topic Re: Upgrading firmware on 1200R appliance in Spark Firewall (SMB)

Upgrading firmware on 1200R appliance

Egor_Cherkasov — Thu, 17 Jan 2019 07:04:46 GMT

Hello CheckMates.

I'd like to share with you an issue and its solution.

So if you want to upgrade firmware on SMB appliances like 1100, 1200R etc.,which have embedded Gaia OS, you will probably face with a lot of problems.

There is a small guide (sk107592) or you can find official Check Point 1200R Appliance Administration Guide:

To perform a fresh/clean install of firmware on 600/700/1100/1400/1200R appliances via USB, the USB must use a FAT32 file system.

Copy the desired firmware image onto the USB (not in subfolders and not with other firmware images present).
Insert the USB into "USB1" on the front of the appliance.
Wait for the "USB1" LED light to activate, indicating that the USB was detected.
Reboot the appliance either via the WebUI, SSH command #reboot, or by power cycling the appliance.

During the boot process, the appliance will detect the USB and firmware image.
The appliance will perform a reset to factory defaults, followed by a fresh install of the selected firmware version.
Note: You may need to use Ctrl-C to interrupt the bootloader and select the relevant option.

Note: This procedure erases the existing image and settings.

First of all you can not do manual upgrade via Web interface, because of operation failed error.

Moreover USB is only one way to upgrade your device.

What is the desired firmware image? It is an appliance package, not the actual firmware!!!

Here is an example of what you have to download (img extension).

Then you copy this file on the USB (may be you'll need to extract and archive) and follow the instruction.

P.S.: If the USB is not read, try to rename your image file to fw1_ind_vR77_990172541_20_81.img view (this is what appliance wants to see).

Re: Upgrading firmware on 1200R appliance

Tom_Hinoue — Thu, 17 Jan 2019 08:34:23 GMT

Per an update on sk122276 - SMB appliances fail to upgrade firmware it looks like we need one more flavor to it.

To prevent the issue from occuring again in such scenario (due to bad blocks), we will need to burn the image with the following hotfix

R77.20.81 jumbo hf: fw1_sx_dep_R77_990172557_20.img
R77.20.85 jumbo hf: fw1_sx_dep_R77_990172740_20.img

Re: Upgrading firmware on 1200R appliance

G_W_Albrecht — Thu, 17 Jan 2019 10:37:54 GMT

This discussion is very, very confusing and looks like a copy/paste action using CP documents - nice to cite the well-known sk107592 and provide screenshots from CP website, but i see no description of any issue at all !

What i see is the assertion: So if you want to upgrade firmware on SMB appliances like 1100, 1200R etc.,which have embedded Gaia OS, you will probably face with a lot of problems.

But after nearly 8 years, out of my experiences i could not say that - in most use cases, firmware update using WebGUI is working very fine, and local access and USB install is not so easy (mostly small remote sites). So i would be rather interested in statistics about the reported installation failures and its causes.

Re: Upgrading firmware on 1200R appliance

Egor_Cherkasov — Thu, 17 Jan 2019 10:49:49 GMT

The reason why I have created a discussion is to inform people, that they have to download Appliance Package (green arrow) , not the firmware (red arrow). There is no information about it nuance on the Internet. And it's confusing, because logically if you want to upgrade firmware, you should install firmware, but here we can see that's not true.

Re: Upgrading firmware on 1200R appliance

G_W_Albrecht — Thu, 17 Jan 2019 11:28:01 GMT

I never had such an issue - i use the firmware version page, e.g. sk137212: R77.20.81 for Small and Medium Business Appliances to download firmeware install files for WebGUI or Smart Update. When using the Search page like you do, i find installable .img files here

R77.20 HFA 60 (R77.20.60) Build 990171625 firmware for 1200R Appliances

or here

R77.20.80 Build 990172437 for 1200R Appliances

But the Check Point 1200R Appliance package R77.20.70 build 990171948 you give is the .tgz for SmartUpdate...

But please finally explain what the issue is that you like to discuss here !

Re: Upgrading firmware on 1200R appliance

Egor_Cherkasov — Thu, 17 Jan 2019 11:45:25 GMT

I don't actually want to discuss the issue, I just want to share with that little problem with community. Maybe someone will face with the same problem.

