Next-Generation Firewall FAQs

Pico-UTM 100 / Dual Ark-UTM 16 / Tera-UTM 12:

Step 1: Connect the Lionic NGFW WAN port to a network that can automatically assign an IP address (DHCP).

Step 2: Connect the Lionic NGFW LAN port to your computer using an Ethernet cable.

Step 3: Open a web browser and go to the corresponding management URL:

• Pico-UTM 100: https://mypico.lionic.com
• Dual Ark-UTM 16: https://myark.lionic.com
• Tera-UTM 12: https://mytera.lionic.com

LionFilter 200:

Step 1: Connect the Lionic NGFW LAN MGMT port to your computer using an Ethernet cable.

Step 2: Configure your computer’s network settings to Obtain an IP address automatically (DHCP).

Step 3: Open a web browser and go to https://myfilter.lionic.com to access the Lionic NGFW management interface.

Note: By configuring the MGMT port with a dedicated IP address, you can reduce the risk of losing access to the management interface due to misconfiguration.

If the Lionic NGFW cannot obtain an IP address:

Step 1: Connect the Lionic NGFW LAN port or LionFilter 200 LAN 1~3 to your computer with an Ethernet cable.

Step 2: Manually configure your computer’s network settings:

• IP Address: 10.254.254.1 ~ 10.254.254.253

• Subnet Mask: 255.255.255.0

Step 3: Open a web browser and enter http://10.254.254.254 to access the Lionic NGFW management interface.

If the Lionic NGFW cannot obtain an IP address automatically due to the following conditions, you can use an alternative method:

• When you need to configure a static IP address.
• When you need to configure PPPoE to obtain an IP address.
• When DHCP fails or other factors prevent automatic IP assignment.

Alternative Method (Pico-UTM 100 / Dual Ark-UTM 16 / Tera-UTM 12):

Step 1: Connect the Lionic NGFW LAN port to your computer with an Ethernet cable.

Step 2: Manually configure your computer’s network settings:

• IP Address: 10.254.254.1 ~ 10.254.254.253
• Subnet Mask: 255.255.255.0

Step 3: Open a web browser and enter http://10.254.254.254.

Alternative Method (LionFilter 200):

If the MGMT LED is ON:

Step 1: Connect the LAN MGMT port to your computer.

Step 2: Set your computer to Obtain an IP address automatically (DHCP).

Step 3: Enter https://myfilter.lionic.com in a browser.

If the MGMT LED is OFF:

Step 1: Connect the LAN port to your computer.

Step 2: Set a manual IP address (10.254.254.1 ~ 253, Subnet Mask: 255.255.255.0).

Step 3: Enter http://10.254.254.254 in a browser.

If the MGMT LED is ON, ensure the computer is set to obtain an IP via DHCP.

If the MGMT LED is OFF, please refer to Q1-2 for the alternative solution for LionFilter 200.

For security purposes, it is recommended to allow only trusted IP addresses to connect to the management interface.

• To restrict IP access: Go to [WAN] > [Remote Control] > [ACL] > [+ Add], then add the trusted IP address.
• To allow all connections: Go to [WAN] > [Remote Control] > [ACL] and disable it. (Not recommended)

• Refer to Q1-8 to perform a factory reset to restore the default password (the product serial number).
• If the device is connected to CMS, you can reset the password via CMS.

After 10 consecutive failed login attempts, the source IP will be locked for 1 hour.

The Ark device has separate serial numbers for the upper and lower boards on the back (see label, item #5).

After the device is powered on and booted into the system, press and hold the Reset button for 10 seconds until the MGMT LED blinks red, then release the button.

The system log stores up to 100,000 entries, with a maximum retention of 1 month.

Each Threat Log can store up to 5,000 entries. Once the limit is reached, the oldest logs are automatically deleted.

Enterprise or organizational network administrators can centrally manage multiple Lionic NGFW devices via the Central Management System (CMS). From the centralized interface, administrators can remotely configure security rules and monitor detected cyber threats.

For CMS requirements, please contact your local sales partner or representative.

Up to 6 months.

• Go to [System Tools] > [Network Tools], and use Ping CMS Server to check connectivity.
• Confirm that your firewall is not blocking TCP port 4222.

