topic Re: Downgrade R80.30 to R80.10 in Firewall and Security Management

Downgrade R80.30 to R80.10

Sanjay_S — Fri, 03 Apr 2020 13:30:44 GMT

Hi Team,

We have a new firewall with R80.30 installed in it. What is the right approach to downgrade it to R80.10?

Regards,

Sanjay S

Re: Downgrade R80.30 to R80.10

HeikoAnkenbrand — Sat, 04 Apr 2020 05:58:04 GMT

Clean installation ISO Image of R80.10 via USB (ISOMorphic Toolsk65205) or DVD:

sk111841: Check Point R80.10

PS:

But I would upgrade the management to R80.30 or R80.40. Then you can also use R80.30 gateways.

Re: Downgrade R80.30 to R80.10

Maarten_Sjouw — Fri, 03 Apr 2020 17:15:06 GMT

Be aware that some newer appliances do not support an older version.

Re: Downgrade R80.30 to R80.10

Sanjay_S — Fri, 03 Apr 2020 17:36:59 GMT

So clean install with the USB or DVD is the only option. We cant try with CPUSE?

Re: Downgrade R80.30 to R80.10

Sanjay_S — Fri, 03 Apr 2020 17:38:17 GMT

This is 5600, does that mean new devices or certain models?

Re: Downgrade R80.30 to R80.10

HeikoAnkenbrand — Fri, 03 Apr 2020 17:53:34 GMT

👍

Supported models:

23800, 23500, 21800, 21700, 21600, 21400, 15600, 15400, 13800, 13500, 12600, 12400, 12200, 5900, 5800,

5600:-)

, 5400, 5200, 5100, 4800, 4600, 4400, 4200, 3200, 3100, 2200

Re: Downgrade R80.30 to R80.10

Maarten_Sjouw — Fri, 03 Apr 2020 21:00:04 GMT

CPUSE cannot be used in this case.
The latest models in the 3000 series and most in the 6000, 16000, 26000 series are not supported on R80.10 and some even not on R80.20.

Re: Downgrade R80.30 to R80.10

PhoneBoy — Sat, 04 Apr 2020 05:53:07 GMT

My question: why?

R80.30 is the widely recommended release for all customers and has many significant improvements over R80.10.
Even if your management is R80.10 or R80.20, you can manage R80.30 gateways with the appropriate jumbo hotfix.
That said, you'll get even more benefits by upgrading the management as well.

Really don't see a reason to go through the trouble of downgrading.

Re: Downgrade R80.30 to R80.10

Sanjay_S — Sat, 04 Apr 2020 07:05:19 GMT

Hi PhoneBoy,
Our Management server is running on R80.10 and we are not able to manage the firewalls with R80.20. We are not able to push the policy to the firewalls which are above R80.10. Do we need to raise it with TAC to get the appropriate JHF for this to work?

Re: Downgrade R80.30 to R80.10

PhoneBoy — Sat, 04 Apr 2020 07:28:00 GMT

You just need to apply the latest GA take from the Jumbo Hotfix from here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380
The ability to manage R80.20 and R80.30 gateways from R80.10 were added in various builds.

Is there a reason you are still on R80.10 on the management?
Like I said, R80.30 is the widely recommended release at this point and offers significant improvements over R80.10.

Re: Downgrade R80.30 to R80.10

Sanjay_S — Mon, 06 Apr 2020 07:44:50 GMT

Hi PhoneBoy thank you for providing me the JHF details.
We are still having R77.30 VSX cluster and few GWs in R77.30, we thought of getting it to R80.10 first and then upgrade MDS to R80.30.
However, now as you suggested we will install new GA JHF on MDS and try to install policy on R80.30 GWs and see how it works. Will keep you posted.
Thank you,
Sanjay

Re: Downgrade R80.30 to R80.10

Maarten_Sjouw — Mon, 06 Apr 2020 07:51:56 GMT

Sanjay, there realy is no reason to stick with R80.10 on the MDS, the MDS runs much smoother and leaner when you upgrade it to R80.30, first of all you get the 3.10 kernel and you also get (with the clean install) the new file system.
R77.30 gateways are no reason to stay behind, I still have around 80 gateways on R77.30 including many VSX in about 100 different CMA's and I am running R80.30 for 7 months now.

Re: Downgrade R80.30 to R80.10

Sanjay_S — Mon, 06 Apr 2020 10:26:55 GMT

Sure Maarten,
Will plan this as soon as we are done with the COVID-19 situation.

Re: Downgrade R80.30 to R80.10

Sanjay_S — Fri, 17 Apr 2020 12:43:25 GMT

Hi All,
We are planning to install R80.30 in a virtual machine as a MDS and then migrate all domains in the R80.10 MDS(Physical Box) to it. Is there any pre and post checks or any suggestions on how to proceed with this?

Re: Downgrade R80.30 to R80.10

PhoneBoy — Fri, 17 Apr 2020 22:18:34 GMT

That's precisely why you should perform the migrate export/import to a VM as practice before you do it for real...to ensure there are no issues.
Unless the VM has the same IPs as your existing MDM, you'll need to get evaluation licenses.
The migrate export process does require a cpstop on the management server, which should not impact traffic at all.
If there are any issues, they should be obvious when you do this.
Logs should be migrated separately, and you'll have to reindex old logs to have them show up once they are copied to the new server.

Re: Downgrade R80.30 to R80.10

Sanjay_S — Mon, 20 Apr 2020 10:46:26 GMT

Thanks PhoneBoy,
Does Migrate Export/Import works for different versions?
For Example we will export it from MDS R80.10 and Import it on R80.30?

Re: Downgrade R80.30 to R80.10

PhoneBoy — Mon, 20 Apr 2020 18:51:17 GMT

You have to use the R80.30 version of the migration tools on your R80.10 MDM, but yes.
This is the standard process for an "Advanced" upgrade.

Re: Downgrade R80.30 to R80.10

Sanjay_S — Tue, 21 Apr 2020 08:35:55 GMT

Thank you.
Just one more thing any limitations if we install MDS on Virtual Machine?

Re: Downgrade R80.30 to R80.10

PhoneBoy — Tue, 21 Apr 2020 15:23:12 GMT

Provided you allocate the VM the appropriate resources, not really.