Firmware, backups, and HA

The firewall's Settings tab has three sections:

Anyone who can see the firewall can read these sections. Changing anything needs permission to change firewalls.

#Firmware and restarts

Firmware and restarts shows the firewall's OPNsense and ReadyView plugin versions, when it last checked for updates, and how long it's been running. Its status reads Up to date, Updates available, Restart needed, Working, or Not checked.

#Check for updates

Click Check for updates. The firewall checks with its update server, which takes a minute or so, and the section shows what it found: how many packages, the new OPNsense and plugin versions, and whether the firewall will restart. Show the packages lists each one.

Major OPNsense upgrades aren't offered in ReadyView. Do those in the firewall's own web interface under System > Firmware.

#Update or restart

1. Click Update… or Restart….
2. For an update, choose What to update:
   • Everything: OPNsense and all its packages. The firewall goes offline while it updates, usually for 5 to 20 minutes, and restarts if an update needs it.
   • ReadyView plugin only: traffic keeps flowing, and the firewall disappears from ReadyView for about a minute while the plugin restarts.
3. Choose When:
   • Now;
   • At a time, up to 90 days ahead, in your time zone;
   • Maintenance window: days of the week and a start and end time in the firewall's time zone, once or Every week.
4. Click Update now, Schedule update, Restart now, or Schedule restart, then Yes, go ahead.

While a job runs, the section shows its progress and keeps checking the firewall, including while it's offline, for up to two hours. Show the log shows the update's output.

Scheduled jobs are kept on the firewall itself and run even if it can't reach ReadyView at the time. A firewall holds up to four. A job that misses its time because the firewall was off still starts if it's back within an hour. Cancel removes a scheduled job.

Recent jobs lists how each job ended. A job that failed says why, for example:

#Firmware on several firewalls

To check, update, or restart up to 20 firewalls at once, open Security > Fleet templates on any firewall and use Firmware on several firewalls. Click Choose firewalls, or With updates to pick every firewall that has updates, then choose the action and when. Maintenance windows use each firewall's own time zone. Each firewall needs plugin 1.11 or later and Allow updates and reboots from ReadyView.

#Configuration backups

With backups on, the firewall sends ReadyView an encrypted copy of each new configuration version, with who saved it and what changed. The firewall encrypts each copy with its own backup password, so ReadyView can't read the files.

#Turn on backups

1. On the firewall, open Services > ReadyView > Settings.
2. Under Backups, enter a Backup password, 12 to 128 characters, and click Save.
3. Refresh ReadyView. The firewall sends its first version within a few minutes.

ReadyView keeps the newest 30 versions, plus the newest of each day for 90 days, up to 200 MB per firewall. Saves close together are kept as one version, so one version can hold several saves by different people.

#Compare versions

Click a version to see its saves and what changed from the version before: settings added, changed, or removed. Passwords and keys show as "secret, not shown".

To compare any two versions, tick both and click Compare. Because ReadyView doesn't keep every version in between, a comparison over a long gap may miss changes that came and went.

#Download a version

Click Download on a version. The file is encrypted with the firewall's backup password. To restore it in the firewall's own web interface, open System > Configuration > Backups, choose the file, tick Configuration file is encrypted., enter the password, and click Restore configuration.

#Restore a version

Restoring from ReadyView also needs Allow restores from ReadyView under Backups on the firewall, and ReadyView's command key.

1. Click Restore on the version.
2. Confirm Restore.

The firewall saves its configuration as it is now, applies the version, and reloads its services, without a reboot. It keeps its ReadyView and console settings. If it can't reach ReadyView afterwards, it puts the saved configuration back. You can leave the page; the firewall finishes on its own.

The firewall refuses a version that would move the port it reaches ReadyView through, or that uses network ports it doesn't have, such as a version from a different model. Nothing changes in either case.

#Warm spare

A warm spare is a second ReadyWall at the same site that takes over if the primary stops answering. The two firewalls share addresses on each network. The primary answers on them, and the warm spare takes them over within seconds when the primary fails. Under the hood this is OPNsense's CARP high availability.

#Before you start

• Both firewalls must be in the same organization and site, and run plugin 1.11 or later.
• Both need Allow warm spare changes from ReadyView and ReadyView's command key.
• Each network to share needs a fixed IPv4 address on both firewalls, in the same range, and one free address in that range for the shared address.
• Ideally, connect the two firewalls with a cable of their own, to copy open connections between them.

#Pair two firewalls

1. On the firewall that should handle the traffic, open Settings > Warm spare and click Pair with a warm spare.
2. Choose the Warm spare firewall. ReadyView says whether it's ready to pair.
3. Leave This firewall's role as Primary (handles the traffic).
4. For each Network to share, enter a free Shared address, and leave Group number on Auto.
5. Under Copy open connections over, choose the interface that links the two firewalls, or Don't copy open connections.
6. Choose how fast to Take over: within about 3, 10, or 30 seconds.
7. Leave Hand back to the primary when it's back ticked, unless you want to move back by hand.
8. Click Check, read the plan, and click Pair.

#Keep both firewalls the same

Settings on both firewalls compares the two firewalls' rules, port forwards, aliases, and DNS filter, and marks each Same or Different.

• Copy to the spare copies the primary's aliases and DNS filter to the warm spare. It adds and updates, and never removes anything.
• Keep the spare in step automatically copies alias, region filter, and DNS filter changes made from ReadyView as you make them. Changes made in the firewall's own web interface aren't copied.

Rules and port forwards are never copied. Change them on both firewalls.

#Test failover

1. On the primary, click Test failover and confirm. Every shared address moves to the warm spare. Open connections that aren't copied drop.
2. Watch the shared addresses move. ReadyView reads both firewalls every 5 seconds for a minute.
3. Click End the test to move the addresses back.

The status then reads Warm spare in charge, for a test and a real failover alike. Check the alerts or the organization's Logs to tell them apart.

On the warm spare, Pause the warm spare stops it from taking over, for example during maintenance on it. A paused spare gives no protection, so click Resume the warm spare when you're done.

#Warm spare alerts

• Alert when the warm spare takes over: on by default, after 2 minutes. It clears 2 minutes after the primary has every address back.
• Alert when the warm spare can't take over: on by default, after 5 minutes.

#Unpair

Click Unpair and confirm. Both firewalls remove the shared addresses, so devices using them as their gateway or DNS server lose their connection until you point them at one firewall's own address. Change the DHCP settings first.

#Warm spare problems