Print topic

Use recovery mode to reset the device

There are two ways to reset your WatchGuard SSL device to factory default settings:

Use the WatchGuard SSL Web UI

If you can log into the WatchGuard SSL Web UI, you can restore the device to factory default settings in the Web UI. This is the easiest method to restore the factory default settings.

For more information, see Restore factory default settings.

Use recovery mode

If you cannot log into the WatchGuard SSL Web UI, you can start the device in recovery mode. When the device is in recovery mode you can reinstall the software image and restart the device with factory default settings. 

Before you begin

Before you start the recovery process, you must download a copy of the WatchGuard SSL OS onto your computer. The file has an extension of .sysa-dl. You can download the file from the Software Downloads section of the WatchGuard web site at If the file you download is a zip file, you must extract the files before you start the recovery process.

Start the WatchGuard SSL device in recovery mode

  1. Turn the power off.
  2. Press and hold the up arrow on the front panel while you turn the power on.
  3. Keep the button depressed until you see the words “Executing SysB” on the LCD display.
  4. When you see the words "Recovery Mode Ready" on the LCD display, the device is in recovery mode. In recovery mode, the Eth1 address of the device is set to

Upload a new software image

You must use the command line FTP command to upload the software image. This is because many commands are disabled on the WatchGuard SSL device for security. For example, you cannot change directories (cd) or show the remote working directory (pwd). Other FTP programs rely on these commands to show you a list of files in the remote directory, and cannot operate when these commands are disabled.

Use these steps to upload a new software image to your WatchGuard SSL device.

  1. Connect an Ethernet network cable between your computer and the Eth1 interface on the WatchGuard SSL device.
  1. Change the IP address of your computer to (or to another IP address on the network).
  1. Open the command line interface of your computer. To do this: if you use Windows XP, select All Programs > Accessories > Command Prompt from the Windows Start Menu.
  2. Change your local working directory to the location where you saved the .sysa_dl file.
  3. At the command prompt type:
  4. Type admin as the user.
  5. Type admin as the password.
  6. At the ftp prompt, type:
  7. At the ftp prompt, type:
    put <filename>
    For the filename, type the name of the file you downloaded from the WatchGuard Software Downloads page.
  8. Type quit to close the FTP connection and exit the program.

After the software image upload completes, the WatchGuard SSL device installs the software and resets the configuration to the default settings. When the reset process completes, the device automatically restarts.

The installation and reset process can take up to 10 minutes. Do not turn off the device during this process.

Next Steps

After you restore the software image and the device restarts with factory default settings, you can use the Quick Setup Wizard to set up your configuration again.

After the reboot, the IP address of the Eth1 interface changes to You must change the IP address on your computer before you launch the Quick Setup Wizard.

For more information, see Use the Quick Setup Wizard to set up a basic configuration.


Give us feedback  •   Get Support  •   All product documentation  •   Knowledge Base