Configure a Replacement (RMA) FireCluster Member

Applies To: Locally-managed Fireboxes This topic applies to Fireboxes you configure in Policy Manager or Fireware Web UI.

If your Firebox hardware fails during the warranty period, WatchGuard might replace it with an RMA (Return Merchandise Authorization) unit of the same model. When you exchange a Firebox for an RMA replacement, WatchGuard Customer Care transfers the licenses from the original device serial number to the new device serial number. All the features that were licensed to the original device are transferred to the replacement device.

Caution: When you return a Firebox, return only the defective product. Keep any expansion modules and all of the original manuals, cables, cords, and disks, as we do not ship these with the replacement product.

Before You Begin

If you replace a FireCluster member, follow the procedures in this topic to prepare the replacement Firebox and add the device to the FireCluster.

WARNING: You must use WatchGuard System Manager (WSM) for this procedure. You cannot use Fireware Web UI to configure a cluster, change FireCluster settings, or save the FireCluster configuration to the replacement Firebox.

• Use Policy Manager to update the FireCluster configuration and save the updated configuration to both the active Firebox and the replacement Firebox.
• The management computer used to configure the replacement Firebox does not need to be the same computer used to manage the production cluster. After you update the configuration, save it as a file. You can then open that file from another computer running WSM and save it to the replacement Firebox.

Do not connect the replacement Firebox to the production network while you prepare it. Configure the replacement Firebox from a management computer connected directly to interface 1, or from a separate network.

Overview of Replacement Steps

Complete these steps in order:

1. Compare the Fireware Version and Build Number on Each Firebox
2. Get the Feature Key for the Replacement Firebox
3. Upgrade or Downgrade the Fireware Version on the Replacement Firebox
4. Update the FireCluster Configuration
5. Prepare the Replacement Firebox
6. Connect the Replacement Firebox and Form the Cluster
7. Verify Cluster Status
8. Troubleshooting

After you update the FireCluster configuration and save it to the active Firebox, you can start the replacement Firebox with factory-default settings, connect it to the cluster, and use Discover Member instead of saving the configuration to the replacement Firebox offline. For more information, go to Discover a Cluster Member.

Compare the Fireware Version and Build Number on Each Firebox

Before you add the replacement Firebox to your cluster, compare the version of Fireware on the replacement Firebox with the version installed on the current cluster master Firebox. You can use WatchGuard System Manager to find the version of Fireware installed on each Firebox.

To find the Fireware version and build number installed on the replacement Firebox:

1. Start the replacement Firebox. It does not have to be connected to the Internet.
2. Use an Ethernet cable to connect your management computer to interface 1.
3. In WatchGuard System Manager, connect to the Firebox with the default Firebox settings:
   • IP Address — 10.0.1.1
     
   • User Name — status
   • Passphrase — readonly
4. After you connect to the Firebox, adjacent to the Firebox model number, find the Fireware version and build number.

To find the Fireware version and build number installed on the cluster master in WatchGuard System Manager:

1. In WatchGuard System Manager, connect to the cluster master.
2. Expand the cluster and the cluster master details.
3. In the cluster member details, find the Fireware version and build number.

If the Fireware version and build numbers are not the same, you must upgrade the replacement Firebox to the same version of Fireware that is installed on the cluster master.

Get the Feature Key for the Replacement Firebox

Because your replacement Firebox has a different serial number than your original Firebox, the device requires a new feature key. You must have the Firebox feature key to upgrade software on the Firebox (if necessary), and to add the replacement Firebox to the FireCluster configuration.

If the replacement Firebox is connected to the Internet, synchronize the feature key with Firebox System Manager:

1. Connect to the replacement Firebox with WatchGuard System Manager.
2. Start Firebox System Manager.
3. Select Tools > Synchronize Feature Key.
   If you are logged in to the device as a Device Monitor user, the Synchronize Feature Key dialog box appears. If you are logged in as a Device Administrator, the feature keys are synchronized.

4. In the User Name text box, type the name of a user account with Device Administrator credentials.
5. In the Passphrase text box, type the passphrase for the user.
6. From the Authentication Server drop-down list, select the authentication for the user account you specified.
7. If you select an Active Directory authentication server, in the Domain text box, type the domain for the user account you specified.
8. Click OK.
   The Firebox connects to the WatchGuard website and downloads the current feature key to your Firebox .
9. Open Policy Manager.
10. Select Setup > Feature Keys > Details.
    The Feature Key Details dialog box opens.
11. Copy the feature key text to a local file. You will use this feature key to update the FireCluster configuration.

If the replacement Firebox is not connected to the Internet, manually copy the feature key from the WatchGuard website:

1. To get the feature key for your device:
2. Open a web browser and go to https://myproducts.watchguard.com/manage-products.
3. Log in to your WatchGuard account.
   The Manage Products page appears.
4. On the Manage Products page, in the Network Security section, click View Products.
   The Network Security page opens with a list of devices activated for your account.
5. From your list of activated devices, select the replacement Firebox. The replacement Firebox is in your activated products list with the same Friendly Name as the original Firebox, but with the serial number of the replacement Firebox.
   The Product Details page for the replacement Firebox opens.
6. Click Get Feature Key.
   The feature key details appear in a dialog box.
7. Click Copy.
8. Paste the selected text into a local text file.

Upgrade or Downgrade the Fireware Version on the Replacement Firebox

If the version of Fireware on the replacement Firebox is the same as the version installed on the cluster master, you can skip this section and go to the Update the FireCluster Configuration section.

You can upgrade or downgrade the standalone replacement Firebox with WatchGuard System Manager or with Fireware Web UI. The replacement Firebox does not need Internet access for the upgrade. Use Fireware Web UI only for the firmware upgrade on the standalone replacement Firebox. You must still use WatchGuard System Manager and Policy Manager for all FireCluster configuration steps later in this topic.

