Stonesoft FW-1030, FW-1060 Appliance Installation Manual

Appliance Installation Guide

Stonesoft FW-1030 and FW-1060

Legal Information

Revision: AIG_Stonesoft_FW-1030_1060_20121026

End-User License Agreement

The use of the products described in these materials is subject to the then current end-user license
agreement, which can be found at the Stonesoft website:
www.stonesoft.com/en/support/eula.html

Third Party Licenses

The Stonesoft software includes several open source or third-party software packages. The appropriate
software licensing information for those products at the Stonesoft website:
www.stonesoft.com/en/support/third_party_licenses.html

U.S. Government Acquisitions

If Licensee is acquiring the Software, including accompanying documentation on behalf of the U.S.
Government, the following provisions apply. If the Software is supplied to the Department of Defense
(“DoD”), the Software is subject to “Restricted Rights”, as that term is defined in the DOD Supplement to
the Federal Acquisition Regulations (“DFAR”) in paragraph 252.227-7013(c) (1). If the Software is supplied
to any unit or agency of the United States Government other than DOD, the Government’s rights in the
Software will be as defined in paragraph 52.227-19(c) (2) of the Federal Acquisition Regulations (“FAR”).
Use, duplication, reproduction or disclosure by the Government is subject to such restrictions or successor
provisions.

Product Export Restrictions

The products described in this document are subject to export control under the laws of Finland and the
European Council Regulation (EC) N:o 1334/2000 of 22 June 2000 setting up a Community regime for the
control of exports of dual-use items and technology (as amended). Thus, the export of this Stonesoft
software in any manner is restricted and requires a license by the relevant authorities.

General Terms and Conditions of Support and Maintenance Services

The support and maintenance services for the products described in these materials are provided pursuant
to the general terms for support and maintenance services and the related service description, which can be
found at the Stonesoft website:
www.stonesoft.com/en/support/view_support_offering/terms/

Replacement Service

The instructions for replacement service can be found at the Stonesoft website:
www.stonesoft.com/en/support/view_support_offering/return_material_authorization/

Hardware Warranty

The appliances described in these materials have a limited hardware warranty. The terms of the hardware
warranty can be found at the Stonesoft website:
www.stonesoft.com/en/support/view_support_offering/warranty_service/

Trademarks and Patents

The products described in these materials are protected by one or more of the following European and US
patents: European Patent Nos. 1065844, 1189410, 1231538, 1231754, 1259028, 1271283, 1289183,
1289202, 1304830, 1304849, 1313290, 1326393, 1361724, 1379037, and 1379046 and US Patent
Nos. 6,650,621; 6,856,621; 6,912,200; 6,996,573; 7,099,284; 7,127,739; 7,130,266; 7,130,305;
7,146,421; 7,162,737; 7,234,166; 7,260,843; 7,280,540; 7,325,248; 7,360,242; 7,386,525;
7,406,534; 7,461,401; 7,573,823; 7,721,084; and 7,739,727 and may be protected by other EU, US, or
other patents, or pending applications. Stonesoft, the Stonesoft logo and StoneGate, are all trademarks or
registered trademarks of Stonesoft Corporation. All other trademarks or registered trademarks are property
of their respective owners.

Disclaimer

Although every precaution has been taken to prepare these materials, THESE MATERIALS ARE PROVIDED
"AS-IS" and Stonesoft makes no warranty to the correctness of information and assumes no responsibility
for errors, omissions, or resulting damages from the use of the information contained herein. All IP
addresses in these materials were chosen at random and are used for illustrative purposes only.

Copyright © 2012 Stonesoft Corporation. All rights reserved. All specifications are subject to change.

2

Introduction

Thank you for choosing a Stonesoft™ appliance. This guide provides
instructions for the initial hardware installation and the maintenance of
the FW-1030 and FW-1060 appliances. See Product Documentation
(page 4) for information on other available documentation.

