topic Re: Need a working Isomorphic for unattended imaging 200+ Appliances in General Topics

Need a working Isomorphic for unattended imaging 200+ Appliances

Zoltan_Bogdan — Tue, 13 Jul 2021 18:04:06 GMT

Dear All,

I was looking for an easy way to provide customized base installations for 200+ 6k appliances.

- 80.40 Fresh installation

- Apply basic configuration (MGMT,Admin password, some Base services like NTP/DNS etc.) and completing First Time Configuration Wizard utilizing a provided config_system script according to the respective gateways MAC address.

- Installing the provided Jumbo by previously updating the CPUSE Agent.

Unfortunately there's a bug/shortcoming interfering with installing the Jumbo isn't possible as anaconda thinks that there's not enough space as described in sk122014.

Has anyone managed to circumvent this by any means.

Where is that space actually missing? On the target HD? in Ramdisk?

Thanks in advance

Zoltan

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

PhoneBoy — Wed, 14 Jul 2021 00:39:52 GMT

From what the SK is suggesting, a "factory default" partition is created that includes the base OS + JHF.
It looks like that partition is too small.
I presume we would have to increase the size of that partition as created in ISOmorphic, which may require an RFE.

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Zoltan_Bogdan — Wed, 14 Jul 2021 09:57:35 GMT

Dear PhoneBoy,

thanks for your reply.

As this SK is from 2017 I doubt that Engineering is going fix this in the near future so I hoped for some creative ways to have this fixed on my own.

What I think is rather irritating is "some instances" in "This causes the process to fail in some instances."
If the issue is to come from is a too small partition the process starts to fail from a certain Jumbo as the amount of data tends to grow from take to take.

I'm taking a closer look at Blink now but I miss some features:

-pruning of the HD including the log Partition

- I see how to install and configure a single machine but not how to auto provision a mass rollout and apply individual config_system templates. I'm lacking something comparable to the possibility in isomorphic to tie template A to MAC address X and template B to MAC address Y or something the like.

Is there a comparison of ALL those tools (Isomorphic/Blink/Zero Touch/CDT/LSA) and which use cases they where meant for?

Thanks & kind regards

Zoltan

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

_Val_ — Wed, 14 Jul 2021 09:51:58 GMT

AFAIK, there is no Blink image for 6k series

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Zoltan_Bogdan — Wed, 14 Jul 2021 10:38:07 GMT

Not sure. Accoding to this, there's one for Quantum devices:

https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=114983

but according to this the Blink utility wouldn't work for them:

https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=58510

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

_Val_ — Wed, 14 Jul 2021 11:37:39 GMT

Blink is not supported on 6K, they have a special RAID. https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk120193 - 6K series are not listed.

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Zoltan_Bogdan — Wed, 14 Jul 2021 11:42:21 GMT

Ah, thanks for clarification; so I'm stuck with isomorphic anyway.

How long would a RFE take and how/where am I supposed to open it?

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Zoltan_Bogdan — Wed, 14 Jul 2021 12:22:00 GMT

looks rather trivial at first glance:

there is a file in the iso called appliance_configuration.xml where every single appliance starting from the Nokia/early Check Point IP appliances are described.

increasing the "lv_fcd" from 8192 to 16384 might do the trick.

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

PhoneBoy — Wed, 14 Jul 2021 14:34:36 GMT

Not sure that’s the right file to modify.
Maybe one of @Tsahi_Etziony ’s team can comment on this.

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Zoltan_Bogdan — Wed, 14 Jul 2021 17:02:51 GMT

Somethings seem to work because if I break the syntax (I've written 16.384 instead of 16384) no partitioning takes place an the anaconda partitioning tool throws an error.

Writing the ISO file anyway seems to loose some data because the written file is always way smaller than the original mounting/comparing those files shows quite some missing files.

I'd very much appreciate @Tsahi_Etziony to have a look at this.

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Dov_Fraivert — Sun, 18 Jul 2021 10:23:47 GMT

Hi @PhoneBoy @Zoltan_Bogdan @_Val_
We have blinks for 6K.
You can see details at the following link:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk139932&partition=Basic&product=Enterprise

Regarding isomorphic, from R81.10 we made a change so that Jumbo would be copied straight to the current partition and would not be saved in FCD partition.
This should solve the problem of the partition size.

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

genisis__ — Sun, 18 Jul 2021 11:23:27 GMT

I've had the same issue, and in fact raised a TAC case about this, suggesting to Checkpoint that this seems to be an issue in the build process ie not enough space allocated.

I've also had the same issue when mounting any ISO via LOM.

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

_Val_ — Mon, 19 Jul 2021 05:49:30 GMT

Good news. The main Blink SK should be adjusted then, @Dov_Fraivert

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Zoltan_Bogdan — Mon, 19 Jul 2021 08:30:37 GMT

Dear @Dov_Fraivert

<edit>

Great news, thanks for sharing, so I'take Blink into consideration again:

Concerning isomorphic sounds good, ~~but I encounter the issue anyway.~~

I missed the 81 in 81.10 - sorry. Is there some kind of backport possible?

</edit>

I'm using isomorphic build 187 to make 80.40 installations with the latest Jumbo (T118) alongside DA (Build 284) applied.

As the error anaconda throws during installation is exactly the one described in sk122014, the Fix somehow doesn't seem to work.

Any suggestions (take a sooner build/another image etc.)?

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Zoltan_Bogdan — Mon, 19 Jul 2021 08:06:35 GMT

Dear @genisis__ ,

"I've also had the same issue when mounting any ISO via LOM."

=> That's a little strange. That has always worked for me.

From when is your TAC case?

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

genisis__ — Mon, 19 Jul 2021 08:28:36 GMT

It would be great if Checkpoint implemented this fix on the ISO images so customers are not forced to just use blink images.

I take it, this should be a relatively easy thing to do?

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

genisis__ — Mon, 19 Jul 2021 08:31:42 GMT

I believe its another know issue. I should point out that I've not had this issue building R81 using the ISO image over iDRAC.

Now remember when going over iDRAC I'm just using the standard ISO image, no Jumbo's etc integrated.

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Dov_Fraivert — Mon, 19 Jul 2021 21:44:01 GMT

Yes, we will update the SK,

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Dov_Fraivert — Mon, 19 Jul 2021 21:53:08 GMT

Since the correction is only from R81.10. For R80.40, if there is a problem with size of the partition, the recommendation is to create isomorphic with iso only and install JHF after that.

@Zoltan_Bogdan I would be happy if you would send me privately more details about the installation you need to do. Maybe we can use other tools we have like Octo or Zero Touch.

Re: Need a working Isomorphic for unattended imaging 200+ Appliances

Zoltan_Bogdan — Wed, 11 Aug 2021 09:09:31 GMT

Maybe still the same root cause. I managed to work around the issue by unpacking the image, editing the respective appliances' patitioning defaults in /system/base/appliance_configuration.xml
<appliance_partitioning>
<layout min_disksize="434000M">
<volume name="lv_current">32768M</volume>
<volume name="lv_log">196608M</volume>
<volume name="lv_fcd">8192M</volume>
<volume name="hwdiag">1024M</volume>
<volume name="max_swap">32768M</volume>
</layout>

and of cause repacking the image again:

genisoimage -U -r -v -T -J -joliet-long -V "CP_R80.40_GAIA_3_10" -volset "CP_R80.40_GAIA_3_10" -A "CP_R80.40_GAIA_3_10" -b isolinux.bin -c boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table -no-emul-boot -o ../CP_R80.40_GAIA_3_10.iso .

Sticks with that image work flawlessly with jumbos