Sorry if I jumbled the categories,where I can write this.

Re: Upgrading firmware on 1200R appliance

G_W_Albrecht — Thu, 17 Jan 2019 11:50:23 GMT

So please explain in detail what the problem is that you want to share with community, because i did not understand it yet - downloading and trying to install a wrong file for firmware update will not really be an issue, i suppose...

Re: Upgrading firmware on 1200R appliance

_Val_ — Fri, 21 Jun 2019 09:13:00 GMT

Hi all, I have to second Günther W. Albrecht‌'s opinion here.

From where I stand, the issue is cause by an attempt to download and apply a wrong file. The best practice is always to use R77.20.81 for Small and Medium Business Appliances for firmware downloads.

Also, Egor Cherkasov, if you have not seen Günther W. Albrecht's great collection of SMB related SKs, here is the link: https://community.checkpoint.com/docs/DOC-2648-smb-devices-references-and-sk-s

Re: Upgrading firmware on 1200R appliance

Egor_Cherkasov — Thu, 17 Jan 2019 12:13:16 GMT

I haven't seen this article, it's an amazing job, thank you for sharing.

Re: Upgrading firmware on 1200R appliance

_Val_ — Thu, 17 Jan 2019 12:18:13 GMT

Always happy to help and share. Follow Gunter, he is our SMB champion here

Re: Upgrading firmware on 1200R appliance

Egor_Cherkasov — Thu, 17 Jan 2019 12:23:24 GMT

Okay

I was upgrading 1200R and certainly I was following the administration guide.

But there was a problem: appliance had not read the USB, when it rebooted.

I had tried a lot of firmware images, a lot of USBs and the decision was to download appliance package.

I mean, in the guide there is an information that you have to download Firmware to upgrade firmware, however it didn't worked. You should download appliance package to upgrade firmware.

That thing is confusing for me.

Re: Upgrading firmware on 1200R appliance

G_W_Albrecht — Thu, 17 Jan 2019 12:59:07 GMT

If you have the 1200R locally managed, you can use the .img file for firmware update by using WebGUI or USB medium. If it is centrally managed, you either install the .tgz file using SmartUpdate or the .img file for firmware update by using WebGUI or USB medium. Further possibilities are: Upgrade using boot menu will load a firmware fw1*.img or u-boot.bin boot-loader file from a BOOTP or tftp server. On R77.30 you can also use SmartProvisionig/LSM. If you have a SMB unit managed by SMP Portal you can control firmware updates from the portal.

--> But there was a problem: appliance had not read the USB, when it rebooted.

Yes, led (red) should light up before you can reboot unit from CLI. Otherwise, .img will not be found.

Re: Upgrading firmware on 1200R appliance

LadislavNemecek — Fri, 18 Jan 2019 11:01:41 GMT

Based on my about 5y experiences I can agree with Günther W. Albrecht - Not remember any serious issues with WebGUI based firmware upgrade - by my opinion easiest way especially for central managed smb appliances spread all around the world with no local support...

USB deploy will restore to factory defaults, which require additional console config of interfaces... Manual upgrade preserve all settings

Worth to mention two important things by me

do not rename original iso file placed in USB root dir!
there are several different GaiaEmbeded firmware versions - of course update will fail if you apply 1400 iso to 1100

