topic Re: Kindly need information on upgrading 4800 from R77.30. to R80.10 using cpuse in Firewall and Security Management

Kindly need information on upgrading 4800 from R77.30. to R80.10 using cpuse

srihari_ml — Mon, 16 Sep 2024 06:27:03 GMT

We are currently utilizing the 4800 (4GB) as an independent gateway for a mobile access blade. Our objective is to upgrade the gateway from version r77.30 to 80.10 through CPUSE in order to address the findings from Bitsight. Please advise if a fresh installation is the sole option available, as upgrading the RAM and replacing the device are not feasible due to budget constraints.

Re: Kindly need information on upgrading 4800 from R77.30. to R80.10 using cpuse

_Val_ — Mon, 16 Sep 2024 06:39:06 GMT

Please be advised, R80.10 is very old and EOL ages ago.

All documentation and upgrade packages, including CPUSE upgrade package for R77.XX, are available in sk111841

Re: Kindly need information on upgrading 4800 from R77.30. to R80.10 using cpuse

PhoneBoy — Mon, 16 Sep 2024 15:06:35 GMT

Is this a Standalone (i.e. no external management) 4800?
Unfortunately, according to the release notes, R80.10 will not run in a Standalone configuration with under 8GB of RAM: https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_ReleaseNotes/html_frameset.htm

Also, am curious what specific findings you're referring to from Bitsight.
If it is related to CVE-2024-24919, we have patches for R77.30 here: https://support.checkpoint.com/results/sk/sk182336
If you weren't aware of this CVE previously, it is highly recommended to patch for this issue and follow the remediation steps in the SK.

Re: Kindly need information on upgrading 4800 from R77.30. to R80.10 using cpuse

srihari_ml — Mon, 23 Sep 2024 09:34:39 GMT

These are bitsight findings for the device:

Website Does Not Implement HSTS Best Practices

Website does not implement X-Content-Type-Options Best Practices

We are only using it as standalone Mobile access blade and no VPN and Threat detection were configured on the device.

Re: Kindly need information on upgrading 4800 from R77.30. to R80.10 using cpuse

PhoneBoy — Mon, 23 Sep 2024 18:33:55 GMT

Since you have Mobile Access Blade enabled, you are vulnerable to CVE-2024-24919 unless you apply the relevant patch or upgrade to a version where the issue is fixed.
Please refer to the following section of sk182336:

I believe you can fix the issues Bitsight identified without an upgrade: https://support.checkpoint.com/results/sk/sk138813

Re: Kindly need information on upgrading 4800 from R77.30. to R80.10 using cpuse

srihari_ml — Wed, 25 Sep 2024 06:46:03 GMT

Dear @_Val_ ,

I am doing an upgrade test using Check_Point_R80.10_T479_Fresh_Install_and_Upgrade_from_R7X.tgz, but the import of this package does not finish even after waiting for more than 2 hours.(Errors that were displayed with other packages so far do not occur.)Even if I close the session and reopen the GUI, it appears that the import is not completed. Please find the screenshot and suggest.

Thanks and regards.

Re: Kindly need information on upgrading 4800 from R77.30. to R80.10 using cpuse

PhoneBoy — Wed, 25 Sep 2024 17:16:31 GMT

You need to update to the latest Deployment Agent before doing any upgrades: https://support.checkpoint.com/results/sk/sk92449
Even so, unless your Standalone 4800 has at least 8GB of RAM, you will not be able to run R8x releases.

Re: Kindly need information on upgrading 4800 from R77.30. to R80.10 using cpuse

emmap — Thu, 26 Sep 2024 01:45:13 GMT

From the screenshot the Deployment Agent has already been updated, but to the wrong one. It should not be the latest version (which it seems to be) but the older one in the article listed for versions R80.30 and older.