aes-128-cbc's in 0.14s
Doing aes-128-cbc for 3s on 64 size blocks: 110095 aes-128-cbc's in 0.05s
Doing aes-128-cbc for 3s on 256 size blocks: 93032 aes-128-cbc's in 0.04s
Doing aes-128-cbc for 3s on 1024 size blocks: 56316 aes-128-cbc's in 0.05s
Doing aes-128-cbc for 3s on 8192 size blocks: 8643 aes-128-cbc's in 0.00s
OpenSSL 0.9.8y 5 Feb 2013
built on: date not available
options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) aes(partial) blowfish(idx) 
compiler: cc
available timing options: USE_TOD HZ=128 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc      13690.32k   156398.83k   538937.61k  1147202.67k 70803456.00k

The number when using the card are far higher at 64bytes or higher. However at small sizes it's actually lower.

When running a real test using an site to site style OpenVPN connection with the X-Core box as one end the results are interesting. Using aes-128-cbc I was able to push ~25Mbps but after removing the card completely I was seeing ~33Mbps. This is perhaps understandable if VPN traffic is mostly small packets. It seems that to make use of the card would require tuning the VPN tunnel to use much larger packets.

In the wiki page I have said that the Safenet card does not work correctly. It would seem from my testing that better advise would be to remove it completely but I would like to get other opinions on that. Anyone seen similar results?

Steve