Re: Upgrading firmware on 1200R appliance

Vitaly_86 — Thu, 20 May 2021 07:07:19 GMT

When updating through the GUI, we get an error

An attempt to update via usb also fails

U-Boot 2013.07 (Development build, svnversion: u-boot:exported, exec:) (Build time: Oct 09 2017 - 16:34:33) Check Point version: 990170228 ************ Hit 'Ctrl + C' for boot menu ************ OCTEON CN7010-AAP pass 1.2, Core clock: 1200 MHz, IO clock: 500 MHz, DDR clock: 667 MHz (1334 Mhz DDR) Base DRAM address used by u-boot: 0x4e000000, size: 0x2000000 DRAM: 1 GiB Clearing DRAM...... done Octeon MMC/SD0: 1, Octeon MMC/SD1: 2 Flash: 0 Bytes PCIe: Port 0 not in PCIe mode, skipping PCIe: Port 1 not in PCIe mode, skipping PCIe: Port 2 not in PCIe mode, skipping PCI console init succeeded, 1 consoles, 1024 bytes each PCIe: Port 0 not in PCIe mode, skipping PCIe: Port 1 not in PCIe mode, skipping PCIe: Port 2 not in PCIe mode, skipping Type the command 'usb start' to scan for USB storage devices. mmc1(part 0) is current device MMC read: dev # 1, address # a80000, count 524288 ... 1024 blocks read: OK Verifying CRC for settings area... Done USB0: Register 2000140 NbrPorts 2 Starting the controller USB XHCI 1.00 scanning bus 0 for devices... 2 USB Device(s) found USB1: Register 2000140 NbrPorts 2 Starting the controller USB XHCI 1.00 scanning bus 1 for devices... 1 USB Device(s) found scanning usb for storage devices... 1 Storage Device(s) found Trying to load image (fw1*.img) from USB flash drive using FAT FS reading fw1*.img Found image file: fw1_ind_vr77_990172605_20_81.img 525074432 bytes read in 31182 ms (16.1 MiB/s) get_loadaddr_free: No free memory found 525074432 >= 209715200 Could not get free memory addresses Image CRC verification failed! ERROR: Install/Update Image from USB failed. Enabling network ports... Net: Enabling SMI interface mdio-octeon0 Enabling SMI interface mdio-octeon1 *******initialize 88E6350R********** octeth0, octeth1, octrgmii0 [PRIME] Done. Press any key to continue...

Re: Upgrading firmware on 1200R appliance

G_W_Albrecht — Thu, 20 May 2021 12:42:33 GMT

Strange filename - i have used fw1_ind_dep_R77_990172605_20.img sucessfully.

Re: Upgrading firmware on 1200R appliance

G_W_Albrecht — Thu, 20 May 2021 13:42:16 GMT

Newest Version is available from R77.20.81 for Small and Medium Business Appliances - Effective Feb 4 20201: Build 990172611 for R77.20.81 image has been released for 1200R appliances with 1 fix: SMB-14401

Re: Upgrading firmware on 1200R appliance

Vitaly_86 — Fri, 21 May 2021 06:05:51 GMT

We've tried a bunch of img already. the result is always the same.
TAC has now proposed the following solution:
Since your using old firmware, you will have to follow the upgrade path from - SK120512

So according to your appliance, you'll first need to upgrade to R77.20.31 from SK111656

Can we try to upgrade the appliance from CLI?
Manual Firmware upgrade from CLI
• Copy the image to / storage directory (using WinSCP)
• Run (from Expert mode): upgrade_revert_image.sh / storage /% FILENAME% upgrade safe

TOTAL:
[Expert @ Gateway-ID-7F994B4A] # upgrade_revert_image.sh /storage/fw1_ind_dep_R77_990170952_20.gz upgrade safe
2021-May-21-10: 34: 38 - Running Connectivity Validations.
2021-May-21-10: 34: 38 - SIC Connection Error

Show upgrade-log:
2021-May-21-10: 35: 43: Error: Cannot import settings from the old image (2)
2021-May-21-10: 35: 43: Executing command: '/ bin / sync'
2021-May-21-10: 35: 43: Executing command: '/ bin / umount / mnt / inactive'
umount: cannot umount / mnt / inactive: Device or resource busy
2021-May-21-10: 35: 43: Executing command: '/opt/fw1/bin/cp_write_syslog.sh -p er r [System Operations] Failed to upgrade the appliance software version'
2021-May-21-10: 35: 43: Executing command: '/ bin / rm -rf / fwtmp / upgradeRevertInPro gress'
2021-May-21-10: 35: 43: Exiting with error code -1.

Re: Upgrading firmware on 1200R appliance

PhoneBoy — Mon, 24 May 2021 03:41:50 GMT

What happens if you try to upgrade to R77.20.31 first as noted in the sk?

Re: Upgrading firmware on 1200R appliance

Vitaly_86 — Mon, 24 May 2021 03:46:07 GMT

I tried to upgrade to R77.20.31. Above is just the log for this update.

Re: Upgrading firmware on 1200R appliance

PhoneBoy — Mon, 24 May 2021 04:40:43 GMT

It's possible this will require an RMA to resolve.