Netgate SG-2100 Manual

Security gateway

Hide thumbs Also See for SG-2100:

Manual (50 pages)

Table Of Contents

Table of Contents

Quick Links

Download this manual

Security Gateway Manual

SG-2100

Jul 22, 2022

Table of Contents

Summary of Contents for Netgate SG-2100

Page 2: Table Of Contents
2 Initial Conﬁguration 3 pfSense Plus Software Overview 4 Input and Output Ports 5 Safety and Legal 6 Netgate 2100 Wall Mount 7 Connecting to the Console Port 8 Reinstalling pfSense Plus Software 9 Optional M.2 SATA Installation 10 Conﬁguring the Switch Ports 11 Conﬁguring an OPT interface as an additional WAN...
Page 3 Security Gateway Manual SG-2100 This Quick Start Guide covers the ﬁrst time connection procedures for the Netgate® 2100 Firewall Appliance. It will provide the information needed to keep the appliance up and running. Tip: Before getting started, a good practice is to download the...
Page 4: Getting Started
CHAPTER GETTING STARTED The basic ﬁrewall conﬁguration begins with connecting the Netgate® appliance to the Internet. The Netgate appliance should be unplugged at this time. Connect one end of an Ethernet cable to the WAN port (shown in the Input and Output Ports section) of the Netgate appliance.
Page 5 Connecting to the Console Port. Warning: The default IP Address on the LAN subnet on the Netgate ﬁrewall is 192.168.1.1/24. The same subnet cannot be used on both WAN and LAN, so if the default IP address on the ISP-supplied modem is also 192.168.1.1/24, disconnect the WAN interface until the LAN interface on the ﬁrewall has been renumbered...
Page 6: Initial Configuration
If the CPE on WAN (e.g. DSL or Cable Modem) has a default IP Address of 192.168.1.1, disconnect the Ethernet cable from the WAN port on the Netgate 2100 Security Gateway before proceeding. Change the default LAN IP Address of the device during a later step in the conﬁguration to avoid having conﬂicting subnets on the WAN and LAN.
Page 8 Tip: If the CPE on WAN (e.g. DSL or Cable Modem) has a default IP Address of 192.168.1.1, disconnect the Ethernet cable from the WAN port on the Netgate 2100 Security Gateway before proceeding. © Copyright 2022 Rubicon Communications LLC...
Page 10 Fig. 7: Read and Click Accept If the Ethernet cable was unplugged at the beginning of this conﬁguration, reconnect it to the WAN port now. This completes the basic conﬁguration for the Netgate appliance. © Copyright 2022 Rubicon Communications LLC...
Page 11: Pfsense Plus Software Overview
ﬁrewall. ® Fig. 1: The pfSense Plus Dashboard Section 1 Important system information such as the model, Serial Number, and Netgate Device ID for this Netgate ﬁrewall. ® Section 2 Identiﬁes what version of pfSense Plus software is installed, and if an update is available.
Page 12 Click Download configuration as XML and save a copy of the ﬁrewall conﬁguration to the computer con- nected to the Netgate ﬁrewall. This backup (or any backup) can be restored from the same screen by choosing the backed up ﬁle under Restore Conﬁguration.
Page 14 See also: Connecting to the Console Port. Cable is required. Tip: To learn more about getting the most out of a Netgate appliance, sign up for a pfSense Plus Software Training course or browse the extensive Resource Library.
Page 15: Input And Output Ports
CHAPTER FOUR INPUT AND OUTPUT PORTS 4.1 Rear Side Fig. 1: Rear view of the Netgate 2100 Firewall Appliance The items in this image are described by entries in Routed Ethernet, Switched Ethernet, and Other Ports. 4.1.1 Routed Ethernet The WAN Combo-Port is shared between an RJ-45 port and an SFP port. Only one port can be used.
Page 16 Security Gateway Manual SG-2100 4.1.2 Switched Ethernet Interface Name Port Name LAN1 mvneta1 LAN2 mvneta1 LAN3 mvneta1 LAN4 mvneta1 The four LAN Ethernet ports are switched ports. By default all of these ports as a single switch uplinked to the LAN interface on the ﬁrewall.
