Kerio Control v10 and New NG Hardware — Customer Guide

Summary

• New Kerio Control NG appliances (NG 520 and NG 521) ship with Kerio Control v10 preinstalled and are fully supported.

• These new models require v10 due to updated network interface drivers and will not operate correctly on older 9.x images.

• Legacy appliances can continue to run 9.x; if you’re unsure which version is right for your environment, contact Support.

Hardware details & availability

Model	Availability	Typical use	Network ports
NG120	Shipping now (includes printed port mapping reference in box)	Small office	4 × 1GbE
NG320	Shipping now (includes printed port mapping reference in box)	Medium office	8 × 2.5GbE + 2 × SFP
NG520	Late 2025	Large office	8 × 2.5GbE
NG521	Late 2025	Complex networks	8 × 2.5GbE + 8 × 1GbE
NG700	Late 2025	Enterprise	4 × 10GbE SFP

Kerio Control hardware is available through authorized distributors and resellers. For purchasing assistance, contact your reseller or GFI Sales.

Software versions & compatibility

• Preinstalled version: Kerio Control v10 on new NG hardware.

• Why v10 is required on new NG hardware: New NIC chipsets (e.g., Intel i225/i226 families) need drivers included in v10. Installing older 9.x builds may appear to succeed, but the device will not recognize network interfaces.

• 9.x on legacy appliances: If you run older NG models, you may continue using the latest 9.x release. If you notice performance changes after moving to v10 on legacy hardware, contact Support to review options (including staying on 9.x).

Update path to v10

Follow the path from your current version; without skipping any steps. Create a backup and plan a maintenance window before you start.

• From 9.3.6p1 or earlier → 9.4.2p2 → 9.4.3p4 → 9.4.5p2 → 9.5p1 → v10

  • Note: 9.4.3p4 is mandatory because it resizes partitions for later updates.

• From 9.4.2p2 → 9.4.3p4 → 9.4.5p2 → 9.5p1 → v10

• From 9.4.3p4 → 9.4.5p2 → 9.5p1 → v10

• From 9.4.5 (any patch) → 9.5p1 → v10

• From 9.5/9.5p1 → v10

Versions before 8.0 require a fresh installation rather than an in-place update.

Why These Specific Versions?

• 9.4.3p4: Performs critical partition resizing required for all future updates.
• 9.4.5p2: Most stable intermediate version.
• 9.5p1: Fixes stability issues and prepares for v10 kernel upgrade.
• v10: Modern Debian Bookworm kernel with improved performance and security.

Install, update, and recovery

New NG units support two workflows: Update image (in-place) and Rescue image (factory reimage).

A) Update image (in‑place)

Use when the device is already running and you’re moving to a newer v10 build.

1. Back up your configuration (Dashboard → Configuration Assistant → Export your configuration).

2. Upload the update image in the admin UI and reboot when prompted.

3. Verify services and connectivity.

B) Rescue image (factory reimage) — required for NG hardware when installing from scratch or correcting a wrong ISO install

1. Back up your configuration (Dashboard → Configuration Assistant → Export).

2. Prepare USB with the official v10 rescue .img for your model (use a tool like Rufus) and note the USB will be erased.

3. Recover: With the box powered off, insert the USB and power on. The recovery starts automatically and powers off when complete.

4. First boot: Remove USB and power on. Connect to https://10.10.10.1/admin from a computer on LAN port 1. Default login is admin / admin (change immediately).

5. Activate license: Dashboard → License. Enter your NG license key.

6. Restore configuration: Dashboard → Configuration Assistant → Import configuration and upload your backup. Reassign interfaces if prompted, then verify DHCP, VPN, and traffic rules.

Tip: Keep the printed port-mapping card handy during setup; for digital copies, contact Support or your reseller.

Migration from legacy hardware

Two common scenarios when moving from NG110/310/510/511 (legacy) to NG120/320/520/521/700. Please consult the attached Hardware Transition Guide during the migration.

1) Direct migration (same or more ports on the new unit)

• Export a full configuration from the old appliance.

• Bring the new appliance online and activate the license.

• Use Import configuration to restore the backup. During the wizard, pair original interfaces with the new ones if needed.

• Verify policies, VPN tunnels, and (if used) AD integration.

2) Port‑reduction migration (new unit has fewer physical ports)

• Avoid a full export and import. Instead, plan a VLAN‑based design to consolidate networks.

• On the new unit, configure trunk ports and add VLAN interfaces (name, VLAN ID, parent interface, IP/DHCP as needed).

• Update traffic rules to reference the new VLAN interfaces.

• Configure downstream switches for 802.1Q trunking and appropriate access ports.

• Selectively recreate/import specific items (rules, VPNs, users) after the VLAN base is in place.

Tip: If you manage devices via GFI AppManager, confirm the new appliance appears Online after migration and that automated backups are enabled. If registration/licensing looks wrong, proceed with Resetting KerioControl’s connection to GFI AppManager.

License & OS changes

• When moving licenses between different hardware models or operating system variants, an OS/hardware model change must be processed.

• You can complete this step directly via the article below:

  • How can I update my Kerio Connect or Kerio Control OS or Hardware model?

  • You can contact the GFI Customer Care Support for any issues during this process

• After the OS/hardware model change is completed, the original unit will stop working with that license. Using the same license concurrently on multiple units is not permitted.

• If you encounter an “invalid license” message after a restore, reboot once and re‑sync license information. If the message persists, contact GFI Customer Care Support.

Known issues in v10 (current)

We’re actively improving v10 on the new NG hardware. The following issues may be observed at this time:

• Update check may report “Update failed.”
  Status: Known. Workaround: Apply updates manually using the update image until automatic checks are fully enabled.

• SSH toggle status may appear incorrect in the UI.
  Status: Known. Workaround: If you have enabled SSH, verify connectivity by attempting an SSH connection rather than relying solely on the toggle state.

• Front‑panel status banner may remain visible across pages.
  Status: Cosmetic; no action required. A fix is planned in a future build.

• Port order labeling in the UI may not match the physical port sequence on some units.
  Status: Known. Workaround: Refer to the printed port mapping card included with the device and label your cables accordingly.

• Custom deployments with 10 GbE NICs may currently observe maximum throughput around 6.5 Gbps under v10.
  Status: Driver limitation under active investigation. Performance improvements are planned.

Getting help

• Purchasing & availability: Contact your authorized reseller or GFI Sales.

• Technical support: If you need the latest v10 images, recovery media, or run into any of the issues above, contact GFI Customer Care with your appliance model and current version.

FAQ

• Can I install a 9.x version on new NG hardware?
  Not supported. New NG models require v10 due to updated NIC drivers; older builds will not detect the network interfaces.
• I upgraded a legacy appliance to v10 and noticed reduced performance. What should I do?
  Contact Support. Depending on your model and workload, we may recommend remaining on the latest 9.x release.
• Where can I get the latest v10 image or recovery media?
  Contact Support or your reseller for the official download and instructions.
• Can I reuse my existing license on new hardware?
  Yes—once an OS/hardware model change is processed (see the Customer Care guide above). After the change, the original unit will no longer work with that license.

If you have questions not covered here, please contact Support or your reseller and reference your NG model (e.g., NG 520 or NG 521) and Kerio Control version.