Suspend or retire a firewall

Retire a firewall

Use this when a firewall is replaced or decommissioned.

1. Remove the agent from the firewall (if you still have access). As root:

   pkg delete pfSense-pkg-nats-agent

   This stops the agent, removes its service, binary and /usr/local/etc/nats-agent/ (including its credentials). It leaves the package’s saved settings in the pfSense configuration and the log file /var/log/nats_agent.log.

2. Delete the device in pfCentral. Open the device, then More → General Setup. In the Danger zone, click Delete device and confirm. You need the admin role.

   This deletes the device’s connect-secret, removes it from the fleet, and writes an audit record. It cannot be undone; to bring the firewall back, add and enroll it again.

Cut off a compromised or stolen firewall

Deleting the device stops it from connecting again. But its current hourly pass stays valid until it expires, so a connected agent can keep answering requests for up to one hour.

1. Delete the device in pfCentral, as above.
2. Drop the connection now: block the firewall’s public IP address on port 24222 at your edge, or restart pfCentral to drop all connections (healthy firewalls reconnect within seconds).
3. If you suspect the server’s sentinel credentials leaked with the device, know that they are useless on their own: they grant no permissions without a valid connect-secret.

Suspend

pfCentral’s data model has suspended and decommissioned states, and the login check refuses both, but there is no button for them yet. Until there is, deleting the device is the way to cut it off.

Remove pfCentral from a firewall but keep the device

If you want to stop managing a firewall for a while, stop the agent on it: Services → pfCentral → Status → Stop, or service nats_agent stop. pfCentral shows it offline. Start it again to reconnect; no new token is needed.