Jump to:navigation, search
Wiki

Restore with configuration backup on a UTM

From Securepoint Wiki





























In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden























Restoring a configuration backup after resetting to factory settings or on new hardware

Last adaption: 06.2022

notempty
This article refers to a Beta version
-





































Preparation

notempty
Careful preparation of even simple steps is a prerequisite for successful installation

Have login information ready

  • When operating on a modem or fiber optic connection:
  • Have login information of the Internet service provider ready
    • Who has the current login information of the ISP?
    • Is the login information available at the installation site?
    • Is the login information available at the time of installation?
    • if applicable: Is the person who has the login information available at the time of installation?
  • When operating with a router:
    • What is the IP address of the router?
    • Can the UTM get a fixed IP?
    • For new installations, DHCP is activated on the external interface
  • Local network:
    • What is the network IP of the local network(s)?
    • Which IP addresses should the interfaces of the UTM in these networks receive?
      As a rule, this should always be a fixed IP address!

Prepare firmware update

notempty
Why should a firmware update be done?

  • If an existing configuration file is to be used, the installed firmware version must be identical or newer.
  • Latest features and patches are available immediately.
    Several firmware versions may have been released between the manufacturing and delivery.
  • Damage due to manipulation of the firmware in transit (unlikely, but not impossible) can thus be excluded.
  • A USB stick with the UTM image is required.
    This Securepoint Imaging Tool can be used. (Resellerportal → Menu  Downloads → Tools x )
  • Connect keyboard and monitor
  • Monitor connection type see table below the figure


    • In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden





















  • v12 is mandatory, as some of the hardware installed in the G5 units is not supported by v11
  • When installing/updating via USB stick, use the image first UTM v12.x - Interactive installation UTM Software v12 - USB-Image
    (not Autoinstall or Autoupdate)
    • The prepared USB stick must be connected to the UTM
    • Switch on the UTM
    • Under Save & Exit execute Restore Defaults
      The USB stick should then be listed at the top of the boot menu of the device, preceded by the TAG UEFI
    • Execute under Save & Exit Save Changes and Reset
    • Perform installation/ update

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden





















    Installing the firmware

    The firmware is installed in just a few steps. The preselection options only need to be confirmed.


    • Display and confirmation of the license conditions
    • Decision as to whether an upgrade should be carried out
      Default: Upgrade
    • Selection of the hard disk on which the firmware is to be installed
    • Starting the installation
    • Request to remove the USB stick
    • Reboot
    • Display of the login console

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden































    UTM Without expansion cards Port assignment as printed on the unit casing
    Portname Port type Speed
    A0 RJ45 2,5 GBit/s
    A1 RJ45 2,5 GBit/s
    A2 RJ45 2,5 GBit/s
    A3 RJ45 2,5 GBit/s
    A4 RJ45 2,5 GBit/s
    A5 RJ45 2,5 GBit/s
    A6 RJ45 2,5 GBit/s
    A7 RJ45 2,5 GBit/s
    A8 SFP+ 10 GBit/s
    A9 SFP+ 10 GBit/s
    Connection Type
    Monitor HDMI
    Keyboard USB
    Console RJ45

    Expansion card 8 port GBit
    Portname Port type Speed
    A0 RJ45 2,5 GBit/s
    A1 RJ45 2,5 GBit/s
    A2 RJ45 2,5 GBit/s
    A3 RJ45 2,5 GBit/s
    A4 RJ45 2,5 GBit/s
    A5 RJ45 2,5 GBit/s
    A6 RJ45 2,5 GBit/s
    A7 RJ45 2,5 GBit/s
    A8 SFP+ 10 GBit/s
    A9 SFP+ 10 GBit/s
    B0 RJ45 1 GBit/s
    B1 RJ45 1 GBit/s
    B2 RJ45 1 GBit/s
    B3 RJ45 1 GBit/s
    B4 RJ45 1 GBit/s
    B5 RJ45 1 GBit/s
    B6 RJ45 1 GBit/s
    B7 RJ45 1 GBit/s
    Connection Type
    Monitor HDMI
    Keyboard USB
    Console RJ45


