topic Re: Upgrade Firmware in Firewall and Security Management

Upgrade Firmware

Nishanthan — Tue, 29 Apr 2025 07:25:04 GMT

After upgrading Check Point, the cleanup rule was moved to the top of the rulebase, which blocked access to the management portal. How can this issue be resolved?

Re: Upgrade Firmware

_Val_ — Tue, 29 Apr 2025 10:03:49 GMT

Please specify the sowftware versions, and some more details about your setup

Re: Upgrade Firmware

Nishanthan — Tue, 29 Apr 2025 10:09:08 GMT

The issue occurred after we upgraded from R81.10 to R81.20

Re: Upgrade Firmware

_Val_ — Tue, 29 Apr 2025 10:19:56 GMT

Still not enough information. Do you use on-prem management or Smart-1 cloud? Did you push policy after upgrade?

Re: Upgrade Firmware

Nishanthan — Tue, 29 Apr 2025 10:29:00 GMT

I tried to upgrade the on-premises device, but I couldn’t push the policy because the firewall upgrade disabled login access while upgrade.

Re: Upgrade Firmware

the_rock — Tue, 29 Apr 2025 11:31:42 GMT

In all my years dealing with CP, I personally had NEVER heard of something like that. If I were you, I would check the audit logs to be 100% sure that someone inadvertenaly did not make such a change.

Andy

Re: Upgrade Firmware

Lesley — Tue, 29 Apr 2025 11:42:39 GMT

I assume you mean it went back to the initial policy? This can be checked with the CLI command cpstat fw

It should show your normal policy name. It could happen that it is unable to fetch the policy during bootup. Did you changed the version in SmartConsole and did a publish? Did you enable MVC? What Check Point guide you followed for upgrade? clean install or inplace upgrade?

Search for errors like this during boot:

going to fetch policy from MGMT...

Fetching FW1 Security Policy From: <IP>

Installing Security Policy <policy name>

Failed to Load Security Policy

Failed to Load Security Policy: Module version as defined by FW object,

does not match actual version installed

Fetching Security Policy Failed

Failed to fetch policy from masters in masters file

Fetching Threat Prevention Security Policy From: <IP>

Threat Prevention Security Policy wasn't loaded

Fetching Threat Prevention policy failed

Re: Upgrade Firmware

the_rock — Tue, 29 Apr 2025 11:46:17 GMT

All super valid points @Lesley . Though this is what really surprised me what @Nishanthan said...

After upgrading Check Point, the cleanup rule was moved to the top of the rulebase...

Andy