# Next-Generation Firewall FAQs

Technical guide for configuring, managing, and securing Lionic Next-Generation Firewall (NGFW) devices.

[Resources](https://www.lionic.com/supports/downloads)

### ACCESS & MANAGEMENT

## Login and Manage Lionic NGFW

### 

Q1-1. How do I access the management interface of the Lionic NGFW?

### Pico-UTM 100 / Dual Ark-UTM 16 / Tera-UTM 12:

**Step 1**: Connect the Lionic NGFW WAN port to a network that can automatically assign an IP address (DHCP).

**Step 2**: Connect the Lionic NGFW LAN port to your computer using an Ethernet cable.

**Step 3**: Open a web browser and go to the corresponding management URL:

-   Pico-UTM 100: [https://mypico.lionic.com](https://mypico.lionic.com/)
-   Dual Ark-UTM 16: [https://myark.lionic.com](https://myark.lionic.com/)
-   Tera-UTM 12: [https://mytera.lionic.com](https://mytera.lionic.com/)

  

### LionFilter 200:

**Step 1**: Connect the Lionic NGFW LAN MGMT port to your computer using an Ethernet cable.

**Step 2**: Configure your computer’s network settings to Obtain an IP address automatically (DHCP).

**Step 3**: Open a web browser and go to [https://myfilter.lionic.com](https://myfilter.lionic.com/) to access the Lionic NGFW management interface.

Note: By configuring the MGMT port with a dedicated IP address, you can reduce the risk of losing access to the management interface due to misconfiguration.

  

### If the Lionic NGFW cannot obtain an IP address:

**Step 1**: Connect the Lionic NGFW LAN port or LionFilter 200 LAN 1~3 to your computer with an Ethernet cable.

**Step 2**: Manually configure your computer’s network settings:

-   IP Address: **10.254.254.1 ~ 10.254.254.253**
    
-   Subnet Mask: **255.255.255.0**
    

**Step 3**: Open a web browser and enter **http://10.254.254.254** to access the Lionic NGFW management interface.

### 

Q1-2. What if the Lionic NGFW cannot obtain an IP address? How can I access the management interface?

If the Lionic NGFW cannot obtain an IP address automatically due to the following conditions, you can use an alternative method:

-   When you need to configure a static IP address.
-   When you need to configure PPPoE to obtain an IP address.
-   When DHCP fails or other factors prevent automatic IP assignment.

  

### Alternative Method (Pico-UTM 100 / Dual Ark-UTM 16 / Tera-UTM 12):

**Step 1**: Connect the Lionic NGFW LAN port to your computer with an Ethernet cable.

**Step 2**: Manually configure your computer’s network settings:

-   IP Address: **10.254.254.1 ~ 10.254.254.253**
-   Subnet Mask: **255.255.255.0**

**Step 3**: Open a web browser and enter **http://10.254.254.254**.

  

### Alternative Method (LionFilter 200):

If the MGMT LED is **ON**:

**Step 1**: Connect the LAN MGMT port to your computer.

**Step 2**: Set your computer to Obtain an IP address automatically (DHCP).

**Step 3**: Enter **[https://myfilter.lionic.com](https://myfilter.lionic.com/)** in a browser.

If the MGMT LED is **OFF**:

**Step 1**: Connect the LAN port to your computer.

**Step 2**: Set a manual IP address (**10.254.254.1 ~ 253**, Subnet Mask: **255.255.255.0**).

**Step 3**: Enter **http://10.254.254.254** in a browser.

### 

Q1-3. The LionFilter 200 MGMT port cannot access the management interface.

If the MGMT LED is **ON**, ensure the computer is set to obtain an IP via DHCP.

If the MGMT LED is **OFF**, please refer to Q1-2 for the alternative solution for LionFilter 200.

### 

Q1-4. How do I restrict access to the management interface to trusted IP addresses only?

For security purposes, it is recommended to allow only trusted IP addresses to connect to the management interface.

-   To restrict IP access: Go to **\[WAN\] > \[Remote Control\] > \[ACL\] > \[+ Add\]**, then add the trusted IP address.
-   To allow all connections: Go to **\[WAN\] > \[Remote Control\] > \[ACL\]** and disable it. (Not recommended)

### 

Q1-5. I forgot my login password. What should I do?

-   Refer to Q1-8 to perform a factory reset to restore the default password (the product serial number).
-   If the device is connected to CMS, you can reset the password via CMS.

