Quantum Force 3920

[RemoteUser]

Hi Mates,

Yesterday I configured a Quantum Force 3920 cluster running R82.10, managed by an R82 -S1C. Everything seems to be working fine so far.

However, I have a question because I’m a bit confused: does this cluster require any hotfixes to be installed?
When i'm try to download a pacakeg this is the only option:


installer download
** ************************************************************************* **
** Majors **
** ************************************************************************* **
Num Display name Status
1 Check_Point_R82.10_T464_Gaia_Install_and_Upgrade_For_3900_Appliances.tgz Available for Download

I put the cpinfo output:

cpinfo -y all

This is Check Point CPinfo Build 914000219 for GAIA
[CPshared]
No hotfixes..
[IDA]
No hotfixes..
[CPFC]
No hotfixes..
[MGMT]
No hotfixes..
[FW1]
HOTFIX_INEXT_NANO_EGG_AUTOUPDATE
HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE
HOTFIX_GOT_TPCONF_AUTOUPDATE

FW1 build number:
This is Check Point's software version R82.10 - Build 407
kernel: R82.10 - Build 422
[SecurePlatform]
No hotfixes..
[CPinfo]
No hotfixes..
[PPACK]
No hotfixes..
[AutoUpdater]
HOTFIX_INFRA_CONFIG_AUTOUPDATE
[DIAG]
No hotfixes..
[CVPN]
No hotfixes..
[CPUpdates]
BUNDLE_INEXT_NANO_EGG_AUTOUPDATE Take: 38
BUNDLE_CPVIEWEXPORTER_AUTOUPDATE Take: 75
BUNDLE_QUID_AUTOUPDATE Take: 53
BUNDLE_CPOTLPAGENT_AUTOUPDATE Take: 131
BUNDLE_CPOTELCOL_AUTOUPDATE Take: 210
BUNDLE_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE Take: 21
BUNDLE_GOT_TPCONF_AUTOUPDATE Take: 158
BUNDLE_HCP_AUTOUPDATE Take: 88
BUNDLE_CPSDC_AUTOUPDATE Take: 40
BUNDLE_INFRA_CONFIG_AUTOUPDATE Take: 13
[cpsdc_wrapper]
HOTFIX_CPSDC_AUTOUPDATE
[hcp_wrapper]
HOTFIX_HCP_AUTOUPDATE
[CPotelcol]
HOTFIX_OTLP_GA
[CPotlpAgent]
HOTFIX_OTLP_GA
[CPquid]
HOTFIX_QUID_AUTOUPDATE
[CPviewExporter]
HOTFIX_OTLP_GA

Platform: BT-91-00
Model: CheckPoint 3920
CPU Model: Arm..Neoverse..(N2)
CPU Frequency: 1600 MHz
Number of Cores: 6
CPU Hyperthreading: Disabled



Thanks in advance

[Tom_Hinoue · Accepted solution]

See here.

Jumbo Hotfix Accumulator for Quantum Force 3900 Appliances
https://support.checkpoint.com/results/sk/sk183557

The latest JHF build is Take 22 for 3900 appliances, but from your cpinfo output it says the base build is T464 which already includes the fixes from Take 22. This means your appliance is already up to date and no hotfixes are needed atm.

>>The content of Jumbo Hotfix Accumulator for Quantum Force 3900 Appliances Take 22 is included in Check Point R82.10 Take >>464. You do not need to install Jumbo Hotfix Accumulator for Quantum Force 3900 Appliances Take 22 on top of R82.10 Take 464.

::EDIT::
I saw the output says a T464 is available for "download", sorry for my confusion.
You may also want to check CPUSE if it suggests you a JHF T22 is available for your environment. Thanks.

[RemoteUser]

Thank a Lot!

[the_rock]

Hey bro,

I dont believe there is an official "standalone" jumbo take yet for R82.10, its all included in the base version. Once first comes out, Im sure there will be a link for it and announcement on the community.