The use of the appliance is subject to the acceptance of the End User
License Agreement, which can be found at the Stonesoft website.

Contents

Installation Procedure .................. 4

Product Documentation ................ 4

Safety Precautions ....................... 5

Unpacking the Appliance .............. 7

Front Panel .................................. 8

Back Panel .................................. 9

Rack-Mounting............................. 10

Connecting the Cables ................. 14

Initial Configuration ...................... 16

Maintenance Operations............... 24

Disposal Instructions ................... 26

Caution – Never open the covers of the appliance! There are no user
serviceable parts inside. Opening the covers may lead to serious
injury and will void the warranty. Read the Safety Precautions (page 5)
before you conduct any installation or maintenance operations on the
appliance.

Introduction 3

Installation Procedure

Management

Client

Management

Server

Initial

Configuration

File

USB Memory

Stick

Appliance

USB Memory

Stick

Note – You must have a working Management Center on a separate
server to bring the appliance(s) operational. See the Stonesoft
Management Center Installation Guide.

 To install the appliance

1. Configure the Firewall element in the Management Client, and

save the initial configuration on a USB memory stick. See the
Firewall/VPN Installation Guide.

2. Install the appliance into a rack and connect the cables. See

Rack-Mounting (page 10) and Connecting the Cables (page 14).

3. Insert the USB memory stick in a USB port on the appliance, and

reboot the appliance to import the initial configuration. See Initial
Configuration (page 16).

Product Documentation

Press F1 in any Management Client window to view the Online Help.
All PDF guides are available:

• On the Management Center CD-ROM (in the Documentation folder)

• At the Stonesoft website at http://www.stonesoft.com/en/support/
technical_support_and_documents/manuals/

Install the free Adobe Reader program to view the PDF documents
(available at www.adobe.com/reader/).

4 Installation Procedure

Safety Precautions

The following safety information and procedures must be followed
whenever working with electronic equipment. However, please be
advised that Stonesoft appliances are not end-user serviceable, and you
must never open the appliance covers for any reason. Doing so may lead
to serious injury and will void any hardware warranty that may be
associated with your appliance.

Electrical Safety Precautions

Basic electrical safety precautions should be followed to protect yourself
from harm and the appliance from damage:

• Be aware of the locations of the power on/off switch as well as the
room's emergency power-off switch, disconnection switch, or
electrical outlet. If an electrical accident occurs, you can then quickly
cut power to the system.

• Do not work alone when working with high voltage components.

• Use only one hand when working with powered-on electrical
equipment. This is to avoid making a complete circuit, which will
cause electrical shock. Use extreme caution when using metal tools,
which can easily damage any electrical components or circuit boards
they come into contact with.

• Do not use mats designed to decrease electrostatic discharge as
protection from electrical shock. Instead, use rubber mats that have
been specifically designed as electrical insulators.

• The power supply cord must include a grounding plug and must be
plugged into a grounded electrical outlet.

Caution – Never open the appliance covers! There are no user
serviceable parts inside. Opening the covers may lead to serious
injury and will void the warranty.

General Safety Precautions

Follow these rules to ensure general safety:

• Keep the area around the appliance clean and free of clutter.

• We recommend using a regulating uninterruptible power supply (UPS)
to protect the appliance from power surges, voltage spikes and to
keep your system operating in case of a power failure.

Safety Precautions 5

ESD Precautions

Electrostatic discharge (ESD) is generated by two objects with different
electrical charges coming into contact with each other. An electrical
discharge is created to neutralize this difference, which can damage
electronic components and printed circuit boards. Use a grounded wrist
strap designed to prevent static discharge.

Note – Use a UPS (Uninterruptible Power Supply) in critical
environments with your Stonesoft appliance. If after a brief power
outage your Stonesoft appliance only partially starts up (for example,
the power light is on, but the appliance does not connect) turn the
appliance off for five seconds and then back on.

