topic Re: Firmware update warning with R81.20 upgrade on Azure in Cloud Firewall

Firmware update warning with R81.20 upgrade on Azure

nmelay2 — Mon, 18 Nov 2024 13:58:14 GMT

Hi all,

I need to update a customer's Azure-hosted management and log servers from R81.10 to R81.20.
Following R81.20 documentation, I went the in-place upgrade path, as per sk177714.
(For some reason, the regular CPUSE upgrade packages do not show up on Azure VMs, and you need to use specific packages from this SK).
Everything looked fine but then Verify Update gave me a very confusing message:

Based on a system check, a firmware update may be necessary on one or more network cards to bring them up to date with the current Gaia network drivers. This update is a one-time process which could take several minutes, and is executed after Gaia OS upgrade is finished and has rebooted post-upgrade. After the firmware update is complete, the system will automatically reboot once more to apply the new firmware. Please do not reboot or shut the system down during this time.

The need for a firmware update on an Azure VM is rather unexpected.
However, I learned Azure VM do indeed run on hardware with Mellanox NICs, as do CP appliances, and part of the real NIC is actually exposed to the VM.
https://learn.microsoft.com/en-us/azure/virtual-network/accelerated-networking-how-it-works

Did you guys run into this?
Can we fearlessly go on with the upgrade in this situation?
I wouldn't want the upgrade process to fail trying to flash a new NIC firmware, and either just crash here or enter an endless reboot loop...

And before anyone asks, yes I'm also running this through TAC.
I'm just looking for insight from fellow admins with hands-on experience with this use case.

Re: Firmware update warning with R81.20 upgrade on Azure

Don_Paterson — Mon, 18 Nov 2024 14:09:22 GMT

I haven't seen it, but am curious to know if you considered deploying a new R81.20 SMS (followed by an import)?

You would get the latest R81.20 marketplace image/template.

It is just out of curiosity that I ask, with no knowledge of the specific deployment or requirements, including logging, which may be one reason why you want to do the in-place upgrade.

Regards,

Don

Re: Firmware update warning with R81.20 upgrade on Azure

nmelay2 — Mon, 18 Nov 2024 14:34:25 GMT

That's what we did for previous upgrades, but going through all of this seemed unnecessarily painfull.

Deploying a new SMS does come with the benefit of the new properly aligned disk layout though, so I'm still considering it.

Re: Firmware update warning with R81.20 upgrade on Azure

Don_Paterson — Mon, 18 Nov 2024 14:38:44 GMT

ACK
Too soon for R82 😉

Re: Firmware update warning with R81.20 upgrade on Azure

the_rock — Mon, 18 Nov 2024 14:45:44 GMT

Way too soon 🙂

Re: Firmware update warning with R81.20 upgrade on Azure

Don_Paterson — Mon, 18 Nov 2024 14:48:02 GMT

This time is different 😉

But seriously, with an EA that lasted nearly a year, it could be something to consider.

Obviously carefully considering all the factors!

Re: Firmware update warning with R81.20 upgrade on Azure

nmelay2 — Mon, 18 Nov 2024 15:00:34 GMT

I'm not sure why you're bringing R82 here.

AFAICT, Check Point has been really good with the quality of GA releases since R80.40, but I still wouldn't adopt it so soon without a very strong customer requirement to do so.

Re: Firmware update warning with R81.20 upgrade on Azure

the_rock — Mon, 18 Nov 2024 15:02:53 GMT

It probably wont be recommended until summer 2025...just my educated guess.

Andy

Re: Firmware update warning with R81.20 upgrade on Azure

Don_Paterson — Mon, 18 Nov 2024 18:29:55 GMT

Just in case it helps:

I see that someone else had this situation last year, but on physical appliances.

https://community.checkpoint.com/t5/Security-Gateways/Enterprise-appliance-upgrade-to-R81-20/m-p/190367#M35127

Re: Firmware update warning with R81.20 upgrade on Azure

JozkoMrkvicka — Mon, 18 Nov 2024 21:33:30 GMT

My wild guess is that very soon we will get first JHF for R82 and until CPX there will be JHF Take around 30 which will be consided as "stable" and thus R82 will be recommended during/after CPX 😉

R81.20 was released 21.11.2022 and marked as recommended 27.7.2023.