Page 17 For example, UPS/Battery Backups, Cellular modems, GPS units, and storage devices. Though the operating system also supports wired and wireless network devices, these are not ideal and should be avoided. 4.2 Front Side Fig. 2: Front view of the Netgate 2100 Firewall Appliance 4.2.1 LED Patterns Description...
Page 18: Safety And Legal
CHAPTER FIVE SAFETY AND LEGAL 5.1 Safety Notices 1. Read, follow, and keep these instructions. 2. Heed all warnings. 3. Only use attachments/accessories speciﬁed by the manufacturer. Warning: Do not use this product in location that can be submerged by water. Warning: Do not use this product during an electrical storm to avoid electrical shock.
Page 19 Security Gateway Manual SG-2100 5.3 FCC Compliance Changes or modiﬁcations not expressly approved by the party responsible for compliance could void the user’s au- thority to operate the equipment. This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: 1.
Page 20 Security Gateway Manual SG-2100 5.7.2 Deutsch Die Europäische Richtlinie 2002/96/EC verlangt, dass technische Ausrüstung, die direkt am Gerät und/oder an der Verpackung mit diesem Symbol versehen ist, nicht zusammen mit unsortiertem Gemeindeabfall entsorgt werden darf. Das Symbol weist darauf hin, dass das Produkt von regulärem Haushaltmüll getrennt entsorgt werden sollte. Es liegt in Ihrer Verantwortung, dieses Gerät und andere elektrische und elektronische Geräte über die dafür zuständigen und von...
Page 21 SG-2100 5.8 Declaration of Conformity 5.8.1 ˇ Cesky[Czech] NETGATE tímto prohla uje, e tento NETGATE device, je ve shod se základními po adavky a dal ími p íslu n mi ustanoveními sm rnice 1999/5/ES. 5.8.2 Dansk [Danish] Undertegnede NETGATE erklærer herved, at følgende udstyr NETGATE device, overholder de væsentlige krav og øvrige relevante krav i direktiv 1999/5/EF.
Page 22 Alulírott, NETGATE nyilatkozom, hogy a NETGATE device, megfelel a vonatkozó alapvetõ követelményeknek és az 1999/5/EC irányelv egyéb elõírásainak. 5.8.10 Íslenska [Icelandic] Hér me l sir NETGATE yﬁr ví a NETGATE device, er í samræmi vi grunnkröfur og a rar kröfur, sem ger ar eru í tilskipun 1999/5/EC. 5.8.11 Italiano [Italian] Con la presente NETGATE dichiara che questo NETGATE device, è...
Page 23 Security Gateway Manual SG-2100 5.8.16 Slovensky [Slovak] NETGATE t mto vyhlasuje, e NETGATE device, sp a základné po iadavky a v etky príslu né ustanovenia Smernice 1999/5/ES. 5.8.17 Svenska [Swedish] Härmed intygar NETGATE att denna NETGATE device, står I överensstämmelse med de väsentliga egenskapskrav och övriga relevanta bestämmelser som framgår av direktiv 1999/5/EG.
Page 24 Security Gateway Manual SG-2100 4616 West Howard Lane, Suite 900 Austin, Texas 78728 legal@netgate.com The arbitration will be conducted by the American Arbitration Association (AAA) under its rules. The AAA’s rules are available at www.adr.org. Payment of all ﬁling, administration and arbitrator fees will be governed by the AAA’s rules.
Page 25 Security Gateway Manual SG-2100 5.13 Limited Warranty DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITY THE PRODUCTS/SERVICES AND ALL INFORMATION, CONTENT, MATERIALS, PRODUCTS (INCLUD- ING SOFTWARE) AND OTHER SERVICES INCLUDED ON OR OTHERWISE MADE AVAILABLE TO YOU THROUGH THE PRODUCTS/SERVICES ARE PROVIDED BY US ON AN “AS IS” AND “AS AVAILABLE” BA- SIS, UNLESS OTHERWISE SPECIFIED IN WRITING.
Page 26: Netgate 2100 Wall Mount
CHAPTER NETGATE 2100 WALL MOUNT The Netgate 2100 has built in wall-mount keyholes on the bottom of the appliance. This page provides an overview and a PDF template for attaching the system to the wall.
Page 27 SG-2100 The Netgate 2100 can be mounted vertically or horizontally. If mounted horizontally, the ports and cables should face up to reduce the pull from the weight of the cables on the ports. Click on the button below to download the Wall Mount Template.
Page 29: Connecting To The Console Port
