topic Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20 in General Topics

Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 07:28:52 GMT

hi chaps, quick one as always from me. here is the scenario:

1. customer is having still under support R81.20 SG5800 running R81.20 take 631

2. Check_Point_R81_20_JUMBO_HF_MAIN_Bundle_T65_FULL.tgz

- this take cannot be installed as it is called by the installer (CPUSE) that this appliance is incompatible with that take - any clues what a heck? I've tried my lab 5800 - same stuff - no way to install this take due to some storage shortage?

# pvs
PV VG Fmt Attr PSize PFree
/dev/sda3 vg_splat lvm2 a-- 449.97g 236.97g

3. Check_Point_R81_20_JUMBO_HF_MAIN_Bundle_T70_FULL.tgz

- this take is downloaded and verified as fine then installation takes 15 mins and then - nothnig, back to sq. 1

- impossible to install as well as the previous one, any clues chaps?

*** will provide any output you wish, just let me know your thoughts should you have any (or experienced the same latelly).

Cheers!

ps. additional info's reg. validation processes:

R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 65
Package is available for installation (1 warnings)
● It was found that a hotfix (HF) preventing internal users from connecting to the Remote-Access VPN has been installed. Note that the behavior of the new Jumbo HF has changed: Remote Access VPN for local accounts authenticated only with Check Point password created in R80.20 or earlier, and not updated after R80.30 will be blocked until they reset their password.

R81.20 Jumbo Hotfix Accumulator Take 70
Package is available for installation (1 warnings)
● It was found that a hotfix (HF) preventing internal users from connecting to the Remote-Access VPN has been installed. Note that the behavior of the new Jumbo HF has changed: Remote Access VPN for local accounts authenticated only with Check Point password created in R80.20 or earlier, and not updated after R80.30 will be blocked until they reset their password.

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

MatanYanay — Thu, 18 Jul 2024 07:30:04 GMT

Hi @Jerry

Please note that R81.20 Jumbo above and including Take 65 can be installed only on top of R81.20 Take 634 ( due to the VPN CVE issue )

Thanks

Matan.

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 07:38:45 GMT

Thanks Matan, so if that product is running R81.20 take 631, how do we get onto the "634" if any take currently available for that setup cannot be installed? any hints? any custom hotfix in order to get "634"?

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Alex- — Thu, 18 Jul 2024 07:51:48 GMT

You will certainly need to format the system.

From https://support.checkpoint.com/results/sk/sk173903:

If you use Bootable USB device, see instructions:

Effective June 3, 2024, the R81.20 Gaia images have been replaced with Take 634.
By installing the new image, you automatically install Preventative Hotfix for CVE-2024-24919 (see sk182336).

Edit: You could maybe download the Blink and upgrade in place with the same version to change the baseline.

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 07:52:37 GMT

so that means folks that the "634" is only for "brand new installations" therefore Take 65 and 70 are also only for BRAND NEW installations utilizing "634". So as long as the appliance runs R81.20 take 631 there would be NO WAY to install either Take 65 or 70 - am I thinking that right?

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

MatanYanay — Thu, 18 Jul 2024 07:55:29 GMT

@Jerry you are correct and it applies to any future jumbo we will release...

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Alex- — Thu, 18 Jul 2024 07:57:17 GMT

It seems to. Although I checked one my appliances still in R81.10 and the Blink with Take 65 refers to the 631 baseline.

Display name: R81.20 Security Gateway + JHF T65 for Appliances and Open Servers
File name: Blink_image_1.1_Check_Point_R81.20_T631_JHF_T65_SecurityGateway.tgz
Description: Blink Image for R81.20 Take 631 including Take 65 of R81.20 Jumbo Hotfix Accumulator - Security Gateway only
Size: 7.949 GB
Type: Blink Version
Status: Downloaded

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 08:05:42 GMT

ok. cheers

so does it mean that any applice or VM gaia R81.20 running 631 already, won't be able to bump up to the 634 without a full reinstall of the entire device from USB image? am I correct though?

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 08:07:18 GMT

yup, have had the same but that is the case with R81.10 already running.

I do have anothe vsx on 15000 series which runs just now take 70 on

Deployment Agent build: 2432 | R81.20 take 631

and all works fab!

so seems this is something what CP did not explain well on the latest CPX 😄

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

MatanYanay — Thu, 18 Jul 2024 12:49:55 GMT

@Jerry and all

I'm deeply sorry I was confused with the scenario 😞

The scenario which I referred to was if you have R81.20 take 634 you can't install any jumbo below take 65 in order not to lose the CVE-2024-24919

The Jumbos can be installed on top R81.20 take 631

please open TAC case on it so they will investigate your issue

Thanks

and sorry again about the confusion

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 13:24:54 GMT

Thanks a lot for the clarification, indeed it is all about installing TAKES on the top of the R81.20 631 running already Take 54. No other (higher) takes can be installed hence my post.

