Recovery Mode - WSM 12.6.x fireware installation fails

Norman

Hello,
I am able to install different fireware versions in recovery mode up to wsm 12.5.3

with wsm 12.6.2U2 & 12.6.3 the wizzard runs into timeout.

this happens with all fireboxes i have testet ( x330,M300,M400)

mfg
norman

james.carson

Hi @Norman

Recovery mode boots the firewall into a different partition, and re-flashes the main partition of the firewall. This is intended to allow a firewall to be recovered if something happens to the main partition somehow.

If you're running into an issue installing, it's likely that there isn't enough space on the main partition, or something else needs to happen. Upgrading via the normal procedure in policy manager (File -> Upgrade) or in WebUI (System -> Upgrade OS) should correct whatever is wrong, or provide a useable error.

I would suggest against repeated re-flashing of the firewalls via recovery mode as that will cause unnecessary write cycles on the flash module of the firewall. It also generally takes longer, and requires taking the firewall down for an extended period of time.

Norman

@James
let me say it different
recovery mode is broken in WSM 12.6.x
i have tried different windwos OS and different Fireboxes
after downgrade to WSM 12.5.3 or lower, recovery mode works fine.

james.carson

Hi @Norman
Where specifically is recovery mode getting stuck when you attempt to use it?

Norman

Hi @James_Carson
the wizard asks for temporary IP >>> IP of the Firebox is changed ( verified by ping ) , but it looks like nothing is transferred.
after some time , there is a timeout message.

james.carson

Hi Norman,

It sounds like you're using DHCP for this -- I'd suggest the following:
-Have your computer plugged directly into eth1 of the firewall. with no switch between you and it.

-Set your IP statically to 10.0.1.2 with a subnet mask of 255.255.255.0 and a default gateway of 10.0.1.1.

-Run the quick setup wizard, and when the wizard asks, give the firewall a static IP address.

The above keep IPs from moving or changing while the device reboots (as windows will often try to assign an APIPA address because the firewall takes longer to reboot than it's willing to wait.

I ran through and tested the quick setup wizard with the latest version of WSM both 12.6.3 and the 12.6.4 beta.) I was able to run recovery mode successfully on both versions with a T80, and XTM545, and an XTM26-W.

Alternatively to the above, completing the setup process and running the normal quick setup wizard from the WebUI (https://10.0.1.1:8080) should also work. Once the firewall is set up, you can upgrade it from System -> Upgrade OS as normal.

Again, I want to stress that recovery mode is in place to recover a firewall that has corrupted its main partition somehow (most often via power failure during a upgrade operation.) Upgrading normally via File -> Upgrade OS, or System -> Upgrade OS is the best way to complete system upgrades.

If you continue to have issues with the Quick Setup Wizard, I'd suggest opening a support case and including the log file that is at

C:\Users\ - user name - \appdata\roaming\watchguard\qswiz.txt
on your PC.

Norman

hi @James_Carson

i followed your advice on cabeling and IP, but the wizard says
"the temporary IP can not be the same as the default trusted IP adress of the device"
so i had to use 10.0.1.10

here is what happens in the log:

