HF not compatible

[S_E_]

Playground/Lab:

After upgrading a virtual appliance R81.20 to R82 with image Check_Point_R82_T633_Gaia_Install_and_Upgrade.tar,
we tried to install HF12 and/or HF19. But did not work.

fw2-virtual> installer import local /var/log/Check_Point_R82_JUMBO_HF_MAIN_Bundle_T12_FULL.tar
Preparing package for import. This operation might take a few moments
Note: The selected package will be copied into CPUSE repository
Info: Initiating import of Check_Point_R82_JUMBO_HF_MAIN_Bundle_T12_FULL.tar...
Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)
Result: The following results are not compatible with the package:
- Check package compatibility with this version
This hotfix is supported only for Gaia OS Take 627 and higher.
Installing this hotfix on the current Maestro Security Group or Maestro Orchestrator may cause a traffic interruption.
please follow the instructions in sk181511.

fw2-virtual> exit

[Expert@fw2-virtual:0]# fw ver
This is Check Point's software version R82 - Build 760

[Expert@fw2-virtual:0]# cpinfo -y all
cp_get_kernel_version: ERROR: kernel version 4.18.0-372.9.1cpx86_64 is unknown. Perhaps 4.18.0-372.9.1cpx86_64 needs to be added as a version to cp_get_kernel_version and CpOsKernelVersion?

This is Check Point CPinfo Build 914000248 for GAIA
[CPshared]
No hotfixes..
[IDA]
No hotfixes..
[CPFC]
No hotfixes..
[MGMT]
No hotfixes..
[FW1]
HOTFIX_UCA_SSH_TUNNELING_APP_AUTOUPDATE
HOTFIX_UCA_SSH_TUNNELING_SERVICE_AUTOUPDATE
HOTFIX_INEXT_NANO_EGG_AUTOUPDATE
HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE
HOTFIX_UCA_INFRA_MONITOR_SERVICE_AUTOUPDATE
HOTFIX_UCA_INFRA_LOG_SERVICE_AUTOUPDATE
HOTFIX_UCA_INFRA_AUTOUPDATE
HOTFIX_GOT_TPCONF_AUTOUPDATE

FW1 build number:
This is Check Point's software version R82 - Build 760
kernel: R82 - Build 735
[SecurePlatform]
No hotfixes..
[PPACK]
No hotfixes..
[CPinfo]
No hotfixes..
[AutoUpdater]
HOTFIX_INFRA_CONFIG_AUTOUPDATE
[DIAG]
Initializing...ixes..
[CVPN]
HOTFIX_ESOD_CSHELL_AUTOUPDATE
[CPUpdates]
BUNDLE_UCA_SSH_TUNNELING_APP_AUTOUPDATE Take: 32
BUNDLE_CORE_FILE_UPLOADER_AUTOUPDATE Take: 17
BUNDLE_UCA_SSH_TUNNELING_SERVICE_AUTOUPDATE Take: 32
BUNDLE_INEXT_NANO_EGG_AUTOUPDATE Take: 13
BUNDLE_CPSDC_AUTOUPDATE Take: 34
BUNDLE_HCP_AUTOUPDATE Take: 74
BUNDLE_CPVIEWEXPORTER_AUTOUPDATE Take: 40
BUNDLE_QUID_AUTOUPDATE Take: 14
BUNDLE_CPOTLPAGENT_AUTOUPDATE Take: 50
BUNDLE_CPOTELCOL_AUTOUPDATE Take: 129
BUNDLE_ESOD_CSHELL_AUTOUPDATE Take: 20
BUNDLE_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE Take: 21
BUNDLE_INFRA_CONFIG_AUTOUPDATE Take: 5
BUNDLE_UCA_INFRA_MONITOR_SERVICE_AUTOUPDATE Take: 29
BUNDLE_UCA_INFRA_LOG_SERVICE_AUTOUPDATE Take: 23
BUNDLE_UCA_INFRA_AUTOUPDATE Take: 56
BUNDLE_GOT_TPCONF_AUTOUPDATE Take: 128
[CPotelcol]
HOTFIX_OTLP_GA
[CPotlpAgent]
HOTFIX_OTLP_GA
[CPquid]
HOTFIX_QUID_AUTOUPDATE
[CPviewExporter]
HOTFIX_OTLP_GA
[hcp_wrapper]
HOTFIX_HCP_AUTOUPDATE
[cpsdc_wrapper]
HOTFIX_CPSDC_AUTOUPDATE
[core_uploader]
HOTFIX_CHARON_HF

