November 2020 UPDATE:

I’ve uploaded a newer version of this project to YouTube. This method achieves the same goals as before but all without opening the Steelhead device!

From this point on I will be using YouTube to document all my projects, and also embed the videos with some additional info to this blog.

Please subscribe to my channel to stay informed of new projects.

The old method of hacking the Steelhead I’ve kept below, for posterity. Thanks to all who contributed.

The below method to hack your Steelhead and install pfSense is OBSOLETE, please see above YouTube video for best way to hack your Steelhead.

[Note from Aug/2020. There are a considerable number of comments at the bottom of the page with loads of advice from many people. Be sure to check them out]

Having worked quite extensively with all Riverbed devices in the past I knew how much of a great deal I was getting when I bought a used CX755 for $100.

Hardware specs:

  • 4GB RAM
  • 1.66GHz Intel Xeon processor
  • 6 gigabit NIC’s**
  • 160GB SSD
  • 250GB HDD
  • NVRAM of unknown size
  • Very sturdy build
  • Small form factor
  • Minimal power consumption (compared with a PC)

**
4 of the 6 NIC’s are used for data optimisation. This means that each pair of NIC’s (2 pairs on this device) share a layer 3 (IP) address called an “inpath” interface. I don’t know whether this means I won’t be able to use those interfaces, but for my purposes I only need 2 NIC’s. So I will use AUX and Primary.

Both Primary and AUX are ‘normal’ interfaces. Primary is used for managing the device (among various other optional optimisation-related uses) and the AUX is for various uses, some of the more common are for connecting to other SH (Steelhead) devices for datastore synchronisation, interface used in virtual environments, or out-of-band management.

2016-06-15 15_50_28-StartThe inpath interfaces are the 4 NIC’s on the left. Far right is AUX and the one beside that is Primary.

The below steps will allow you to just about install any OS you like on the 755. So long as the OS supports headless mode. My intentions are to install pfSense on it. This is an open source network firewall distribution made with FreeBSD.

Step 1 – Open the case

There are two phillips-head screws on the back along the top. Remove these and then slide the top panel away from the front fascia.

[I had already replaced the Intel 160GB SSD with the SanDisk 120GB SSD you see in the pic]

At the top is the power supply, don’t touch this!
Below is a black plastic shroud used for cooling. It is important you use this whenever you have the device powered up, otherwise the CPU and chipset can overheat and cause the system to be unstable.

Remove the black plastic shroud

2016-06-15 15.36.52

  1. CPU heat sink
  2. Chipset heat sink
  3. SSD and HDD (HDD is under the SSD)
    These are connected to the board using what looks to be a PCIe 2x SATA riser
  4. 3 very loud fans
  5. 2x 2GB RAM
  6. Under this SD card is a flash memory chip soldered on to a board which connects to a USB riser (more on this later)
  7. PSU (do not touch!)
  8. Relays for inpath interfaces
  9. There is no 9

Normally, the SH will boot from the flash memory (#6 in the pic above). The SSD is used for the data-store (for optimisation purposes) and the HDD is for other things like virtual machines etc.
The BIOS is password protected so we can’t change where the machine boots from (and I am not sure if PXE boot is enabled, I had no way to test it). So this means we need to boot from the flash memory.

Step 2 – Unscrew and remove the flash memory

There is one phillips-head screw holding it in place. Remove this and slide the board up.

The flash memory pulled out of the device.

At first I thought it was some mSATA thingy I hadn’t seen before, but then I realised the pins on the board are in the USB riser configuration. So I tried connecting a USB riser plug in to it (if your PC has USB ports on the front then it likely has this riser plug inside it connecting to the motherboard) and sure enough I was able to boot a USB memory stick from it.

Step 3 – Plug in your own USB riser plug

A USB riser allows for two USB devices. The one inside the SH has only one enabled,
so if you can’t boot then try using the other one.

Now it is a simple matter of booting from your USB memory stick.

The SH has no graphics card, only serial via an RS-232 interface (use a baud of 9600 for communication), so an installation disk that supports headless mode is needed.

In my case I chose to install pfSense on the 160GB SSD. The SSD then has a bootloader installed on it and in an ideal world we would go in to the BIOS and tell it to boot from the SSD. But because we can’t do that, we need to install a bootloader on a USB flash drive (a small and cheap one will do as it will only have a bootloader on it) and then point it to the SSD to boot from there. So the boot flow will be PowerOn > BIOS > USB riser port > SSD > OS boots.

Now, at this point we may part ways. There are several options you have at this point:

  1. Install your OS on a USB drive, and then boot from it using the USB riser.
    This is probably the easiest one. You can just leave the USB memory stick plugged in to the riser in the case. To install on to a different USB drive just plug that stick in to one of the USB ports on the front of the SH.
  2. Install your OS on the flash memory thingy that came with the SH.
    I haven’t actually tried this, but am thinking you could either try PXE booting and then installing on the memory thingy; or you could try plugging the memory thingy in to a USB riser on another PC and install it there, then shift it back to the SH.
  3. Install your OS on the HDD or SSD inside the SH.
    This is what I plan to do, so if you want to do this too then read on below.

Step 4 – Boot from USB

Provided you have created a bootable USB which will work in headless mode (ie. via a serial interface) then you should be able to boot from  your USB. If you are booting pfSense  remember that after BIOS pfSense changes your serial baud rate to 115200, so be sure to change it.

During the setup process I tried to install pfSense on my 120GB SSD and when that failed I tried the 160GB SSD the SH came with. Both failed during the below stage of creating drive partitions and mounting.

