Firmware update warning with R81.20 upgrade on Azure

[nmelay2]

Hi all,

I need to update a customer's Azure-hosted management and log servers from R81.10 to R81.20.
Following R81.20 documentation, I went the in-place upgrade path, as per sk177714.
(For some reason, the regular CPUSE upgrade packages do not show up on Azure VMs, and you need to use specific packages from this SK).
Everything looked fine but then Verify Update gave me a very confusing message:

Based on a system check, a firmware update may be necessary on one or more network cards to bring them up to date with the current Gaia network drivers. This update is a one-time process which could take several minutes, and is executed after Gaia OS upgrade is finished and has rebooted post-upgrade. After the firmware update is complete, the system will automatically reboot once more to apply the new firmware. Please do not reboot or shut the system down during this time.

The need for a firmware update on an Azure VM is rather unexpected.
However, I learned Azure VM do indeed run on hardware with Mellanox NICs, as do CP appliances, and part of the real NIC is actually exposed to the VM.
https://learn.microsoft.com/en-us/azure/virtual-network/accelerated-networking-how-it-works

Did you guys run into this?
Can we fearlessly go on with the upgrade in this situation?
I wouldn't want the upgrade process to fail trying to flash a new NIC firmware, and either just crash here or enter an endless reboot loop...

And before anyone asks, yes I'm also running this through TAC.
I'm just looking for insight from fellow admins with hands-on experience with this use case.

[Don_Paterson]

I haven't seen it, but am curious to know if you considered deploying a new R81.20 SMS (followed by an import)?

You would get the latest R81.20 marketplace image/template.

It is just out of curiosity that I ask, with no knowledge of the specific deployment or requirements, including logging, which may be one reason why you want to do the in-place upgrade.

Regards,

Don

[nmelay2]

That's what we did for previous upgrades, but going through all of this seemed unnecessarily painfull.

Deploying a new SMS does come with the benefit of the new properly aligned disk layout though, so I'm still considering it.

[Don_Paterson]

ACK
Too soon for R82 😉

[the_rock]

Way too soon 🙂

[Don_Paterson]

This time is different 😉

But seriously, with an EA that lasted nearly a year, it could be something to consider.

Obviously carefully considering all the factors!

[nmelay2]

I'm not sure why you're bringing R82 here.

AFAICT, Check Point has been really good with the quality of GA releases since R80.40, but I still wouldn't adopt it so soon without a very strong customer requirement to do so.

[the_rock]

It probably wont be recommended until summer 2025...just my educated guess.

Andy

[JozkoMrkvicka]

My wild guess is that very soon we will get first JHF for R82 and until CPX there will be JHF Take around 30 which will be consided as "stable" and thus R82 will be recommended during/after CPX 😉

R81.20 was released 21.11.2022 and marked as recommended 27.7.2023.

[the_rock]

Lets see 😉

Andy

[Don_Paterson]

Just in case it helps:

I see that someone else had this situation last year, but on physical appliances.

https://community.checkpoint.com/t5/Security-Gateways/Enterprise-appliance-upgrade-to-R81-20/m-p/190...