### 

Q1-6. I entered the wrong password too many times and cannot log in.

After 10 consecutive failed login attempts, the source IP will be locked for 1 hour.

### 

Q1-7. I cannot log in with the default password (serial number) on Dual Ark-UTM 16.

The Ark device has separate serial numbers for the upper and lower boards on the back (see label, item #5).

### 

Q1-8. How do I restore factory settings?

After the device is powered on and booted into the system, press and hold the Reset button for 10 seconds until the MGMT LED blinks red, then release the button.

### 

Q1-9. How long can Lionic NGFW logs be stored?

The system log stores up to 100,000 entries, with a maximum retention of 1 month.

### 

Q1-10. How can I manage multiple Lionic NGFW devices?

Enterprise or organizational network administrators can centrally manage multiple Lionic NGFW devices via the Central Management System (CMS). From the centralized interface, administrators can remotely configure security rules and monitor detected cyber threats.

For CMS requirements, please contact your local sales partner or representative.

### 

Q1-11. How long can CMS data be retained?

Up to 6 months.

### 

Q1-12. What should I do if CMS cannot connect?

-   Go to **\[System Tools\]** > **\[Network Tools\]**, and use Ping CMS Server to check connectivity.
-   Confirm that your firewall is not blocking TCP port 4222.

### NETWORK CONFIGURATION

## Lionic NGFW Network Settings

### 

Q2-1. Does the Lionic NGFW need to be connected to the Internet?

Yes. The Lionic NGFW must be connected to the Internet in order to obtain license authentication, firmware updates, signature updates, and to use Lionic’s cloud-based security services. This ensures complete cybersecurity protection.

### 

Q2-2. How can I deploy Lionic NGFW in a network environment without Internet access?

If you need to deploy the Lionic NGFW in an environment isolated from the Internet (e.g., a smart factory), you must connect to the Internet through an HTTP Proxy Server (Lionic CMS can act as a Proxy Server). This allows the NGFW to maintain full protection capabilities.

For such requirements, please contact your local sales partner or representative.

### 

Q2-3. How can Lionic NGFW obtain an IP address to connect to the Internet?

The Lionic NGFW supports three methods of obtaining an IP address, depending on your network environment:

-   Auto (Automatic DHCP, default)
-   Static (Static IP)
-   PPPoE

Go to the **\[WAN\]** page in the management interface, select the **\[Connection\]** type, and configure accordingly.

### 

Q2-4. What if my ISP or network administrator only provides me with a single IP address? How should I configure the Lionic NGFW?

If your ISP or network administrator provides only one IP address, configure the Lionic NGFW in Router Mode as follows:

### Pico-UTM 100 / Dual Ark-UTM 16 / Tera-UTM 12:

**Step 1**: Connect the Lionic NGFW as shown in the diagram.

  
  

**Step 2**: Manually set your computer’s IP configuration:

-   IP Address: **10.254.254.1 ~ 10.254.254.253**
-   Subnet Mask: **255.255.255.0**

**Step 3**: Open a web browser and enter **http://10.254.254.254** to access the management interface.

**Step 4**: Go to **\[WAN\]** page, select the **\[Connection\]** type, and configure to obtain an IP address.

**Step 5**: Go to **\[LAN\] > \[Mode\]**, then change the **\[Connection Mode\]** to **\[Router Mode\]**.

  

### LionFilter 200:

If the MGMT LED is **ON**:

**Step 1**: Connect the LAN MGMT port to your computer using an Ethernet cable.

**Step 2**: Set the computer to Obtain an IP address automatically (DHCP).

**Step 3**: Access the Web GUI at [https://myfilter.lionic.com](https://myfilter.lionic.com/).

**Step 4**: Go to **\[WAN\]** page, select the **\[Connection\]** type, and configure to obtain an IP address.

**Step 5**: Go to **\[LAN\] > \[Mode\]**, then change the **\[Connection Mode\]** to **\[Router Mode\]**.

  

If the MGMT LED is **OFF**:

**Step 1**: Connect the LAN port to your computer.

**Step 2**: Manually set the computer’s network settings:

-   IP Address: **10.254.254.1 ~ 10.254.254.253**
-   Subnet Mask: **255.255.255.0**

**Step 3**: Enter **http://10.254.254.254** in a web browser to access the interface.

Once the settings are completed and your computer is replaced with a router or Wi-Fi access point, the Lionic NGFW will use the ISP-provided Public IP as the WAN IP, and distribute Private IPs to LAN devices via DHCP.

