Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Mazin_D
Contributor

upgarde to R80.30 using CPUSE failing

Jump to solution

i ma trying to upgrade the management server from R80.10 to R80.30 , the management server is in HA and installed on VM. i have upgarded the stnandby managmnet server without any issue. the primary though keeps failing with error "CPUSE encounter a problem while importing the package to Gaia machine. Try to import the package again. If the issue persist, contact checkpoint technical service"

i have tried to upgrade the DA " currently running build 1786" but i got another error "File is not a DA package"

 

any help is highly appreciate it.

 

0 Kudos
2 Solutions

Accepted Solutions
JonnyV
Contributor

CPUSE (not related to mgmt or take 200)
We saw some odd behavior last night in our upgrade using DA 1818 and 1832.
The package we tried to import (t50) gave us branch errors, that DA 1786 didn't.
We had to disable our proxy settings and down rev DA to 1786; then we could import the tgz without errors.

 

 

------------------------------------------------------------------------------
our error for reference: 

checkpoint r80.30 The following results are not compatible with the package:

- Branch gogo_heat_188_main is installed from take 300

This hotfix is only supported on R80.20 takes 260 to 273.
This hotfix is not supported on Linux kernel versions below 3.10.
This hotfix is not supported on Checkpoint Gaia R80.20SP Machines.
This hotfix is not supported on Smart-1 625 appliances.
For more information, refer to sk152652.

------------------------------------------------------------------------------

fw1 ~ # cpinfo -yall

This is Check Point CPinfo Build 914000196 for GAIA
[IDA]
No hotfixes..

[MGMT]
No hotfixes..

[CPFC]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

[FW1]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

FW1 build number:
This is Check Point's software version R80.30 - Build 032
kernel: R80.30 - Build 034

[SecurePlatform]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

[PPACK]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

[CPinfo]
No hotfixes..

[CPUpdates]
BUNDLE_CPINFO Take: 49
BUNDLE_R80_30_JUMBO_HF_MAIN_3_10_GW Take: 50

[DIAG]
No hotfixes..

[CVPN]
No hotfixes..

View solution in original post

JonnyV
Contributor

Speculating here since we never got a good RFO from Checkpoint.

Checkpoint didn't include a CRC check in the newer CPUSE version for take 50.
The only work around we could come up with was to disable internet connectivity (by breaking DNS or proxy) and installing take50 before CPUSE upgraded past the affected version.

View solution in original post

0 Kudos
21 Replies
Martin_Valenta
Advisor
At first you you should have TAC case and second, if you have it VM based, why not have clean install and export/import database data? It's prefered to do clean install for management installs.
0 Kudos
Mazin_D
Contributor
Thanks Martin for your quick response. I will do the clean install if I couldn't solve this issue, as I mentioned, the standby has been upgraded successfully without any issue.
0 Kudos
Maarten_Sjouw
Champion
Champion
For the upgrade of the installer itself, you need the command:
installer agent update
Downloading the deployment agent package indeed gives the mentioned error, had it this week as well, running the agent update did work though.
Regards, Maarten
0 Kudos
Mazin_D
Contributor
Hi Maarten
the management server has no access to Internet, so all the upgrade is offline upgrade. I have tried installer agent update and I have Deployment Agent: Agent is up to date message.

Regards,

Mazin
0 Kudos
mdjmcnally
Advisor

Current Deployment Agent release is 1818.   There is an 1825 on Gradual Deployment If you have no Internet Connection from the Management Server then will say whatever version has is upto date.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

 

Download the tgz file from here and then update by SFTP the file to the VM and installing with

 

Extract the DA File

tar -zxvf DeploymentAgent_<build>.tgz 

Install the RPM

rpm -Uhv --force CPda-00-00.i386.rpm

Start the DA Agent

$DADIR/bin/dastart

This will get the DA Agent upto dat

Mazin_D
Contributor
thank you a lot, that's work to upgrade the DA to 1818, but still not able to upgrade R80.30, getting the same error "CPUSE encounter a problem while importing the package to Gaia machine. Try to import the package again. If the issue persist, contact checkpoint technical service"
any advice please
0 Kudos
_Val_
Admin
Admin

Please check file hash, it might be corrupted when downloaded or transferred to the target machine

0 Kudos
Mazin_D
Contributor
checked it and it match the hash on the checkpoint download page
0 Kudos
mdjmcnally
Advisor

Did you download the package from

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_d...

