topic Re: HF not compatible in General Topics

HF not compatible

S_E_ — Thu, 26 Jun 2025 15:38:19 GMT

Playground/Lab:

After upgrading a virtual appliance R81.20 to R82 with image Check_Point_R82_T633_Gaia_Install_and_Upgrade.tar,
we tried to install HF12 and/or HF19. But did not work.

fw2-virtual> installer import local /var/log/Check_Point_R82_JUMBO_HF_MAIN_Bundle_T12_FULL.tar
Preparing package for import. This operation might take a few moments
Note: The selected package will be copied into CPUSE repository
Info: Initiating import of Check_Point_R82_JUMBO_HF_MAIN_Bundle_T12_FULL.tar...
Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)
Result: The following results are not compatible with the package:
- Check package compatibility with this version
This hotfix is supported only for Gaia OS Take 627 and higher.
Installing this hotfix on the current Maestro Security Group or Maestro Orchestrator may cause a traffic interruption.
please follow the instructions in sk181511.

fw2-virtual> exit

[Expert@fw2-virtual:0]# fw ver
This is Check Point's software version R82 - Build 760

[Expert@fw2-virtual:0]# cpinfo -y all
cp_get_kernel_version: ERROR: kernel version 4.18.0-372.9.1cpx86_64 is unknown. Perhaps 4.18.0-372.9.1cpx86_64 needs to be added as a version to cp_get_kernel_version and CpOsKernelVersion?

This is Check Point CPinfo Build 914000248 for GAIA
[CPshared]
No hotfixes..
[IDA]
No hotfixes..
[CPFC]
No hotfixes..
[MGMT]
No hotfixes..
[FW1]
HOTFIX_UCA_SSH_TUNNELING_APP_AUTOUPDATE
HOTFIX_UCA_SSH_TUNNELING_SERVICE_AUTOUPDATE
HOTFIX_INEXT_NANO_EGG_AUTOUPDATE
HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE
HOTFIX_UCA_INFRA_MONITOR_SERVICE_AUTOUPDATE
HOTFIX_UCA_INFRA_LOG_SERVICE_AUTOUPDATE
HOTFIX_UCA_INFRA_AUTOUPDATE
HOTFIX_GOT_TPCONF_AUTOUPDATE

FW1 build number:
This is Check Point's software version R82 - Build 760
kernel: R82 - Build 735
[SecurePlatform]
No hotfixes..
[PPACK]
No hotfixes..
[CPinfo]
No hotfixes..
[AutoUpdater]
HOTFIX_INFRA_CONFIG_AUTOUPDATE
[DIAG]
Initializing...ixes..
[CVPN]
HOTFIX_ESOD_CSHELL_AUTOUPDATE
[CPUpdates]
BUNDLE_UCA_SSH_TUNNELING_APP_AUTOUPDATE Take: 32
BUNDLE_CORE_FILE_UPLOADER_AUTOUPDATE Take: 17
BUNDLE_UCA_SSH_TUNNELING_SERVICE_AUTOUPDATE Take: 32
BUNDLE_INEXT_NANO_EGG_AUTOUPDATE Take: 13
BUNDLE_CPSDC_AUTOUPDATE Take: 34
BUNDLE_HCP_AUTOUPDATE Take: 74
BUNDLE_CPVIEWEXPORTER_AUTOUPDATE Take: 40
BUNDLE_QUID_AUTOUPDATE Take: 14
BUNDLE_CPOTLPAGENT_AUTOUPDATE Take: 50
BUNDLE_CPOTELCOL_AUTOUPDATE Take: 129
BUNDLE_ESOD_CSHELL_AUTOUPDATE Take: 20
BUNDLE_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE Take: 21
BUNDLE_INFRA_CONFIG_AUTOUPDATE Take: 5
BUNDLE_UCA_INFRA_MONITOR_SERVICE_AUTOUPDATE Take: 29
BUNDLE_UCA_INFRA_LOG_SERVICE_AUTOUPDATE Take: 23
BUNDLE_UCA_INFRA_AUTOUPDATE Take: 56
BUNDLE_GOT_TPCONF_AUTOUPDATE Take: 128
[CPotelcol]
HOTFIX_OTLP_GA
[CPotlpAgent]
HOTFIX_OTLP_GA
[CPquid]
HOTFIX_QUID_AUTOUPDATE
[CPviewExporter]
HOTFIX_OTLP_GA
[hcp_wrapper]
HOTFIX_HCP_AUTOUPDATE
[cpsdc_wrapper]
HOTFIX_CPSDC_AUTOUPDATE
[core_uploader]
HOTFIX_CHARON_HF

[Expert@fw2-virtual:0]# c

Could not find a never image version or R82. Is there any ?
Blink/GUI is not an option/can't be used.

