Downgrade R80.30 to R80.10

[Sanjay_S]

Hi Team,

We have a new firewall with R80.30 installed in it. What is the right approach to downgrade it to R80.10? 

Regards,

Sanjay S

[HeikoAnkenbrand · Accepted solution]

Clean installation ISO Image of R80.10 via USB (ISOMorphic Toolsk65205)  or DVD:

sk111841: Check Point R80.10

PS:

But I would upgrade the management to R80.30 or R80.40. Then you can also use R80.30 gateways.

[Maarten_Sjouw]

Be aware that some newer appliances do not support an older version.

[Sanjay_S]

This is 5600, does that mean new devices or certain models?

[HeikoAnkenbrand]

👍

Supported models:

23800, 23500, 21800, 21700, 21600, 21400, 15600, 15400, 13800, 13500, 12600, 12400, 12200, 5900, 5800,

5600:-)

, 5400, 5200, 5100, 4800, 4600, 4400, 4200, 3200, 3100, 2200

[Sanjay_S]

So clean install with the USB or DVD is the only option. We cant try with CPUSE?

[Maarten_Sjouw]

CPUSE cannot be used in this case.
The latest models in the 3000 series and most in the 6000, 16000, 26000 series are not supported on R80.10 and some even not on R80.20.

[PhoneBoy]

My question: why?

R80.30 is the widely recommended release for all customers and has many significant improvements over R80.10.
Even if your management is R80.10 or R80.20, you can manage R80.30 gateways with the appropriate jumbo hotfix.
That said, you'll get even more benefits by upgrading the management as well. 

Really don't see a reason to go through the trouble of downgrading.

[Sanjay_S]

Hi PhoneBoy,
Our Management server is running on R80.10 and we are not able to manage the firewalls with R80.20. We are not able to push the policy to the firewalls which are above R80.10. Do we need to raise it with TAC to get the appropriate JHF for this to work?

[PhoneBoy]

You just need to apply the latest GA take from the Jumbo Hotfix from here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
The ability to manage R80.20 and R80.30 gateways from R80.10 were added in various builds.

Is there a reason you are still on R80.10 on the management?
Like I said, R80.30 is the widely recommended release at this point and offers significant improvements over R80.10.

[Sanjay_S]

Hi PhoneBoy thank you for providing me the JHF details.
We are still having R77.30 VSX cluster and few GWs in R77.30, we thought of getting it to R80.10 first and then upgrade MDS to R80.30.
However, now as you suggested we will install new GA JHF on MDS and try to install policy on R80.30 GWs and see how it works. Will keep you posted.
Thank you,
Sanjay

[Maarten_Sjouw]

Sanjay, there realy is no reason to stick with R80.10 on the MDS, the MDS runs much smoother and leaner when you upgrade it to R80.30, first of all you get the 3.10 kernel and you also get (with the clean install) the new file system.
R77.30 gateways are no reason to stay behind, I still have around 80 gateways on R77.30 including many VSX in about 100 different CMA's and I am running R80.30 for 7 months now.

[Sanjay_S]

Sure Maarten,
Will plan this as soon as we are done with the COVID-19 situation.

[Sanjay_S]

Hi All,
We are planning to install R80.30 in a virtual machine as a MDS and then migrate all domains in the R80.10 MDS(Physical Box) to it. Is there any pre and post checks or any suggestions on how to proceed with this?

[PhoneBoy]

That's precisely why you should perform the migrate export/import to a VM as practice before you do it for real...to ensure there are no issues.
Unless the VM has the same IPs as your existing MDM, you'll need to get evaluation licenses.
The migrate export process does require a cpstop on the management server, which should not impact traffic at all.
If there are any issues, they should be obvious when you do this.
Logs should be migrated separately, and you'll have to reindex old logs to have them show up once they are copied to the new server.

[Sanjay_S]

Thanks PhoneBoy,
Does Migrate Export/Import works for different versions?
For Example we will export it from MDS R80.10 and Import it on R80.30?

[PhoneBoy]

You have to use the R80.30 version of the migration tools on your R80.10 MDM, but yes.
This is the standard process for an "Advanced" upgrade.

[Sanjay_S]

Thank you.
Just one more thing any limitations if we install MDS on Virtual Machine?

[PhoneBoy]

Provided you allocate the VM the appropriate resources, not really.