Laser Precautions

Class 1 Laser Product.

Caution – Invisible laser radiation is emitted from the end of fiber
cable and from fiber port. Do not stare into the beam and avoid direct
exposure to the beam.

Operating Precautions

Care must be taken to assure that the cover is in place when the
appliance is operating to ensure proper cooling. If this rule is not strictly
followed, the warranty may become void. Do not open the power supply
casing. Power supplies can only be accessed and serviced by a qualified
technician of the manufacturer.

Operating and Storage Temperatures

The allowed operating temperature of the appliance is 0...+40ºC. The
allowed storage temperature is -20...+70ºC. Do not operate or store the
appliance in temperatures outside these limits.

6 Safety Precautions

Lithium Battery Precautions

Caution – Do not change the battery; the battery must be replaced by
authorized service personnel only. Danger of explosion if battery is
incorrectly replaced. Replacement battery must be same or equivalent
type recommended by the manufacturer. Used batteries must be
discarded according to the manufacturer’s instructions. Short­circuiting the battery may heat the battery and cause severe injuries.

For California:

Perchlorate Material - special handling may apply. See www.dtsc.ca.gov/
hazardouswaste/perchlorate.

This notice is required by California Code of Regulations, Title 22,
Division 4.5, Chapter 33: Best Management Practices for Perchlorate
Materials. This product/part includes a battery that contains Perchlorate
material.

Unpacking the Appliance

Inspect the box the appliance was shipped in and note if it was
damaged in any way. If the appliance itself shows damage, file a damage
claim with the carrier who delivered it. Confirm that the Stonesoft anti­tamper tape on the appliance is intact.

Unpacking the Appliance 7

Front Panel

Power and disk
activity indicators

Port indicators

Rack-mounting brackets

Power Disk Activity

Note – Standby power is supplied to the system even when the
appliance is turned off.

The connectors are explained in detail in Connecting the Cables
(page 14). The front panel indicator lights are explained below.

Power and Disk Activity

Table 1 Power and Disk Activity Indicators

Indicator Status Explanation

Indicates power is being supplied to the
system's power supply unit. This LED is

Power Blue

illuminated when the system is operating
normally.

Disk Activity Red Indicates hard drive activity when flashing.

8 Front Panel

Fixed Ports

Activity

Link

AC power connector

Power on/off switch

Table 2 Port Indicators

Indicator Status Explanation

Activity

Unlit No link.

Amber Link ok.

Unlit Speed is 10 Mbps.

Link

Green Speed is 100 Mbps.

Orange Speed is 1 Gbps.

Table 3 SFP Port Indicators on FW-1060 SFP

Indicator Status Explanation

Unlit No link.

Activity

Yellow Link ok.

Link Amber Speed is 1 Gbps.

Back Panel

Back Panel 9

Rack-Mounting

This section provides information on installing the Stonesoft appliance
into a rack unit. You can install the appliance into a two-post or a four­post rack unit.

Caution – Read the Safety Precautions (page 5) before proceeding.

Preparing for Rack-Mounting

The appliance delivery includes four (4) six-millimeter screws for
attaching the appliance into a rack unit.

Read the sections below before you begin the installation.

Choosing a Setup Location

Decide on a suitable location for the rack unit that will hold the
appliance:

• The appliance must be situated in a clean, dust-free area that is well
ventilated.

• Avoid areas where heat, electrical noise, and electromagnetic fields
are generated.

• Leave enough clearance in front of the rack to enable you to open the
front door completely (~63 cm/25 inches).

• Leave enough clearance in the back of the rack to allow for sufficient
airflow and ease in servicing (~76 cm/30 inches).

Rack Precautions

• Ensure that the leveling jacks on the bottom of the rack are fully
extended to the floor with the full weight of the rack resting on them.

• In single rack installation, attach stabilizers to the rack.

• In multiple rack installations, couple the racks together.