    Expansion card 8 port GBit + Expansion card 4 port SFP+
    Portname Port type Speed
    A0 RJ45 2,5 GBit/s
    A1 RJ45 2,5 GBit/s
    A2 RJ45 2,5 GBit/s
    A3 RJ45 2,5 GBit/s
    A4 RJ45 2,5 GBit/s
    A5 RJ45 2,5 GBit/s
    A6 RJ45 2,5 GBit/s
    A7 RJ45 2,5 GBit/s
    A8 SFP+ 10 GBit/s
    A9 SFP+ 10 GBit/s
    B0 RJ45 1 GBit/s
    B1 RJ45 1 GBit/s
    B2 RJ45 1 GBit/s
    B3 RJ45 1 GBit/s
    B4 RJ45 1 GBit/s
    B5 RJ45 1 GBit/s
    B6 RJ45 1 GBit/s
    B7 RJ45 1 GBit/s
    C0 SFP+ 10 GBit/s
    C1 SFP+ 10 GBit/s
    C2 SFP+ 10 GBit/s
    C3 SFP+ 10 GBit/s
    Connection Type
    Monitor HDMI
    Keyboard USB
    Console RJ45


    Expansion card 4 port SFP+
    Portname Port type Speed
    A0 RJ45 2,5 GBit/s
    A1 RJ45 2,5 GBit/s
    A2 RJ45 2,5 GBit/s
    A3 RJ45 2,5 GBit/s
    A4 RJ45 2,5 GBit/s
    A5 RJ45 2,5 GBit/s
    A6 RJ45 2,5 GBit/s
    A7 RJ45 2,5 GBit/s
    A8 SFP+ 10 GBit/s
    A9 SFP+ 10 GBit/s
    C0 SFP+ 10 GBit/s
    C1 SFP+ 10 GBit/s
    C2 SFP+ 10 GBit/s
    C3 SFP+ 10 GBit/s
    Connection Type
    Monitor HDMI
    Keyboard USB
    Console RJ45





























    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden





























    }}








































    Integration into the local network

    Adjust IP addresses of the UTM via CLI

    If administration via the CLI is not an issue, the IP adresses can be provided directly to the UTM via CLI
    In this case, the monitor and keyboard remain directly connected to the UTM.
    The login is done on the console.


    To be able to administer the UTM, the admin interface must be accessed via the IP of the UTM and the port of the admin interface via the interface LAN2.
    In the factory settings, the UTM can be reached via https://192.168.175.1:11115.
    If the IP or the interface cannot be reached from the local network, changes must be made.

    1. Connecting keyboard and monitor directly to the UTM
    2. Log in to the UTM: Username admin / Password: insecure
    3. the Command Line Interface appears.
    4. change network configuration:
      1. Determine the existing interfaces: interface get
      2. Determine the ID of the IP addresses: interface address get
        LAN2 corresponds to the internal interface through which the admin interface can be reached.
        The ID is needed for changing the IP address in the next step.
      3. Change the interface IPs: interface address set id 1 address 192.168.12.1/24
        system update interface         (desired IP of the internal network with subnet mask)
      4. Activate an interface: interface address new device LAN1 or A0 address 192.168.x.y/24
        system update interface
    5. Set up administration access:
      In the factory settings, access to the admin interface of the UTM is only possible via the internal interface LAN2. If the admin interface is to be accessible via another interface, the IP of the host (or a net IP with subnet mask) must be released:
      manager new hostlist 192.168.168.0/24
      system update rule       Here: All hosts in the network 192.168.168.0 (no matter at which interface) can access the admin interface
      Attention: If e.g. the IP 192.168.175.1 is at LAN1 or A0 and the admin interface should be called from a computer in the network at LAN1, the IP 192.168.175.x must be released extra nevertheless.
    Adjust the IP address of your own computer

    The IP address of your own computer is temporarily adapted to the default network of the internal interface of the UTM.
    This is followed by connecting your own computer to interface A1 (the internal interface) of the UTM.
    The correct interface can be seen in the figure and table above.