[Expert@fw2-virtual:0]# c

Could not find a never image version or R82. Is there any ?
Blink/GUI is not an option/can't be used.

Thanks, Regards

[the_rock]

I dont know if this could be related, but had similar issue with customer the other day. Have a look at steps in the documentation.

Andy

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Maestro_AdminGuide/Content/T...

step 2 is what really matters

[S_E_]

sorry, was not clear enough.

It is a virtual sytem on a hypervisor

not a VSX, not maestro

But thanks

[the_rock]

Gotcha. if you do installer verify, what does it show?

Andy

[S_E_]

hi

issue appears already with import. verifyer does not see package.

Regards

[the_rock]

I get that. What I mean is this:

in clish, type installer verify, hit tab and see what it shows. If you get some options, try hit one of them and see what it gives you.

Andy

[S_E_]

hi,

nothing

Regards

fw2-virtual> installer verify
** ************************************************************************* **
** Connection error. Packages list might be incomplete **
** ************************************************************************* **
Show packages: no packages to display

[emmap]

Is the take of Deployment Agent on there up to date? Does the VM have internet access to check?

[the_rock]

Good point, though to me, logically, based on the message shown, it would indicate that jumbo itself is incompatible with the actual version, which is indeed odd. I upgraded 2 of my labs while ago from R81.20 ro R82 and never had this problem. Mind you, I did jumbos via web UI, only via clish in vsnext, but that one was fresh R82 install.

Andy

[S_E_]

yeah,

basically, Initial idea was to test image Check_Point_R82_T633_Gaia_Install_and_Upgrade.tar

before we roll out to production devices (virtual & hardware)

Thanks, Regards

[emmap]

Is that an EA installer? The GA upgrade file on the R82 SK page is Check_Point_R82_T777_Gaia_Install_and_Upgrade.tar.

[S_E_]

Hi,

No idea, I downloaded the file some weeks ago.

But, I do not see r82 tar file do download. If you have direct link, that would be great. 

Only the blink image: blink_image_1.1_Check_Point_R82_T777_JHF_T19_SecurityGateway.tgz 

And this can't be installed via cpuse/clish.

Regards

[emmap · Accepted solution]

You can use blink files via CPUSE if you want. Here is the link to the GA upgrade file:

https://support.checkpoint.com/results/download/135015

[S_E_]

hi,

this did the trick.

Upgrade to T777 and afterwards HF12

Check_Point_R82_JUMBO_HF_MAIN_Bundle_T12_FULL.tar
Check_Point_R82_T777_Gaia_Install_and_Upgrade.tar

[Expert@fw-virtual:0]# cpinfo -y FW1

This is Check Point CPinfo Build 914000250 for GAIA
[FW1]
HOTFIX_R82_JUMBO_HF_MAIN Take: 12

Thanks a lot

Regards

PS:  I tried cpuse and blink, did not work

PS2: Official R82 points always to blink images(combined with HF)

Search didn't provide this link

[the_rock]

Glad you got it working.

[emmap]

The base GA ISO is on the R82 page as well, but it's lower down under Additional Downloads. I don't know why this happened.

[S_E_]

hi,

yes up2date, manual installation

no internet access

fw2-virtual> show installer status build
Build number: 2589 (agent build is up to date)