Rubicon Netgate SG-5100 User manual

Secure Router Manual
SG-5100
© Copyright 2022 Rubicon Communications LLC
Mar 22, 2022

OUT OF THE BOX
1 Getting Started 2
2 Input and Output Ports 3
3 Connecting to Console Port 5
4 Additional Resources 12
5 Warranty and Support 13
i

Secure Router Manual SG-5100
This Quick Start Guide covers the first time connection procedures for the Netgate 5100 Secure Router and also
provides information needed to stay up and running.
© Copyright 2022 Rubicon Communications LLC 1

CHAPTER
ONE
GETTING STARTED
Use the following steps to configure the TNSR Secure Router.
1. To configure the Network Interfaces and gaining access to the Internet, follow the instructions provided in the
Zero-to-Ping documentation.
Note: Not all steps in the Zero-to-Ping documentation will be necessary for every configuration scenario.
2. Once the Host OS is capable of reaching the Internet, check for updates (Updating TNSR) before proceeding.
This ensures the security and integrity of the router before TNSR interfaces are exposed to the Internet.
3. Finally, configure the TNSR instance to meet the specific use case. The topics are listed on the left column of
the TNSR Documentation site. There are also TNSR Configuration Example Recipes that might be of assistance
when configuring TNSR.
2

CHAPTER
TWO
INPUT AND OUTPUT PORTS
2.1 Rear Side
2.2 Network Ports
Port Label Linux Label TNSR Label Port Type Port Speed
IGB0 enp3s0 GigabitEthernet3/0/0 RJ-45 1 Gbps
IGB1 enp4s0 GigabitEthernet4/0/0 RJ-45 1 Gbps
IX0 enp6s0f0 TenGigabitEthernet6/0/0 RJ-45 1 Gbps
IX1 enp6s0f1 TenGigabitEthernet6/0/1 RJ-45 1 Gbps
IX2 enp8s0f0 TenGigabitEthernet8/0/0 RJ-45 1 Gbps
IX3 enp8s0f1 TenGigabitEthernet8/0/1 RJ-45 1 Gbps
Note: Intel C3000-based (Denverton) platforms using the SoC’s Intel X5333 network controllers utilize Intel’s ixgbe
driver, not the igb driver, so the TNSR Label reports these ports as TenGigabitEthernet rather than GigabitEthernet.
Default Host OS Interface is eno1. The Host OS Interface is one network interface that is only available to the host
OS and not available in TNSR. Though technically optional, we strongly recommend having one for accessing and
updating the host OS.
3

Secure Router Manual SG-5100
Status LED State Description
Left LED
(Link Status)
Solid Amber Link has been established and there
is no activity on this port
Blinking Amber Link has been established and there
is activity on this port
Off No link has been established
Right LED
(Speed)
Solid Green Operating as a 100 Mbps connection
Blinking Amber Operating as a Gigabit connection
(1000 Mbps)
Off No link has been established
2.3 Other Ports and Indicators
• Console (Mini-USB)
• Status LEDs
• 2x USB 3.0
2.4 Front Side
1. Receessed Reset Button
2. Power Button
3. Power (12VDC with threaded locking connector)
Center Pin Positive
Note: The power button on the Netgate 5100 has been programmed to perform a graceful shutdown when depressed.
© Copyright 2022 Rubicon Communications LLC 4

CHAPTER
THREE
CONNECTING TO CONSOLE PORT
3.1 Simple Configuration
Below are the simple instructions for connecting to the console port with Microsoft Windows. If these steps do not
work for you or if you’re an operating system other than Windows, then please skip forward to Advanced Configura-
tion.
3.1.1 Serial Terminal Emulation Client
A serial terminal emulation program is required to access the Netgate appliance console through the serial interface.
Microsoft Windows no longer includes HyperTerminal in Versions 7 and up. PuTTY is free and can be downloaded
from:
http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
3.1.2 Configuring Serial Terminal Emulator
PuTTY must be configured to communicate with the Netgate appliance. In order to do so, you must first know what
COM Port your computer has assigned to your serial port. Even if you assigned your serial port to COM1 in the BIOS,
Windows may remap it to a different COM Port.
To determine this, you must open Windows Device Manager and view the COM port assignment:
5

