upgarde to R80.30 using CPUSE failing

[Mazin_D]

i ma trying to upgrade the management server from R80.10 to R80.30 , the management server is in HA and installed on VM. i have upgarded the stnandby managmnet server without any issue. the primary though keeps failing with error "CPUSE encounter a problem while importing the package to Gaia machine. Try to import the package again. If the issue persist, contact checkpoint technical service"

i have tried to upgrade the DA " currently running build 1786" but i got another error "File is not a DA package"

any help is highly appreciate it.

[Martin_Valenta]

At first you you should have TAC case and second, if you have it VM based, why not have clean install and export/import database data? It's prefered to do clean install for management installs.

[Mazin_D]

Thanks Martin for your quick response. I will do the clean install if I couldn't solve this issue, as I mentioned, the standby has been upgraded successfully without any issue.

[Maarten_Sjouw]

For the upgrade of the installer itself, you need the command:
installer agent update
Downloading the deployment agent package indeed gives the mentioned error, had it this week as well, running the agent update did work though.

[Mazin_D]

Hi Maarten
the management server has no access to Internet, so all the upgrade is offline upgrade. I have tried installer agent update and I have Deployment Agent: Agent is up to date message.

Regards,

Mazin

[mdjmcnally]

Current Deployment Agent release is 1818.   There is an 1825 on Gradual Deployment If you have no Internet Connection from the Management Server then will say whatever version has is upto date.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Download the tgz file from here and then update by SFTP the file to the VM and installing with

Extract the DA File

tar -zxvf DeploymentAgent_<build>.tgz 

Install the RPM

rpm -Uhv --force CPda-00-00.i386.rpm

Start the DA Agent

$DADIR/bin/dastart

This will get the DA Agent upto dat

[Mazin_D]

thank you a lot, that's work to upgrade the DA to 1818, but still not able to upgrade R80.30, getting the same error "CPUSE encounter a problem while importing the package to Gaia machine. Try to import the package again. If the issue persist, contact checkpoint technical service"
any advice please

[_Val_]

Please check file hash, it might be corrupted when downloaded or transferred to the target machine

[Mazin_D]

checked it and it match the hash on the checkpoint download page

[mdjmcnally]

Did you download the package from

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_d...

That is where the CPUSE Upgrade Security Management link on the R80.30 pages takes me

Check_Point_R80.30_T200_Fresh_Install_and_Upgrade_Security_Management.tgz

Is the filename

Does the md5sum matchup after the download

[Mazin_D]

yes this is the one, and I checked the hash and it matchup

[mdjmcnally]

Anything in the /opt/CPInstLog/DeploymentAgent.log to indicate about errors.

Failing that then going to say TAC Case.

[Mazin_D]

I have already opened TAC but its not as fast as checkmate, I have attached the log. hopefully someone can spot something.

thanks in advance for all the help.

[mdjmcnally]

/var/log/upload//Check_Point_R80.30_T200_Fresh_Install_and_Upgrade_Security_Management.tgz is not a valid archive. Not attempting to extract content

Seems to be what sticks out here.   Have the latest DA  so that shouldn't be an issue.

Not sure how going to fix that

[EdsonF96]

Why don't you upgrade using "migrate export/import " ?

[Mazin_D]

as I mentioned before, the upgrade using CPUSE was successful with the standby server, so that why I was trying to fix this issue with the primary. as I get to dead end with this issue. I will use migrate export/import today

[Maarten_Sjouw]

A clean install for management is preferred anyway when you go from R80.10 to any higher version as then you will get the new filesystem, that is a main benefit for management as there most of the actions include disk access.

[JonnyV · Accepted solution]

CPUSE (not related to mgmt or take 200)
We saw some odd behavior last night in our upgrade using DA 1818 and 1832.
The package we tried to import (t50) gave us branch errors, that DA 1786 didn't.
We had to disable our proxy settings and down rev DA to 1786; then we could import the tgz without errors.

------------------------------------------------------------------------------
our error for reference: 

checkpoint r80.30 The following results are not compatible with the package:

- Branch gogo_heat_188_main is installed from take 300

This hotfix is only supported on R80.20 takes 260 to 273.
This hotfix is not supported on Linux kernel versions below 3.10.
This hotfix is not supported on Checkpoint Gaia R80.20SP Machines.
This hotfix is not supported on Smart-1 625 appliances.
For more information, refer to sk152652.

------------------------------------------------------------------------------

fw1 ~ # cpinfo -yall

This is Check Point CPinfo Build 914000196 for GAIA
[IDA]
No hotfixes..

[MGMT]
No hotfixes..

[CPFC]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

[FW1]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

FW1 build number:
This is Check Point's software version R80.30 - Build 032
kernel: R80.30 - Build 034

[SecurePlatform]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

[PPACK]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

[CPinfo]
No hotfixes..

[CPUpdates]
BUNDLE_CPINFO Take: 49
BUNDLE_R80_30_JUMBO_HF_MAIN_3_10_GW Take: 50

[DIAG]
No hotfixes..

[CVPN]
No hotfixes..

[Mazin_D]

thank you all,

I was upgrade using the clean install but because I used the wrong migration tool package I reverted back to R80.10 and restored from backup, updated the DA to 1786 and tried again to upgarde using CPUSE and it worked like magic.

thanks again, and have a nice weekend all

[_Val_]

I am glad the issue is resolved. Thanks for sharing

[JonnyV · Accepted solution]

Speculating here since we never got a good RFO from Checkpoint.

Checkpoint didn't include a CRC check in the newer CPUSE version for take 50.
The only work around we could come up with was to disable internet connectivity (by breaking DNS or proxy) and installing take50 before CPUSE upgraded past the affected version.

[Simon_Taylor]

Note that if you edit the date on your Check Point device in an attempt to circumvent the license you may encounter this issue. I did and after much research a new eval license was all I needed along with setting the correct date/time to get the packages to add.