• Always make sure the rack is stable before extending a component
from the rack.

• Extend only one component at a time—extending two or more
simultaneously may cause the rack to become unstable.

10 Rack-Mounting

Appliance Precautions

• Determine the placement of each component in the rack before
starting the installation.

• Install the heaviest components on the bottom of the rack first, and
then work up.

• The appliance must be connected to a grounded power outlet.

• Use a regulating uninterruptible power supply (UPS) to protect the
appliance from power surges, voltage spikes and to keep your system
operating in case of a power failure.

• Always keep the rack's front door and all panels and components on
the appliances closed when not servicing to maintain proper cooling.

Before Installing the Appliance Into a Rack

• Make sure that the rack is securely anchored onto an unmovable
surface or structure before installing the appliance into the rack.

• Make sure that the system is adequately supported. Make sure that
all the components are securely fastened to the appliance to prevent
components falling off from the appliance.

• Be sure to install an AC power disconnect for the entire rack
assembly. This power disconnect must be clearly marked.

• The rack assembly must be properly grounded to avoid electric shock.

• The rack assembly must provide sufficient airflow to the appliance for
proper cooling.

Installing the Appliance Into a Rack

Note – Do not install the appliance upside down.

This section provides information on installing the appliance into a rack
unit. There are a variety of rack units on the market, so the assembly
procedure may differ slightly from what is instructed. If necessary, refer
to the instructions that came with the rack unit you are using.

If you are installing the appliance into a Telco-type rack, follow the
general directions below. The main difference in the installation
procedure is whether you are installing the appliance into a four-post
rack or a two-post rack. Proceed to one of the following:

• Installing the Appliance Into a Four-Post Telco Rack (page 12)

• Installing the Appliance Into a Two-Post Telco Rack (page 12)

Rack-Mounting 11

Installing the Appliance Into a Four-Post Telco Rack

If you are installing the appliance into a four-post Telco-type rack, the
rack-mounting brackets on the appliance are in the right position for the
installation. You only need to attach the rack-mounting brackets to the
rack using four (4) six-millimeter screws and cage nuts.

 To install the appliance into a four-post Telco rack

1. Attach a rack-mounting bracket to the rack using two screws and

cage nuts. Insert the screws through the holes in the front of the
bracket: one screw through the top hole and another through the
bottom hole in the bracket (see the front panel illustration for the
location of the holes).

Caution – You must use two screws to attach each rack-mounting
bracket to the rack. Using only a single screw for each bracket does
not provide sufficient support and may cause damage to the
appliance.

2. Repeat step 1 with the bracket on the other side of the appliance.

Proceed to Connecting the Cables (page 14).

Installing the Appliance Into a Two-Post Telco Rack

If you are installing the appliance into a two-post Telco-type rack, you
must move the rack-mounting brackets into the correct position on the
side of the appliance before attaching the rack-mounting brackets to the
rack.

 To install the appliance into a two-post Telco rack

1. Remove the six (6) screws on the side of the appliance to detach

the rack-mounting bracket from the appliance. You can optionally

12 Rack-Mounting

also remove the lifting handle from the bracket by removing the
screws that hold the handle to the bracket.

2. Move the rack-mounting bracket to the back of the appliance and

re-attach the bracket with three of the screws. It is also
recommended to re-attach the three remaining screws back to the
front of the appliance.

3. Repeat steps 1 and 2 with the bracket on the other side of the

appliance.

4. Attach each bracket to the rack using two screws and cage nuts.

Insert the screws through the holes in the front of the bracket: one
screw through the top hole and another through the bottom hole in
the bracket (see the front panel illustration for the location of the
holes).

Caution – You must use two screws to attach each rack-mounting
bracket to the rack. Using only a single screw for each bracket does
not provide sufficient support and may cause damage to the
appliance.

Proceed to Connecting the Cables (page 14).