CHAPTER SEVEN CONNECTING TO THE CONSOLE PORT This guide shows how to access the serial console which can be used for troubleshooting and diagnostics tasks as well as some basic conﬁguration. There are times when directly accessing the console is required. Perhaps GUI or SSH access has been locked out, or the password has been lost or forgotten.
Page 30 Security Gateway Manual SG-2100 Tip: Be certain to gently push in the USB Mini-B (5-pin) connector on the device side completely. With most cables there will be a tangible “click”, “snap”, or similar indication when the cable is fully engaged.
Page 31 Security Gateway Manual SG-2100 macOS The device associated with the system console is likely to show up as, or start with, /dev/cu.usbserial-<id>. Run ls -l /dev/cu. * from a Terminal prompt to see a list of available USB serial devices and locate the ap- propriate one for the hardware.
Page 32 Security Gateway Manual SG-2100 7.5 Launch a Terminal Program Use a terminal program to connect to the system console port. Some choices of terminal programs: Windows For Windows the best practice is to run PuTTY in Windows or SecureCRT. An example of how to conﬁgure PuTTY is below.
Page 34 Security Gateway Manual SG-2100 Fig. 2: An example of using PuTTY in Linux GNU screen In many cases screen may be invoked simply by using the proper command line, where <console-port> is the console port that was located above. sudo screen <console-port>...
Page 35 Some devices expose multiple ports, so using the incorrect port may lead to no output or unexpected output. Hardware Failure There could be a hardware failure preventing the serial console from working. Contact Netgate TAC for assistance.
Page 36 Security Gateway Manual SG-2100 7.7.2 No Serial Output If there is no output at all, check the following items: USB Cable Not Plugged In For USB consoles, the USB cable may not be fully engaged on both ends. Gently, but ﬁrmly, ensure the cable has a good connection on both sides.
Page 37 Security Gateway Manual SG-2100 7.7.5 Serial Output Stops After the BIOS If serial output is shown for the BIOS but stops afterward, check the following items: Terminal Speed Ensure the terminal program is conﬁgured for the correct speed for the installed operating system.
Page 38: Reinstalling Pfsense Plus Software
1. Please open a support ticket General Problem and then select Netgate SG-2100 for the platform. Make sure to include the serial number in the ticket to expedite access. Once the ticket is processed, the latest stable version of the ﬁrmware will be attached to the ticket, with a name such as: pfSense-plus-SG-2100-recovery-22.05-RELEASE-aarch64.img.gz...
Page 41 Security Gateway Manual SG-2100 11. Cycle the power to complete the installation. Remove the power cable from the Netgate SG-2100 and plug it back in. See also: For information on restoring from a previously saved conﬁguration, go to Backup and Restore.
Page 42: Optional M.2 Sata Installation
CHAPTER NINE OPTIONAL M.2 SATA INSTALLATION The Netgate® 2100 has built-in onboard eMMC storage. Optionally, a M.2 SATA drive could be installed as an upgrade or to bypass the onboard eMMC ﬂash memory. Warning: Before proceeding: 1. Backup the conﬁguration ﬁle, if possible.
Page 43 Security Gateway Manual SG-2100 Fig. 1: Removing the Netgate 2100 Case Screws 2. Turn system upright and carefully remove the cover. Set the cover off to the side and keep it upright so the top is not scratched. Identify where the M.2 SATA drive slot is located and remove the screw from the standoff.
Page 44 4. Gently push down the M.2 SATA card and replace the screw into the standoff. 5. Place the cover back on and turn the Netgate 2100 over. Replace the four (4) T10 Torx case screws. Be careful not to crossthread the screws or overtighten them.
Page 46: Configuring The Switch Ports