Thanks, Regards

Re: HF not compatible

the_rock — Thu, 26 Jun 2025 16:08:41 GMT

I dont know if this could be related, but had similar issue with customer the other day. Have a look at steps in the documentation.

Andy

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Maestro_AdminGuide/Content/Topics-Maestro-AG/Installing-Uninstalling-Hotfix-on-Security-Group-Members.htm?tocpath=Installing%20and%20Uninstalling%20a%20Hotfix%7CInstalling%20and%20Uninstalling%20a%20Hotfix%20on%20Security%20Group%20Members%7C_____0#Installing_a_Hotfix_Package_on_Security_Group_Members

step 2 is what really matters

Re: HF not compatible

S_E_ — Thu, 26 Jun 2025 16:48:23 GMT

sorry, was not clear enough.

It is a virtual sytem on a hypervisor

not a VSX, not maestro

But thanks

Re: HF not compatible

the_rock — Thu, 26 Jun 2025 16:51:12 GMT

Gotcha. if you do installer verify, what does it show?

Andy

Re: HF not compatible

S_E_ — Thu, 26 Jun 2025 17:34:29 GMT

issue appears already with import. verifyer does not see package.

Regards

Re: HF not compatible

the_rock — Thu, 26 Jun 2025 17:47:41 GMT

I get that. What I mean is this:

in clish, type installer verify, hit tab and see what it shows. If you get some options, try hit one of them and see what it gives you.

Andy

Re: HF not compatible

emmap — Fri, 27 Jun 2025 01:56:57 GMT

Is the take of Deployment Agent on there up to date? Does the VM have internet access to check?

Re: HF not compatible

the_rock — Fri, 27 Jun 2025 02:05:31 GMT

Good point, though to me, logically, based on the message shown, it would indicate that jumbo itself is incompatible with the actual version, which is indeed odd. I upgraded 2 of my labs while ago from R81.20 ro R82 and never had this problem. Mind you, I did jumbos via web UI, only via clish in vsnext, but that one was fresh R82 install.

Andy

Re: HF not compatible

S_E_ — Fri, 27 Jun 2025 06:02:37 GMT

hi,

nothing

Regards

fw2-virtual> installer verify
** ************************************************************************* **
** Connection error. Packages list might be incomplete **
** ************************************************************************* **
Show packages: no packages to display

Re: HF not compatible

S_E_ — Fri, 27 Jun 2025 06:04:14 GMT

hi,

yes up2date, manual installation

no internet access

fw2-virtual> show installer status build
Build number: 2589 (agent build is up to date)

Re: HF not compatible

S_E_ — Fri, 27 Jun 2025 06:06:22 GMT

yeah,

basically, Initial idea was to test image Check_Point_R82_T633_Gaia_Install_and_Upgrade.tar

before we roll out to production devices (virtual & hardware)

Thanks, Regards

Re: HF not compatible

emmap — Fri, 27 Jun 2025 06:14:33 GMT

Is that an EA installer? The GA upgrade file on the R82 SK page is Check_Point_R82_T777_Gaia_Install_and_Upgrade.tar.

Re: HF not compatible

S_E_ — Fri, 27 Jun 2025 06:45:12 GMT

Hi,

No idea, I downloaded the file some weeks ago.

But, I do not see r82 tar file do download. If you have direct link, that would be great.

Only the blink image: blink_image_1.1_Check_Point_R82_T777_JHF_T19_SecurityGateway.tgz

And this can't be installed via cpuse/clish.

Regards

Re: HF not compatible

emmap — Fri, 27 Jun 2025 07:07:55 GMT

You can use blink files via CPUSE if you want. Here is the link to the GA upgrade file:

https://support.checkpoint.com/results/download/135015

Re: HF not compatible

S_E_ — Fri, 27 Jun 2025 08:36:02 GMT

hi,

this did the trick.

Upgrade to T777 and afterwards HF12

Check_Point_R82_JUMBO_HF_MAIN_Bundle_T12_FULL.tar
Check_Point_R82_T777_Gaia_Install_and_Upgrade.tar

[Expert@fw-virtual:0]# cpinfo -y FW1

This is Check Point CPinfo Build 914000250 for GAIA
[FW1]
HOTFIX_R82_JUMBO_HF_MAIN Take: 12

Thanks a lot

Regards

PS: I tried cpuse and blink, did not work

PS2: Official R82 points always to blink images(combined with HF)

Search didn't provide this link

Re: HF not compatible

the_rock — Fri, 27 Jun 2025 11:18:54 GMT

Glad you got it working.

Re: HF not compatible

emmap — Tue, 01 Jul 2025 02:02:10 GMT

The base GA ISO is on the R82 page as well, but it's lower down under Additional Downloads. I don't know why this happened.