Rack-Mounting 13

Connecting the Cables

Two USB ports

Serial port Six or eight Ethernet ports (location and

number depends on appliance model)

Connecting Network Cables

 To connect network cables

 Connect network cables to the Ethernet ports.

• The ports are numbered 0-5 or 0-7 depending on the appliance

model. The port numbers increase from left to right.

• You are free to choose which Ethernet ports you connect to which

network. The Ethernet ports are mapped to Interface IDs during
the initial configuration. See the next section for information on
connecting network cables to ports 6-7 of FW-1060 SFP
appliances.

Note – When the appliance is powered and you need to unplug it,
always wait at least five (5) seconds before plugging in the appliance
again. Otherwise, the appliance may not have time to clear properly
and fails to start.

Connecting Cables to SFP Ports

FW-1060 SFP has two SFP ports (ports 6--7). You can use these ports as
either copper or fiber ports by inserting a small form-factor pluggable
(SFP) transceiver for copper or fiber-optic cable in the port slot.

Caution – Do not connect cables directly to the SFP ports on a FW­1060 SFP appliance. You must insert a SFP transceiver to the SFP
port before connecting the cable. Connecting cables directly to SFP
ports may damage the FW-1060 SFP appliance.

14 Connecting the Cables

 To connect cables to SFP ports

SFP transceiver

for copper cable

SFP transceiver for

fiber-optic cable

Rubber plug

1. Insert the SFP transceiver in the port slot until you feel the

connector on the transceiver snap into place. The illustration
below shows the correct position of inserting the transceiver.

Note – Make sure that the latch on the SFP transceiver is up (see the
illustration above) when you insert the SFP transceiver in the port
slot.

2. If the SFP transceiver has a rubber plug, remove the plug after

inserting the transceiver to the slot.

3. Connect the copper or fiber-optic cable to the SFP transceiver.

Note – Each SFP port must match the wavelength specifications at

the other end of the cable. The cable must not exceed the
stipulated cable length for reliable communications.

Cable Types

Make sure that the copper cables you use are correctly rated (CAT 5e or
CAT 6 in gigabit networks).

Speed/Duplex Settings

Network cards at both ends of each cable must have identical speed/
duplex settings. This also applies to the automatic negotiation setting: if
one end of the cable is set to autonegotiate, the other end must also be
set to autonegotiate. Gigabit standards require interfaces to use
autonegotiation—fixed settings are not allowed at gigabit speeds.

Connecting the Cables 15

Connecting the Appliance to the Power Supply

 To connect the appliance to the power supply

1. Connect the power cable to the AC power connector on the back of

the appliance.

2. Plug the power cord into a grounded, high-quality power strip that

offers protection from electrical noise and power surges.

• We highly recommend using an uninterruptible power supply

(UPS) to ensure continuous operation and minimize the risk of
damage to the appliance in case of sudden loss of power.

Note – Standby power is supplied to the system even when the
appliance is turned off.

Proceed to Initial Configuration.

Initial Configuration

To start using the appliance, you must activate the network interfaces
and establish a secure connection to the Management Server as
outlined in the sections below.

To successfully complete this configuration, the following prerequisites
must be met:

• The Firewall element must be defined in the Management Center.

• You must have the following engine-specific information from the
Management Server: a one-time password or a saved initial
configuration file on a USB stick.

See the Firewall/VPN Installation Guide for details.

Note – The appliance must contact the Management Server before it
can be operational.

There are two ways to configure the engine software.

• You can configure the engine automatically with a USB stick. See
Configuring the Engine Automatically (page 17).

• If the automatic configuration is not possible or desired, you can use
the engine configuration wizard. See Using the Engine Configuration
Wizard (page 18).

16 Initial Configuration

Configuring the Engine Automatically

The automatic configuration requires that you have a suitable
configuration saved on a USB memory stick. See the Firewall/VPN
Installation Guide or the Online Help of the Management Client for
details.