That is where the CPUSE Upgrade Security Management link on the R80.30 pages takes me

 

Check_Point_R80.30_T200_Fresh_Install_and_Upgrade_Security_Management.tgz

Is the filename

Does the md5sum matchup after the download

 

Mazin_D
Contributor
yes this is the one, and I checked the hash and it matchup
0 Kudos
mdjmcnally
Advisor

Anything in the /opt/CPInstLog/DeploymentAgent.log to indicate about errors.

Failing that then going to say TAC Case.

 

Mazin_D
Contributor

I have already opened TAC but its not as fast as checkmate, I have attached the log. hopefully someone can spot something.

 

thanks in advance for all the help.

 

0 Kudos
mdjmcnally
Advisor

/var/log/upload//Check_Point_R80.30_T200_Fresh_Install_and_Upgrade_Security_Management.tgz is not a valid archive. Not attempting to extract content

 

Seems to be what sticks out here.   Have the latest DA  so that shouldn't be an issue.

Not sure how going to fix that

 

 

 

 

 

EdsonF96
Participant

Why don't you upgrade using "migrate export/import " ?

Mazin_D
Contributor
as I mentioned before, the upgrade using CPUSE was successful with the standby server, so that why I was trying to fix this issue with the primary. as I get to dead end with this issue. I will use migrate export/import today
0 Kudos
Maarten_Sjouw
Champion
Champion
A clean install for management is preferred anyway when you go from R80.10 to any higher version as then you will get the new filesystem, that is a main benefit for management as there most of the actions include disk access.
Regards, Maarten
JonnyV
Contributor

CPUSE (not related to mgmt or take 200)
We saw some odd behavior last night in our upgrade using DA 1818 and 1832.
The package we tried to import (t50) gave us branch errors, that DA 1786 didn't.
We had to disable our proxy settings and down rev DA to 1786; then we could import the tgz without errors.

 

 

------------------------------------------------------------------------------
our error for reference: 

checkpoint r80.30 The following results are not compatible with the package:

- Branch gogo_heat_188_main is installed from take 300

This hotfix is only supported on R80.20 takes 260 to 273.
This hotfix is not supported on Linux kernel versions below 3.10.
This hotfix is not supported on Checkpoint Gaia R80.20SP Machines.
This hotfix is not supported on Smart-1 625 appliances.
For more information, refer to sk152652.

------------------------------------------------------------------------------

fw1 ~ # cpinfo -yall

This is Check Point CPinfo Build 914000196 for GAIA
[IDA]
No hotfixes..

[MGMT]
No hotfixes..

[CPFC]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

[FW1]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

FW1 build number:
This is Check Point's software version R80.30 - Build 032
kernel: R80.30 - Build 034

[SecurePlatform]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

[PPACK]
HOTFIX_R80_30_GOGO_JHF_MAIN Take: 50

[CPinfo]
No hotfixes..

[CPUpdates]
BUNDLE_CPINFO Take: 49
BUNDLE_R80_30_JUMBO_HF_MAIN_3_10_GW Take: 50

[DIAG]
No hotfixes..

[CVPN]
No hotfixes..

View solution in original post

Mazin_D
Contributor

thank you all,

I was upgrade using the clean install but because I used the wrong migration tool package I reverted back to R80.10 and restored from backup, updated the DA to 1786 and tried again to upgarde using CPUSE and it worked like magic.

thanks again, and have a nice weekend all

_Val_
Admin
Admin

I am glad the issue is resolved. Thanks for sharing

0 Kudos
JonnyV
Contributor

Speculating here since we never got a good RFO from Checkpoint.

Checkpoint didn't include a CRC check in the newer CPUSE version for take 50.
The only work around we could come up with was to disable internet connectivity (by breaking DNS or proxy) and installing take50 before CPUSE upgraded past the affected version.

View solution in original post

0 Kudos
Simon_Taylor
Contributor

Note that if you edit the date on your Check Point device in an attempt to circumvent the license you may encounter this issue. I did and after much research a new eval license was all I needed along with setting the correct date/time to get the packages to add.

0 Kudos