Installation wizard to restore a RC1000R (G5) with cloud backup

Achtung: In der .lang-Datei werden je nach Parameter hw Varaiblen gesetzt für die Bezeichnung der Schnittstellen und ob dmz / dmz interface und wlan vorhanden sind

Set up Internet access of a UTM and import cloud backup

Last adaptation to the version: 12.5.1

New:

PPPoE and VDSL are united

notempty

This article refers to a Resellerpreview

12.5 12.2.3 12.2 11.6

Prefaces

Usually, the installation wizard appears during the initial setup of the UTM.
This checks whether a configuration already exists that is marked as the start configuration.

(Status )
If this is not the case, the wizard opens automatically.

It is not advisable to start the installation wizard later, as other settings made in the meantime may be overwritten.

Installation wizard

Step 1 - General

Caption	Value	Description	Step 1
Firewall Name:	firewall.ttt-point.local	Any value Any value can be entered here for a restore. As soon as a configuration from the cloud backup has been activated, those settings will be applied.
Global contact person:	Alina Admin	Any value Any value can be entered here for a restore. As soon as a configuration from the cloud backup has been activated, those settings will be applied.
Global email address:	admin@ttt-point.de	Any value Any value can be entered here for a restore. As soon as a configuration from the cloud backup has been activated, those settings will be applied.
Language of reports:	German English	Leave default setting For a restore the default setting can be left. As soon as a configuration from the cloud backup has been activated, those settings will be applied.

Step 2 - Privacy
Anonymize all applications	Yes	Leave default setting For a restore the default setting can be left. As soon as a configuration from the cloud backup has been activated, those settings will be applied.	Step 2
			Step 2
Step 3 - Internal

Internal firewall IP address:	192.168.175.1/24	During a restore, the default address should be left as it is. This means that after setting up Internet access and the necessary reboot, the firewall is still accessible to the device from which the current configuration is being carried out in order to subsequently activate the cloud configuration.	Step 3 - without WLAN module
Dynamically assign Client IP Addresses via DHCP:	No	Leave default setting For a restore the default setting can be left. As soon as a configuration from the cloud backup has been activated, those settings will be applied.
Router Advertisement:	Off	If the UTM has received an IPv6 prefix, it can advertise the subnet via router advertisement in the network segment behind the interface. (See article IPv6 Prefix Delegation)


Internal firewall IP address:	192.168.175.1/24	During a restore, the default address should be left as it is. This means that after setting up Internet access and the necessary reboot, the firewall is still accessible to the device from which the current configuration is being carried out in order to subsequently activate the cloud configuration.	Step 3 - with WLAN module
Dynamically assign Client IP Addresses via DHCP:	No	Leave default setting For a restore the default setting can be left. As soon as a configuration from the cloud backup has been activated, those settings will be applied.
Generate WLAN Bridge:	No Default	Any value Any value can be entered here for a restore. As soon as a configuration from the cloud backup has been activated, those settings will be applied.
Generate portfilter rule: Shown when Generate WLAN Bridge is enabled	No	When activated, a port filter rule is automatically generated
STP: Shown when Generate WLAN Bridge is enabled	Off	When activated, STP (Spanning Tree Protocol) is used
STP Bridge Priority: Shown when Generate WLAN Bridge is enabled	32768 Default	The priority of the STP Bridge is set

Step 4 - Internet This is where the Internet connection is configured on the external interface (A0). The following variations are available:
Connection type PPPoE / VDSL Connection type: ‌ PPPoE / VDSL
With this type, an ADSL or SDSL modem is connected to the external interface (A0). The connection is initiated by the UTM. A router can only be used with this connection type if it can be set to modem mode and it can be guaranteed that the UTM will initiate the connection.
Username:	(Shares ISP)	The login information is provided by the ISP (Internet Service Provider)
Password:	(Shares ISP)
PPPoE for VDSL/fiber optics:	Off	Check the box if PPPoE is connected via a VDSL modem or via fibre.
IPv6 Prefix Delegation:	Off	Allows an IPv6 network assigned by the Internet Service Provider to be split into /64 networks and assigned to individual interfaces via Router Advertisement. Example: Network assigned by ISP: 2001:0db8:aaaa:bb::/56 Networks distributed at internal interfaces via router adviertisement: 2001:0db8:aaaa:bb00::/64 2001:0db8:aaaa:bb01::/64

