Does 4600 Appliances supports upgrade to R80.20?

[Gareth_Kik]

Guys Hi!

Friends, need your advice.

In one of our office we have cluster of 4600 appliances with default memory 4GB. It is managed by our central management server that is running on R80.20 VMware.

My question is, can I upgrade 4600 appliances from R77.30 to R80.20? 

I saw documentation, it says I should upgrade memory only in case if I need Standalone Mode. As I understand Standalone Mode means that security gateway and security management is running on the same appliance. But In my case our appliances are managed by central management server.

Can I relax and start upgrade processes? 🙂

[Martin_Valenta]

Yes you can, you can relay on Upgrade wizard, when not sure if it's supported or not..

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowupgradewizard

[Gareth_Kik]

Hi!

Upgrade Wizard shows supported systems but I know it do supports on this appliance. My question actually is if R80.20 is supported with default memory that is 4GB on 4600 Appliances. I cannot upgrade them because this series is out of sales. I need to go with 4GB memory only

[Timothy_Hall]

Normally you would go here and click Appliances Support, then click Enterprise Appliances to determine if an appliance supports a certain software release:

https://www.checkpoint.com/support-services/support-life-cycle-policy/

However the only gateways currently shown as supporting R80.20 are the 6000 series appliances which I know is not correct, looks like this page needs to be updated for R80.20.

The R80.20 release notes say that a 4600 with 4GB RAM is supported for gateway only but not for standalone (gateway + management) unless upgraded to 8GB RAM.

[Gareth_Kik]

Timothy Hi! Thanks for reply.

With R77.30 and with 4GM RAM appliances memory is in most cases overloaded 80-90%.

Support said I new version is lither and it works faster based on code. Is R80.20 uses less memory in case of security gateway? I use NGTP with SSL inspection?

Please advice

[PhoneBoy]

Can you explain what you mean specifically by "overloaded 80-90%"?

From a gateway (only) perspective, you should be able to run R80.20 on a 4600 with 4GB of RAM.
In some cases, yes, the performance will be marginally better.
If the box is already operating near capacity as your comment suggests, your situation may not substantially improve by upgrading.

I would strongly consider working with your local Check Point reseller to trade-in your 4600 for something more modern.
A "cpsizeme" can be done on your existing gateways to find out what the true performance requirements are for your environment to ensure the right-sized solution is chosen.

[Benny_Shlesinge]

Thank you for letting us know of the mistake in the lifecycle page. It is of course an error and R80.20 is supported on 4600 as well as the rest of the 4000 series. I'll check why was it removed (the cached page proves it was there March 31st).

Regarding the RAM requirements of R80.20 on 4600: 8GB RAM is recommended in this case. For standalone deployments it is mandatory.

The SKU to look into ordering for upgrades is CPAC-RAM4GB (same as 4800 / 12200).

It is officially EOL together with the appliances but we continue to provide it based on stock availability and we currently do have it in stock.

Thanks again,

Benny.

[Vato_Chantladze]

Please refer based on SK71001 - Starting from R80.20, all appliances are 64-bit by default. It requires 8GB of RAM. When you install new system you may need to manually switch 64-bit mode to 32-bit.

BR
Vato

[Gareth_Kik]

Guys,

Thanks for replies! I will close topic last    questions

1) Officially it is supported to install and run R80.20 on 4600 series appliances in gateway mode with 4GB memory? I think you already answered Yes!

2) Does R80.20 supports 32bit mode on 4000 Appliances?

3) So I can upgrade it to R80.20 with 4GB Ram and change mode to 32-bit correct?

4) I’m asking this question because I do not want open case after upgrade and receive answer from support engineers that it is not supported installation

PS. We cannot upgrade memory right now unfortunately 😞

[PhoneBoy]

Pretty sure not only is 64bit the default in R80.20 there is is no 32bit mode in R80.20 either.

It is otherwise supported as you described, though more RAM is highly recommended.

[Vato_Chantladze]

Agree, based on sk94627 starting from R80.20 there is no 32bit at kernel level anymore, only 64bit.

For those who have 4GB memory only and want to go from 77.X to R80.X can choose R80.10 with the 32-bit mode.

BR
Vato

[Gareth_Kik]

Guys,

I'm lost to be honest!

For running 64bit you need more than 4GB RAM. You say 80.20 is supporting 64bit only. But why I see this table on the 80.20 chart where it says you can have 80.20 with 4GB RAM? Is it something like "you can look but never touch" ?

[_Val_]

Not really. RAM size has some conditional relation to OS bit mode. 64bit mode is enabled by default with 4GB or more. 4GB is still a supported RAM size, although it is practically the lower limit.

[Gareth_Kik]

@_Val_ 

I have not started upgrading yet was waiting your response. You saw my case here what you recommend me to do? To go to R80.10 or R80.20? I'm limited with 4GB RAM this is what hurts me  a lot

[_Val_]

@Gareth_Kik, particular upgrade path and target version should be chosen based on your particular needs. If you are interested in plain classic filtering, there is no much difference between R80.10 and R80.20. However, if you want to benefit from the latest and greatest features coming in R80.20, such as Updatable Objects, and others,  go for .20, of course.

[Wolfgang]

Gareth,

I‘m running since two weeks an 4600 gateway with 4GB RAM.

We switched from standalone to distributed and I did no upgrade, we did a fresh install.

Everything looks fine at the moment. We have enabled Firewall, VPN, MOB, URLF, APPCL, ASPAM, AVIR, IPS.

There are only 100 Users behind and fully controlled connections are only at 50MBit/s. Some 1GBit/s connections are working but they are only controlled by firewall blade.

For the way back to the old environment we did some test with snapshots to reverting back. This was the problematic part in the upgrade. We need 1,5hours for a full revert, copying old snapshot to the appliance 20min, reverting from snapshot 1h10min.

Wolfgang

[Gareth_Kik]

Guys,

Thanks for replying. I made upgrade several weeks ago. For this time system works fine.