This optional guide shows the steps required to conﬁgure the 4 switched Ethernet ports as discrete ports. The following attributes are used in this conﬁguration guide but can be changed to suit other requirements: • SG-2100 Ethernet Port: LAN4 • IP Address Assignment: 192.168.100.1/24 •...
Page 47 Security Gateway Manual SG-2100 4. In the lower right-hand corner of the screen, click + Add. 5. Choose mvneta1 (MAC Address) - lan from the Parent Interface drop-down menu. 6. Set the VLAN Tag to 4084. Type Lan port 4 as the Description. Click Save.
Page 48 Security Gateway Manual SG-2100 Click on + Add. 9. Click on OPT1. This is the Interface that matches the new VLAN being created. 10. Check the Enable Interface check-box. 11. Change the IPv4 Conﬁguration Type from None to Static IPv4.
Page 49 Security Gateway Manual SG-2100 13. Click Save. 14. Click Apply Changes. 15. Go to Interfaces > Switches. 16. Go to the VLANs tab. Click in the Enable 802.1q VLAN mode check-box and click Save. The table will change to reﬂect the new mode.
Page 50 Security Gateway Manual SG-2100 18. Type 4084 for the VLAN Tag and 4 for Member(s). This represents LAN4 (port 4) and tagged should be unchecked. 19. Click + Add Member to add the LAN Uplink, 5. This member should be tagged as shown.
Page 51 25. Click on Port VID 1 beside LAN4. Backspace through 1 and insert 4084, the new VLAN ID. 26. Click Save. This completes the conﬁguration of a discrete port on the Netgate SG-2100. By default all trafﬁc is blocked. Create the appropriate ﬁrewall rules...
Page 52: Configuring An Opt Interface As An Additional Wan
CHAPTER ELEVEN CONFIGURING AN OPT INTERFACE AS AN ADDITIONAL WAN Note: By default the Netgate 2100 is not conﬁgured with OPT interfaces. To reconﬁgure one or more of the LAN switch ports as an OPT interface, see Switch Overview. This guide conﬁgures an OPT port as an additional WAN type interface. These interfaces connect to upstream networks providing connectivity to the Internet or other remote destinations.
Page 53 Security Gateway Manual SG-2100 11.1 Requirements • This guide assumes the underlying interface is already present (e.g. physical port, VLAN, etc). • The WAN conﬁguration type and settings must be known before starting. For example, this might be an IP address, subnet mask, and gateway value for static addresses or credentials for PPPoE.
Page 54 Security Gateway Manual SG-2100 Gateway IPv4 The IPv4 address of the gateway inside the same subnet. Description Optional text describing the purpose of the gateway. – Click – Ensure the new gateway is selected as the IPv4 Upstream Gateway • Check Block private networks This will block private network trafﬁc on the interface, though if the ﬁrewall rules for this WAN are not permis-...
Page 55 Security Gateway Manual SG-2100 Source Network, and ﬁll in the LAN subnet, e.g. 192.168.1.0/24. If there is more than one LAN subnet, create rules for each or use other methods such as aliases or CIDR summarization to cover them all.
Page 56 Security Gateway Manual SG-2100 • Click Save • Click Add to create another gateway group • Conﬁgure the group as follows: Group Name LoadBalance Gateway Priority Gateways for WAN and WAN2 both on Tier 1 Description Prefer WAN2, fail to WAN Note: This performs connection-based load balancing, not per-packet load balancing.
Page 57 Security Gateway Manual SG-2100 • Uncheck DNS Server Override This will tell the ﬁrewall to use the DNS servers entered on this page and to ignore servers provided by dynamic WANs such as DHCP or PPPoE. Occasionally these providers may push conﬂicting DNS server information so the best practice is to assign the DNS servers manually.
Page 58 Security Gateway Manual SG-2100 11.9 Dynamic DNS Dynamic DNS provides several beneﬁts for multiple WANs, particularly with VPNs. If the ﬁrewall does not already have one or more Dynamic DNS hostnames conﬁgured, consider signing up with a provider and creating one or more.
Page 59: Configuring An Opt Interface As An Additional Lan
