Netgate SG-1000 microFirewall

Author Topic: pfSense on a Riverbed Steelhead  (Read 4757 times)

0 Members and 1 Guest are viewing this topic.

Offline shouptech

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
pfSense on a Riverbed Steelhead
« on: October 15, 2013, 06:49:42 am »
I successfully installed pfSense on an old Riverbed Steelhead appliance. You can see how, with pictures of the unit, here.

Unfortunately, I ran into the same problems with the LAN bypass ports from this thread (though mine is a newer model). Of course, the original poster in that thread leaves without specifying how it was fixed.

Regardless, it is still a useful appliance for pfSense, even with just two ports. It'll even fit on the shelf in my basement better than the Watchguard Firebox I have.

Offline shouptech

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #1 on: October 15, 2013, 07:10:10 am »
The synopsis of the installation is basically:
1. Remove the flash drive and hard drive from the appliance
2. Plug the flash drive into a USB header on your PCs motherboard
3. Write the pfSense image to it
4. Replace the flash drive, set kern.cam.boot_delay=10000
5. Enjoy

em0 and em1 are the bypass ports and don't work. em2 and em3 are the aux/primary ports and do work.

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11728
  • Karma: +446/-15
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #2 on: October 15, 2013, 08:27:57 am »
Yes, disappointing he didn't come back. Anyway reading between the lines I would guess he disabled or changed the mode of the LAN-bypass in the BIOS. As I said there you often use the TAB key to enter the BIOS setup via serial console. Can you access the BIOS on your box?

Steve

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11728
  • Karma: +446/-15
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #3 on: October 15, 2013, 08:53:06 am »
You could probably disable the bypass manually with a small program anyway. Is there any evidence that board is made by Axoimtech?

For example they give source code for their LAN-bypass control for various products:
Code: [Select]
/* Use GPIO Control LAN by-pass*/
/**************************************************************/
int _8a811_lan_by_pass_enable(void)
{
iopl(3);
// _gpio_use_sel(BIT0);
// _gp_io_sel(BIT12, GP_IO_SEL_OUT);
_gp_lvl(34, Low); //control by ICH GP34
_gp_lvl(23, Low); //control by ICH GP23
return 0;
}
/*******************************************/
int _8a811_lan_by_pass_disable(void)
{
iopl(3);
// _gpio_use_sel(BIT0);
// _gp_io_sel(BIT12, GP_IO_SEL_OUT);
_gp_lvl(34, High); //control by ICH GP34
_gp_lvl(23, High); //control by ICH GP23
return 0;
}

It would be easy to test something similar given sufficient clues.

Steve

Offline shouptech

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #4 on: October 15, 2013, 11:03:31 am »
I did something stupid somewhere that is keeping from getting back into the BIOS, but when I was able to get into the BIOS, there were no options for LAN bypass.

I'll have to look on the main board when I get home to see what markings there are and if any indicate what model the board is.

Offline shouptech

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #5 on: October 15, 2013, 06:52:39 pm »
The board is a Jabil Circuits MNPBA000698C. I'm not having any luck finding much documentation on the board, but I can buy one for less than $30 on eBay: http://www.ebay.com/itm/JABIL-CIRCUIT-MOTHERBOARD-MAINBOARD-SBC-NEW-/300300470392

Offline charliem

  • Sr. Member
  • ****
  • Posts: 565
  • Karma: +43/-1
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #6 on: October 15, 2013, 10:16:01 pm »
Yes, those are LAN bypass ports.  Looking at your pics, the 4 big white things on the MB behind the ports are relays; these control if the active lines on each port are connected to the MB or to each other.

I'm not clear if the GPIO code, like Steve posted or in the bios, will directly control the state (bypassed or not), or if the GPIO simply allows or prevents bypass on power fail.  I suspect the latter.

If you don't need the bypass feature, you may be able to do some hardware hacking to energize the relays directly from somewhere else on the board.  I see a big 1F supercap there, and there's also an LED on the front panel to indicate bypassed condition that may provide some clues.

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11728
  • Karma: +446/-15
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #7 on: October 16, 2013, 04:33:38 am »
The way that LAN bypass usually works is that the relays are powered via the output from a watchdog timer. This can be in the SuperIO chip or in the southbridge chip. The design of the system is such that if the OS crashes and stops resetting the watchdog then the LAN-bypass automatically kicks in. It's usually possible to control the properties of the watchdog by setting various registers in which ever chip is running it. Alternatively it might be possible to drive it via some separate GPIO pins in parallel.

I see in your photo the board is labelled: ETON ET866 94V-0
That seems to bring up references to graphics cards though.  :-\ Jabil Circuits seems to be a pcb assembly company rather than a motherboard designer so not much help as you found.

I notice that the connector in the top right of the photo is labelled J20. This implies there are are more jumpers! Are there any that we can't see in the photo?

Steve
« Last Edit: October 16, 2013, 04:36:51 am by stephenw10 »

Offline shouptech

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #8 on: October 16, 2013, 09:45:19 am »
There does not appear to be any other jumpers on the board. I've looked for any other J# labels as well (perhaps the pins were removed) and I don't see any.

Offline dipswitch

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #9 on: August 27, 2017, 05:47:57 am »
Where you ever able to recover the bios password? I have the same issue, trying to get into the bios...

Offline johnkeates

  • Sr. Member
  • ****
  • Posts: 409
  • Karma: +35/-0
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #10 on: August 27, 2017, 07:54:33 am »
You could force bypass off permanently by shorting the control pins to either ground or 1v8/3v3/5v

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11728
  • Karma: +446/-15
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #11 on: August 27, 2017, 07:12:04 pm »
You have identical hardware?
https://shoup.io/project-steelwall.html

it's a little out of date these days. No need to mount RW if you're running Nano as it's always mounted RW.

Always use /boot/loader.conf.local

That hardware appears to be 32bit which means no 2.4.

Steve

Offline Skybw89

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #12 on: September 13, 2017, 08:05:18 am »
hi

i also interested to get the two left NICs working.

someone been successful?

Thanks

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11728
  • Karma: +446/-15
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #13 on: September 13, 2017, 09:15:46 am »
You have access to the BIOS?

Any lan bypass or watchdog functions available there?

Otherwise you will need to switch the relays manually by flipping the control registers. Or by changing the circuit that drives them.
Are you up for a challenge?  ;)

Steve

Offline Skybw89

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: pfSense on a Riverbed Steelhead
« Reply #14 on: September 13, 2017, 06:28:08 pm »
You have access to the BIOS?

Any lan bypass or watchdog functions available there?

Otherwise you will need to switch the relays manually by flipping the control registers. Or by changing the circuit that drives them.
Are you up for a challenge?  ;)

Steve

Unfortunately there is no option in the BIOS to activate the relays manually.

I read a few posts on other Websites about bridge the relays power feedpin to an Mosfet to power them from boot.


iam a noob in things like this. But i really want to get it working. do you have some information, maybe some pictures how i had to modify the relais circuit ?

here is a picture





thank you so far
« Last Edit: September 13, 2017, 06:31:20 pm by Skybw89 »