Upgrade Fireware or WatchGuard System Manager

WatchGuard periodically distributes upgrades for Fireware and WatchGuard System Manager. If you use WatchGuard System Manager to administer your Fireboxes, you must upgrade WatchGuard System Manager before you upgrade the Fireboxes it manages. The version of WatchGuard System Manager you use must be the same as, or higher than, the version of Fireware on any Firebox it manages.

For information about how to upgrade a Firebox from WatchGuard Cloud, go to Upgrade Firmware in WatchGuard Cloud.

For information about how to upgrade a FireCluster, go to Upgrade Fireware OS for a FireCluster.

See Available OS Versions in Fireware Web UI

From Fireware Web UI, you can see the versions of Fireware OS that are available for your Firebox to upgrade to:

  1. Log in to Fireware Web UI.
  2. Select System > Upgrade OS.
    The Firebox contacts the WatchGuard software update server to get the latest OS version available for this Firebox.

Screen shot of the Upgrade OS page in Fireware Web UI

If a higher version of Fireware OS is available for your Firebox, you can use the Web UI to download and install the upgrade directly from WatchGuard, or you can download the upgrade to your management computer and use Policy Manager or the Web UI install it on your Firebox from there. Both options are described in the next sections.

Download OS and Management Software Upgrade Files

Before you can use Policy Manager or Fireware Web UI to upgrade the version of Fireware OS on your Firebox, you must first download the latest OS upgrade file for your Firebox model and install it on your management computer. If you use Policy Manager, and the version of WatchGuard System Manager is not higher than the version of Fireware OS you want to upgrade your Firebox to, you must also download an upgrade to WatchGuard System Manager.

Fireware OS updates are available in two file formats. You can use either of these files to install the Fireware OS upgrade file:

  • Fireware (Windows executable installer) — Installs the Fireware OS upgrade file on a Windows computer. If you use Policy Manager to administer your Firebox, because the installer automatically saves the sysa-dl file for each Firebox model in the location that Policy Manager expects to find the OS upgrade file for each model, WatchGuard recommends that you use the Fireware OS installer to install the OS upgrade on your management computer.
  • Fireware Sysa-dl (ZIP file) — This ZIP file contains the sysa-dl Fireware OS upgrade file. You can use this option if you use Fireware Web UI to administer your Firebox and you want to save the upgrade file to a specific location, or if you want to use the Web UI to install a Firebox upgrade from a computer that does not run Windows.

To download Fireware OS and management software upgrades:

  1. Go to software.watchguard.com.
  2. To see all available software downloads for your Firebox, select your Firebox model.
  3. For information about what is included in the release and any release-specific upgrade steps, click the Release Notes link.
  4. Download Fireware OS for your Firebox.
    • Fireware (EXE file)
    • Fireware Sysa-dl (ZIP file)
  5. Download the latest version of WatchGuard System Manager.

Upgrade WatchGuard System Manager on Your Management Computer

Before you can use Policy Manager to upgrade the version of Fireware OS on your Firebox, the version of WatchGuard System Manager must be the same or higher than the version of Fireware OS you want to install on your Firebox.

If you have installed WatchGuard Servers on your management computer, we recommend that you back up the server data (if appropriate) before you upgrade.

To upgrade WatchGuard System Manager:

  1. To back up the settings on your Management Server, go to Back Up or Restore the Management Server Configuration.
  2. Uninstall the version of WatchGuard System Manager currently installed on your management computer:
    1. Select Control Panel > Programs > Programs and Features.
    2. From the list of installed programs, select WatchGuard System Manager.
    3. Click Uninstall.
    4. If the uninstaller asks whether you want to delete the WatchGuard Server configuration files, click No.
      The configuration files are used by the upgraded WatchGuard Servers after you reinstall the newer version of servers with WatchGuard System Manager.
  3. Install the new version of WatchGuard System Manager:
    1. Run the WatchGuard System Manager installer that you downloaded from the WatchGuard website.
    2. Follow the installer instructions to install the WatchGuard System Manager and any WatchGuard servers you want to use.
      For more information about how to install WatchGuard System Manager, go to Install WatchGuard System Manager Software.

Install a Fireware OS Upgrade on Your Management Computer

After you download the Fireware OS upgrade file to your computer, use either of these methods to install the OS upgrade file on your computer.

To use the Fireware OS installer:

  1. Run the Fireware OS installer file that you downloaded from the Software Downloads page for your Firebox model.
  2. To install the OS upgrade file on your computer, follow the installer instructions.
    The final page of the installer shows the directory location where the sysa-dl OS upgrade file was installed. The installer saves the file in these locations:
  • 32-bit Windows — C:\Program Files\Common Files\WatchGuard\resources\FirewareXTM\<OS version>\<model>
  • 64-bit Windows — C:\Program Files (x86)\Common Files\WatchGuard\resources\FirewareXTM\<OS version>\<model>

Screen shot of the Installation Complete page of the installer, with the Open Directory option

  1. To open the directory where the sysa-dl file was installed, click Open Directory.

To use the ZIP file:

  1. Open the ZIP file you downloaded from the Software Downloads page for your Firebox model.
  2. Extract the sysa-dl file from the ZIP file and save it to a location on your computer.

After you have installed or unzipped the Fireware OS update to your computer, you can update the Firebox, as described in the next sections.

