topic Re: Security Gateway kernel upgrade in Firewall and Security Management

Security Gateway kernel upgrade

vsurresh — Wed, 21 Jul 2021 09:09:15 GMT

Hello.

Let me preface by saying that I'm a novice at best when it comes to Check Point. I'm looking to get some help with upgrading the kernel on the SGs.

I'm planning to implement management plane separation on a pair of 5800s following this guide https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk138672

As per the guide, one of the requirement is to be on kernel , 3.10 R80.30 Jumbo Hotfix Take 136 or higher. However, the SGs are currently on R80.30 kernel version 2.6.18. How do I also check which Jumbo Hotfix the SGs are on?

Could somebody please point me in the right direction on how to do upgrade the kernel and and install the hotfix? The management servers are already on 3.10. The output of 'show version all' shown below:

Product version Check Point Gaia R80.30 OS build 200 OS kernel version 2.6.18-92cpx86_64 OS edition 64-bit

Thanks in advance.

Re: Security Gateway kernel upgrade

_Val_ — Wed, 21 Jul 2021 09:50:02 GMT

You need to install your GWs with R80.40 or higher. If your MGMT is on R80.30, it has to be upgraded first.

Also, clear install and not upgrade im place is the recommended way to benefit from the new XFS capabilities. if you do upgrade in place, it remains EXT

Re: Security Gateway kernel upgrade

vsurresh — Wed, 21 Jul 2021 12:22:45 GMT

Thanks for the response. Do you mean that I can't have kernel 3.10 with R80.30? Can I not have 3.10 with R80.30?

Re: Security Gateway kernel upgrade

_Val_ — Wed, 21 Jul 2021 12:25:00 GMT

You can, on Management and on some very limited amount of new models, but no on all GWs. You also cannot change the kernel in any way on any of R80.30 installations, from one to another.

Re: Security Gateway kernel upgrade

RamGuy239 — Wed, 21 Jul 2021 13:52:37 GMT

The information regarding R80.30 with 3.10 kernel can be located here:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk152652&partition=Basic&product=Quantum

Management installations moved to 3.10 kernel with R80.20. Gateway installations did not until R80.40. But because some new series of Check Point appliances and open servers have newer series of CPU's they required 3.10 kernel in order to function correctly. Thus Check Point released some limited versions of R80.20 and R80.30 for gateways with 3.10 kernel.

These were never meant for broad adoptions. They were only meant for a small subset of the hardware that required the 3.10 kernel and every since R80.40 went GA the recommended approach for gateway installations that do not support the use of 2.6 kernel is to go straight to R80.40+.

You should aim for an upgrade to R80.40, R81 or R81.10 instead of looking at an R80.30 with 3.10 kernel re-installation. When doing an upgrade from R80.30 with 2.6 kernel to R80.40/R81/R81.10 with 3.10 kernel the transition will be seamless. You can do a direct upgrade and you will move from 2.6 kernel to 3.10 seamlessly.

Before doing any upgrades you should remember that your management server needs to be upgraded beforehand so it can manage your gateways running on newer versions.

Re: Security Gateway kernel upgrade

RamGuy239 — Wed, 21 Jul 2021 13:57:02 GMT

One thing to remember is that 3.10 kernel also introduce the use of XFS filesystem as opposed to ext3. The only way for you to get the new filesystem is by doing a re-installation from USB/ISO. XFS is not all that important for gateways, but it's still preferable to do a complete re-installation to R80.40/R81/R81.10 so you get it if possible. Make a copy of your GAiA configuration and migrate it to a fresh installation.

For your management doing a re-installation aka an "advanced upgrade" whereby you export the configuration and database from your current management where you move it to a freshly installed R80.40/R81/R81.10 is recommended. A management installation puts much higher loads (IOPS/read/write) on your disk so getting the XFS filesystem is the recommended approach.

Re: Security Gateway kernel upgrade

vsurresh — Sat, 24 Jul 2021 17:32:40 GMT

Thanks for response. It started to make sense. I will aim to perform a fresh installation of R80.40.

Cheers