topic Failed Security Gateway upgrade (from R77.30 to R80.40) in Firewall and Security Management

Failed Security Gateway upgrade (from R77.30 to R80.40)

pedrorezende87 — Thu, 10 Dec 2020 20:46:16 GMT

Hi all,

I am trying to upgrade two of my Security Gateways from R77.30 to R80.40, but I am facing a really strange issue.

Once I upgrade them via CDT (on the MDS) or CPUSE, I am no longer able to install the policies, and I've noticed that they are "converted" to Security Management.

I am using the package Check_Point_R80.40_T294_Fresh_Install_and_Upgrade.tgz, downloaded from Check Point. I have done other Security Gateway upgrades in paralel, and they have worked fine with the same package.

It is failing only for these two devices.

Has anyone seen it before? I am really clueless on how to proceed with these two. (I know I could do a Clean Install, but since those are remote devices, it would be a little bit complex).

Any help appreciated.

Thanks!

Regards,

Pedro

Re: Failed Security Gateway upgrade (from R77.30 to R80.40)

PhoneBoy — Thu, 10 Dec 2020 21:37:32 GMT

What precise errors show when you attempt to install policy?
Can you elaborate what you mean by “converted” to Security Management?

Re: Failed Security Gateway upgrade (from R77.30 to R80.40)

pedrorezende87 — Thu, 10 Dec 2020 22:10:41 GMT

Yes,

First thing, when I am upgrading via CDT, I get the following message: "Installation of package Check_Point_R80.40_T294_Fresh_Install_and_Upgrade.tgz on fwnlens2 failed! (Self test failed - One of the Check Point processes did not start as expected.FWD process is not in cpwd - The package is still installed)"

R80.40 is installed, however it is installed as a Security Management instead of Security Gateway.

This is what is looks like before I do the upgrade (even via CDT or manually via CPUSE). After it is upgraded, it changed to Check Point Security Management R80.40.

I cannot install the policies because the FWD process is not up. And if I try to bring this process up (by doing a FWSTOP/FWSTART) it tells me that it cannot do it because this is a Security Management server.

Thanks!

Re: Failed Security Gateway upgrade (from R77.30 to R80.40)

pedrorezende87 — Thu, 10 Dec 2020 22:51:41 GMT

I believe I've found the solution.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk167638&partition=Advanced&product=Security

Thanks!

Re: Failed Security Gateway upgrade (from R77.30 to R80.40)

PhoneBoy — Fri, 11 Dec 2020 01:19:43 GMT

That does seem to match what you've run into.