Query regarding Checkpoint firewall firmware upgradation

[nilanjan_lahiri]

Dear All,

Hope you are doing great !

We are currently using Checkpoint 6400, R80.40 which is already EoS. We are planning for a firmware upgrade. In this regard, I have a few queries :-

1) What will be the recommended firmware version

2) We don't happen to have any valid software subscription account or TAC support. Is it still possible to carry out the upgrade, whether online or offline

Thanks a lot,

Nilanjan

[Tal_Paz-Fridman]

R80.40 is not a "firmware" but a main Check Point Release.

The current recommended release by Check Point is R82:

https://support.checkpoint.com/results/sk/sk181127

Refer to R82 Installation and Upgrade Guide:

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Installation_and_Upgrade_Guide/Con... 

[the_rock]

I would go with at least R81.20, or R82, if you can. Please follow below process, works really well.

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/td-p/69216

[nilanjan_lahiri]

Thank you... However, I need some guidance on my 2nd question please.

[the_rock]

I would say it is possible if you have the right package for the upgrade, but doing it via web UI, you need AT LEAST eval license on the firewall, otherwise, it wont work.

Hope that helps.

[the_rock]

I read what @Bob_Zimmerman said and I agree 100% with him.

[Lesley]

2) https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/R82.00/R82_Downloads.htm

[Wolfgang]

@nilanjan_lahiri you have to have a valid software subscription to run a newer release. If you don‘t know your Check Point account ID or your subscription check out with your local partner.

[Bob_Zimmerman]

2) You won't be able to upgrade without a valid software subscription. Upgrading in place to R82 requires a relatively new version of the Check Point Upgrade and Service Engine (CPUSE). You can generally download the new version of the main software without a subscription, but you need a subscription to download new CPUSE builds.

Since this is the vendor's forum and my understanding is updating without a software subscription is against the license agreement, we probably won't be able to discuss other ways to get where you want to go. I'll defer to somebody from Check Point if they bring up other options.

I definitely don't recommend upgrading to R82 with no jumbo hotfix accumulators.

[PhoneBoy]

As far as I know, provided you download the necessary files from sk181127 and follow the relevant documentation, you should be able to perform the upgrade (either in-place or advanced migration). 

[RemoteUser]

https://www.checkpoint.com/support-services/support-life-cycle-policy/
take a look also here note that R81.20 it's Support Until November 2026

[nilanjan_lahiri]

Thanks... We are using 6400 appliance but didn't find a mention in the link you provided.

[RemoteUser]

I'm just letting you know that if you want to install r81.20, you need to bear in mind that it will be supported until November 2026, so perhaps it would be an option to install r82.

[the_rock]

Good point bro.