topic R80.10 upgrade from JHF 70 to JHF 91 failed in Firewall and Security Management

R80.10 upgrade from JHF 70 to JHF 91 failed

Jonathan_Horne — Wed, 11 Apr 2018 15:17:45 GMT

Restoring a CMA backup to R80.10 JHF 70 system. Import completes successfully, MDS and CMA/Domains are up and running. but when I go to try to update to JHF 91 via CPUSE install fails. It looks like there are some remnants of other Patches that get restored when MDS backup was restored. How do I remove these packages in order to move forward with upgrade to JHF 91

Status:

The package failed a pre-install validation at Tue Apr 10 20:04:36 2018
Reason of failure: The package is not compatible to install:
A fix conflict was detected during pre-install validation.
To prevent system instability, installation will not continue.
Please contact Check Point support with the following information:

Package: R80.10 Jumbo Hotfix Accumulator (Take 91)
conflicts with the following hotfixes:

R80_10_JHF_70_958
R80_10_JHF_70_IPONLY

For more information - see log files:
/opt/CPInstLog/CRSValidator_fw1_wrapper_R80_10_JUMBO_HF.log

Re: R80.10 upgrade from JHF 70 to JHF 91 failed

Alejandro_Mont1 — Wed, 11 Apr 2018 15:34:03 GMT

Your first sentence states you are restoring from a CMA backup, however from looking at the rest of your post it appears that you are restoring a full MDS backup, is that correct? Was the backup taken via the WebUI or CLI? When you restored, did you fresh install R80.10 or are you trying to do it on top of an existing configuration? When the backup was created, was the take of the jumbo on the source machine already on take 70? Did you have any other custom hotfixes installed? More info may be found in the opt/CPInstLog/CRSValidator_fw1_wrapper_R80_10_JUMBO_HF.log file.

Re: R80.10 upgrade from JHF 70 to JHF 91 failed

Jonathan_Horne — Wed, 11 Apr 2018 16:02:54 GMT

It is a MDS restore. Restored via CLI on top of fresh install of R80.10 w/ JHF 70 installed. Any recommendation on how to get these hotfixs or remove the remnants from the restored MDS? Why would that be carried over with MDS backup anyways?

These packages didn't show up until MDS was restored. Even though they don't appear when doing cpinfo -y all.

HOTFIX_R80_10_JHF_70_IPONLY

HOTFIX_R80_10_JHF_70_958

/opt/CPInstLog/CRSValidator_fw1_wrapper_R80_10_JUMBO_HF.log Errors

[10 Apr 18:27:37]
Checking for conflicts between new file: /var/log/CPda/metadata/CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_JUMBO_HF#91/tmp/crs/CheckPoint#fw1#All#6.0#4#8#HOTFIX_R80_10_JUMBO_HF/crs.xml
And existing inventory log: /opt/CPsuite-R80/conf/crs.xml
[10 Apr 18:27:37]
A fix conflict was detected during pre-install validation.
To prevent system instability, installation will not continue.
Please contact Check Point support with the following information:

HF 'Check R80_10_JUMBO_HF

[10 Apr 18:27:37]
A fix conflict was detected during pre-install validation.
To prevent system instability, installation will not continue.
Please contact Check Point support with the following information:

HF 'Check R80_10_JUMBO_HF

Conflicts with hotfix R80_10_JHF_70_958 - details:
CPM-1277

Conflicts with hotfix R80_10_JHF_70_IPONLY - details:
API-239

[10 Apr 19:57:58]
Checking for conflicts between new file: /var/log/CPda/metadata/CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_JUMBO_HF#91/tmp/crs/CheckPoint#fw1#All#6.0#4#8#HOTFIX_R80_10_JUMBO_HF/crs.xml
And existing inventory log: /opt/CPsuite-R80/conf/crs.xml
[10 Apr 19:57:58]
A fix conflict was detected during pre-install validation.
To prevent system instability, installation will not continue.
Please contact Check Point support with the following information:

HF 'Check R80_10_JUMBO_HF

[10 Apr 19:57:58]
A fix conflict was detected during pre-install validation.
To prevent system instability, installation will not continue.
Please contact Check Point support with the following information:

HF 'Check R80_10_JUMBO_HF

Conflicts with hotfix R80_10_JHF_70_958 - details:
CPM-1277

Conflicts with hotfix R80_10_JHF_70_IPONLY - details:
API-239

[10 Apr 20:04:31]
Checking for conflicts between new file: /var/log/tmp/bundle_tmpdir_CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_JUMBO_HF#91_4bnhf6/CheckPoint#fw1#All#6.0#4#8#HOTFIX_R80_10_JUMBO_HF/crs.x
ml
And existing inventory log: /opt/CPsuite-R80/conf/crs.xml
[10 Apr 20:04:31]
A fix conflict was detected during pre-install validation.
To prevent system instability, installation will not continue.
Please contact Check Point support with the following information:

HF 'Check R80_10_JUMBO_HF

[10 Apr 20:04:31]
A fix conflict was detected during pre-install validation.
To prevent system instability, installation will not continue.
Please contact Check Point support with the following information:

HF 'Check R80_10_JUMBO_HF

Conflicts with hotfix R80_10_JHF_70_958 - details:
CPM-1277

Conflicts with hotfix R80_10_JHF_70_IPONLY - details:
API-239

Re: R80.10 upgrade from JHF 70 to JHF 91 failed

Alejandro_Mont1 — Wed, 11 Apr 2018 16:25:07 GMT

It looks like you've done it all by the book-my only other idea is to make sure the CPUSE installer is updated. Other than that I've got nothing else, be checking in with TAC.

Re: R80.10 upgrade from JHF 70 to JHF 91 failed

Danny — Wed, 11 Apr 2018 17:35:55 GMT

I always prefer creating a Snapshot of the MDS appliance / VM host before doing such changes. This way I can revert easily wiithout any relics to the original status whenever needed.

Re: R80.10 upgrade from JHF 70 to JHF 91 failed

Kaspars_Zibarts — Wed, 11 Apr 2018 18:13:49 GMT

We had somewhat similar situation with JHF 91 just 2 days ago.

Actual CPUSE upgrade (MDS/HA + MLM) succeeded but synchronization stopped working complaining about different hotfix levels. Even though they were identical prior 91. But after upgrade some old HFs appeared on HA MDS (that were installed and then uninstalled long time ago)

Fix was this SK

Management HA fails to synchronize with "The Security Management Servers contain different Hotfixes" error

Not exactly your case but something fishy with old hotfixes turning up from dead.. looks like deployment agent history reading somehow has been "improved".

Would be good to know how to edit it manually

Re: R80.10 upgrade from JHF 70 to JHF 91 failed

Tomer_Sole — Thu, 12 Apr 2018 10:06:21 GMT

Hi, I would like to explain how to read this kind of error message.

When you were at Jumbo Hotfix Take 70, you received 2 private fixes from Check Point Support and installed them. These are their names:

R80_10_JHF_70_958
R80_10_JHF_70_IPONLY

During the upgrade to Jumbo Hotfix Take 91, the pre-upgrade mechanism noticed that these 2 private fixes were not yet integrated to the public availability of everyone, and in that case, it stopped and did not touch the configuration at all.

The reason why both fixes were not integrated with the newly released Jumbo Hotfix Take 91 was because that they were done after the content for Jumbo Hotfix Take 91 was closed. They might be available for everyone with the next Jumbo Hotfix that will be available but we cannot commit on that for sure at the moment.

I hope this helps understanding this kind of error message and not just for today's instance.