Secure Router Manual SG-5100
Note: The first time you connect your computer to the SG-5100, it may take up to 3 minutes for the driver to install.
It should install automatically for Windows 7 and above.
Open PuTTY and locate the Session display as shown below. For the Connection type, select Serial. Set Serial line
to the COM Port that is displayed in Windows Device Manager, COM3 for this example, and the Speed to 115200
bits per second, the speed of the BIOS in this case.
© Copyright 2022 Rubicon Communications LLC 6

Secure Router Manual SG-5100
Select Open and the console screen will be displayed.
3.2 Advanced Configuration
A Prolific PL2303 USB-to-UART bridge is used to provide access to the serial port that acts as a system console. This
is exposed via a USB Mini-b (5-pin) port on the front of the case. There are several steps required to access the system
console via this port.
© Copyright 2022 Rubicon Communications LLC 7

Secure Router Manual SG-5100
3.2.1 Install the Driver
Install an appropriate PL2303 USB to UART Bridge VCP (virtual COM port) driver on the workstation used to connect
with the system if needed. There are drivers available for Windows, Mac OS X, and Linux available in the Download
Software section of the Prolific Website.
Note: Recent versions of FreeBSD and many Linux distributions include this driver and will not require manual
installation.
3.2.2 Connect a USB Cable
Next, locate an appropriate USB cable. The type of cable required for the serial console has a USB Mini-b (5-pin)
connector on one end and a regular USB (Type A) plug on the other end. These cables are commonly used with
smaller USB peripherals such as GPS units, cameras, and so on.
Attach the USB cable between a workstation and the system. Gently push the Mini-B plug end into the console port
on the system and connect the USB type A plug into an available USB port on the workstation.
Tip: Be certain to gently push in the Mini-B connector on the system side completely. With most cables there will
be a tangible “click”, “snap”, or similar indication when the cable is fully engaged.
3.2.3 Locate the Console Port Device
The appropriate device to attach the terminal program to each platform varies by platform and must be located before
attempting to connect to the console.
Windows
To locate the device name on Windows, open Device Manager and expand the section for Ports (COM & LPT).
Look for an entry with a title such as Prolific USB-to-Serial Comm Port. If there is a label in the name that contains
“COMX” where X is a decimal digit (e.g. COM1), that value is what would be used as the port in the terminal
program.
Mac OS X
The device associated with the system console is likely to show up as /dev/cu.usbserial.
© Copyright 2022 Rubicon Communications LLC 8

Secure Router Manual SG-5100
Linux
The device associated with the system console is likely to show up as /dev/ttyUSB0. Look for messages about the
device attaching in the system log files or by running dmesg.
Note: If the device does not appear in /dev/, see the note above in the driver section about manually loading the Linux
driver and then try again.
FreeBSD
The device associated with the system console is likely to show up as /dev/cuaU0. Look for messages about the device
attaching in the system log files or by running dmesg.
3.2.4 Launch a Terminal Program
Use a terminal program to connect to the system console port. PuTTY is a popular terminal program that is available
on various operating systems. Some other choices of terminal programs:
• Linux: screen, PuTTY, minicom, dterm
• Mac OS X: screen, ZTerm, cu
• Windows: PuTTY, SecureCRT, Do not use Hyperterminal
• FreeBSD: screen, cu
The settings to use within the terminal program are:
Speed 115200 baud
Data bits 8
Parity none
Stop bits 1
Flow Control Off or XON/OFF. Hardware flow control (RTS/CTS) must be disabled.
Client-Specific Examples
PuTTY
Launch PuTTY and configure it for a Serial type connection with a speed of 115200 using the port name located
previously.
• Windows Example:
© Copyright 2022 Rubicon Communications LLC 9