I would have opened the SR with the TAC if I could believe it can be sorted out otherwise R&D will keep that case as the least important and in about 1 month one email will end up in my inbox asking for the Remote Session. I was there, I'm with CP since 1999 abd believe I just don't think this can be sorted as quickly as my customer expect. Neverthanless I'd like someone to look at this so I'm happy to provide cpinfo if needed and do the remote session if required.

ps. that CP5800 is a standalone installation (meaning that FWM is also running on it) but runs perfectly fine. Just no new takes cane be installed hence I don't believe anyone would have assume it is critical, indeed it isn't but would be great to know why and if those new TAKES could be installed normally (tried cpuse webUI, cpuse clish, bash tgz - same result or rather no result).

Cheers

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Max_Frankl — Thu, 18 Jul 2024 14:00:18 GMT

Hi Jerry,

Using DA 2432
The Flow is 5800 as a Stand Alone with 81.20 take 631 -> upgrade to JHF T65/70? No JHF or hotfix already installed on the machine?

The warnings you added in your original post, only appear if someone has the original hotfix for the VPN CVE installed on their machine. The warning appears because the initial fix was changed in the jumbo so the DDR gives the user a heads-up saying this behavior is now changed.

@Below

R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 65
Package is available for installation (1 warnings)
● It was found that a hotfix (HF) preventing internal users from connecting to the Remote-Access VPN has been installed. Note that the behavior of the new Jumbo HF has changed: Remote Access VPN for local accounts authenticated only with Check Point password created in R80.20 or earlier, and not updated after R80.30 will be blocked until they reset their password.

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

the_rock — Thu, 18 Jul 2024 14:22:26 GMT

Broooooo, nice to see you here again 🙂

Glad you had not been STROPPY with me lately 😉

Anywho, sorry, did not read the whole thing, but did you try installer install from clish?

Andy

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 14:39:22 GMT

R81.20 631 running already Take 54 and DA 2432.

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 14:40:05 GMT

hey maaaatey yes I did, still the same 🙂 read above pls.

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

the_rock — Thu, 18 Jul 2024 14:47:40 GMT

Hm, I dont see why it would not work, unless something is not compatible...I dont have physical box to test, sorry m8 😞

This is what I see in my lab though, same in R82 as well.

Andy

[Expert@CP-GW:0]# da_cli da_status
{
"Action ID" : "0",
"DABuildNumber" : "2432",
"DAService State" : "ready",
"Installation in Progress" : false,
"Last Update Time" : "Thu Jul 18 09:59:27 2024",
"New DA Availability" : "up to date",
"Update Status" : "Finalizing"
}

[Expert@CP-GW:0]#

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Max_Frankl — Thu, 18 Jul 2024 14:57:07 GMT

Please send here cpinfo -y all

Also please share what you see in this file
/opt/CPInstLog/CRs_conflict_summary.txt

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 15:00:34 GMT

This is Check Point CPinfo Build 914000239 for GAIA
[MGMT]
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
[IDA]
No hotfixes..
[CPFC]
No hotfixes..
[FW1]
HOTFIX_R81_20_JHF_T53_BLOCK_PORTAL_MAIN Take: 2
HOTFIX_R81_20_JHF_T53_BLOCK_INT_MAIN
HOTFIX_GOT_MGMT_AUTOUPDATE
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
HOTFIX_VCE_R81_20_AUTOUPDATE
HOTFIX_NGM_DOCTOR_AUTOUPDATE
HOTFIX_WEBCONSOLE_AUTOUPDATE
HOTFIX_GOT_TPCONF_MGMT_AUTOUPDATE
HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE
HOTFIX_GOT_TPCONF_AUTOUPDATE