 To configure the engine from a USB memory stick

1. Insert the USB stick that contains the configuration saved in your

Management Client in one of the USB ports on the appliance.

2. Turn on the appliance using the power on/off switch. The

appliance automatically imports the configuration from the USB
stick and then tries to make the initial contact to the Management
Server.

• If the connection is successful, the appliance automatically

reboots itself and the engine configuration is finished.

If you configure the engine with a USB stick, you must set a password
for the root account in the Management Client to enable command line
access to the engine. If you want to allow remote access to the engine
using SSH, enable the SSH daemon for the engine in the Management
Client. See the Administrator’s Guide for more information.

Proceed to After Successful Management Server Contact (page 23).

If the Automatic Configuration Fails

• If the automatic configuration fails, you can check for the reason in
the log (sg_autoconfig.log) written on the USB stick.

• If you see a “connection refused” error message, ensure that the
Management Server IP address is reachable from the engine and
check the IP addresses you have defined in the Management Client.

• If the configuration with the USB stick still does not succeed, remove
the USB stick from the USB port, and follow the instructions for the
manual configuration. See Using the Engine Configuration Wizard
(page 18).

Initial Configuration 17

Using the Engine Configuration Wizard

1

You can use the engine configuration wizard with all Management Center
and Firewall versions. If you have saved the initial configuration on a
USB stick, you can import it in the configuration wizard to reduce typing.

 To start the configuration wizard

1. Connect appliance to a computer using the serial cable supplied

with the appliance.

2. On the computer, open a terminal with settings 9600bps, 8

databits, 1 stopbit, no parity.

3. Turn on the appliance using the power on/off switch. The engine

bootup process is shown in the console and, after some time, the
engine configuration wizard starts.

Note – You can (re)start the engine configuration wizard at any time
using the sg-reconfigure command on the engine command line.

 To select the configuration method

1. Do one of the following:

• To import a saved configuration, highlight Import using the arrow

keys and press E

NTER.

• To skip the import, highlight Next and press ENTER.

2. If you selected the Import option, select the configuration file.

 To set the keyboard layout

1. Highlight the entry field for Keyboard Layout using the arrow keys

and press E

NTER. The Select Keyboard Layout dialog opens.

18 Initial Configuration

2. Highlight the correct layout and press ENTER.

2

1

Tip: Type in the first letter to move forward more quickly in the list of keyboard
layouts.

Note – If the desired keyboard layout is not available, use the best­matching available layout, or select US_English.

 To set the engine’s timezone

1. Highlight the entry field for Local Timezone using the arrow keys

and press E

NTER.

2. Select the correct timezone in the dialog that opens.

Note – The timezone setting affects only the way the time is displayed

on the engine command line. The actual operation always uses UTC
time.

Note – The appliance’s clock is automatically synchronized with the
Management Server’s clock.

Initial Configuration 19

 To set the rest of the OS settings

2

1

1. Type in the name of the firewall.

2. Type in the password for the user root. This is the only account for

engine command line access.

3. (Optional) Highlight Enable SSH Daemon and press the spacebar

on your keyboard to select the option and allow remote access to
engine command line using SSH.

Note – It is not necessary to enable the SSH daemon now for ongoing
management, as this option can also be set through the Management
Client. We recommend that you enable the SSH access in the
Management Client when needed and then disable the access again
when you are done.

4. Highlight Next and press E

NTER. The Configure Network Interfaces

window is displayed.

20 Initial Configuration

Configuring the Network Interfaces

1

2

 To map the physical interfaces to interface IDs

1. Type in the Interface IDs to define how physical interfaces are

mapped to the Interface IDs you defined in the Firewall element.

2. Highlight the Media column and press E

NTER to match the speed/

duplex settings to those used in each network.

• Make sure that the speed/duplex settings of network cards are

identical at both ends of each cable.