Connection type Ethernet with static IP Connection type:‌ Ethernet with static IP
With this connection type, a router is connected to the external interface (A0), which itself initiates the connection to the Internet. The login information of the provider is stored in the preceding router and not on the UTM. This connection type cannot be used with a modem or router in modem mode.
External IP address:	192.168.178.101/24	The IP address of the external interface (A0) and the IP address range for the external network (subnet mask in CIDR notation). The default is an already existing IP address, if applicable. The external interface receives an IP address via DHCP by default, provided a DHCP server is available in the external network.
Default Gateway:	192.168.178.1/---	IP address of the default gateway for the UTM so that it knows which is the closest router for all networks that are not on an internal interface: As a rule: the Internet.
IPv6 Prefix Delegation:	Off	Allows an IPv6 network assigned by the Internet Service Provider to be split into /64 networks and assigned to individual interfaces via Router Advertisement. Example: Network assigned by ISP: 2001:0db8:aaaa:bb::/56 Networks distributed at internal interfaces via router adviertisement: 2001:0db8:aaaa:bb00::/64 2001:0db8:aaaa:bb01::/64

Connection type Cable modem with DHCP Connection type: ‌ Cable modem with DHCP e.g.: DSL connection via telephone line with Fritzbox or Speedport router. Originally mostly devices that cable providers provided to their customers.
Also with this connection type, a router is connected to the external interface (A0), which itself initiates the connection to the Internet. The login information of the provider is stored in the preceding router and not on the UTM. This connection type cannot be used with a modem or router in modem mode.
DHCP Client:	IPv4	Selection with which protocol the interface receives IP addresses from the preceding router with DHCP server.
	IPv6
	IPv4 & IPv6
	Off	Allows an IPv6 network assigned by the Internet Service Provider to be split into /64 networks and assigned to individual interfaces via Router Advertisement. Example: Network assigned by ISP: 2001:0db8:aaaa:bb::/56 Networks distributed at internal interfaces via router adviertisement: 2001:0db8:aaaa:bb00::/64 2001:0db8:aaaa:bb01::/64

Connection type LTE / others Connection type: ‌ LTE / others LTE connections or other connections are configured after the installation wizard is completed

Step 5 - DMZ Configuration of a second internal network, often referred as Demilitarized Zone: Usually a network that is separate from the internal network. In the UTM, all networks are separated from each other by default.
DMZ IP address:	192.168.176.1/24	Any value Any value can be entered here for a restore. As soon as a configuration from the cloud backup has been activated, those settings will be applied.	Step 5 without WLAN
Assign the IP addresses to the clients in this network via DHCP:	No	Leave default setting For a restore the default setting can be left. As soon as a configuration from the cloud backup has been activated, those settings will be applied.
Autogenerated rules:	No	Leave default setting For a restore the default setting can be left. As soon as a configuration from the cloud backup has been activated, those settings will be applied.
Generate WLAN Bridge: Only if a WLAN module is present	No	Any value Any value can be entered here for a restore. As soon as a configuration from the cloud backup has been activated, those settings will be applied.
Router Advertisement:	No	If the UTM has received an IPv6 prefix, it can advertise the subnet via router advertisement in the network segment behind the interface. (See article IPv6 Prefix Delegation)