FW1 build number:
This is Check Point Security Management Server R81.20 - Build 011
This is Check Point's software version R81.20 - Build 025
kernel: R81.20 - Build 033
[SecurePlatform]
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
HOTFIX_ENDER_V17_AUTOUPDATE
[CPinfo]
No hotfixes..
[PPACK]
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
[AutoUpdater]
HOTFIX_INFRA_CONFIG_AUTOUPDATE
[DIAG]
No hotfixes..
[CVPN]
HOTFIX_ESOD_CSHELL_AUTOUPDATE
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
[SmartLog]
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
[Reporting Module]
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
[CPuepm]
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
[VSEC]
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
[CPDepCon]
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
[CPRepMan]
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 54
[R7540CMP]
No hotfixes..
[R76CMP]
No hotfixes..
[SFWR77CMP]
HOTFIX_R81_20_JHF_COMP Take: 54
[SFWR80CMP]
HOTFIX_R81_20_JHF_COMP Take: 54
[SFWR81CMP]
HOTFIX_R81_20_JHF_COMP Take: 54
[R77CMP]
No hotfixes..
[R8040CMP]
HOTFIX_R81_20_JHF_COMP Take: 54
[MGMTAPI]
No hotfixes..
[CPUpdates]
BUNDLE_R81_20_JHF_T53_BLOCK_PORTAL_MAIN Take: 2
BUNDLE_INFRA_CONFIG_AUTOUPDATE Take: 3
BUNDLE_CPOTLPAGENT_AUTOUPDATE Take: 26
BUNDLE_GENERAL_AUTOUPDATE Take: 21
BUNDLE_QUID_AUTOUPDATE Take: 14
BUNDLE_ESOD_CSHELL_AUTOUPDATE Take: 20
BUNDLE_R81_20_JUMBO_HF_MAIN Take: 54
BUNDLE_GOT_MGMT_AUTOUPDATE Take: 129
BUNDLE_CORE_FILE_UPLOADER_AUTOUPDATE Take: 21
BUNDLE_VCE_R81_20_AUTOUPDATE Take: 15
BUNDLE_ENDER_V17_AUTOUPDATE Take: 26
BUNDLE_MINMUS_AUTOUPDATE Take: 23
BUNDLE_KERBIN_AUTOUPDATE Take: 47
BUNDLE_TUNNEL_AUTOUPDATE Take: 117
BUNDLE_DANA_AUTOUPDATE Take: 170
BUNDLE_CPSDC_AUTOUPDATE Take: 34
BUNDLE_HCP_AUTOUPDATE Take: 73
BUNDLE_CPVIEWEXPORTER_AUTOUPDATE Take: 34
BUNDLE_CPOTELCOL_AUTOUPDATE Take: 97
BUNDLE_NGM_DOCTOR_AUTOUPDATE Take: 23
BUNDLE_WEBCONSOLE_AUTOUPDATE Take: 114
BUNDLE_GOT_TPCONF_MGMT_AUTOUPDATE Take: 39
BUNDLE_DC_CONTENT_AUTOUPDATE Take: 20
BUNDLE_DC_INFRA_AUTOUPDATE Take: 30
BUNDLE_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE Take: 21
BUNDLE_INFRA_AUTOUPDATE Take: 67
BUNDLE_DEP_INSTALLER_AUTOUPDATE Take: 27
BUNDLE_GOT_TPCONF_AUTOUPDATE Take: 128
[itp_wrapper]
HOTFIX_GOT_MGMT_AUTOUPDATE
[CPotelcol]
HOTFIX_OTLP_GA
[CPviewExporter]
HOTFIX_OTLP_GA
[core_uploader]
HOTFIX_CHARON_HF
[hcp_wrapper]
HOTFIX_HCP_AUTOUPDATE
[cpsdc_wrapper]
HOTFIX_CPSDC_AUTOUPDATE
[sho_wrapper]
HOTFIX_DANA_AUTOUPDATE
[infinity_onprem_wrapper]
HOTFIX_TUNNEL_AUTOUPDATE
[diff_report_wrapper]
HOTFIX_KERBIN_AUTOUPDATE
HOTFIX_MINMUS_AUTOUPDATE
[CPDepInst]
No hotfixes..
[CPquid]
HOTFIX_QUID_AUTOUPDATE
[CPotlpAgent]
HOTFIX_OTLP_GA

***

# cat /opt/CPInstLog/CRs_conflict_summary.txt
cat: /opt/CPInstLog/CRs_conflict_summary.txt: No such file or directory

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

the_rock — Thu, 18 Jul 2024 15:02:35 GMT

Never knew of that file, thats super helpful @Max_Frankl ...thank you!

Andy

R81.20 lab:

[Expert@CP-GW:0]# more /opt/CPInstLog/CRs_conflict_summary.txt
Package: R81.20 Take 53 Hotfix for CVE-2024-24919
conflicts with the following hotfixes:

R81.20 Jumbo Hotfix Accumulator Take 70

For more information - see log files:
/opt/CPInstLog/CRSValidator_fw1_wrapper_R81_20_JHF_T53_BLOCK_PORTAL_MAIN
.log
[Expert@CP-GW:0]

Re: Take 65 or Take 70 - Impossible to install on 5800 appliance R81.20

Jerry — Thu, 18 Jul 2024 15:02:48 GMT

# da_cli da_status
{
"Action ID" : "0",
"DABuildNumber" : "2432",
"DAService State" : "ready",
"Installation in Progress" : false,
"Last Update Time" : "Thu Jul 18 14:34:44 2024",
"New DA Availability" : "up to date",
"Update Status" : "done"
}