3. Highlight the Mgmt column and press the spacebar on your

keyboard to select the correct interface for contact with the
Management Server.

Note – The Management interface must be the same that you
configured as the Primary Control Interface for the corresponding
Firewall element in the Management Center.

4. Highlight Next and press ENTER to continue.

Contacting the Management Server

The Prepare for Management Contact window opens. If the initial
configuration was imported, most of this information is filled in.

This task has two parts. First, you activate an initial configuration on the
firewall.

• The initial configuration contains the information that the engine

needs to connect to the Management Server for the first time.

• The initial configuration is replaced with a working configuration when

you install a Firewall Policy from the Management Server on this
engine using the Management Client.

Initial Configuration 21

 To activate the initial configuration

1

2

1

2

3

1. Highlight Switch Firewall Node to Initial Configuration and press

spacebar to activate.

2. Fill in according to your environment. The information must match to

what you defined for the Firewall element (Primary Control IP
Address).

• If the engine and the Management Server are on the same

network, you can leave the Gateway to Management field empty.

The initial configuration contains a simple firewall policy that allows only
administration-related connections and blocks everything else.

In the second part of the configuration, you define the information
needed for establishing a trust relationship between the engine and the
Management Server.

 To fill in the Management Server information

1. Highlight Contact Management Server and press spacebar to

activate.

2. Fill in the Management Server IP address and the one-time

password that was created for this engine when you saved the
initial configuration.

• If you do not have a one-time password for this firewall, see the

Firewall/VPN Installation Guide for instructions on how to save an
initial configuration.

22 Initial Configuration

3. (Optional) Fill in the Key fingerprint (also shown when you saved the

initial configuration). Filling it in increases the security of the
communications.

4. Highlight Finish and press E

NTER.

The engine now tries to make initial Management Server contact.

• If you see a “connection refused” error message, ensure that the

one-time password is correct and the Management Server IP address
is reachable from the node. Save a new initial configuration if unsure
about the password.

• If the engine is unable to contact the Management Server, make sure

there are no networking problems, that all information defined in the
Firewall element corresponds to what you entered in the configuration
wizard and, if NAT is in use, that you have configured contact
addresses for NAT as explained in the Firewall/VPN Installation Guide.

Note – Once initial contact has been made, the engine receives a
certificate from the Management Center for identification. If the
certificate is deleted or expires, you must repeat the initial contact
using a new one-time password.

After Successful Management Server Contact

After you see a notification that Management Server contact has
succeeded or the appliance has rebooted itself after automatic
configuration with a USB stick, the firewall engine installation is
complete and the firewall is ready to receive a policy. In a while, the
firewall’s status changes in the Management Client from Unknown to No
Policy Installed, and the connection state is Connected indicating that
the Management Server can connect to the node.

The next step is creating a security policy and installing it on the engine.
See the Online Help of the Management Client for detailed instructions.

Caution – When using the command prompt, use the reboot
command to reboot and halt command to shut down the node. Do
not use the init command. You can also reboot the node using the
Management Client.

Initial Configuration 23

Maintenance Operations

Connecting to the Engine Command Line

You may need to connect to the engine command line, for example, to
undo a software upgrade.

 To connect to the engine command line

1. Connect the serial cable supplied with the appliance to the serial

port on the appliance and to a computer.

2. On the computer, open a terminal with settings 9600bps, 8

databits, 1 stopbit, no parity.

Reverting to Previously Installed Software Version

This procedure allows you to undo a software upgrade.
The appliance has two working partitions. One is designated as active

and the other as inactive. The inactive partition is used for upgrades and
the status is switched between the partitions when the upgrade is ready
to be activated. If the appliance does not start up with the new version,
it automatically switches to the previous configuration at the next
reboot. You can also switch back to the previously installed software
version manually as instructed here whenever necessary.

 To switch back to the previously active version

1. Connect to the engine command line as described above in

Connecting to the Engine Command Line (page 24).

