topic Re: R81.20 jumbo 90 in Firewall and Security Management

R81.20 jumbo 90

the_rock — Tue, 12 Nov 2024 16:06:00 GMT

I installed it in my lab today, no issues so far, but will give it 24 hours. I do see lots of fixes listed in the official doc.

Andy

https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/R81.20/Take_90.htm?tocpath=_____6

Re: R81.20 jumbo 90

PhoneBoy — Tue, 12 Nov 2024 20:38:04 GMT

Looks like we have a fix for Blast RADIUS now 🙂
https://support.checkpoint.com/results/sk/sk182516

Re: R81.20 jumbo 90

the_rock — Tue, 12 Nov 2024 20:39:41 GMT

I think that was included in jumbo 89?

Re: R81.20 jumbo 90

PhoneBoy — Tue, 12 Nov 2024 20:55:42 GMT

In JHF 89, we only had fixes for Gaia OS itself, not the other components.

Re: R81.20 jumbo 90

the_rock — Tue, 12 Nov 2024 22:38:54 GMT

Got it.

Re: R81.20 jumbo 90

JozkoMrkvicka — Tue, 12 Nov 2024 23:15:39 GMT

Yeah, you see just fixes which Check Point mentioned in release notes. There might be many many more fixes which were just not mentioned for whatever reason, but are included in T90 🙂

Back to the topic, will have a look on each issue to be declared as fixed in T90. At least going to test Blast RADIUS fix.

Re: R81.20 jumbo 90

Thomas_Eichelbu — Thu, 21 Nov 2024 14:10:20 GMT

Hello Folks,

i installed HFA 90 yesterday to get rid of this nasty

[16 Nov 16:34:47][fw4_5];[vs_0];[10.X.X.X:52745 -> 1.1.1.1:53] [ERROR]: cmik_loader_fw_context_match_cb: match_cb for CMI APP 31 - DNS_DATA_SOURCE failed on context 201, executing context 366 and adding the app to apps in exception

messages!
after installing HFA90 they are gone! Great success!

But i had a weird issue,
i was installing this HFA90 via CPUSE on a remote GW (Cluster XL R81.20 HFA84) over VPN.
The Installation just started into a few % of progress and suddenly my access to this member stopped.
no SSH, no Ping, etc. not reachable over VPN anymore.
but i was able to reach the affected member over the Sync Interface of the active member.
HFA90 was installed successfully no issues after reboot.
The same issue happened on the the remaining cluster member as well.

did anybody noticed that before? Thats weird, because normally you stay connected on the installing member until its final reboot.

Re: R81.20 jumbo 90

the_rock — Thu, 21 Nov 2024 14:41:57 GMT

I updated my lab actually over VPN as well, did not have such an issue. Though I was on jumbo 89, but not sure if that would make any difference.

Andy

Re: R81.20 jumbo 90

Thomas_Eichelbu — Thu, 21 Nov 2024 14:54:31 GMT

yes maybe its highly customer depending, or a solar flare just hit the earth, who knows 🙂

Re: R81.20 jumbo 90

the_rock — Thu, 21 Nov 2024 14:56:55 GMT

@Thomas_Eichelbu haha, maybe 🤣🤣

Re: R81.20 jumbo 90

JozkoMrkvicka — Thu, 21 Nov 2024 16:56:15 GMT

At some point of jumbo update, the installer stops cp services. It might be that the connection was cut during cpstop.

Always connect over serial connection or LOM 😉

Re: R81.20 jumbo 90

Lesley — Thu, 21 Nov 2024 19:18:33 GMT

I had same issues. 2 vsx gateways all good. Other units jumbo update at 14% stopped showing progress and unit was not reachable. I saw layer 2 connection so it was still alive. Update took around 20-25 minutes each unit. At one point I saw that arp entry was gone and I knew it was rebooting. It is not normal behavior but to be honest there was no impact or any issues during this. But I could imagine that a first timer would break a sweat maybe 😄

Re: R81.20 jumbo 90

genisis__ — Thu, 21 Nov 2024 21:31:24 GMT

One thing to meantion - this fix is included in Take_106 for R81, however Take_106 also has an issue related to failover (I get R81 is EoL, but I think Checkpoint should fix this final Jumbo release, rather leave it in a broken state, and yes TAC case raise).
I totally understand that it would be more best effort, but come on, why issue a jumbo with a known issue and then just leave it.

Re: R81.20 jumbo 90

Lesley — Thu, 21 Nov 2024 22:27:24 GMT

Just my 2 cents. If you release a new jumbo that will fix your issue it could be it introduces new issues for different customers. At one point it has to end. In this case a portfix based on best effort would make more sense to me.

Re: R81.20 jumbo 90

Duane_Toler — Thu, 21 Nov 2024 22:46:30 GMT

Yeah agreed. I've had mixed results and had the same effect described in this thread. Usually, tho, when that happens, I'm able to re-connect to the host via SSH directly to the public external IP. My policies on customer gateways allow me to have that access from an external management host, tho (for this reason).

Re: R81.20 jumbo 90

the_rock — Thu, 21 Nov 2024 22:50:50 GMT

Personally, and I say the same to all my colleagues, when we do any sort of upgrade for the customers, we always ask them to have someone on site if possible, because better be safe than sorry. It could be that 1 time out of 100 when issue happens and no one is there when you need them.

Andy

Re: R81.20 jumbo 90

Axel_Winterberg — Tue, 03 Dec 2024 18:40:23 GMT

Hi Thomas,

just updated a cluster with JHF T90, today. Same issue. After a few % of installing I had to reconnect.

Noticed it on both cluster member.

Re: R81.20 jumbo 90

the_rock — Wed, 04 Dec 2024 01:26:45 GMT

Did you open TAC case about it?

Andy

Re: R81.20 jumbo 90

Thomas_Eichelbu — Wed, 04 Dec 2024 09:54:22 GMT

Hello,

well no, no TAC case for this topic ... i am currently overloaded with cases and must prioritize on the most important problems ...
today i install HFA90 again on a single gateway again, lets see how it turnes out.

Re: R81.20 jumbo 90

Axel_Winterberg — Thu, 05 Dec 2024 07:14:39 GMT

No, Not for this issue. But after installing the JHF T90, we can only connect via local Admin to Smart Console.

SSH and https to the management server are working fine with RADIUS authentication.

But Login with Smart Console over RADIUS stops working. Opened a TAC case SR#6-0004135071

Log of RADIUS shows successfull Login, but we get error message "authentication to server failed"

In Audit Log we see, that the login is denied with "Wrong Password" !!!