    This is how it works

    Change IP address on Windows
    • Display of network connections:
       r  ncpa.cpl
      ↵
    • Show status of Ethernet connection with double click
    • Show properties of the interface
    • Show properties of the TCP/IPv4 connection
    • Set IP address:
      • IP address:192.168.175.2
      • Subnet mask:255.255.255.0
      • Default gateway:192.168.175.1 (=Default address of the internal interface of the UTM)





    1. 2. 3.
    Abb.1 Abb.2 Abb.3
    Abbildungen
    Display of the network interface:
    • Access via desktop display:
      • Click on the network icon in the taskbar next to the clock
      • Click on Network and Internet settings.
      • Click on Change adapter options.
    • Access by command:
      • Windows key  r  ncpa.cpl
    • Double-click on the interface used to display the status of the ethernet connection
  • In the status click on the button Properties
  • Select the entry Internet Protocol, Version 4 (TCP/IPv4) in the properties.
  • Click Properties button
  • Select entry Use the following IP address:
  • Set IP address:
    • IP address:192.168.175.2
    • Subnet mask:255.255.255.0
    • Default gateway:192.168.175.1 (=Default address of the internal interface of the UTM)
    • Change IP address on Linux

    Please refer to the corresponding documentation of the used distribution.
    Examples for Ubunutu:

    • Opening the terminal
    • Identify the name of the interface: ip a
    • Change IP address: (In the example enp0s3 is the interface used: sudo ip address add 192.168.175.2/24 dev enp0s3
    Change IP address on a MAC

    Change IP address on a MAC

    • Menu System settings / network
    • Configure IPv4: Manuell select in the dropdown menu
    • IP address:192.168.175.2
    • Subnet mask:255.255.255.0
    • Router:192.168.175.1 (=Default address of the internal interface of the UTM)
    • ButtonApply
    notempty
    After finishing the installation wizard and rebooting, the UTM is located in another network.
    For further configuration, the IP address of your own computer must then be changed again.

    Setting the original IP address:

    • Fixed IP Addresses: Enter as described above
    • Enable DHCP:
      • Windows: Properties Internet Protocol Version 4 (TCPIPv4) → select Obtain an IP address automatically
      • Linux: Example for Ubuntu: sudo ip address del 192.168.175.2/24 dev enp0s3
        sudo dhclient enp0s3
        If necessary, refer to the documentation of the distribution used.
      • MAC: coming soon...

    First access

    If not already done, the following connections must be made now physically:

    • Connect interface for the external interface (A0) towards the Internet (modem, router, etc.).
    • Connect the internal interface (A1)
      • with your own computer, if the IP address has been adjusted on it.
      • to the network from which the UTM is to be administered, if the IP address of the UTM has been adjusted.

  • The admin interface is available at port 11115. Access:
    https://192.168.175.1:11115 (Default) or
    https://172.16.0.1:11115, if the IP address of the UTM was changed to 172.16.0.1

    • When the admin interface is called up for the first time, a certificate warning appears in the browser.
    Since the browser doesn't know the certificate of the UTM, a security warning is issued.
    This warning must be ignored.

    Message in Firefox: Warning: Potential security risk ahead
    Button Advanced / Accept the risk and continue
    Message in Chrome / Chromium: This is not a secure connection. At the end click on Continue to IP address (unsure) .
    Message in Edge: Your connection isn't private. At the end click on Continue to IP address (unsure) .
    Message in Safari:
    Button Show details / Link Open this website

    First registration

    Caption Value Description
    UTM-Login (noch nicht lizensiert)
    User admin Login with the default login information of the factory settings: admin
    Password insecure Login with the default login information of the factory settings: insecure
     Login (admin)
    Agree to license agreement and privacy policy
    Accept The license agreement and privacy policy must be accepted by clicking the button. Datenschutzerklärung UTM Decline Accept The privacy policy must be agreed to. Lizenzvereinbarung UTM Decline Accept The license agreement must be agreed to.
    Basic configurations
    Firewall name firewall.ttt-point.local An individual firewall name must be assigned.
  • The name should correspond to an FQDN.
    		•  Basic configurations UTMuser@firewall.name.fqdn License agreement Log out
    Basic configurations
    The fields displayed may vary depending on what information is already available on the UTM
    License key Browse... Import valid license.
  • Each license key may only be used once. The UTM is identified via this and various services and configurations are assigned via the license key.
    • System time yyyy-mm-dd hh-m--ss The system time should be correct. It is compared with other servers, e.g. for user authentication (Kerberos, OTP, etc.). If the deviation is too large, for example, login will not be possible.
    Password
    Passwort bestätigen    		    
           		 Das Standard Passwort
    insecure
    muss geändert werden.