Step 6 - WLAN The RC1000R (G5) model has no WLAN option. This step is therefore skipped. For long-term use of WLAN (>30 days) a license is required
WLAN IP address: Not in bridge mode	192.168.177.1/24	The IP address of the WLAN interface (wlan0) and the subnet mask (as CIDR notation) for the WLAN network. In bridge mode, the setting from the internal network in which bridge mode was activated is used here.	Step 6: WLAN dialog without bridge configuration Step 6: WLAN dialog when using a bridge
Country code:	DE	The country code is used to determine which frequencies and which signal strengths may be used. The frequencies used and the transmission power can be found in a Wikipedia article.
SSID:	TTT-POINT	The Service Set Identifier (SSID) is the name under which the WLAN network is presented to the clients. This must be entered in any case.
SSID Broadcast:	On	This option can be used to define whether the WLAN network can be seen by every client or whether the transmission of the SSID should be suppressed. (Off)
Security Mode	WPA	Is considered unsafe and only exists for backwards compatibility. (TKIP is used as encryption method)
	WPA2	Standard with enhanced security AES128 is used as encryption method: https://en.wikipedia.org/wiki/WPA2
	WPA3	Standard with highest available level of security AES256 and SAE are used as encryption methodes: https://en.wikipedia.org/wiki/WPA3
Assign the IP addresses to the clients in this network via DHCP: Not in bridge mode	Off	When enabled Yes, the UTM works as a DHCP server: All clients in the WLAN network receive an IP address via DHCP. This sets the UTM as the default gateway and DNS server for the clients. In bridge mode, the setting from the internal network in which bridge mode was activated is used here.
Pre-Shared Key:	Don'tcopythis:Ei)#W~X$…	The base station and mobile device must have the same PSK (≙password). The security of the encryption depends directly on the length and complexity of the PSK! Short or easily guessed PSKs compromise network security.
Pre-Shared Key:		Automatically generates a very strong PSK
Generate rules for Internet access: Not in bridge mode	Off	Port filtering rules can be automatically created for this network, allowing traffic to the Internet on the interface to the external interface (A0). Likewise, rules are created that also allow data traffic from the internal network into the WLAN network. These rules release all from this network to the Internet and other internal networks. notempty These any rules are intended for testing purposes and should be disabled and replaced with well-defined rules in production mode. In bridge mode, the setting from the internal network in which bridge mode was activated is used here.

Step 7 - Certificate
Generate CA and server certificate:	Yes Default	If Yes is enabled, a CA and server certificate will be generated. The boxes Country, Organization and Department are preset depending on the license entered, but can also be changed here.	Step 7
Country:	DE	Detailed information is used to identify who issued the certificate
State:	Lower Saxony
Organization:	TTT Point
Department:	Support
Email address:	admin@ttt-point.de

Step 8 - Administrator
User	admin	The username admin cannot be changed at this point	Step 8
Password:	•••••••	Passwords must meet the following criteria: at least 8 characters length at least 3 of the following categories: Upper case Lower case Special characters Digits
Confirm password:	•••••••
Done	The wizard is being completed A new configuration is created with the name configuration-wizard-date-time This configuration is set as the start configuration This configuration is set as the active configuration

Reboot → Configuration →Restart
Do you want to reboot the system now?	Yes	In order for the configuration changes to be applied, the respective services must be restarted in the correct order. This is achieved by a reboot of the device.

Import Cloud Backup

Import cloud backup under
As soon as the UTM has access to the Internet, those cloud backups that were created with this licence are displayed here.

Cloud Backup download Tab Cloud-Backup
Import configuration		Loads the selected backup into the local configuration manager under the name backup-YYYY-DD-MM_HH:ii:ss , where the time of backup is included in the name. The servers only hold a certain number of configurations. The rotation is done according to the following scheme: the latest 7 backups are kept (first in, first out) after that 4 weekly backups are kept after that 12 monthly backups are kept This rotation takes place separately for each license key.

Set cloud backup as start configuration Tab Local Configuration
Set as boot configuration		Sets the restored version as the future start version

Perform reboot
Do you want to reboot the system now?	Yes	In order for the configuration changes to be applied, the respective services must be restarted in the correct order. This is achieved by restarting the machine.

The UTM now boots with the cloud backup settings

Prefaces

Installation wizard

Step 1 - General

Step 2 - Privacy

Step 3 - Internal

Step 4 - Internet

Connection type PPPoE / VDSL

Connection type Ethernet with static IP

Connection type Cable modem with DHCP

Connection type LTE / others

Step 5 - DMZ

Step 6 - WLAN

Step 7 - Certificate

Step 8 - Administrator

Reboot

Import Cloud Backup

Cloud Backup download

Set cloud backup as start configuration

Perform reboot