[Steffen_Appel]

How can you upgrade the factory image to a new take on the 3920?

[RemoteUser]

What you mean sorry?
Can you elaborate more? If the appliance have the OS build 271, so you need to upgrade to R82.10 Take 464. This Take (464) include the JHF 22.

[Steffen_Appel]

The normal upgrade only upgrades the current image, a factory reset will revert to the old factory image - on the Sparks appliance you can update the factory image from the current image, is there a way for other appliances as well?

[Steffen_Appel]

Is Isomorphic the only way?

[RemoteUser]

You can do a clean install

[Steffen_Appel]

Does that update the factory image?

[emmap]

A clean build from USB using Isomorphic is the only way to change the factory defaults image on any full Gaia system.

[Steffen_Appel]

Take 464 is the latest build for R82.10, which includes JHFA take 22 and additional patches, from the dokumentaion you should be fine and the doku says, that new jumbos will rquire T464 as the base.

So as we got out 3920 with the older GA version of R82.10, we had to install jumbo 22 and then T464 to be able to install future jumbos.

[emmap · Accepted solution]

Check your OS build in clish with 'show version all'. If you have the old build of R82.10 (271?) then you need to install the special JHF for 3900 take 22, then upgrade to R82.10 build 464 with the package available for download there.

Or if this isn't in production yet, the cleanest way would be to get the R82.10 build 464 ISO for 3900s (it's not the regular ISO, there's a special one for the 3900s) and install it fresh with ISOMorphic. This will have the advantage of ensuring that the factory default image on there is updated too. 

[RemoteUser]

Product version Check Point Gaia R82.10
OS build 271
OS kernel version 5.14.0-427.13.1cpaarch64
OS edition aarch64

[RemoteUser]

Can i leave at the moment the cluster in this way? (Without JHF)  What could be the impact? Thanks @emmap 

[Chris_Atkinson]

You risk encountering already resolved issues at a minimum.

Rather what would be the motivation not to apply the updates?

Future JHF will not be installable without first  undertaking the upgrade as described above by Emma.

[RemoteUser]

I'm just curious 🙂

[Phil_Pasquier]

Has anyone here performed the upgrade on 3920 appliances from R82.10 T271 JHF T22 to R82.10 T464 using the package:

Check_Point_R82.10_T464_Gaia_Install_and_Upgrade_For_3900_Appliances.tar

Any issue ?

Thanks

Phil

[emmap]

I haven't done it myself, but I've heard from people who have and they haven't reported any issues. 

[RemoteUser]

Hi mates,

Yesterday I was on site at the customer for the configuration of a 3920 appliance, and I have a few questions:

Why is the appliance preconfigured with OS build 271, if this OS is not part of the future roadmap?

I noticed that I need to install JHF 22 before upgrading to OS build 464. Why is this required? Why can’t I upgrade directly to build 464? I understand that OS 464 it's integrated with the JHF22 - but why it's neccsary to install the jumbo before going to new OS..

Additionally, I’m experiencing a separate issue with the USB when using isomorphic.
Thanks a lot for the clarification 

[Steffen_Appel]

I was able to reimage to B464 with an USB stick, but had to try 2 different ones as well.

[PhoneBoy]

The appliance you received was likely manufactured before the introduction of R82.10 GA2.
More about this here: https://community.checkpoint.com/t5/Security-Gateways/3900-Gateways-and-R82-10-GA/m-p/266211#M52569 

[the_rock]

Makes sense.

[RemoteUser]

Thanks for the info @PhoneBoy 

[RemoteUser]

Update for all. If you want to upgrade from 271 to 464 rember to enable MVC!!!

[C_H]

Can confirm this, otherwise 464 member wont join the cluster. 

[Alex-]

Note that if you can allow the maintenance window, Take 464 is an opportunity to switch from ClusterXL to ElasticXL.

It took a couple of steps but worked.

https://community.checkpoint.com/t5/Security-Gateways/3900-Gateways-and-R82-10-GA/m-p/269483/highlig...