To upgrade or downgrade Fireware on the replacement Firebox with WatchGuard System Manager:

1. To make sure the correct Fireware version and build number is installed on your management computer, in WatchGuard System Manager, select Help > About WatchGuard.
   The list of installed Fireware device software appears.
2. Select Tools > Policy Manager.
   Policy Manager appears.
3. Select File > Upgrade.
   The Upgrade dialog box opens.
4. Type the configuration passphrase. The default administrator account credentials are:
   Username — admin
   Passphrase — readwrite
5. To enter the path to the upgrade (or downgrade) image, click Browse. Make sure to select the image file that is the same version as the version installed on the cluster master.
6. Confirm that you want to upgrade the Firebox.
   The Firebox reboots automatically after you confirm.

Update the FireCluster Configuration

Before you update the FireCluster configuration, make sure you have completed these steps on the replacement Firebox:

• Get the Feature Key for the Replacement Firebox
• Copy the feature key to local text file (required for the next procedure)
• Upgrade or Downgrade the Fireware Version on the Replacement Firebox

Complete these steps in WatchGuard System Manager to update the FireCluster configuration so it uses the new feature key. Save the updated configuration to the active FireCluster member only. You prepare the replacement Firebox in the next section.

1. In WatchGuard System Manager, connect to the FireCluster and start Policy Manager.
   
2. Select FireCluster > Configure.
3. Select the Members tab.
4. Select the cluster member that the replacement Firebox will replace, and click Edit.
5. Select the Feature Key tab.
6. To remove the feature key for the old Firebox, click Remove.
7. Click Import.
   The Import Firebox Feature Key dialog box appears.
8. Paste the feature key text from the replacement Firebox into the Import Feature Key dialog box.
9. Select File > Save > To Firebox, specify the management IP address of the current active FireCluster member (not the virtual cluster IP address), and click OK.
   The configuration is saved to the active Firebox. The active member now expects the replacement Firebox serial number and feature key.
10. Select File > Save > As File and save the updated configuration file.
    You can use this configuration file to prepare the replacement Firebox. For more information, go to Save the Configuration File.

Prepare the Replacement Firebox

If you want to use the Discover Member method, you can start the replacement Firebox with factory-default settings, connect it to the cluster, and use Discover Member instead of saving the configuration to the replacement Firebox offline in this section. To use this method and skip this section, go to Connect the Replacement Firebox and Form the Cluster.

Save the same updated FireCluster configuration that you saved to the active member to the replacement Firebox. That configuration includes the replacement Firebox feature key and member identity.

Do this from a management computer that is not on the production network, such as with a direct Ethernet cable to the replacement Firebox, or on a separate network.

WARNING: You must use WatchGuard System Manager (WSM). Do not use Fireware Web UI to save or import the FireCluster configuration to the replacement Firebox.

To save the updated configuration to the replacement Firebox:

1. Make sure the replacement Firebox is not connected to the production network.
2. Use an Ethernet cable to connect your management computer to interface 1 on the replacement Firebox.
3. In WatchGuard System Manager, connect to the replacement Firebox with the default Firebox settings:
   • IP Address — 10.0.1.1
   • User Name — admin
   • Passphrase — readwrite
4. Open Policy Manager with the updated FireCluster configuration.
   
5. Select File > Save > To Firebox, specify the IP address of the replacement Firebox (use 10.0.1.1 if the device still uses factory-default settings), and click OK.
   The full updated FireCluster configuration is saved to the replacement Firebox.
6. Power off the replacement Firebox before you move it to production.

Connect the Replacement Firebox and Form the Cluster

After you prepare the replacement Firebox, install the device in the cluster:

1. Power off the replacement Firebox if it is still running.
2. Disconnect the cables from the original Firebox and connect them to the replacement Firebox. Make sure you connect each cable to the same numbered interface on the new Firebox as it was connected to on the old Firebox.
3. Make sure you install any expansion modules you removed from the old Firebox.
4. Start the replacement Firebox.

To use the Discover Member method to manually start discovery of the second cluster member, select Tools > Cluster > Discover Member. For more information, go to Discover a Cluster Member.

Verify Cluster Status

The cluster should form automatically after you connect the replacement Firebox. To verify whether a cluster has formed, connect to the device in WatchGuard System Manager and refresh the status periodically. If the cluster does not form automatically after a few minutes, reboot or power cycle each Firebox to trigger automatic cluster formation. For more information, go to Monitor and Control FireCluster Members.

Troubleshooting

If the cluster still does not form, reset the replacement Firebox to factory-default settings. This resets the configuration settings and removes the feature key, but does not change the installed version of Fireware. If the Firebox has Internet access after the reset, it automatically downloads its current feature key.

You can then use Firebox System Manager to start discovery of the replacement Firebox.

1. Start the replacement Firebox with factory-default settings.
   For information about how to reset your Firebox, go to Reset a Firebox.
2. Start Firebox System Manager for the cluster master.
3. To manually start discovery of the second cluster member, select Tools > Cluster > Discover Member. For more information, go to Discover a Cluster Member.
4. On the Front Panel tab, expand the cluster to view the status of both cluster members.
   For more information, go to Monitor and Control FireCluster Members.

A factory reset removes the feature key and configuration settings, but does not change the installed Fireware version.

Update Mobile VPN with IKEv2 Profiles

If you use Mobile VPN with IKEv2 with the FireCluster, make sure you generate new profiles and install them on your clients after you add the replacement Firebox to the cluster. For more information, go to Configure Client Devices for Mobile VPN with IKEv2.

Related Topics

Move a FireCluster Configuration to a New Device Model