To update your Firebox configuration from a saved configuration file, make sure you open the configuration from the Firebox and save it to a new file after you upgrade. This is to make sure that you do not overwrite any configuration changes that were made as part of the upgrade.

Upgrade the Firebox

You can upgrade the version of Fireware OS on your Firebox from Fireware Web UI, Policy Manager, or WatchGuard Cloud. An OS upgrade can take as long as 15 minutes. Do not interrupt power or restart your Firebox until the upgrade is complete. The upgrade process automatically restarts the Firebox after the upgrade.

If the current Fireware OS version on your Firebox is v12.2.1 or higher, the upgrade process creates a backup image automatically and saves it to the Firebox. If the current Fireware OS version is v12.2 or lower, WatchGuard recommends that you always create a backup image before you upgrade. To downgrade the Firebox to the previous version and restore the configuration in the future, you must have the backup image. For more information, go to Save a Firebox Backup Image.

WARNING: If you use the Fireware Web UI Upgrade feature to downgrade the installed version of Fireware OS, and you do not restore a backup image, the downgrade process resets the configuration to factory-default settings. The downgrade process does not change the Firebox passphrases and does not remove backup images stored on the Firebox, feature keys, or certificates.

Use one of these methods to upgrade the version of Fireware OS on your Firebox from Fireware Web UI:

Download an upgrade directly from WatchGuard:

  1. From Fireware Web UI, select System > Upgrade OS.
    The Upgrade OS page opens.
  2. Select Download and install an upgrade directly from watchguard.com.
  3. From the drop-down list, select the upgrade version.
  4. Click Upgrade.
    The software download starts and the upgrade proceeds automatically.

You can click Stop Download to stop the download of the OS upgrade file.

Use a local sysa-dl file to upgrade:

  1. From Fireware Web UI, select System > Upgrade OS.
    The Upgrade OS page opens.
  2. Select I have an upgrade file.
  3. To select the upgrade file from the directory where you unzipped or installed it, click Choose File.
    The upgrade file extension is sysa-dl.
  4. Click Upgrade.
    The upgrade can take as long as 15 minutes for some Firebox models. Do not interrupt power or restart your Firebox until the upgrade is complete.
  1. Connect to your Firebox and open Policy Manager.
  2. Select File > Upgrade.
    The Upgrade dialog box opens.
  3. Type the administrator passphrase. Click OK.
    The default path to the upgrade image shows.
  4. To install an upgrade file from a different location, click Browse and select the path to the upgrade file.

Screen shot of the Upgrade dialog - Enter the path to the upgrade image.

  1. Click OK.
    An upgrade confirmation message shows.
  2. Click Yes.
    If the current Fireware OS on your Firebox is v12.2 or lower, a message about whether to create a backup image shows.
  3. If you do not already have a backup image, click Yes to save a backup image.

Firebox T15 devices do not have enough available memory to create and save a backup image in Fireware 12.2 and lower. Before you upgrade Fireware on these models save the configuration to a file. For more information, go to Save the Configuration File.

  1. Type and confirm the Authentication Key for the backup image.
  2. To change the location to save the backup image, click Browse.
  3. Click OK to create the backup image.
    Policy Manager creates the backup image, and then upgrades the Fireware OS on the Firebox. The upgrade can take as long as 15 minutes for some Firebox models. Do not interrupt power or restart your Firebox until the upgrade is complete.

An OS upgrade can change the Firebox configuration. Those changes do not appear in Policy Manager until you download the updated configuration from the Firebox.

  1. After you upgrade, click Yes to download the latest configuration from the Firebox.
    If Policy Manager does not prompt you to download the latest configuration file, select File > Open > Firebox to download the latest configuration file after the upgrade.

For information on how to upgrade the firmware from WatchGuard Cloud, go to Upgrade Firmware in WatchGuard Cloud.

If your Firebox has been in operation for some time before you upgrade, it might be necessary to restart the Firebox to clear the temporary memory before you start the upgrade process.

Install a Component Package

WatchGuard occasionally releases component packages, which enable you to update a specific component of the firmware installed on the Firebox without an upgrade to Fireware OS.

A component package is a .wgpkg-dl file, distributed in a ZIP file. After you download a component package, extract the .wgpkg-dl file to a location on your computer. Then use the same steps to install it as you would to install a. sysa-dl OS upgrade file.

Some component packages are included in Fireware OS updates. It is not necessary to install a component package if your Firebox uses a version of Fireware OS that includes that component.

  1. Select System > Upgrade OS.
    The Upgrade OS page opens.
  2. Select I have an upgrade file.
  3. Click Choose File to select the component package file from the directory you extracted it to.
    The component package file extension is .wgpkg-dl.
  4. Click Upgrade.
  1. Select File > Upgrade.
    The Upgrade dialog box opens.
  2. Type the administrator passphrase. Click OK.
    The default path to the upgrade image shows.
  3. Click Browse.
  4. From the Files of type drop-down list, select XTM Component Package (*.wgpkg-dl).
  5. Browse to the location you save the wgpkg-dl file, select the file, and click Open.
  6. Click OK.
  7. Click Yes to create a backup image. Then specify the authentication key and file location for the backup image.
  8. Click OK.
    Policy Manager applies the component upgrade package to the Firebox.

Related Topics

Downgrade Fireware