    Passwords must meet the following criteria:
    • at least 8 characters length
    • at least 3 of the following categories:
      • Upper case
      • Lower case
      • Special characters
      • Digits
     notempty
    Neu ab v14.0.7: Passwortänderung bereits beim ersten Login
    Global email address: notempty
    New as of v12.4.4
         		admin@ttt-point.de Required information e.g. for the mail connector and the proxy. Also serves as postmaster address for the mail relay.
    Authentication method: notempty
    New as of v12.5.1
         		PIN (recommended)Login mask Authentication method for Web sessions via USC
    The web session PIN also secures the use of the following actions within the scope of the USC:
    • Reboot
    • Shutdown
    • Factory settings
    • Importing cloud backups

    If the PIN is not used, these actions cannot be called up from the Unified Security Portal.

    PIN:     PIN as additional security for Websessions
    No number sequences or duplications are allowed
    Creates a secure PIN
    License agreement Displays the license agreement
    Privacy policy Displays the privacy policy
    Log out Logs off again.
    No settings are saved!
    Complete Completes the login process and opens the Welcome window.
    Welcome
    Basic settings are completed with the welcome dialog. Welcome UTMuser@firewall.name.fqdn Installation wizard Start tour Welcome dialog
    Installation wizard Starts the Installation Wizard.
    Start tour Starts a tour that explains the admin interface and menus in 15 steps.

    Configure interfaces

    notempty
    New as of v12.7.0
    Do you want to configure the interfaces now? Yes No This message appears if not all existing interfaces are configured correctly. However, it is recommended to do this to prevent possible problems. The Yes button opens the network configuration directly.
    Do not ask again. Off If this message is not desired, it can be set here so that it is not displayed again.

    Commissioning with a cloud backup

    If the restore is to be run with a cloud backup, all that is required is an Internet connection.
    Due to the association with the license file, the corresponding cloud backups are automatically displayed in the Configuration  Area Cloud Backup menu.
    Simply start the installation wizard and fill only step 4 (Internet) with the correct data.


    notempty
    Continue with the button Installation Wizard
    → Wiki Installation Wizard UTM show for a restore


    Commissioning with locally available configuration backup

    If a local backup is available, it can be imported in the Configuration management.

    Configuration  Area Local configurations button Import configuration

    notempty
    Proceed by closing the Welcome window








    Import configuration

    Import configuration     		Imports the configuration of a (different) Securepoint UTM.
    Select the config file with Browse
    Import with the Upload button.
  • The appliance being imported into must have the same or a higher version than the configuration file being imported.
  • As of version 12, only configurations from a UTM v11.8.x and higher are imported.
    If an older configuration file must be used, it can first be imported into a (virtual) UTM with version 11.8.x. From there, the configuration can be exported again and imported into a v12.
    		• Import configuration UTMuser@firewall.name.fqdn Upload
    Name:     Label under which this configuration is to be displayed in the configuration management.
    Password:     Password used to encrypt this configuration
    Then upload or add configuration with Upload
    notempty
    New as of v14.0.0:

     If a database conversion error occurs during an import, then
    • the resulting faulty database is deleted immediately
    • an alarm is triggered in the alerting center
    • a message is displayed in the UI with the option of viewing and downloading the conversion log
    • continue with the original database


    Set boot configuration You must set the configuration you have just imported as the start configuration
    Reboot System In order for the configuration settings to be applied, the respective services must be restarted in the correct order. This is achieved by restarting the machine.
    Retrieved from "https://wiki.securepoint.de/index.php?title=UTM/CONFIG/Restore-G6-RC350R&oldid=96423"