**Note**: It is recommended to configure the router or Wi-Fi access point in Bridge Mode to avoid double NAT issues.

### 

Q2-5. How do I configure VLAN in Lionic NGFW?

-   Pico-UTM 100 does not support VLAN.
    
-   Ark-UTM 16, Tera-UTM 12, and LionFilter 200, when in Bridge Mode, operate in Trunk Mode, allowing all VLAN packets to pass through.
    
-   The WAN VLAN ID setting is used to configure NGFW Internet access, depending on your environment.
    

### 

Q2-6. If the Lionic NGFW is behind a firewall, which external services need to be allowed?

Please contact the sales representatives or resellers for details.

### 

Q2-7. What is the purpose of "Routing without NAT" in Lionic NGFW?

In Router Mode, if you need to configure a subnet without NAT, you can enable this option.

### 

Q2-8. How should I configure firewall rules in Lionic NGFW?

-   Firewall rules are processed top to bottom (priority order).
-   Always place more specific rules above more general ones.

Example:

-   To allow access from a specific IP only: create an allow rule for that IP.
-   Place a deny ANY rule at the bottom, and the allow IP rule above it.

### 

Q2-9. Why some settings are not synchronized to the Standby device in HA (High Availability) mode? How should I handle this?

Certain configurations (e.g., network settings, Packet Scan Mode, Management Port, Restore, scheduled System Reboot, Firmware Upgrade, etc.) may cause system restarts or network interruptions. Therefore, these settings are not automatically synchronized to the Standby device in HA environments.

  
  

To avoid service interruptions, you must configure or perform these settings manually on the Standby device.

-   **Network Settings and Packet Scan Mode**: These changes cause network reconnection and these settings are not automatically synchronized to the Standby device. Please manually set the same configurations in Standby device.
-   **Management Port**: This setting does not synchronize on the Standby. Please manually set the same configurations in Standby device. When enabled, the MGMT port cannot connect to external networks, so HA must be established via LAN ports 1-3.
-   **Restore**: Disable HA first, then perform Restore separately on Active and Standby, and re-enable HA afterward.
-   **Firmware Upgrade**: Firmware updates are applied first to the Standby device, then to the Active device.
-   **System Reboot**: Only the Active device reboots.
-   **Schedule System reboot**: The schedule syncs to Standby, but only the Active device reboots at the scheduled time. The Standby takes over as Active during Active device reboot. Scheduled reboot only executes if the Active device has been stable for more than 1 hour.
-   **Factory Reset**: Factory Reset clears HA configuration. Only the Active device is reset and rebooted. The Standby device will take over as Active, leaving only one device in the HA group.

### LICENSE & SUBSCRIPTION

## License and Subscription Issues

### 

Q3-1. Why does the Lionic NGFW require a subscription license?

A valid subscription license is required for the Lionic NGFW to:

-   Obtain proper authentication.
-   Receive firmware updates.
-   Download signature updates.
-   Access Lionic’s cloud-based security services.

With a valid license, the NGFW can provide complete protection.

### 

Q3-2. How do I update the firmware of the Lionic NGFW?

When a new firmware version is released, an update notification will appear under **\[System\]** > **\[Firmware Upgrade\]**.

Click **\[Upgrade Now\]**, and the Lionic NGFW will automatically complete the update process.

  

**Note**: The NGFW will reboot during the firmware update. Network connections will be temporarily interrupted and restored once the reboot is complete.

### 

Q3-3. How to update the signature for the Lionic NGFW?

As long as the license is valid and the NGFW is connected to the Internet, the signature will be updated automatically twice a week. No manual action is required.

### 

Q3-4. Can I still use the Lionic NGFW after the license expires?

Yes, but with limitations. After license expiration:

-   Firmware updates stop.
-   Signature updates stop.
-   Access to Lionic’s cloud-based security services is disabled.

  

This reduces the protection capability of the NGFW. It is strongly recommended to renew the license subscription to maintain full protection.

### 

Q3-5. Why does the "License Expiration Date" show "Status checking failed"?

If **\[Dashboard\]** > **\[Information\]** > **\[License Expiration Date\]** displays “Status checking failed” it means the NGFW cannot connect to the Lionic License Server.

  

Troubleshooting steps:

-   Check the NGFW’s Internet connection status.
-   Verify the system time under **\[System\]** > **\[Device\]** > **\[System Date & Time\]** is correct.
-   If the problem persists, contact your local sales partner or technical support.

