CliDeck
PlatformLog in
Workspace

pfSense and Netgate Reinstall for Resale: Console, config.xml, and Storage Scope

ITAD & Refurbishment
#pfsense#ITAD#refurbishment#verification#ITAD & Refurbishment#serial-console#itad#network-device-processing
← Back to Blog

Short answer

A pfSense configuration reset restores settings but does not remove arbitrary filesystem changes. For an owned appliance that needs a clean software baseline, use the supported installer and the correct console path, deliberately avoid restoring the previous config.xml, and inspect the resulting configuration. Reinstallation is not automatically certified storage sanitization.

Define the baseline and storage requirement

Record appliance model, architecture, pfSense Plus or CE edition, installed version, and internal or removable storage. Choose an approved target edition and version before writing installer media. A Netgate appliance's installation requirements may differ from a generic x86 firewall.

If the customer's contract requires media sanitization, complete the approved drive-specific process separately. An installer can replace active files without establishing that every prior byte is unrecoverable. Do not infer a storage-erasure certificate from a successful installation screen.

Preserve only what the owner requires

If configuration return is required, obtain an authorized private backup before processing. config.xml can reconstruct substantial customer configuration and must be handled as sensitive evidence. Packages can also store data outside that file, so define the preservation scope rather than assuming one XML file covers everything.

If backup retention is prohibited, do not create an unnecessary copy. Document the decision and keep the asset disconnected from the customer's network.

Prepare console access and installer media

  • Confirm the hardware's supported serial or VGA console connection.
  • Select the correct serial settings for that model.
  • Confirm stable power and identify the intended installation disk.
  • Create clean, approved installer media.
  • Inspect removable media for old config.xml files before use.
  • Plan installer network access when the selected path requires it.

Do not guess serial settings from another appliance. A blank console can be a cable or speed problem, while unreadable characters are not proof of a failed firewall.

Install without restoring the old customer configuration

The installer can recover configuration from an existing installation or attached media. For clean-state processing, inspect Configuration Restore and ensure an old configuration is not selected. If a selection is present and the installer offers Reset Selection, clear it deliberately before continuing.

Identify the target disk by the hardware inventory and installer display. Do not select a disk simply because it appears first. Complete installation, remove installation media at the instructed point, and boot from the intended internal storage.

Verification note: a successful reinstall can still restore customer settings

Automatic configuration recovery is useful for repair but can conflict with resale preparation. Require a fresh baseline after installation rather than trusting the word reinstall.

Check the interface assignments, hostname, local users, VPN definitions, certificates, services, and package state through authorized management. On pfSense Plus 24.03 and later, first console or SSH access after installation or reset can require a new administrator password. Record any temporary bench credential and its handoff disposition.

Grade hardware separately

Verify normal startup, intended edition and version, console access, storage stability, and the interfaces needed for grading. If old configuration returns, inspect installer restore choices and attached media before repeating the whole process.

Hold the unit if storage errors persist, the edition is wrong, licensing is unresolved, or the sanitization requirement has not been met. Report the result accurately: software baseline restored, configuration verified, and storage sanitization status recorded separately.

CliDeck Workspace can retain the console installation record. Combine it with the network-device intake checklist so model, disk, software, and evidence remain associated with one asset.

Safety note: This guidance applies only to devices your team owns or is authorized to process. Use the approved, device-specific procedure, customer policy, and your organization’s sanitization and evidence procedures.

Who this is for

This guide is for ITAD teams, refurbishment teams, network engineers, and operations teams who need to perform an owner-authorized reset, recovery, verification, or documented device-processing workflow on network devices that your team owns or is authorized to process.

When to use this

Use this guide when:

  • Your team owns or is authorized to process the device.
  • You need to reset, zeroize, recover, reimage, verify, or document a network device.
  • The result must be attached to an asset, resale, reuse, refurbishment, or recycling workflow.

When not to use this

Do not use this guide when:

  • You do not own or have authorization to work on the device.
  • The device is outside your approved change, recovery, or processing scope.
  • The task may expose customer data, secrets, licenses, or credentials that you are not allowed to view or store.
  • You need a certified data destruction procedure and your organization has not provided one.

