topic Re: GATEWAY VSX - DOWNGRADE 81.10 > 80.10 in Firewall and Security Management

GATEWAY VSX - DOWNGRADE 81.10 > 80.10

FabioLima1 — Sat, 12 Aug 2023 15:01:09 GMT

Hey guys,
I need help from the community, I have a vsx gateway in version 81.10 and I returned a snapshot of version 80.10, I'm trying to install version 81.10 again but the message below appears:

[Expert@FW03:0]# vsx_util upgrade

******************************************************************************************
* Note: the operation you are about to perform changes the information in the management *
* database. Back up the database before continuing. *
******************************************************************************************

Enter Security Management Server/main Domain Management Server IP address (Hit 'ENTER' for 'localhost'): 10.10.10.1
Enter Administrator Name: admin
Enter Administrator Password:
Select VSX gateway/cluster object name:
1) FW01
2) FW02
3) FW03
Select: 1
You are about to change VSX version, please read sk97552.
Are you sure you want to continue [y/n]? y
Please select a version:
1) R81.10
Selected version: 1
VSX gateway/cluster is already the required version.
Logging details are available at /opt/CPmds-R81.10/customers/Firewall/CPsuite-R81.10/fw1/log/vsx_util_20230812_10_34.elg

In the manager it appears that this version is 80.10.

Re: GATEWAY VSX - DOWNGRADE 81.10 > 80.10

genisis__ — Sun, 13 Aug 2023 11:49:10 GMT

Reading the above, it looks like you restored an older snapshot to the VSX appliance, however the SMS/MDS still believes the version is R81.10 hence you are getting this issue.

I would suggest you need to do one of the following:

- Restore the correct version snapshot (if you have this).

- Rebuild the appliance as R81.10 and ensure all the GAIA level configurations are exactly the same and the run 'vsx_util reconfigure', this will convert the gateway into VSX and push down your VS configurations. If you have any custom configurations, then you need to ensure you put these back on after.

Think of this are a hardware failure and you now need to replace the node.

Re: GATEWAY VSX - DOWNGRADE 81.10 > 80.10

FabioLima1 — Sat, 12 Aug 2023 16:20:54 GMT

Do you think your creating another object in the mds like 80.10 would I be able to update?

Re: GATEWAY VSX - DOWNGRADE 81.10 > 80.10

genisis__ — Sun, 13 Aug 2023 11:51:04 GMT

I would not do that, as you could just things more complicated.

b.t.w if you are going to do a clean install, one thing to do is actually rebuild as R81.20 and then downgrade the appliance to R81.10 before converting to VSX.

This will resolve a filesystem issue which was fixed in R81.20.

Re: GATEWAY VSX - DOWNGRADE 81.10 > 80.10

_Val_ — Mon, 14 Aug 2023 06:30:59 GMT

Please open a TAC case for this: https://help.checkpoint.com

Re: GATEWAY VSX - DOWNGRADE 81.10 > 80.10

_Val_ — Mon, 14 Aug 2023 06:32:47 GMT

This is not what I read here. The management DB sees the object as R80.10, so the only logical conclusion is, he restored MGMT, not GW to an older version.

Re: GATEWAY VSX - DOWNGRADE 81.10 > 80.10

genisis__ — Mon, 14 Aug 2023 15:39:48 GMT

Fabio - Val has a good point here, can you please confirm if you reverted the Management Server to R80.10 or the VSX gateway?

Re: GATEWAY VSX - DOWNGRADE 81.10 > 80.10

emmap — Tue, 15 Aug 2023 07:10:13 GMT

You can do a 'vsx_util downgrade' to fix the mgmt DB, though at this point it may be safer to rebuild the gateways fresh to R81.10 and just 'vsx_util reconfigure' them.