Upgrade Fireware OS or WatchGuard System Manager

WatchGuard periodically distributes upgrades for Fireware OS and WatchGuard System Manager. If you use WatchGuard System Manager to administer your Fireboxes, you must upgrade WatchGuard System Manager before you upgrade the Fireboxes it manages. The version of WatchGuard System Manager you use must be the same as, or higher than, the version of Fireware OS on any Firebox it manages.

For information about how to upgrade a FireCluster, go to Upgrade Fireware OS for a FireCluster.

Fireware OS Upgrade Requirements

Before you upgrade a Firebox to Fireware v11.10 or higher, your Firebox must install one of these OS versions:

  • Fireware XTM v11.9 or higher
  • Fireware XTM v11.8.4
  • Fireware XTM v11.7.5

For more information, go to Upgrade Requirements for Fireware 11.10 in the WatchGuard Knowledge Base.

See Available OS Versions in Fireware Web UI

From Fireware Web UI, you can see the versions of Fireware OS that are available for your Firebox to upgrade to:

  1. Log in to Fireware Web UI.
  2. Select System > Upgrade OS.
    The Firebox contacts the WatchGuard software update server to get the latest OS version available for this Firebox.

Screen shot of the Upgrade OS page in Fireware Web UI

If a higher version of Fireware OS is available for your Firebox, you can use the Web UI to download and install the upgrade directly from WatchGuard, or you can download the upgrade to your management computer and use Policy Manager or the Web UI install it on your Firebox from there. Both options are described in the next sections.

Download OS and Management Software Upgrade Files

Before you can use Policy Manager or Fireware Web UI to upgrade the version of Fireware OS on your Firebox, you must first download the latest OS upgrade file for your Firebox model and install it on your management computer. If you use Policy Manager, and the version of WatchGuard System Manager is not higher than the version of Fireware OS you want to upgrade your Firebox to, you must also download an upgrade to WatchGuard System Manager.

Fireware OS updates are available in two file formats. You can use either of these files to install the Fireware OS upgrade file:

  • Fireware (Windows executable installer) — Installs the Fireware OS upgrade file on a Windows computer. If you use Policy Manager to administer your Firebox, because the installer automatically saves the sysa-dl file for each Firebox model in the location that Policy Manager expects to find the OS upgrade file for each model, WatchGuard recommends that you use the Fireware OS installer to install the OS upgrade on your management computer.
  • Fireware Sysa-dl (ZIP file) — This ZIP file contains the sysa-dl Fireware OS upgrade file. You can use this option if you use Fireware Web UI to administer your Firebox and you want to save the upgrade file to a specific location, or if you want to use the Web UI to install a Firebox upgrade from a computer that does not run Windows.

To download Fireware OS and management software upgrades:

  1. Go to software.watchguard.com.
  2. To see all available software downloads for your Firebox, select your Firebox model.
  3. For information about what is included in the release and any release-specific upgrade steps, click the Release Notes link.
  4. Download Fireware OS for your Firebox.
    • Fireware (EXE file)
    • Fireware Sysa-dl (ZIP file)
  5. Download the latest version of WatchGuard System Manager.

Upgrade WatchGuard System Manager on Your Management Computer

Before you can use Policy Manager to upgrade the version of Fireware OS on your Firebox, the version of WatchGuard System Manager must be the same or higher than the version of Fireware OS you want to install on your Firebox.

If you have installed WatchGuard Servers on your management computer, we recommend that you back up the server data (if appropriate) before you upgrade.

To upgrade WatchGuard System Manager:

  1. To back up the settings on your Management Server, go to Back Up or Restore the Management Server Configuration.
  2. Uninstall the version of WatchGuard System Manager currently installed on your management computer:
    1. Select Control Panel > Programs > Programs and Features.
    2. From the list of installed programs, select WatchGuard System Manager.
    3. Click Uninstall.
    4. If the uninstaller asks whether you want to delete the WatchGuard Server configuration files, click No.
      The configuration files are used by the upgraded WatchGuard Servers after you reinstall the newer version of servers with WatchGuard System Manager.
  3. Install the new version of WatchGuard System Manager:
    1. Run the WatchGuard System Manager installer that you downloaded from the WatchGuard website.
    2. Follow the installer instructions to install the WatchGuard System Manager and any WatchGuard servers you want to use.
      For more information about how to install WatchGuard System Manager, go to Install WatchGuard System Manager Software.

Install a Fireware OS Upgrade on Your Management Computer

After you download the Fireware OS upgrade file to your computer, use either of these methods to install the OS upgrade file on your computer.

To use the Fireware OS installer:

  1. Run the Fireware OS installer file that you downloaded from the Software Downloads page for your Firebox model.
  2. To install the OS upgrade file on your computer, follow the installer instructions.
    The final page of the installer shows the directory location where the sysa-dl OS upgrade file was installed. The installer saves the file in these locations:
  • 32-bit Windows — C:\Program Files\Common Files\WatchGuard\resources\FirewareXTM\<OS version>\<model>
  • 64-bit Windows — C:\Program Files (x86)\Common Files\WatchGuard\resources\FirewareXTM\<OS version>\<model>

Screen shot of the Installation Complete page of the installer, with the Open Directory option

  1. To open the directory where the sysa-dl file was installed, click Open Directory.

To use the ZIP file:

  1. Open the ZIP file you downloaded from the Software Downloads page for your Firebox model.
  2. Extract the sysa-dl file from the ZIP file and save it to a location on your computer.

After you have installed or unzipped the Fireware OS update to your computer, you can update the Firebox, as described in the next sections.

To update your Firebox configuration from a saved configuration file, make sure you open the configuration from the Firebox and save it to a new file after you upgrade. This is to make sure that you do not overwrite any configuration changes that were made as part of the upgrade.

Upgrade the Firebox

You can upgrade the version of Fireware OS on your Firebox from Fireware Web UI, Policy Manager, or WatchGuard Cloud. An OS upgrade can take as long as 15 minutes. Do not interrupt power or restart your Firebox until the upgrade is complete. The upgrade process automatically restarts the Firebox after the upgrade.

If the current Fireware OS version on your Firebox is v12.2.1 or higher, the upgrade process creates a backup image automatically and saves it to the Firebox. If the current Fireware OS version is v12.2 or lower, WatchGuard recommends that you always create a backup image before you upgrade. To downgrade the Firebox to the previous version and restore the configuration in the future, you must have the backup image. For more information, go to Save a Firebox Backup Image.

For information on how to upgrade the firmware from WatchGuard Cloud, go to Upgrade Firmware in WatchGuard Cloud.

If your Firebox has been in operation for some time before you upgrade, it might be necessary to restart the Firebox to clear the temporary memory before you start the upgrade process.

Install a Component Package

WatchGuard occasionally releases component packages, which enable you to update a specific component of the firmware installed on the Firebox without an upgrade to Fireware OS.

A component package is a .wgpkg-dl file, distributed in a ZIP file. After you download a component package, extract the .wgpkg-dl file to a location on your computer. Then use the same steps to install it as you would to install a. sysa-dl OS upgrade file.

Some component packages are included in Fireware OS updates. It is not necessary to install a component package if your Firebox uses a version of Fireware OS that includes that component.

Related Topics

Downgrade Fireware