7. Maintenance

What to do regularly, and how to do the things that only happen occasionally.

A routine worth keeping

Backups

System → Configuration → Backups downloads the entire configuration as one file: rules, interfaces, certificates, keys, users, everything.

Store it as a secret. Anyone holding it can stand up a copy of your firewall. Keep it encrypted, off the appliance, and out of the same failure domain as the box.

Restoring is the same page in reverse. It is also how you move to new hardware: install the appliance, restore the configuration, put the cables in the same ports. Check the interface assignment afterwards — the new machine's network cards may have different names.

System → Configuration → History is the finer-grained tool: it records every change with who made it, and can return the appliance to an earlier state. Use it for "what did we change twenty minutes ago"; use a file backup for "the box is gone".

Updating

Updates come from the vendor's signed repository. The appliance verifies the signature and refuses a catalogue that does not verify.

1. Read the changelog — System → Firmware → Changelog.
2. Take a backup.
3. On ZFS, take a snapshot — System → Snapshots. That is the rollback for the operating system itself, as opposed to the configuration.
4. Update — System → Firmware → Status → Check for updates, then apply. The appliance restarts its control plane when it finishes; the data plane keeps forwarding while it does.
5. Verify — the version on Status, then that your services are up (System → Diagnostics → Services) and traffic still flows.

On a high-availability pair, update the backup node first. Confirm it comes back healthy, fail over to it, then update the other node. Never update both at once.

On a remote appliance, prefer a maintenance window where somebody can reach the console. An update that goes wrong on a box nobody can touch is a site visit.

Certificates

The certificate the appliance presents on first contact is one it issued to itself. Replace it:

1. Put the real certificate and key in System → Trust → Certificates (import them, or create a signing request there, have it signed, and import the result).
2. Select it in System → Settings → Administration as the web GUI's certificate.
3. Confirm the browser is happy, from a machine that trusts the issuer.

Watch expiry. The Certificates widget on the dashboard lists everything in the store with the time it has left, soonest first. A VPN that stops working on a Monday morning is usually a certificate that expired over the weekend.

Retiring a certificate before its time — a lost laptop, a departing employee — is System → Trust → Revocation, with a reason.

Accounts and keys

• One account per administrator (Access → Users), privileges through groups (Access → Groups), and root kept for recovery.
• API keys belong to a user and inherit that user's rights: a monitoring key belongs to a read-only account.
• The list shows when each key was last used. A key nothing has used for months is a key to delete.
• When someone leaves: disable the account, delete their API keys, revoke their VPN certificate, remove their WireGuard peer.

Logs and disk space

The appliance rotates its logs, but retention is your decision (System → Settings → Logging). Two rules:

• Send logs off the box. A remote collector survives the appliance and lets you keep local retention short.
• Watch the disk. Packet captures are the usual culprit — take them with a filter and a limit, and delete them afterwards.

Snapshots

On a ZFS installation, System → Snapshots manages boot environments: a complete copy of the operating system you can boot back into. Take one before an update; remove old ones when the disk gets tight.

A snapshot is not a backup — it lives on the same disk. Keep both.

Replacing hardware

1. Configuration backup from the old appliance (or the most recent one you have).
2. Install the same version on the new machine.
3. Restore the configuration.
4. Fix the interface assignment if the card names differ (console, Assign interfaces).
5. Move the cables, port for port.
6. Verify: gateway up, clients getting addresses, VPNs re-establishing.