### SECURITY & THREAT PROTECTION

## Security Protection Issues

### 

Q4-1. How can I confirm that a device is protected by the Lionic NGFW?

Any device whose traffic passes through the Lionic NGFW (LAN port to WAN port or WAN port to LAN port) is protected by the NGFW.

  

**Note**: If your ISP provides an all-in-one device (modem, router, and Wi-Fi access point), devices connected directly to that device will not be protected by the Lionic NGFW. To ensure protection, connect a separate router or Wi-Fi access point to the Lionic NGFW’s LAN port.

### 

Q4-2. Why does Internet speed decrease after connecting through the Lionic NGFW?

Since the NGFW analyzes packet content and compares it with threat signatures, some performance impact on Internet speed is expected. The actual slowdown depends on the type of traffic and applications in use.

### 

Q4-3. How many devices can one Lionic NGFW protect?

The supported number of devices depends on actual traffic and connection load. The following are recommended values:

-   Pico-UTM 100: up to 50 devices
-   Ark-UTM 16 / Tera-UTM 12 / LionFilter 200: up to 300 devices

### 

Q4-4. What actions does the Lionic NGFW take when detecting threats?

The NGFW has three major protection modules, each with configurable actions:

-   Anti-Virus: “Log and Destroy File”(default) or “Log Only”
-   Anti-Intrusion: “Log and Block”(default) or “Log Only”
-   Anti-WebThreat: “Log and Block”(default) or “Log Only”

  

You can adjust actions under **\[Policy\]** > **\[Anti-Virus\]** / **\[Anti-Intrusion\]** / **\[Anti-WebThreat\]**.

### 

Q4-5. What are the benefits of enabling AI features?

Enabling Lionic’s Anti-Virus AI features and Anti-WebThreatAI features significantly improves detection and protection against zero-day threats and malicious websites.

### 

Q4-6. Can the NGFW Anti-Virus or Anti-Spam scan encrypted email protocols?

No. SMTPS, POP3S, and IMAPS protocol are not supported.

### 

Q4-7. Why is TLS Inspection not working?

TLS Inspection is not supported when VLAN settings are enabled.

### 

Q4-8. What can I do if Lionic NGFW destroyed a trusted file or blocked a trusted connection?

Since the packet may be similar to a part of viruses or attacks in rare cases, NGFW would consider it as a threat. If Lionic NGFW destroyed a file or blocked a connection you trust, you can add it into the whitelist by the following steps:

**Step 1**. Log in to Lionic NGFW.

**Step 2**. Go to **\[Threats\]** and find the event in **\[Anti-Virus\]**, **\[Anti-Intrusion\]** or **\[Anti-WebThreat\]** page. You may identify the event with the file name or IP address.

**Step 3**. Click **\[+\]** button at the end of the event (in the last column of each row) to add it into the whitelist.

**Step 4**. Download the file or connect the site again.

  

Furthermore, you can also report this issue via our website: [https://www.lionic.com/supports/report-false-positive/](https://www.lionic.com/supports/report-false-positive/)

### 

Q4-9. Why was a file containing a virus still downloaded to my computer?

If a file is detected to contain a virus, the Anti-Virus module corrupts the file contents, preventing execution.

### 

Q4-10. Why doesn't Advanced Device Identification update immediately?

-   Device identification updates only after traffic passes through the NGFW.
-   A valid subscription license is required.

### 

Q4-11. Why is Behavior Management not working?

Rules at the top of the list have higher priority. If a connection matches the scope of a rule, subsequent rules will not be checked.

### 

Q4-12. Can Lionic NGFW security features scan IPv6 traffic?

Yes. Lionic’s DPI technology supports both IPv4 and IPv6 traffic, including:

-   Packet content inspection
-   Application identification
-   Threat detection

  

This ensures complete protection in IPv6 environments.

### 

Q4-13. Why do some applications or devices can't work when TLS inspection is enabled?

Some legacy applications or devices may not support the latest TLS versions, leading to failed connections or limited functionality.

If the application relies on outdated protocols or has an improper TLS implementation, compatibility issues may occur.

Get in touch

Let’s connect and figure out how our solution can benefit you.

[Get in touch](https://www.lionic.com/contact)

[Contact Us](https://www.lionic.com/contact)

Source: https://www.lionic.com/supports/faq/next-generation-firewall/