Re: Firmware update warning with R81.20 upgrade on Azure

the_rock — Mon, 18 Nov 2024 21:29:41 GMT

Lets see 😉

Andy

Re: Firmware update warning with R81.20 upgrade on Azure

nmelay2 — Tue, 19 Nov 2024 14:55:34 GMT

Yeah, on real hardware, this warning actually makes sense.
But on a VM running on hardware owned by Microsoft, there's no way Check Point will be able to flash its own firmware.
So it's going to tail, either smoothly or badly.

The lack of feedback here and from TAC seems to indicate not that many customers actually do in-place upgrades on Azure VMs... while it seems to be the currently recommended upgrade path.
I indeed did not know until recently this was even an option.

Re: Firmware update warning with R81.20 upgrade on Azure

the_rock — Tue, 19 Nov 2024 15:00:28 GMT

Keep in mind that up until one point in 2023, it was only possible to do in place upgrade on mgmt server in Azure, I believe, not gateways. Now, its possible on both, but I do agree with you, documentation about this could be better.

This is an official sk about it.

Andy

https://support.checkpoint.com/results/sk/sk177714

Re: Firmware update warning with R81.20 upgrade on Azure

Don_Paterson — Tue, 19 Nov 2024 15:08:45 GMT

It's about 10 years since vSec/CloudGuard became available in Azure and upgrading has only been supported in the last couple.

Destroy and redeploy was repeated over and over...

It gets interesting when you compare management pricing for on-prem vs public cloud vs MaaS Smart-1 Cloud.

Apart from Regulations (restrictions) and log retention requirements it is easy to see the attraction to cloud (and maybe Smart-1 Cloud specifically, for management).

With no Regulatory requirements and budget for extra log retention Smart-1 Cloud looks attractive.

Painful to say that because I am old school and like physical on-prem.

"The Cloud" makes things more difficult way too often.

Re: Firmware update warning with R81.20 upgrade on Azure

the_rock — Tue, 19 Nov 2024 15:04:44 GMT

I guess like anything in life, we have to adapt 🙂

Andy

Re: Firmware update warning with R81.20 upgrade on Azure

Don_Paterson — Tue, 19 Nov 2024 15:07:26 GMT

I also wonder about the number of SMS deployments in public cloud.

The 'Check Point Reference Architecture for Azure' SK does not actually state that the PAYG license is an SM25.

It does not seem to be documented anywhere.

I put some feedback in for the SK.

https://support.checkpoint.com/results/sk/sk109360

It seems like it would be documented if there were more enquiries and they needed to clarify in the SK.

Otherwise, we have to assume that there is a lot of BYOL or few deployments of SMS in Azure.

Re: Firmware update warning with R81.20 upgrade on Azure

nmelay2 — Tue, 19 Nov 2024 15:07:44 GMT

Andy...

This thread is specifically about upgrading mgmt and logs servers, and I mentionned sk177714 in the first two lines of my first post.
So, yeah, I'm keeping that in mind.

Re: Firmware update warning with R81.20 upgrade on Azure

the_rock — Tue, 19 Nov 2024 15:10:44 GMT

Fair enough. I used that same process few times and never had an issue. What did TAC say?

Re: Firmware update warning with R81.20 upgrade on Azure

Alex- — Tue, 19 Nov 2024 15:12:14 GMT

We got the notification our Smart-1 Cloud SMS is planned for upgrade in December.

We will then be able to test management with R82 Take 0 if no JHF comes in and gets Recommended in such a short timeframe, let's hope it will sail smoothly. 😀

Re: Firmware update warning with R81.20 upgrade on Azure

nmelay2 — Tue, 19 Nov 2024 15:17:13 GMT

Nothing so far, they're still asking for unrelated logs instead of answering my very simple "is this a known issue?" question.
But the case has only been running for 5 days, lol.
I'll keep you updated next month. 😉