checkpoint IP290 and gaia R77.10

[Mazin_D]

I need an expert opinion here …..

we have checkpoint IP290 running Gaia R77.10, the firewall had a hard drive failure and we can't run fsck as we are not presented with the option  "press any key to see boot menu ".

we have a support contract with other company, this company can provide the hardware but with Gaia R71. we are running glusterXL and the software should be identical. the support company can't source the interim software required to upgarde from R71 to R77.10 ( R75 and R77). 

I need the community help here , what we can do ?

[Wolfgang]

Mazin,

R77.10 and IP290 are a long time out of support....

First of all are you sure you are running GAiA not IPSO on the production and on the replacement appliance?

You can do an upgrade from R71 to R75.40 R75.40 and then to R77.10 R77.10 and then your installed hotfix for R77.10.

Wolfgang 

[Mazin_D]

according to the upgrade map, the latest you can go from R71 is to R75 .

[PhoneBoy]

The IP290 is more than 10 years old and is End of Support.
R77.10 is also End of Support.

The effort you'd spend to bring another IP290 to the same code level would be better spent replacing the cluster with newer appliances.

[Mazin_D]

totally agree, but that decision needs to be taken by our customer who is not welling to invest in new firewalls at the moment.

[G_W_Albrecht]

The IP290 has been supported for 11 years - all support has officially ended on 31-Dec-18. Supported CP SW versions were 77, R76, R75, R70. The CP Download Wizard  still has R76 and R77.xx Version installation packages for IP290 GAiA available, so  i would rather use that...

[Mazin_D]

thanks for the reply, the issue is that the support company seems has no access to checkpoint software. my question here, can we install R77.10 as a fresh install without going through the interim version ?. the replacement firewall is a brand new one so no configuration need to be preserved .

[_Val_]

@Mazin_D I suspect there is a Check Point support contract missing on your HW and licenses. Without it, there is no legitimate way to download the installation software. Moreover, there is no currently supported software that is installable on IP290.

[Mazin_D]

my client has inherited those equipment from another company which is out of the business. they have a support contract with 3rd party company which is proofed useless in this particular case 

[Maarten_Sjouw]

Quote <<My question here, can we install R77.10 as a fresh install without going through the interim version? >>
When you have the install iso for R77.10 you can directly do a fresh install with that ISO, you do not need to first install R77 and then add the R77.10 update..

[Mazin_D]

yes we have the ISO, will go through that path and inform you. thanks

[Maarten_Sjouw]

I still have 2 of those IP290's in production, 1 in Chile and one in our DC but both customers are on the break of leaving us so I don't really want to touch them.
They run IPSO6.2 with R77.30 on top, as this runs much better on those boxes than GAIA does.

[G_W_Albrecht]

That is the main thing - on a late IPSO version it will work better than on GAiA - for a lack of resources only...

[PhoneBoy]

There is no ISO for IP Appliances (either IPSO or Gaia), but the install package should allow for either a fresh install or an upgrade from a previous release.

[_Val_]

@Mazin_D Let me rephrase. There are some options here.

1. You want to reinstall the box with R77.10. To get SW, you need a valid contract subscription in place. If you have it, you can download software from Check Point User Center. You will not have any support from the vendor for this version.

2. There is another _supported_ version, R77.30. However, it will go out of support in a couple of weeks. Same situation on the legal side, you need a valid contract to download.

Any other currently supported version will not work on IP290.

Honestly, I do not see any good option for you here other than buy new appliances and replace the outdated systems for good.

[Mazin_D]

thanks Valeri, totally agree. what is the new hardware I should go to ? I need one that offers easy transition from IP290

[_Val_]

@Mazin_D 

The best is to engage your local Check Point office or a partner to see what replacement options would be reasonable. 

[Ian_Porteous]

@Mazin_D 

I dropped you an email this morning, Please feel free to reply to me outside this thread if we can be of any assistance.

Regards

Ian