R80.30 JHF - ongoing take #50 is now GA

[Shirleyh]

Hi,

 R80.30 Jumbo HF Take #50 is now our GA take.

This take will be available for download to all via CPUSE (as recommended) and via sk153152

Release Highlight:

• This Jumbo include fixes for both Gaia 2.6.18 (based on R80.30 GA Take 200) and Gaia 3.10 (based on R80.30 3.10 GA Take 273).
• Management support for 16000 and 26000 appliances ( with SmartConsole Build #08)
• SA-213 (PRJ-5028) - In a rare scenario, R80.30 Security gateway managed by R80.30 Management crashes when running a Threat Prevention Software Blade with the Forensics feature enabled. Refer to sk161812.

Additional information can be found in sk153152

Thanks,

RLM Group

[Alex-]

I've downloaded this Take via CPUSE on a management station running on VMWARE.

It has currently Take 19. However, the verifier says installation isn't allowed with cause "No conflict found". Apart from Take 19, there's just the latest SmartConsole package installed.

CPUSE says it's Take 50 for 3.10 systems, which should be the case anyway.

>show version all
Product version Check Point Gaia R80.30
OS build 200
OS kernel version 3.10.0-693cpx86_64
OS edition 64-bit

Should I use another base image than the build 200?

[Alex-]

Reading from the release notes, I had this impression the take isn't compatible with Take 19.

TAC also advised to remove Take 19 before installing Take 50.

[PhoneBoy]

What in the release notes suggests it's not compatible @Alex- ?

[Alex-]

@PhoneBoy 

Well, nothing, just a hunch actually. The CPUSE identifier contains the 3.10 identifier and the notes say Take 19 can't work with 3.10 gateways so I totally reckon it shoudln't be an issue with management. Anyway, GA Takes usually install on top of the previous ones quite seamlessly, so here I don't know what's blocking except maybe Take 19, which is why I opened the case and asked the question here.

[Jessie_Rich]

This is what I see. Only 26000 and 16000 appliances.

Jumbo Hotfix Accumulator Take 19 does not support Security Gateway R80.30 with Gaia 3.10, hence cannot be installed on Check Point 26000 and 16000 appliances and CloudGuard IaaS products AWS, Azure, GCP.

I was getting the same verifier error with Take 19 installed, TAC said they tested take 50 install and it worked fine in lab with the same verifier errir. I went ahead and installed take 50 over take 19 on my management server and two gateways last week and all seems to be good.

[Tsahi_Etziony]

Indeed there is some issue with JHF take 50 that is related to its identification on the machine, and this causes the strange "No conflict found" error. There is not issue with the content of the JHF itself, and that's why it is still available for download and installation.

We take these issues very seriously and we are currently checking the best approach to fix this without causing too much hassle to the field and without interfering with a smooth installation of future Jumbo takes. I'll make sure to update on this thread and the Jumbo SK as soon as possible. Expect and update within no more that 48 hours. 

Sorry for any inconvenience,

Tsahi

[Alex-]

There is now a note and even a dedicated SK for the verifier issue, thank you very much.

Another question, the notes state that Take 50 adds support for the new 16000 and 26000 appliances, but I don't see them in the drop-down list if I try to add a new gateway. I'm using build 08 of the R80.30 console: SmartConsole 993000008.

Management station software level:

[CPUpdates]
BUNDLE_R80_30_JUMBO_HF_MAIN_3_10_Mgmt Take: 50
BUNDLE_R80_30_JUMBO_HF_MAIN_SC Take: 39
BUNDLE_R80_30_JUMBO_HF_MAIN_gogoKernel Take: 19
BUNDLE_R80.30_SC Take: 200

[Shirleyh]

Hi, Thanks for your feedback, we checked your concern about the new appliances 16000 and 26000 appliances, that you don't see them in the drop-down list, and we were able to see those appliances when installing R80.30+ JHF. Is it possible that you used the demo mode? If not, please logging to the MGMT server and run the following command: cpinfo -y ALL and send output. Thanks, Shirley.