Yes. The Lionic NGFW must be connected to the Internet in order to obtain license authentication, firmware updates, signature updates, and to use Lionic’s cloud-based security services. This ensures complete cybersecurity protection.

If you need to deploy the Lionic NGFW in an environment isolated from the Internet (e.g., a smart factory), you must connect to the Internet through an HTTP Proxy Server (Lionic CMS can act as a Proxy Server). This allows the NGFW to maintain full protection capabilities.

For such requirements, please contact your local sales partner or representative.

The Lionic NGFW supports three methods of obtaining an IP address, depending on your network environment:

• Auto (Automatic DHCP, default)
• Static (Static IP)
• PPPoE

Go to the [WAN] page in the management interface, select the [Connection] type, and configure accordingly.

If your ISP or network administrator provides only one IP address, configure the Lionic NGFW in Router Mode as follows:

Pico-UTM 100 / Dual Ark-UTM 16 / Tera-UTM 12:

Step 1: Connect the Lionic NGFW as shown in the diagram.

Step 2: Manually set your computer’s IP configuration:

• IP Address: 10.254.254.1 ~ 10.254.254.253
• Subnet Mask: 255.255.255.0

Step 3: Open a web browser and enter http://10.254.254.254 to access the management interface.

Step 4: Go to [WAN] page, select the [Connection] type, and configure to obtain an IP address.

Step 5: Go to [LAN] > [Mode], then change the [Connection Mode] to [Router Mode].

LionFilter 200:

If the MGMT LED is ON:

Step 1: Connect the LAN MGMT port to your computer using an Ethernet cable.

Step 2: Set the computer to Obtain an IP address automatically (DHCP).

Step 3: Access the Web GUI at https://myfilter.lionic.com.

Step 4: Go to [WAN] page, select the [Connection] type, and configure to obtain an IP address.

Step 5: Go to [LAN] > [Mode], then change the [Connection Mode] to [Router Mode].

If the MGMT LED is OFF:

Step 1: Connect the LAN port to your computer.

Step 2: Manually set the computer’s network settings:

• IP Address: 10.254.254.1 ~ 10.254.254.253
• Subnet Mask: 255.255.255.0

Step 3: Enter http://10.254.254.254 in a web browser to access the interface.

Once the settings are completed and your computer is replaced with a router or Wi-Fi access point, the Lionic NGFW will use the ISP-provided Public IP as the WAN IP, and distribute Private IPs to LAN devices via DHCP.

Note: It is recommended to configure the router or Wi-Fi access point in Bridge Mode to avoid double NAT issues.

• Pico-UTM 100 does not support VLAN.

• Ark-UTM 16, Tera-UTM 12, and LionFilter 200, when in Bridge Mode, operate in Trunk Mode, allowing all VLAN packets to pass through.

• The WAN VLAN ID setting is used to configure NGFW Internet access, depending on your environment.

Please contact the sales representatives or resellers for details.

In Router Mode, if you need to configure a subnet without NAT, you can enable this option.

• Firewall rules are processed top to bottom (priority order).
• Always place more specific rules above more general ones.

Example:

• To allow access from a specific IP only: create an allow rule for that IP.
• Place a deny ANY rule at the bottom, and the allow IP rule above it.

Certain configurations (e.g., network settings, Packet Scan Mode, Management Port, Restore, scheduled System Reboot, Firmware Upgrade, etc.) may cause system restarts or network interruptions. Therefore, these settings are not automatically synchronized to the Standby device in HA environments.

To avoid service interruptions, you must configure or perform these settings manually on the Standby device.

• Network Settings and Packet Scan Mode: These changes cause network reconnection and these settings are not automatically synchronized to the Standby device. Please manually set the same configurations in Standby device.
• Management Port: This setting does not synchronize on the Standby. Please manually set the same configurations in Standby device. When enabled, the MGMT port cannot connect to external networks, so HA must be established via LAN ports 1-3.
• Restore: Disable HA first, then perform Restore separately on Active and Standby, and re-enable HA afterward.
• Firmware Upgrade: Firmware updates are applied first to the Standby device, then to the Active device.
• System Reboot: Only the Active device reboots.
• Schedule System reboot: The schedule syncs to Standby, but only the Active device reboots at the scheduled time. The Standby takes over as Active during Active device reboot. Scheduled reboot only executes if the Active device has been stable for more than 1 hour.
• Factory Reset: Factory Reset clears HA configuration. Only the Active device is reset and rebooted. The Standby device will take over as Active, leaving only one device in the HA group.