Quick checklist

  • Identify the device and console connector
  • Use the correct console cable or adapter
  • Find the correct serial port or COM port
  • Start with the expected baud rate and 8N1 settings
  • Press Enter to confirm the prompt
  • If output is unreadable, check baud rate and line settings
  • If the port will not open, check permissions, drivers, and whether another program is holding the port
  • Save useful session notes or logs when the work matters

Traditional cable vs CliDeck workflow

A traditional USB serial cable is still the simplest option for quick local work. CliDeck becomes useful when the console session needs browser access, notes, runbooks, sharing, logs, remote hands support, or a portable controller workflow.

Console Server Go can work like a wired USB serial adapter when connected by USB, but it also adds SSH Console on SSH-enabled firmware builds, browser Workspace, live sharing, 24h+ battery operation, OLED status, and magnetic rack mounting.

Net Controller is the larger 12-port option for teams that need to process many network devices with approved workflows, barcode/API tracking, provisioning files, and evidence-style logs.

Workflow

  • Confirm ownership, processing scope, device identity, and approved procedure.
  • Connect through the console or approved management path and capture the session context.
  • Run the reset, zeroize, recovery, reimage, or verification steps required by the article and vendor documentation.
  • Reboot or reconnect as needed and verify the expected clean, default, or recovered state.
  • Attach logs, verification output, exceptions, and final pass/fail/exception status to the asset record.

Verification checklist

  • Device identity matches the asset record.
  • Console or session log is attached to the asset.
  • The reset, zeroize, recovery, or reimage method is recorded.
  • The post-reboot state matches the expected clean or recovered state.
  • Verification commands and outputs are captured.
  • Exceptions or failures are quarantined instead of marked ready.

Resale and evidence checklist

Before marking the device ready for resale, capture:

  • Device model and serial number
  • Console transcript or session log
  • Reset, zeroize, reimage, or recovery method used
  • Any confirmation prompts and operator decisions
  • Post-reboot state
  • Visible default or clean-state prompt
  • Verification commands and outputs
  • Hardware alarms or boot errors
  • License, entitlement, or customer identifiers handled according to policy
  • Exceptions, failures, or quarantine decisions
  • Final pass/fail/exception status attached to the asset record

What not to publish

Do not publish raw transcripts that include customer names, public IP addresses, VPN settings, license keys, entitlement IDs, serial numbers that must remain private, passwords, tokens, certificates, or other sensitive identifiers. Keep sensitive evidence in the customer-approved internal system and publish only sanitized examples.

Common mistakes

  • Processing a device without owner authorization or the correct asset record.
  • Treating a factory reset as certified data destruction.
  • Failing to capture confirmation prompts, reboot state, verification output, or exceptions.
  • Publishing raw logs that contain customer identifiers, licenses, keys, passwords, or configuration remnants.

CliDeck workflow fit

CliDeck can help turn this procedure into a repeatable workflow. Console Server Go is useful for portable rack-side console access and shared remote support. Net Controller is better for ITAD, refurbishment, and batch processing where multiple devices need barcode tracking, approved scripts, logs, API updates, and evidence-style results.

Net Controller can help operators connect devices, scan assets, run approved workflows, capture console logs, require verification steps, and attach the result to the asset record.

FAQ

Is this a certified data destruction procedure?

No. This article describes a practical, owner-authorized workflow and verification approach. Certification depends on your organization’s process, evidence requirements, customer contract, and any formal certification program that applies.

Does CliDeck provide vendor OS images?

No. CliDeck does not distribute vendor operating system images. Recovery or reimage workflows can use images already present on the device or images provided by the customer where the customer has appropriate rights and licenses.

Should I publish the full console log?

Usually no. Keep complete evidence in the approved internal system and publish only sanitized examples. Console logs can contain serial numbers, license details, customer names, IP addresses, keys, passwords, or configuration remnants.

Can CliDeck help with this workflow?

Yes. Console Server Go helps with portable rack-side console access and shared remote support. Net Controller is better for batch ITAD, refurbishment, recovery, provisioning, barcode/API tracking, and evidence-style results.

Related guides