[Alex-]

Hi @Shirleyh 

The screenshot was taken from a production SMS which was upgraded from Take_19 to Take_50 today.

For the sake of completeness I restarted again the SMS, my PC and also tried from other PC's running the R80.30 Console Build 08 and I still don't get 16/26K appliances.

If I try to change the platform of an installed R80.30 cluster, the 16/26K don't appear either in the list either.

Here's the CPINFO:

cpinfo -y all

This is Check Point CPinfo Build 914000191 for GAIA
Local host is not a Gateway
[IDA]
No hotfixes..

[CPFC]
No hotfixes..

[MGMT]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 50

[FW1]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 50

FW1 build number:
This is Check Point Security Management Server R80.30 - Build 001
This is Check Point's software version R80.30 - Build 484

[SecurePlatform]
HOTFIX_GOGO_LT_HEAT_JHF Take: 50

[CPinfo]
No hotfixes..

[DIAG]
No hotfixes..

[Reporting Module]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 50

[CPuepm]
No hotfixes..

[VSEC]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 50

[SmartLog]
No hotfixes..

[R7520CMP]
No hotfixes..

[R7540CMP]
No hotfixes..

[R76CMP]
No hotfixes..

[SFWR77CMP]
No hotfixes..

[R77CMP]
No hotfixes..

[R75CMP]
No hotfixes..

[NGXCMP]
No hotfixes..

[EdgeCmp]
No hotfixes..

[SFWCMP]
No hotfixes..

[FLICMP]
No hotfixes..

[SFWR75CMP]
No hotfixes..

[MGMTAPI]
No hotfixes..

[CPUpdates]
BUNDLE_R80_30_JUMBO_HF_MAIN_3_10_Mgmt Take: 50
BUNDLE_R80_30_JUMBO_HF_MAIN_SC Take: 39
BUNDLE_R80_30_JUMBO_HF_MAIN_gogoKernel Take: 19
BUNDLE_R80.30_SC Take: 200

Maybe you tried from a new R80.30 and applied Take 50 without passing first through Take 19?

[Shirleyh]

Thank you for your prompt reply,

we will recheck the issue and update you.

Shirley.

[Shirleyh]

Hi,

After further investigation, we found out we have an issue that 16000 and 26000 appliances are not shown in the Gateway drop-down list.

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R80.30 from Take 71.

Note: This is a cosmetic issue.

If you choose to stay with Take 50, you can easily resolve it by selecting "Open server" option from the GW drop down list on the Management machines.

Thanks you for pointing this out.

Thanks,

Shirley.

[gianluca]

With take 50 on my SMS server the scheduled backup isn't working if the Smart Console is open, so at least for me the issue with ID PRJ-1477,
PRJ-5115, PMTR-37425 is still open.

[MeravAlon]

Hi 

Thank for your feedback. We are checking the issue and will update you soon.

Merav

[gianluca]

Thanks Merav,

maybe I have misunderstood the sk153152 and the fix is in the Ongoing Take 76 and not in the GA Take 50.

Regards,

Gianluca

[MeravAlon]

Correct. The fix is part of Take 76.

Regards

Merav

[JonnyV]

Ran into a problem tonight with installing take 50 on r80.30 take 300 (3.10), where it failed to import or install.
If we were running CPUSE <1786, take 50 installed just fine; if we were running 1818+, it would give the error below.

error is as follows:

checkpoint r80.30 The following results are not compatible with the package:

- Branch gogo_heat_188_main is installed from take 300

This hotfix is only supported on R80.20 takes 260 to 273.
This hotfix is not supported on Linux kernel versions below 3.10.
This hotfix is not supported on Checkpoint Gaia R80.20SP Machines.
This hotfix is not supported on Smart-1 625 appliances.
For more information, refer to sk152652.