A valid subscription license is required for the Lionic NGFW to:

• Obtain proper authentication.
• Receive firmware updates.
• Download signature updates.
• Access Lionic’s cloud-based security services.

With a valid license, the NGFW can provide complete protection.

When a new firmware version is released, an update notification will appear under [System] > [Firmware Upgrade].

Click [Upgrade Now], and the Lionic NGFW will automatically complete the update process.

Note: The NGFW will reboot during the firmware update. Network connections will be temporarily interrupted and restored once the reboot is complete.

As long as the license is valid and the NGFW is connected to the Internet, the signature will be updated automatically twice a week. No manual action is required.

Yes, but with limitations. After license expiration:

• Firmware updates stop.
• Signature updates stop.
• Access to Lionic’s cloud-based security services is disabled.

This reduces the protection capability of the NGFW. It is strongly recommended to renew the license subscription to maintain full protection.

If [Dashboard] > [Information] > [License Expiration Date] displays “Status checking failed” it means the NGFW cannot connect to the Lionic License Server.

Troubleshooting steps:

• Check the NGFW’s Internet connection status.
• Verify the system time under [System] > [Device] > [System Date & Time] is correct.
• If the problem persists, contact your local sales partner or technical support.

Any device whose traffic passes through the Lionic NGFW (LAN port to WAN port or WAN port to LAN port) is protected by the NGFW.

Note: If your ISP provides an all-in-one device (modem, router, and Wi-Fi access point), devices connected directly to that device will not be protected by the Lionic NGFW. To ensure protection, connect a separate router or Wi-Fi access point to the Lionic NGFW’s LAN port.

Since the NGFW analyzes packet content and compares it with threat signatures, some performance impact on Internet speed is expected. The actual slowdown depends on the type of traffic and applications in use.

The supported number of devices depends on actual traffic and connection load. The following are recommended values:

• Pico-UTM 100: up to 50 devices
• Ark-UTM 16 / Tera-UTM 12 / LionFilter 200: up to 300 devices

The NGFW has three major protection modules, each with configurable actions:

• Anti-Virus: “Log and Destroy File”(default) or “Log Only”
• Anti-Intrusion: “Log and Block”(default) or “Log Only”
• Anti-WebThreat: “Log and Block”(default) or “Log Only”

You can adjust actions under [Policy] > [Anti-Virus] / [Anti-Intrusion] / [Anti-WebThreat].

Enabling Lionic’s Anti-Virus AI features and Anti-WebThreatAI features significantly improves detection and protection against zero-day threats and malicious websites.

No. SMTPS, POP3S, and IMAPS protocol are not supported.

TLS Inspection is not supported when VLAN settings are enabled.

Since the packet may be similar to a part of viruses or attacks in rare cases, NGFW would consider it as a threat. If Lionic NGFW destroyed a file or blocked a connection you trust, you can add it into the whitelist by the following steps:

Step 1. Log in to Lionic NGFW.

Step 2. Go to [Threats] and find the event in [Anti-Virus], [Anti-Intrusion] or [Anti-WebThreat] page. You may identify the event with the file name or IP address.

Step 3. Click [+] button at the end of the event (in the last column of each row) to add it into the whitelist.

Step 4. Download the file or connect the site again.

Furthermore, you can also report this issue via our website: https://www.lionic.com/reportfp

If a file is detected to contain a virus, the Anti-Virus module corrupts the file contents, preventing execution.

• Device identification updates only after traffic passes through the NGFW.
• A valid subscription license is required.

Rules at the top of the list have higher priority. If a connection matches the scope of a rule, subsequent rules will not be checked.

Yes. Lionic’s DPI technology supports both IPv4 and IPv6 traffic, including:

• Packet content inspection
• Application identification
• Threat detection

This ensures complete protection in IPv6 environments.

Some legacy applications or devices may not support the latest TLS versions, leading to failed connections or limited functionality.

If the application relies on outdated protocols or has an improper TLS implementation, compatibility issues may occur.