CHAPTER TWELVE CONFIGURING AN OPT INTERFACE AS AN ADDITIONAL LAN Note: By default the Netgate 2100 is not conﬁgured with OPT interfaces. To reconﬁgure one or more of the LAN switch ports as an OPT interface, see Switch Overview. This guide conﬁgures an OPT port as an additional LAN type interface. These local interfaces can perform a variety of tasks, such as being a guest network, DMZ, IOT isolation, wireless segment, lab network, and more.
Page 60 Security Gateway Manual SG-2100 12.1 Requirements • This guide assumes the underlying interface is already present (e.g. physical port, VLAN, etc). • Choose a new local subnet to use for the additional LAN type interface. This example uses 192.168.2.0/24. 12.2 Assign the Interface The ﬁrst step is to assign an OPT interface.
Page 61 Security Gateway Manual SG-2100 • Click Apply Changes The lack of a selected gateway in the interface conﬁguration causes the ﬁrewall to treat the interface as a LAN type interface. The ﬁrewall uses LAN type interfaces as sources of outbound NAT trafﬁc but does not apply outbound NAT on trafﬁc exiting a LAN.
Page 62 Security Gateway Manual SG-2100 Destination Any Translation Address Interface Address Description Text describing the rule, e.g. Guest LAN outbound on WAN • Click Save • Click Apply Changes Alternately, clone existing NAT rules and adjust as needed to match the new LAN.
Page 63 Security Gateway Manual SG-2100 12.6.2 Isolated In an isolated local network, hosts on the network cannot contact hosts on other networks unless explicitly allowed in the rules. Hosts can still contact the Internet as needed in this example, but that can also be restricted by more complicated rules.
Page 64 Security Gateway Manual SG-2100 • Click Save Add rule to pass ICMP to ﬁrewall • Click to add a new rule at the bottom of the list. • Conﬁgure the rule as follows: Action Pass Interface OPTx (or the custom name)
Page 65 Security Gateway Manual SG-2100 Action Pass Interface OPTx (or the custom name) Protocol Any Source OPTx Net (or the custom name) Destination Any Description Default allow all from OTPx • Click Save With the rules all in place, now click Apply Changes to ﬁnish and activate the new rules.
Page 66: Factory Reset Procedure
CHAPTER THIRTEEN FACTORY RESET PROCEDURE This procedure performs a factory reset using the hardware button on the Netgate 2100. See also: • Factory Reset Video • Factory Reset from GUI or Console 1. Remove power from the device. 2. Gently use a paper clip or similar tool to depress the reset button.
Page 67: Switch Overview
14.1 Interface Links The four LAN ports on the Netgate 2100 are connected internally to a switch. In addition to the four physical ports there is also an internal switch port (Port 5) which acts as an uplink, and the mvneta1 interface which is the corresponding operating system interface for the switch uplink.
Page 68 Security Gateway Manual SG-2100 14.3 802.1q VLAN Mode It is also possible to enable 802.1q VLAN mode instead of the default port mode. Using VLANs, these four switch ports are customizable and each can be conﬁgured to act as independent interfaces.
Page 69: Additional Resources
Netgate training has got you covered. https://www.netgate.com/training 15.2 Resource Library To learn more about how to use Netgate appliances and for other helpful resources, make sure to browse the Netgate Resource Library. https://www.netgate.com/resources 15.3 Professional Services Support does not cover more complex tasks such as CARP conﬁguration for redundancy on multiple ﬁrewalls or...
Page 70: Warranty And Support
CHAPTER SIXTEEN WARRANTY AND SUPPORT • One year manufacturer’s warranty. • Please contact Netgate for warranty information or view the Product Lifecycle page. • All Speciﬁcations subject to change without notice For support information, view support plans offered by Netgate.

Netgate SG-2100 Manual

Quick Links

Related Manuals for Netgate SG-2100

Summary of Contents for Netgate SG-2100

Table of Contents