2016-06-15 22_16_38-Windows7-TAFE [Running] - Oracle VM VirtualBox

No matter what I did I couldn’t get past this stage. I tried different disks, creating the partitions on another *nix, swapping disks, etc… but nothing worked. The problem seemed to be when creating the Union Filesystem. So I concluded it must be some kind of access needed to the disk which I can only change in BIOS (perhaps enable/disable AHCI?). So I tried using a USB to SATA converter and viola! it worked!

Now we have pfSense installed on the SSD, but we can’t tell BIOS to boot from the SSD. We are stuck booting from the internal USB riser.

UPDATE: September 2018

Default BIOS password is MINNOW

Thanks to Wade who mentioned this in the comments.

Step 5 – Create bootloader on USB

I am a Linux man, but I had never used FreeBSD and the differences are staggering. At this point I began to research online and spoke to a few of the nice folks over at #freebsd on freenode IRC. Huge shout-out to ketas and especially tsoome from the channel for helping me along.

Resources:
https://www.freebsd.org/doc/handbook/boot-introduction.html
https://www.freebsd.org/cgi/man.cgi?query=boot&apropos=0&sektion=8&manpath=FreeBSD+10.3-RELEASE+and+Ports&arch=default&format=html

For the USB image whose bootloader we will commandeer we will use FreeBSD i386 memstick image.

Protip: dd the image to a USB. I tried using Rufus (in Windows) and it would cause problems during the boot process. It took me a while to figure it out because it wasn’t a hard failure.

Protip2: Although you don’t plan on installing FreeBSD, you may need a HDD plugged in to the PC for it to boot to the installation wizard.

Once the image is written to USB, boot it on a PC (not the SH) and drop to shell once the installer wizard is shown.

Inside shell, run the command camcontrol devlist . This will give you a list of devices. You should see the USB drive you are booting from here, take note of the device name (eg. da0) then run:

fdisk -B -b /boot/boot0sio <device>

This will change the stage0 boot process so that it outputs to the serial console (9600 baud). So now you can plug in the USB to the SH and boot it, which is exactly what we will do.

Step 6 – Boot from USB on the SH

At this point you should have the USB plugged in to the USB riser in the SH and the HDD/SSD plugged in which has pfSense installed on it.

2016-06-20 04_15_56-Windows7-TAFE [Running] - Oracle VM VirtualBox

While booting there may be a long delay between BIOS and bootloader, be patient and give it a couple of minutes. Once booted, you will see the FreeBSD installation wizard again (but now with ASCII art!). Drop to shell again.

mount -uw / #remount read-write
vi /boot/loader.conf #open this file to add the below lines
console=comconsole
currdev-“disk1s1a:”

If disk1s1a is not the right disk/partition then you can press ESC at the bootloader menu to go to the OK prompt. Type show currdev to show the current device you are set to boot from, this would be the USB. Then type lsdev and find the other UFS partition. This will be the pfSense partition you want to boot. You will see the disk name to use in the loader.conf file.

Save the file and reboot. Now if you leave it alone to fully boot it should load pfSense!

2016-06-20 04_17_42-Windows7-TAFE [Running] - Oracle VM VirtualBox

Step 7 – Make a connector for your USB

Your USB will be used to boot pfSense from now on. So you should make it nice and comfortable in its new home. Get some plugs and pins and make it a cable like in the pics below. Then you can close up the case for good. Any upgrades you do to pfSense shouldn’t change anything you have done, unless they upgrade/change their bootloader (which is unlikely anytime soon).

2016-06-20 11.57.292016-06-20 12.00.15

Grab one of the above cables and cut it in half. Strip the ends and create a new header connecting using the colour order seen in below pic.

cpx108_2p4

2016-06-20 13.29.51

The row of USB headers closer to the HDD bay is the only one that works. Red/VCC wire is closest to RAM. Wrap the USB in tape or heatshrink to avoid shorting.

2016-06-20 13.31.30

Be sure to put the plastic shroud back in place for proper cooling.

cpx108_2p22

If you’re not comfortable with soldering then you could use one of these, but you may struggle to fit it in the case.

Step 8 – Profit!

You should now have your Riverbed Steelhead x55 series WAN Optimizer functioning as a pfSense firewall. Congratulations!

2016-06-20 13.36.552016-06-20 13_38_08-Windows7-TAFE [Running] - Oracle VM VirtualBox

Fin.

Postscript: Newer version of pfSense have a problem with throttling CPU to control temperature and power consumption. See here to fix: https://redmine.pfsense.org/issues/5739
The changes will need to be done on the /boot/device.hints file on the USB.

Post-postscript: After installation you may notice the cooling fans are very noisy and they don’t vary in speed depending on temperature. To fix this see this post.

ADDENDUM (28/9/18):

Thank you to all those who have added invaluable information in the comments section. One contributor, Jim (https://www.reformat-computer.de/), was helpful enough to provide very specific instructions on how to have the bypass ports enabled which I will details below.

WARNING: You will require some specialised equipment (soldering iron & SMD rework gun) and mediocre skills at soldering.

The CX555 has 1 in-path interface (2 ethernet ports), the CX755 has 2 in-path interfaces (4 ethernet ports). The procedure for both is the same, but the CX755 had an additional piece.

Below circled in yellow is the section of board where your work will be done.

With the CX555 (image below) you must remove the large IC near the bottom along with the two small inductors between the MOSFETs.

With the CX755 (image below) there are two more MOSFETs and two more inductors. You need to remove the two additional inductors.

Then you connect up the +5v power (get this from the USB riser, see main post) to the solder pads as per below.
I have only tested this with the bottom two pads and can only guess which two pads must be powered for the top two pads, which is why I put a ? in the image (can someone please confirm which pads should be used?).

Once again, thanks to Jim for providing all the above information.