topic Check Point ISOMorphic in Hyperscale Firewall (Maestro)

Check Point ISOMorphic

Mikula83 — Mon, 12 May 2025 11:05:26 GMT

Hello, I want to make a bootable ISO image file Gaia R82 for installation on MHO 140 (Maestro Hyperscale Orchestrator). Please let me know what to choose as Installation target (BIOS - Checkpoint appliance, UEFI - Checkpoint appliance, Open Server), attached pictures.

Best regards,
Milan Babic

Re: Check Point ISOMorphic

_Val_ — Mon, 12 May 2025 11:09:02 GMT

Which part of Maestro are you going to re-image? MHO itself or GW appliances?

Re: Check Point ISOMorphic

Mikula83 — Mon, 12 May 2025 11:12:08 GMT

@_Val_ wrote:
Which part of Maestro are you going to re-image? MHO itself or GW appliances?

MHO itself

Re: Check Point ISOMorphic

AkosBakos — Mon, 12 May 2025 11:13:04 GMT

@Mikula83

I'm afraid of, you won't be able to boot from pendrive, because of the boot order.

I have this issue last time, and only the TAC could help me, with the bios PWD.

Akos

Re: Check Point ISOMorphic

_Val_ — Mon, 12 May 2025 11:31:25 GMT

~~Not supported, AFAIK. See the relevant SK for all supported appliances and configurations: sk65205~~

That was not correct. See my updated answer below.

Re: Check Point ISOMorphic

Mikula83 — Mon, 12 May 2025 11:27:40 GMT

I have found this in documentation (page 256), attached documents.

First step is to contact Check Point Support.

That means it is possible, but you have to contact Check Point Support as a first

Re: Check Point ISOMorphic

_Val_ — Mon, 12 May 2025 11:32:34 GMT

Correct. After consulting with the Maestro team, here is the answer:

You can produce a bootable usb stick using the ISOmorphic tool and re-image MHO. You have to contact TAC for BIOS password and change the boot priority. Then you can use ISOmorphic.

We are also fixing the SK mentioned above, to align with the documentation.

Re: Check Point ISOMorphic

Mikula83 — Mon, 12 May 2025 12:34:13 GMT

Also, I find it very strange in documentation why you have to choose "Open Server with console" in Step 3 because MHO 140 is Check Point appliance, also ISOmorphic tool - Build 207 (latest) as Installation target has three options and one of them is "Open Server" and there is no option to select "Open Server with console"

Installation target:

BIOS - Checkpoint appliance
UEFI - Checkpoint appliance
Open Server

Re: Check Point ISOMorphic

Mikula83 — Tue, 13 May 2025 06:53:15 GMT

Hello, I saw that sk65205 has been modified and that MHO 140, MHO 170 and MHO 175 has been added (attached picture).

Also, I have question is it possible to bond MGMT0 and MGMT1 interfaces of MHO 140 orchestrators for redundancy purposes? (attached picture)

Re: Check Point ISOMorphic

_Val_ — Tue, 13 May 2025 07:01:39 GMT

Yes, you can do that.

Re: Check Point ISOMorphic

Mikula83 — Wed, 14 May 2025 09:15:18 GMT

Hello Valeri,

just to avoid misunderstanding MHO 140 on rear panel has a two management interfaces MGMT 0 and MGMT 1. Is it possible to bond theese two management interfaces to manage MHO 140? Is it the same procedure as Configuring MAGG Interfaces.

I know that it is possible to bond front Managamant Ports of Maestro Security Group.

Re: Check Point ISOMorphic

_Val_ — Wed, 14 May 2025 11:40:37 GMT

Correct, we are talking about MGMT 0 and 1 on the rear panel. You can set them up as a bond, no MAGG, through the Gaia settings on the MHO. I asked internally, the recommendation is to set is as active/backup and not LACP

Re: Check Point ISOMorphic

Mikula83 — Thu, 15 May 2025 13:13:42 GMT

Please, let me know what to select after boot from USB. I have made a bootable ISO image file Gaia R82 for Quantum Force 9000. According to sk65205, I have choose UEFI profile (attached picture)

Re: Check Point ISOMorphic

_Val_ — Thu, 15 May 2025 13:18:32 GMT

What appliance are you trying to re-image? MHO or QF9000?

Re: Check Point ISOMorphic

Mikula83 — Thu, 15 May 2025 14:00:21 GMT

Quantum Force 9000

Re: Check Point ISOMorphic

Mikula83 — Fri, 16 May 2025 07:21:15 GMT

Please, let me know what to choose as installation target in ISOMorphic Tool for Quantum Force 9300 (clean install method). According to sk65205 it is written "UEFI" (attached picture installation_target.png) but after created a bootable USB with UEFI, insert it in appliance and reboot I get the following screen (Quantum_Force_9000.png). I'm not sure what to select as a next step.

Also, I'm not sure why I have to choose UEFI and not BIOS as a lot of other appliances.

I have opened a TAC.

Re: Check Point ISOMorphic

Tom_Kendrick — Fri, 16 May 2025 10:48:09 GMT

Hi, on the question of UEFI versus BIOS, it's simply, they are newer 🙂 - For example, today, you would expect a modern motherboard for your home computer or Server for the DC to use UEFI, while you much older system from years ago may use BIOS. Same rules apply with these appliances.

In terms of the ISO, assuming you have the latest ISOMorphic, make sure you have the correct ISO for this appliance - you can find it on https://support.checkpoint.com/results/sk/sk181698 under downloads. Other "General" ISO's may not work. Also note, if used in Maestro, then there is a different ISO to use outside of Maestro. Regardless, you will see this in the downloads section description.

If still it wont boot in UEFI mode, then look for a different USB stick. I found that sometimes one that worked on an older appliance didn't work on a newer one (or vice versa). I ended up, I think with a few different SanDisk sticks for all the generations and things I needed to work with, and marked them up for their device "class". I'm travelling at the moment, so I cant check in the lab to give a specific model, sorry!

Tom

Re: Check Point ISOMorphic

Bob_Zimmerman — Fri, 16 May 2025 14:41:02 GMT

The "Quantum_Force_9000.png" is just showing where you select the default console. Are you using a VGA port to see the console? No, so choose Serial.

Re: Check Point ISOMorphic

Mikula83 — Fri, 16 May 2025 15:33:54 GMT

Hello,

as first we have installed Gaia R82 on MHO 140. We used ISOmorphic tool Build 207 + Open Server Profile + Check_Point_R82_T777.iso. After that we tried to install Gaia R82 on gateways Quantum Force 9300 using ISOmorphic tool Build 207 + UEFI Profile + Check_Point_R82_T777.iso but without success. Also, we have opened a case to try to resolve the problem but nothing happened. As a alternative solution we tried ISOmorphic tool Build 207 + UEFI Profile + Check_Point_R81.20_For_9000_Appliances_T786_Maestro.iso and it works.

I think that it is problem with ISO image file compatibility. I know that for Gaia R81.20 there is a different ISO for Quantum Gateways and Maestro but for Gaia R82 per documentation it should be the same ISO.