2. (Re)start the appliance:

• If the appliance is powered on, press Enter, log in as the user

root with the password you have set for the appliance, and
issue the command reboot.

3. Wait until a boot menu or a list of the appliance partitions is

shown. Proceed to Step 5 if the boot menu is shown.

4. (If a list of partitions is shown) The currently active partition is

highlighted in the list of partitions. Select the inactive partition and
press Enter. A list of available commands opens.

5. Select Switch to Previously Installed Software Version <name of

partition> or Boot SG FW/VPN <name of partition> and press
Enter. The appliance switches partitions and boots up.

24 Maintenance Operations

6. Refresh the policy on the firewall or firewall cluster to synchronize

the policy and other configuration data between components.

Note – If the certificate for system communications on the previously
used partition is not valid anymore, see the Troubleshooting section in
the Management Client’s Online Help for renewal instructions.

If you want to undo this operation, repeat the steps exactly as above.

Resetting the Appliance to Factory Settings

Note – Perform a factory reset only if you have a specific need to do
so. Consult Stonesoft Support before performing this operation if you
are unsure of whether this operation is necessary or not.

 To reset to factory settings

1. Connect to the engine command line as described in Connecting

to the Engine Command Line (page 24).

2. (Re)start the appliance:

• If the appliance is powered on, press Enter, log in as the user

root with the password you have set for the appliance, and
issue the command reboot.

3. Wait until a boot menu or a list of partitions is shown. Proceed to

Step 5 if the boot menu is shown.

4. (If a list of partitions is shown) The currently active partition is

highlighted. Press Ente r. A list of available commands opens.

5. Select System Restore Options and press Enter.

6. Typ e 1 and press Enter to clear the settings. A confirmation

prompt is shown.

7. Typ e YES and press Enter to perform the reset. If you decide to

cancel the operation, type NO and press Enter.

Caution – Do not unplug the power from the appliance or interrupt the
reset in any way. If the reset is interrupted, the appliance may
become unusable until serviced.

To use the appliance after a factory reset, you must configure it as
explained in Initial Configuration (page 16).

Maintenance Operations 25

Removing SFP Transceiver

FW-1060 SFP appliances have two SFP ports. If necessary, you can
remove the SFP transceiver from the SFP ports.

Caution – Invisible laser radiation is emitted from the end of fiber­optic cable and from fiber port. Do not stare into the beam and avoid
direct exposure to the beam.

 To remove an SFP transceiver

1. Connect to the engine command line as described in Connecting

to the Engine Command Line (page 24).

2. Shut down the engine:

• If the appliance is powered on, press Enter, log in as the user

root with the password you have set for the appliance, and
issue the command halt.

3. Unplug all power cords from the system or the wall outlets.

4. Disconnect the cable from the SFP transceiver.

5. Pull down the latch on the transceiver.

6. Pull the SFP transceiver carefully out of the port slot.

If you want to replace the SFP transceiver you have removed, follow the
instructions in Connecting Cables to SFP Ports (page 14).

Disposal Instructions

Dispose of the appliance separately from household waste at an
appropriate waste disposal facility at the end of its useful service life.

26 Disposal Instructions

Stonesoft Appliance Installation Guide

This booklet covers the initial installation and configuration tasks

specific to your Stonesoft Appliance.

For information on how to prepare the Management Center for a new

engine installation, see the other available documentation. See inside

for further details.

All documentation and our technical knowledge base is available at:

www.stonesoft.com/support.

Stonesoft Corporation

International Headquarters

Itälahdenkatu 22 A

Fl-0021O Helsinki, Finland

tel. [phone]

fax. [phone]

www.stonesoft.com

Copyright 2012 Stonesoft Corporation.

Stonesoft Inc.
Americas Headquarters

1050 Crown Pointe Parkway
Suite 900
Atlanta, GA 30338, USA
tel. [phone]
fax. [phone]