01/18/21 12:51:34[Thread-15] Setting temporary IP to 10.0.1.10
01/18/21 12:51:34[Thread-15] Begin setting temporary IP
01/18/21 12:51:34[Thread-16] Begin to wait a new message
01/18/21 12:51:35[Thread-16] One new message was received
01/18/21 12:51:35[Thread-15] Setting temp ip 10.0.1.10 for xxxxxxxx
01/18/21 12:51:35[Thread-16] Begin to wait a new message
01/18/21 12:51:35[Thread-15] Finish setting temporary IP
01/18/21 12:51:45[Thread-15] RsServer.setCertificate(): com.watchguard.util.comm.cmm.RSServer@ef7cf: null(Sid=); null
01/18/21 12:51:45[Thread-15] RsServer.setIpAddress(): 10.0.1.10
01/18/21 12:51:45[Thread-15] RSServer:RSServer:isServerConnectableXmlRpc(), trying url: https://10.0.1.10:4117/
01/18/21 12:51:45[..Thread (xmlrpc)] RSServer:code=0; message=org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:51:45[..Thread (xmlrpc)] RSServer:Exception: org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:51:45[..Thread (xmlrpc)] SSL initialized...
01/18/21 12:51:45[..Thread (xmlrpc)] RSServer:code=0; message=org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:51:45[..Thread (xmlrpc)] RSServer:Exception: org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:51:45[Thread-15] Unable to contact device after setting temp ip (attempt 1 of 3)
01/18/21 12:51:45[Thread-15] Begin setting temporary IP
01/18/21 12:51:45[Thread-18] Begin to wait a new message
01/18/21 12:51:46[Thread-16] One new message was received
01/18/21 12:51:46[Thread-18] One new message was received
01/18/21 12:51:46[Thread-15] Setting temp ip 10.0.1.10 for xxxxxxxxxxxxxx
01/18/21 12:51:46[Thread-16] Begin to wait a new message
01/18/21 12:51:46[Thread-18] Begin to wait a new message
01/18/21 12:51:46[Thread-15] Finish setting temporary IP
01/18/21 12:52:11[Thread-15] RsServer.setCertificate(): com.watchguard.util.comm.cmm.RSServer@8e67e5: null(Sid=); null
01/18/21 12:52:11[Thread-15] RsServer.setIpAddress(): 10.0.1.10
01/18/21 12:52:11[Thread-15] RSServer:RSServer:isServerConnectableXmlRpc(), trying url: https://10.0.1.10:4117/
01/18/21 12:52:11[..Thread (xmlrpc)] RSServer:code=0; message=org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:52:11[..Thread (xmlrpc)] RSServer:Exception: org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:52:11[..Thread (xmlrpc)] SSL initialized...
01/18/21 12:52:11[..Thread (xmlrpc)] RSServer:code=0; message=org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:52:11[..Thread (xmlrpc)] RSServer:Exception: org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:52:11[Thread-15] Unable to contact device after setting temp ip (attempt 2 of 3)
01/18/21 12:52:11[Thread-15] Begin setting temporary IP
01/18/21 12:52:11[Thread-20] Begin to wait a new message
01/18/21 12:52:12[Thread-16] One new message was received
01/18/21 12:52:12[Thread-18] One new message was received
01/18/21 12:52:12[Thread-20] One new message was received
01/18/21 12:52:12[Thread-15] Setting temp ip 10.0.1.10 for xxxxxxxxxxx
01/18/21 12:52:12[Thread-16] Begin to wait a new message
01/18/21 12:52:12[Thread-18] Begin to wait a new message
01/18/21 12:52:12[Thread-15] Finish setting temporary IP
01/18/21 12:52:12[Thread-20] Begin to wait a new message
01/18/21 12:52:34[Thread-16] Waiting socket closed!
01/18/21 12:52:45[Thread-18] Waiting socket closed!
01/18/21 12:52:52[Thread-15] RsServer.setCertificate(): com.watchguard.util.comm.cmm.RSServer@19b91f9: null(Sid=); null
01/18/21 12:52:52[Thread-15] RsServer.setIpAddress(): 10.0.1.10
01/18/21 12:52:52[Thread-15] RSServer:RSServer:isServerConnectableXmlRpc(), trying url: https://10.0.1.10:4117/
01/18/21 12:52:52[..Thread (xmlrpc)] RSServer:code=0; message=org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:52:52[..Thread (xmlrpc)] RSServer:Exception: org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:52:52[..Thread (xmlrpc)] SSL initialized...
01/18/21 12:52:52[..Thread (xmlrpc)] RSServer:code=0; message=org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:52:52[..Thread (xmlrpc)] RSServer:Exception: org.apache.xmlrpc.XmlRpcException: Failed to read servers response: Certificates do not conform to algorithm constraints
01/18/21 12:52:52[Thread-15] Unable to contact device after setting temp ip (attempt 3 of 3)
01/18/21 12:52:52[Thread-15] RsServer.setCertificate(): com.watchguard.util.comm.cmm.RSServer@15c4333: 10.0.1.1(Sid=); null
01/18/21 12:52:52[Thread-15] RsServer.setCertificate(): com.watchguard.util.comm.cmm.RSServer@15c4333: 10.0.1.1(Sid=); null
01/18/21 12:52:52[Thread-15] RsServer.setIpAddress(): 10.0.1.10
01/18/21 12:52:52[Thread-15] Logging into appliance
com.watchguard.vpm.config.ApplianceManagerException: A connection could not be established to the Firebox 10.0.1.10.
Failed to read servers response: Certificates do not conform to algorithm constraints
at com.watchguard.vpm.config.VPMApplianceManager.logInApplianceOp(Unknown Source)
at com.watchguard.vpm.config.VPMApplianceManager.logInApplianceOp(Unknown Source)
at com.watchguard.qswiz.panels.DeployPanel.upgradeConfigureFireboxXtm(Unknown Source)
at com.watchguard.qswiz.panels.DeployPanel$1.run(Unknown Source)
at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: INTERNAL_ERROR: Failed to read servers response: Certificates do not conform to algorithm constraints
at com.watchguard.util.comm.cmm.Messanger.processMessageXmlRpc(Unknown Source)
at com.watchguard.util.comm.cmm.Messanger.(Unknown Source)
at com.watchguard.util.comm.cmm.Messanger.processMessage(Unknown Source)
at com.watchguard.util.comm.cmm.CommCmm.challengeResponseLogin(Unknown Source)
at com.watchguard.util.comm.cmm.CommCmm.xmlRpcLogin(Unknown Source)
at com.watchguard.util.comm.cmm.CommCmm.login(Unknown Source)
at com.watchguard.vpm.comm.CommUtil.loginAppliance(Unknown Source)
... 5 more

Norman

Certificates do not conform to algorithm constraints

editing the java.security file fixed the problem
"C:\Program Files (x86)\Common Files\WatchGuard\java\jre11.0.4\conf\security\java.security"

jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 1024, \
EC keySize < 224, DES40_CBC, RC4_40

jdk.certpath.disabledAlgorithms=MD2, SHA1 jdkCA & usage TLSServer, \
RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224

james.carson

Hi @Norman

For older firewalls (which appear to be what you're working with) recovery mode will boot into the OS the device shipped with, which includes whatever certs were used at the time of manufacture. WSM has been changed over the years to require better certs as the ability for devices to handle them has improved, and requirements have strengthened.

Since recovery mode is intended to get a failed device running, I'd suggest using one of the older versions of WSM to get your older device up, and then log in normally with a later version to run the upgrade.

Thank you,