Applies To: Locally-managed Fireboxes
If a USB drive or storage device is connected to a Firebox in recovery mode, the Firebox can automatically restore a backup image from the USB drive.
To use the auto-restore feature, you must first select a backup image on the USB drive as the image to restore when your Firebox starts in recovery mode. You can use Fireware Web UI, Firebox System Manager, or Fireware command line interface to select this backup image. This feature is not supported on Firebox Cloud, and FireboxV devices.
As of Fireware v12.12.1 and v2026.2.1 and higher, you can no longer select to include the Fireware OS in backup images for auto-restore. You must manually place the matching version and build of the Fireware OS sysa.dl file into the same USB \auto-restore folder as the auto-restore.fxi file (For example: \auto-restore\[Firebox_model]\). This also requires an upgrade to the recovery partition (sysB). For more information, go to Select the Backup Image to Auto-Restore.
WARNING: Do not use a backup image created from a different Firebox for auto-restore. The auto-restore backup image is unique to a single Firebox, and includes the serial number, certificates, and private keys unique to that Firebox.
Select the Backup Image to Auto-Restore
When you designate a backup image to restore automatically, a copy of the backup image file is encrypted and saved on the USB drive with the file name auto-restore.fxi. The backup image file is saved in a subdirectory for your Firebox model below the \auto-restore\ directory. For example, \auto-restore\[Firebox model]\auto-restore.fxi.
You can select only one auto-restore backup image for each Firebox model on each USB drive. If an auto-restore backup image already exists on the USB drive for your Firebox model, it is overwritten when you select a different backup image for auto-restore.
- Fireware v12.12 and v2026.2 and Lower — When you save a backup image to a connected USB drive, you can choose whether to include the Fireware OS in the backup image. The backup image you select for auto-restore must include the Fireware OS. The Firebox cannot automatically restore a backup image that does not include the Fireware OS.
- Fireware v12.12.1 and v2026.2.1 and Higher — When you save a backup image to a connected USB drive, you can no longer select to include the Fireware OS as in previous versions. You must manually place the matching version and build of Fireware OS ([Firebox_model_version].sysa-dl) into the same USB \auto-restore folder as the auto-restore.fxi file.
For example:
\auto-restore\[Firebox_model]\
auto-restore.fxi
[Firebox_model_version].sysa-dl
auto-restore-info.txt
The Firebox also creates an auto-restore-info.txt file in the same folder that identifies the matching .sysa-dl image version required.
Caution: In Fireware v12.12.1 and v2026.2.1 and higher, you must first upgrade your recovery partition (sysB) to be able to restore a USB auto-restore backup image created with these versions. For more information on how to download and install a new recovery partition (sysB) upgrade file, go to Firebox in recovery mode requires updated recovery partition (sysB) for USB auto-restore in the WatchGuard Knowledge Base. If you have not yet upgraded your recovery partition (sysB), USB auto-restore backup images created with previous Fireware versions will continue to work for auto-restore. After you upgrade the recovery partition (sysB), USB auto-restore backup images created with previous Fireware versions will continue to work for auto-restore, but you must manually place the matching Fireware OS .sysa-dl file in the \auto-restore folder on the USB drive. Any embedded OS in the backup image is ignored. Root CA certificates from the previous Fireware version backup image are not restored. The Firebox boots with default certificates for the installed firmware version. You must manually re-import any certificates you imported previously.
The backup image you select for auto-restore must have been saved to the connected USB drive from Fireware 12.3 or higher. The Firebox cannot automatically restore a backup image that was saved to a USB drive from Fireware 12.2.1 or lower.
- Select System > Backup and Restore Image.
The Backup and Restore Image page opens. - Select the USB tab.
The list of available backup images on the USB drive appears. The most recently saved backup image is at the top of the list.
- From the Available backup images list, select a backup image file that includes the Fireware OS.
- Click Set Auto-Restore.
The Set Auto-Restore dialog box opens.
- Type the Password that was used to encrypt the backup image file. Click Set Auto-Restore.
The Firebox saves a copy of the selected backup image on the USB drive with the file name auto-restore.fxi. The image is encrypted with a random encryption key that can only be used by the automatic restore process.
- Start Firebox System Manager.
- Select Tools > USB Drive.
The Backup/Restore to USB Drive dialog box appears. The most recently saved backup image is at the top of the list.
- From the Available backup images list, select a backup image file that includes the Fireware OS.
- Click Set Auto-Restore.
The USB Auto-Restore dialog box opens.
- Type the Encryption Key that was used to encrypt the backup image file. Click OK.
- Type the configuration passphrase for your Firebox. Click OK.
The Firebox saves a copy of the selected backup image on the USB drive with the file name auto-restore.fxi. The image is encrypted with a random encryption key that can only be used by the automatic restore process.
If you previously saved an auto-restore backup image on the USB drive, the existing auto-restore.fxi file is replaced with a copy of the backup image you selected.
Auto-Restore the Backup Image
To auto-restore the selected backup image, you must start your Firebox in recovery mode. When you start the Firebox in recovery mode, it verifies that the USB drive includes a valid auto-restore image for the Firebox. If the USB drive contains a valid auto-restore image for the Firebox, the Firebox automatically restores the backup image and reboots.
WARNING: Backup images saved on your Firebox are removed when you reset the device. Before you reset a Firebox, we recommend that you export a recent backup image from the Firebox. For more information, go to Export a Backup Image Stored on the Firebox.
- Power off the Firebox.
- Press and hold the Reset button on the back of the Firebox.
- While you continue to hold the Reset button, power on the Firebox.
- Continue to press the Reset button until the Attn indicator begins to flash.
- Release the Reset button. Do not power off the Firebox yet.
- Wait for the reset process to complete. This can take 70 seconds. When the reset is complete, the Attn indicator stays lit and does not flash.
The Firebox is in recovery mode.
- Power off the Firebox.
- Press and hold the Reset button on the front left of the Firebox, and briefly press the Power button on the front of the Firebox to power it on.
The Arm indicator is red. - Continue to hold the Reset button while the Arm indicator (
) is red.
The Arm indicator starts to flash green. - Continue to hold the Reset button while the Arm indicator flashes once per second.
- After the Arm indicator starts to flash green twice per second, release the Reset button.
- Wait until the Arm indicator starts to flash red.
The Firebox is in recovery mode.
If the USB drive does not contain a valid auto-restore image, the auto-restore fails and the Firebox does not reboot. If the auto-restore process is not successful, you must power off and then power on the Firebox to start it with factory-default settings. For information about factory-default settings, go to About Factory-Default Settings.