topic Have a 3150 and 10G interfaces? DO NOT upgrade to 80.30 with the interfaces enabled! in Firewall and Security Management

Have a 3150 and 10G interfaces? DO NOT upgrade to 80.30 with the interfaces enabled!

Tommy_Forrest — Sun, 19 Jan 2020 22:41:43 GMT

In December we attempted an in-place upgrade on our 3150's from 80.10 to 80.30.

While we were not actually using our 10G interface, it was installed and enabled. And we were planning on migrating to it during that upgrade.

Unfortunately, after 80.30 rebooted the machine after the upgrade, the machine locked up solid. Not knowing what was going on, and running out of change window time, we reverted. Thank God for snapshots. In the meantime, we decide that a fresh install is our only upgrade path for the MDS boxes.

Fast forward to this weekend.

Spend 3 hours backing everything up and kick off a fresh install on our primary MDS. It comes up, we upgrade to Jumbo Hotfix 111 and then enable the 10Gig card. Good time to switch over, right?

Machine looks up HARD. No ethernet, no serial connection responses.

We revert to factory settings and try again. As soon as I click on OK to enable the interface, BAM! Machine locks up hard again.

We're (my SE hung out with me for the upgrade) hungry so we go get lunch and talk to TAC.

Turns out, there's a known issue with the 10G NIC drivers in 3150's. There's a hotfix for Jumbo HF 50. Or, it is resolved in ongoing take 135.

Really not wanting to be on an older hotfix, we elected to wait for 135 to go GA. We took 111 and will stay on copper for now.

It sure would be nice that if CheckPoint gets wind of issues like this, they write out a new ISO file to either disable the drivers so we're not lost with an unbootable box, or install proper drivers so, again, we're not left with an unbootable box.

Our 5150 SmartEvent and SmartLog boxes sailed through in-place upgrades to 80.30.

Re: Have a 3150 and 10G interfaces? DO NOT upgrade to 80.30 with the interfaces enabled!

Chris_Atkinson — Sun, 19 Jan 2020 23:29:59 GMT

Appreciate the PSA, note for others this is documented in sk153152.

"In some scenarios, the Smart-1 3150 appliance becomes unresponsive after enabling the optical interface."

Re: Have a 3150 and 10G interfaces? DO NOT upgrade to 80.30 with the interfaces enabled!

DCH — Fri, 25 Sep 2020 13:23:49 GMT

We have experienced this a few times. It seems that JHA Take 215 may have forgotten the drivers. Learned a while back on the Smart-1 3150's with these 10GE line cards to disable them, upgrade, install JHA Take 135, THEN enable these interfaces. Otherwise everything locks up - even the JAVA console in LOM. We recently had a hardware failure in a 3150 dedicated SmartEvent box. Decided to just do a clean install, R80.30 JHA Take 215 to align with the other management servers. Hard lock. Had to go back, perform the install, applied Take 135, then 215, and all was good.

The above SK has been removed, but this one is good sk146512.