---
title: "Convert an existing firewall"
description: "Bring a firewall that already runs a supported series under Ixolate management in place, without reinstalling."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ixolate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Convert an existing firewall

An existing firewall can be converted in place. The Ixolate package rebrands the system, pins updates to the Ixolate repository and adds the **Updates & License** page. Your configuration, rules, VPNs and certificates stay untouched.

## Eligibility

- A firewall on a supported series, **24.7 through 26.7**. Series 24.1 is not supported.
- A standard (non-business) installation. Boxes with a vendor business subscription are converted only together with support.
- Shell access as `root` (SSH, or option **8** on the console menu).
- Outbound HTTPS to `repo.ixolate.com`.

Take a configuration backup first (**System › Configuration › Backups**).

## 1. Install the package

From a root shell:

```sh
pkg add https://repo.ixolate.com/ixolate/all/os-theme-ixolate.pkg
```

The package name without a version always resolves to the latest release. Installation is automatic and takes under a minute. It:

- rebrands the product name, login page, console banner, boot logo and message of the day;
- generates the Ixolate theme from the core theme that is actually running, so it always matches your series;
- hides the stock firmware, snapshot, factory-defaults, help and license menu entries;
- registers the signed Ixolate package repository and its public key;
- pins the operating-system mirror to `repo.ixolate.com`;
- selects the `ixolate` theme once. A later manual theme choice is respected.

The web interface stays up during the change; reload the page afterwards.

## 2. Enter the subscription key

Open **System › Updates & License**, paste the subscription key from 8Labs and save. The page shows the effective mirror:

```
https://repo.ixolate.com/<your key>
```

Click **Check for updates**. Updates within the running series are installed from this page; jumping to a new series is done together with support.

Without a key the box keeps working but reports **no-subscription**: the package tree is frozen and no operating-system updates arrive.

## 3. Support license (optional)

The same page shows the **Hardware ID**. Send it to info@ixolate.com; you receive a signed license blob (`IXL1…`). Paste it into the license field, or from the shell:

```sh
ixolate-license install /path/to/license.txt
```

The license grants support entitlement. It does not gate any feature.

## 4. Verify

| Check | Expected |
|---|---|
| Browser tab / login page | `Login \| Ixolate` |
| Console banner after `ssh` or on the VGA console | `*** hostname: Ixolate <version> (amd64) ***` |
| **System › Updates & License** | mirror `https://repo.ixolate.com/<key>`, plugin version shown |
| `pkg query %v os-theme-ixolate` | current plugin release |

## What changes for operators

- **System › Firmware** is replaced by **System › Updates & License**. Everything an operator needs for updates is there.
- Snapshots, factory defaults and the help links are hidden. Backups still work.
- Optional features are switched on from **Optional Features** on the same page, using the package catalogue that ships with Ixolate media. On a converted box the catalogue is fetched from the repository instead.
- Every update or license action is logged with the `ixolate-update` and `ixolate-license` syslog tags.

## Undo

Support can release a box from management with `ixolate-uninstall`. The branding stays; the hidden menus return and the update mirror goes back to the stock default.

Source: https://docs.ixolate.com/get-started/convert-existing/index.mdx