R80.30 JHF 155 to R80.40 Smart-1 410 says its successful - but Its not

[Darren_Fine]

Hi there,

I have a client who wants to use the new multiple vpn domain features of R80.40. So we have tried our first upgrade on their Smart-1 410 from R80.30 to R80.40.

The upgrade says everything is successful but it is not- namely :

1) cant verify the policy - just flat out fails with a red X no reason

2) If I try and install Database it will hang there .. have waited 30 mins ... doesnt get to 1 %

3) Originally did try install policy gave a generic error to contact technical support

4) No logs appear at all.

I have reverted back twice and upgraded 3 times - but nothing changes. Also tried the new hotfix from yesterday JHF 38 - no difference.

Opened a TAC case originally  - they said issue was I had to update the IPS signatures -- but that turned out to be of no use .

Have send TAC info waiting to see what they come up with but doesnt look good . (weird that the upgrade report is happy and says all went fine but its really broken )

Anyone else have similar issues - or are your upgrades just working ?

[Darren_Fine · Accepted solution]

Hi Guys,

So I have the answer and I was really suprised ... the issue is that the new R80.40 has a separate HTTPS Inspection policy and since I did not have HTTPS Inspection running on R80.30 - the upgrade did not populate the HTTP Inspection policy at all.

So this basically was breaking things since there is some validation done on this policy even if you are not using it ..(like https inspection is not ticked under any gateways).

So the fix is really simple - make a rule under the new HTTPS Inspection policy (any rule since its not gonna be used) and then everything will start working ...like 

1) Logging starting working 

2) Database install on Mngmt works

3) Policy verification works

4) Installing policy on gateways works 

So thanks to WesleyM from TAC for catching this one !!!

Hopefully I have saved some of you from this error and made your upgrades smoother 🙂

[PhoneBoy]

That's an interesting bug.
Thanks for sharing your experience and glad it had a relatively simple workaround.