R80.40 Open Server

[Simon_Macpherso]

Hello,

Can you please confirm the procedure to deploy R80.40 as a fresh install to open server?

From what I’ve been reading, the R80.40 blink image for management is required however to install a blink image a prior Gaia OS needs to be installed first i.e. R80.30. Is this correct?

I was advised by TAC to I didn't need to the blink image - I can use the R80.40 ISO from the R80.40 home page and then install the required  R80.40 JHF.

However I’ve tried using the clean install ISO from the downloads section of the R80.40 home page but I cant boot from it in vSphere.

The following information is stated on the download details page.

Gaia Fresh Install For Security Gateway, Security Management and StandAlone

Note:

Clean Install or upgrade of R80.40 Security Gateway or Standalone configuration on Open Server is supported using blink image of R80.40 Jumbo Hotfix. use the latest blink image in  R80.40 Jumbo Hotfix Accumulator SK.

To install a Blink image, a prior Gaia OS is required to be installed first

R80.40 is fully supported on all Check Point appliances.

It seems there is conflicting information.

Regards,

Simon

[PhoneBoy]

I believe you can use the R80.40 ISO to install on Open Server (as TAC said).
It's not a supported configuration until you install the relevant JHF (Take 48 or above, I think).
What you're likely running into here is you did not change the SCSI Controller from VMware Paravirtual.
That definitely won't work, but SAS or Parallel will.

[Simon_Macpherso]

The SCSI Controller is already configured as LSI Logic SAS. 

The ISO is stored on a network share which is mapped as a local drive. 

Using the clean install ISO from the download link on the r80.40 home page.

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_d...

[PhoneBoy]

Just tried it in VMware ESXi 7 with that ISO, appears to be working just fine, or at least I get past where that error generally occurs.
Note the issue with Open Servers on the R80.40 GA ISO does not apply to VMware, but rather bare-metal Open Servers (i.e. things where the HCL applies).

[Simon_Macpherso · Accepted solution]

Thanks @PhoneBoy 

The ISO would not boot off the local network share for some reason. After copying the ISO to a local drive it worked. 

[PhoneBoy]

Yeah, that's the only part of this I couldn't replicate, I just used the ISO from the local datastore.

[_Val_]

On VSphere, always upload ISO to a local datastore on the server.

[Simon_Macpherso]

Is this documented somewhere?

[_Val_]

Yes, on VMware support portal. Here is just an example: https://communities.vmware.com/t5/vSphere-Upgrade-Install/Mounting-an-ISO-Image-with-Web-Client/td-p...

Web client mounts are flaky at best

[RamGuy239]

I'm a tad bit late here. But the easiest option when doing management, or gateway installations on VMware or any virtual environment really is to simply use the images provided in sk158292.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

This makes it far easier. You have various settings already pre-configured to the recommended settings. On newer versions, you even have the capability to pre-configure various settings during the deployment process like admin password, sic password etc.

It ensures a lot of details like always using thick provisioning on the disk that many users tend to ignore, using the recommended VMXNET3 NIC etc. It also pre-configures the /boot/grub/grub.conf with a slight boot delay making you capable of entering the boot menu in order to boot into maintenance mode when running a virtual gateway/management without you have to modify this yourself. A delay of 0 seconds tends to be too fast for anyone to interrupt the boot sequence on a virtual installation.

I can't really recommend using these images enough. The only downside to the image versus ISO is how they only come with a 100GB disk for GAiA. You pretty much have to add an additional disk so you have enough space for upgrades, and for management installations, you will need more storage for logging etc. This is not a huge issue but this means that you will have to add an additional disk and follow sk94671 in order to make the additional disk available in lvm_manager and utilise lvm_manager to increase the partition sizes.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...


Especially when working with less tech-savvy and Check Point-savvy users providing them with a bulletproof OVF-file tends to make things go far smoother than providing them with an ISO.

[RamGuy239]

These issues shouldn't prohibit or cause installation issues as far as I'm aware? You simply shouldn't put any R80.40 open server GA installation without any JHF installation into production. But if you are deploying a new open server it would be rather ill advised to not install the latest GA JHF, to begin with. The best practice would always be to install the latest GA JHF before putting it into production.

[PhoneBoy]

The main blocking issue in R80.40 had to do with Hyperthreading and Licensing, as I recall.
Shouldn’t impact the initial installation which can of course just use the 15-day PnP license.