Secure Router Manual SG-5100
• Linux Example:
PuTTY generally handles most cases OK but can have issues with line drawing characters on certain platforms.
These settings seem to work best (tested on Windows):
Window Columns x Rows = 80x24
Window > Appearance Font = Courier New 10pt or Consolas 10pt
Window > Translation Remote Character Set = Use font encoding or UTF-8
Window > Translation Handling of line drawing characters = Use font in both ANSI and OEM modes
or Use Unicode line drawing code points
Window > Colours Indicate bolded text by changing = The colour
GNU screen
In many cases screen may be invoked simply by using the proper command line:
• Mac OS X
sudo screen /dev/cu.usbserial 115200
• Linux
sudo screen /dev/ttyUSB0 115200
• FreeBSD
sudo screen /dev/cuaU0 115200
If portions of the text are unreadable but appear to be properly formatted, the most likely culprit is a character encoding
mismatch in the terminal. For example, on OS X this is commonly required
sudo screen -U /dev/cu.usbserial 115200
Adding the -U parameter to the screen command line arguments forces it to use UTF-8 for character encoding.
© Copyright 2022 Rubicon Communications LLC 10

Secure Router Manual SG-5100
3.2.5 Troubleshooting
No Serial Output
If there is no output at all, check the following items:
• Ensure the cable is correctly attached and fully inserted
• Ensure the terminal program is using the correct port
• Ensure the terminal program is configured for the correct speed. The default BIOS speed is 115200, and many
other modern operating systems use that speed as well. Some older operating systems or custom configurations
may use slower speeds such as 9600 or 38400.
• Ensure the operating system is configured for the proper console (e.g. ttyS1 in Linux). Consult the various
operating install guides on this site for further information.
Garbled Serial Output
If the serial output apears to be garbled, binary, or random characters check the following items:
• Ensure the terminal program is configured for the correct speed. (See “No Serial Output” above)
• Ensure the terminal program is configured for the proper character encoding, such as UTF-8 or Latin-1, depend-
ing on the operating system. (See the previous entry under “GNU screen”)
Serial Output Stops After the BIOS
If serial output is shown for the BIOS but stops afterward, check the following items:
• Ensure the terminal program is configured for the correct speed for the installed operating system. (See “No
Serial Output” above)
• Ensure the installed operating system is configured to activate the serial console.
• Ensure the installed operating system is configured for the proper console (e.g. ttyS1 in Linux). Consult the
various operating install guides on this site for further information.
• If booting from a USB flash drive, ensure that the drive was written correctly and contains a bootable operating
system image.
© Copyright 2022 Rubicon Communications LLC 11

CHAPTER
FOUR
ADDITIONAL RESOURCES
4.1 Professional Services
Support does not cover more complex tasks such as network design and conversion from other firewalls. These items
are offered as professional services and can be purchased and scheduled accordingly.
https://www.netgate.com/our-services/professional-services.html
4.2 Netgate Training
Netgate training offers training courses for increasing your knowledge of Netgate products and services. Whether
you need to maintain or improve the security skills of your staff or offer highly specialized support and improve your
customer satisfaction; Netgate training has got you covered.
https://www.netgate.com/training/
4.3 Resource Library
To learn more about how to use your Netgate appliance and for other helpful resources, make sure to browse our
Resource Library.
https://www.netgate.com/resources/
12

CHAPTER
FIVE
WARRANTY AND SUPPORT
• One year manufacturer’s warranty.
• Please contact Netgate for warranty information or view our Product Lifecycle page.
• All Specifications subject to change without notice.
Enterprise Support is included with an active software subscription, for more information view our Netgate Global
Support page.
See also:
For more information on how to use pfSense® software, see the TNSR Documentation and Resource Library.
13