topic Re: CPUSE issue in Firewall and Security Management

CPUSE issue

the_rock — Tue, 02 Jun 2020 20:45:11 GMT

Hey guys,

Maybe someone encountered this problem before. So, to make a long story short, I have a customer that wants to upgrade 2 separate CP firewalls and mgmt server from R77.30 to R80.40. All is well with mgmt and one firewalls, but the other one (open server as well), is on really old cpuse code (743 I believe) and in clish, there is NO option to do installer import option at all to import new cpuse 1889 package and I dont see anywhere in the sk the way to do it via rpm file (which was there before...I looked through the whole sk).

Anyone has an idea how to do this? Would below be an option for this?

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111158&partition=Advanced&product=Security#Known%20Limitations

Thanks in advance!

Andy

Re: CPUSE issue

shlomip — Tue, 02 Jun 2020 21:15:26 GMT

Hi @the_rock ,

See sk92449

(3-B) How to manually install the CPUSE Agent package

Procedure:

Transfer the CPUSE Agent package (DeploymentAgent_<build>.tgz) to the machine (into some directory - e.g., /some_path_to_CPUSE/).
Run: Clish> installer agent install <package_name>

Re: CPUSE issue

the_rock — Tue, 02 Jun 2020 21:43:43 GMT

Thanks Shlomi. We tried that first, but option is not there for command installer agent, as its really old cpuse build.

Andy

Re: CPUSE issue

JozkoMrkvicka — Wed, 03 Jun 2020 05:01:24 GMT

The procedure how to upgrade CPUSE agent was totally replaced by the new one, while the old instructions were deleted.

In mentioned SK there were imstructions for older versions how to install it manually. Now, there is even no notice that it was replaced/removed/deleted...

You have to search google...

the "old" procedure was as follows:

Procedure:

Transfer the CPUSE Agent package (DeploymentAgent_<build>.tgz) to the machine (into some directory – e.g., /some_path_to_CPUSE/).
Unpack the CPUSE Agent package:
[Expert@HostName:0]# cd /some_path_to_CPUSE/
[Expert@HostName:0]# tar -zxvf DeploymentAgent_<build>.tgz
Install the CPUSE Agent RPM:
[Expert@HostName:0]# rpm -Uhv –force CPda-00-00.i386.rpm

Notes:
- During the installation, you will see the « Waiting for DAService to stop… » message.
  The preinstall script tries 60 times to stop the DAService executable (by issuing the « dbget installer:stop » command).
  If the script does not succeed to stop the DAService, then it kills it and the installation continues.
- Related solution: sk119954 – « error: Failed dependencies » during manual installation of CPUSE Agent package
[Optional] Restart all Clish daemons and ConfD daemon:
To improve CPUSE Agent, new CPUSE commands are added to Clish from time to time.
It is necessary to restart all Clish daemons for new CPUSE Clish commands to become available, and to restart ConfD daemon.
1. If your default shell is CLISH (/etc/cli.sh), then log in to Expert mode.
  If your default shell is BASH (/bin/bash), then log out from all Clish sessions.
2. Kill all running Clish daemons (they will be restarted automatically):
  [Expert@HostName:0]# killall -v clish clishd
  
  Important Note: If your default shell is CLISH (/etc/cli.sh), then after issuing this command, you will be disconnected / logged out from all active sessions.
3. Restart the ConfD daemon:
  1. [Expert@HostName:0]# tellpm process:confd
  2. [Expert@HostName:0]# tellpm process:confd t
  Maintenance window is required:
  - When confd daemon is starting, by design, it restarts any currently running routed daemons (by sending a TERM signal). It is done to avoid possible issues in Gaia Clish (e.g., returning invalid results for routing-related commands like « show route« ).
  - Since routed daemon is responsible for all the routing in Gaia OS, short traffic outage will occur while routed daemon is being restarted.
  - Since routed daemon is a Critical Device in Check Point cluster (since R76), cluster fail-over might occur while routed daemon is being restarted (refer to sk92878).
Start the CPUSE Agent manually: [Expert@HostName:0]# $DADIR/bin/dastart

Re: CPUSE issue

G_W_Albrecht — Wed, 03 Jun 2020 07:22:32 GMT

If you want to save yourself the typing, you can use a script i published here: CPUSE Deployment Agent install script

Re: CPUSE issue

the_rock — Wed, 03 Jun 2020 12:56:32 GMT

Thanks to everyone who responded, appreciated! I actually also reached out to a good friend who works for CP escalations and he sent me the rpm procedure, so customer will give that a go today and let me know if it works. If any issues, I will give script a go.

Thanks again!

Andy

Re: CPUSE issue

Geo_Mal — Thu, 08 Oct 2020 08:17:53 GMT

Can you please add a 2nd dash to: -force.

It took me sometime to figure why the command wasn't working, it requires --force.

I also accidentally came across sk169220.

Re: CPUSE issue

Alexander_Grois — Thu, 26 Aug 2021 18:08:01 GMT

Please update

the commnad is :

rpm -Uhv -–force CPda-00-00.i386.rpm