Hi
Our secondary SMS [Smart-1 410 running R81.20 GAIA] died and Check Point sent a replacement to our data centre, and the staff there installed the new appliance in the rack for us. I have remote access to the console but I am not able to physically go to the data centre in the next week so I really need to run the first time config wizard through the CLI, as per page 47 of the R81.20 install and upgrade guide.
The replacement appliance had R80.10 installed by default, and I was able to configure this as a secondary SMS by running the first time config wizard through the CLI using the following command [I've replaced names, passwords, etc with x's]:
config_system -s "hostname=xxxxxxxx&domainname=xxxxxxxxxxxx.com&timezone='Europe/London'&ftw_sic_key=xxxxxxxx&install_security_gw=false&install_security_managment=true&install_mgmt_primary=false&install_mgmt_secondary=true&mgmt_gui_clients_radio=any&admin_hash=xxxxxxxx&default_gw_v4=192.168.1.1&download_info=true&download_from_checkpoint_non_security=true&ipaddr_v4=192.168.1.2&masklen_v4=24&ipstat_v4=manually&mgmt_admin_name=admin&mgmt_admin_passwd=xxxxxxxx&upload_info=true"
This command was successful and I was able to get access to the webgui and download the R80.40 clean install and upgrade image for CPUSE [my plan was to upgrade to R80.40, then upgrade to R81.20]. I upgraded to R80.40 successfully, but when I verified the R81.20 clean install and upgrade image it said a clean install was allowed, but an upgrade was not compatible as file /opt/CPShrd-R80.40/conf/sic_cert.p12 was missing.
I decided to just do a clean install of R81.20 and run the first time config wizard from the CLI again. But when I entered the same command as I used before it failed with reason "Missing parameter: maintenance_hash".
The parameter "maintenance_hash" is not mentioned in the R81.20 Install and Upgrade guide and I couldn't find anything online, so I decided to take a guess and enter maintenance_hash=password, so the new config string became:
config_system -s "hostname=xxxxxxxx&domainname=xxxxxxxxxxxx.com&timezone='Europe/London'&ftw_sic_key=xxxxxxxx&install_security_gw=false&install_security_managment=true&install_mgmt_primary=false&install_mgmt_secondary=true&mgmt_gui_clients_radio=any&admin_hash=xxxxxxxx&default_gw_v4=192.168.1.1&download_info=true&download_from_checkpoint_non_security=true&ipaddr_v4=192.168.1.2&masklen_v4=24&ipstat_v4=manually&mgmt_admin_name=admin&mgmt_admin_passwd=xxxxxxxx&upload_info=true&maintenance_hash=password"
This config string was accepted and the config started, but it then displayed "Configuring OS Parameters: Error:Invalid Salted Hash".
It then displayed "Configuring Products" and after some time it went back to the login screen.
However, I now cannot log in through the console port as the old password no longer works. I've tried the old password followed by the maintenance hash password but that doesn't work either, nor does the maintenance hash password on it's own.
So, I guess I have to get the data centre staff to reboot the appliance for me and I reset to factory defaults through the boot menu and start all over again. But can anyone confirm what a valid config string for "maintenance_hash" would be so I don't run into this problem again please?
Alternatively, does anyone know a solution to the missing "sic_cert.p12" file that prevented me from upgrading from R80.40 to R81.20?
Thanks
