topic Re: R80.20 install on Power-1 5070 in Firewall and Security Management

R80.20 install on Power-1 5070

Al_Marti — Thu, 27 Dec 2018 18:47:38 GMT

For various reasons we would like to get more life out of a pair of Power-1 5070 appliances and run R80.20 on them. Officially Checkpoint does not support R80.20 on the hardware which is understandable. But there is still a lot of life left the hardware and I would like to just run it as an open server hardware gateway cluster since it is really just x64 server hardware.

When booting from the R80.20 gateway fresh install ISO it recognizes that it is a 5070 and aborts the install as per the attached screen shot. I was hoping that some configuration in the BIOS was allowing the installation package to determine the hardware was a 5070, so I obtained the BOIS ROM password and booted into the BIOS. Unfortunately after scouring the BIOS I don't see anything that would refer to a 5070 or P-10-00.

Does anyone have any other ideas on how the installation package is identifying the hardware as a 5070?

I have taken apart the installation package and think I have found the file that triggers the installation abort condition:

./hwdiag/system/base/appliance_configuration.xml

and can just change the following:

<name>Power-1 5070</name>
</model>

<model manufacturer="CheckPoint" type="P-10-00" blocked="false">
<name>Power-1 5070</name>
</model>

and then just rebuild the installation package with mkisofs, but that is more of a hack rabbit hole than I want to go down.

Anyways if anyone else some ideas please let me know.

Thanks,

Re: R80.20 install on Power-1 5070

PhoneBoy — Thu, 27 Dec 2018 23:43:58 GMT

Theoretically, modifying the appliance_configuration.xml file AFTER the initial installation and before First Time Wizard runs should be enough to allow the installation to take place.

However, modifying this file to allow something to install that we otherwise block definitely puts you in unsupported territory.

While I'm not aware of any hardware incompatibility with the older Power-1 appliances, it's possible one exists.

Re: R80.20 install on Power-1 5070

Al_Marti — Thu, 27 Dec 2018 23:53:34 GMT

Thanks for the reply Dameon. I guess I was not clear. The issue is that the initial installation is aborted (see attached screenshot in original post), because of the detection of the hardware as 5070/P-10-00.

As far as support goes, yes fully realize that there would no support Checkpoint support for this installation if I am modifying installation files. That is why I would prefer a method that makes the initial installation think this is just open server hardware and not a 5070.

Re: R80.20 install on Power-1 5070

PhoneBoy — Fri, 28 Dec 2018 00:04:00 GMT

Didn't see it as you didn't include the screenshot inline

You're probably getting blocked at the Anaconda stage, which I'm pretty sure is not controlled by the XML file mentioned.

It's possible you can get R80.x on there by loading a supported version (R77.30) and upgrading via CPUSE, but I haven't tried it.

Re: R80.20 install on Power-1 5070

Danny — Fri, 28 Dec 2018 02:52:17 GMT

Only open servers listed on the HCL are supported. You won't get your old Check Point appliance on that list. As your screen shot says, contact Check Point support about this. Maybe you'll get a nice appliance trade-in offer, so I'd recommend to just ask Check Point first.

Re: R80.20 install on Power-1 5070

Al_Marti — Fri, 28 Dec 2018 03:40:58 GMT

Thanks for your suggestion Danny, but for our application, we can live without support. I am just looking for ideas on how to get past the identification of the hardware as a 5070. Just consider it a challenge.

Dameon provided some ideas that I may explore:

1) try to break out into a shell after the Anaconda installation abort message to see if I can find some logs/ideas on how Anaconda is identifying the hardware as 5070/P-10-00

2) try a R80.20 CPUSE upgrade from R77.30

But before trying those options, I am also thinking maybe the installation process is basically doing the equivalent of a dmidecode, which can be called from gaia and does have the ability to id the hardware as P-10-00 by probing the BIOS:

[Expert@rgfw-a:0]# dmidecode | grep Prod
Product Name: P-10-00
Product Name: Bridgeport

After researching dmidecode, It seems that it probes a piece of the BIOS called SMBIOS.   
I do seem to remember I saw a section in the BIOS that will allow me to manipulate SMBIOS.    
I will explore that path tomorrow, see where it leads and report back.

Re: R80.20 install on Power-1 5070

JozkoMrkvicka — Fri, 28 Dec 2018 10:18:30 GMT

There is no option for R80.x within Upgrade Wizard:

The same is valid for Upgrade option.

You should be able to install R77.30 and then try to upgrade to R80.x using CPUSE.

Re: R80.20 install on Power-1 5070

Al_Marti — Mon, 31 Dec 2018 18:06:00 GMT

The only SMBIOS tweak I found in the BIOS was just to disable SMBIOS. I tried that hoping that the initial installation dmidecode was using that to id the hardware as a 5070 but it had no effect and the installation aborted as per my attached screenshot in the original post.

Going the R77.30 to R80.20 CPUSE route, R77.30 CPUSE did give the option to either upgrade or clean install to R80.20. I chose the R80.20 clean install route which it seemed to complete, but the machine would not reboot after the installation. It just looped thru errors:

ACPI: Unable to load the System Description Tables
PCI: BIOS Bug: MCFG area at e0000000 is not E820-reserved
PCI: Not using MMCONFIG.
ÿata2.01: cmd c8/00:08:00:00:00/00:00:00:00:00/f0 tag 0 dma 4096 in
ata2.01: status: { DRDY }
ata2.01: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x2 frozen
ata2.01: cmd c8/00:08:00:00:00/00:00:00:00:00/f0 tag 0 dma 4096 in
ata2.01: status: { DRDY }
Buffer I/O error on device sda, logical block 0

So, my conclusion is that the 5070 appliance is truly not hardware compatible with R80.20 and so my quest ends.

Re: R80.20 install on Power-1 5070

tby1994 — Mon, 11 Nov 2019 04:54:25 GMT

I also have a 5070 but currently stuck and cannot boot.
Entering the BIOS would probably fix it.
Would you mind sharing the BIOS password?

Re: R80.20 install on Power-1 5070

Vitoched — Tue, 28 Jan 2020 16:28:24 GMT

Hi,

anyone have the Bios Password of Smart 1 5050 ?...

regards!!