Convert an existing firewall

Bring a firewall that already runs a supported series under Ixolate management in place, without reinstalling.

An existing firewall can be converted in place. The Ixolate package rebrands the system, configures the update path, and adds the Updates & Subscription page. Your configuration, rules, VPNs, and certificates stay untouched.

Eligibility

A firewall on a supported release series (see Supported releases).
A standard installation. A box using Business Edition can be converted without changing its Business Edition repository settings.
Shell access as root (SSH, or option 8 on the console menu).
Outbound HTTPS to repo.ixolate.com.

Take a configuration backup first (System › Configuration › Backups).

1. Install the package

From a root shell:

pkg add https://repo.ixolate.com/ixolate/all/os-theme-ixolate.pkg

The package name without a version always resolves to the latest release. Installation is automatic and takes under a minute. It:

rebrands the product name, login page, console banner, boot logo and message of the day;
generates the Ixolate theme from the core theme that is actually running, so it always matches your series;
hides the stock firmware, snapshot, factory-defaults, help and license menu entries;
registers the signed Ixolate package repository and its public key;
pins the operating-system mirror to repo.ixolate.com;
selects the ixolate theme once. A later manual theme choice is respected.

The web interface stays up during the change; reload the page afterwards.

2. Enter the subscription key

Open System › Updates & Subscription, paste the update access key and save. The page shows the effective update source:

https://repo.ixolate.com/<your key>

Click Check for updates. Updates within the running series are installed from this page; jumping to a new series is done together with support.

Without a key the box keeps working but reports no-subscription: the package tree is frozen and no operating-system updates arrive.

3. Activate the device

Open System › Updates & Subscription › Activation and copy the activation hardware ID. An administrator uses that ID to approve the device and issue an IXD1 activation key. Paste the key into the activation field and choose Install activation key. Supported lifecycle changes use IXU1 keys.

4. Verify

Check	Expected
Browser tab / login page	`Login \| Ixolate`
Console banner after `ssh` or on the VGA console	`* hostname: Ixolate <version> (amd64) *`
System › Updates & Subscription	update source and plugin version shown
`pkg query %v os-theme-ixolate`	current plugin release

What changes for operators

System › Firmware is replaced by System › Updates & Subscription. Updates, access, and activation are managed there.
Snapshots, factory defaults and the help links are hidden. Backups still work.
Optional features are switched on from Optional Features on the same page, using the package catalogue that ships with Ixolate media. On a converted box the catalogue is fetched from the repository instead.
Every update or activation action is logged with the ixolate-entitlement syslog tag.

Undo

Support can release a box from management with ixolate-uninstall. The branding stays; the hidden menus return and the update mirror goes back to the stock default.