R81.10 Jumbo Hotfix Accumulator - New Ongoing take #75

[eranzo]

Hi All,

A new Ongoing Jumbo Hotfix Accumulator take for R81.10 (take 75) was released today, and is available for download. Please refer to Jumbo documentation ( R81.10) 

Please note the following:

•        Availability:

o   Available to download the via Jumbo documentation ( R81.10) 

o   Available for download via CPUSE by using package identifier.

o   Can be provided by customer support

Content included in this take:

• List of resolved issue in this take can be found in the Jumbo documentation ( R81.10) 

New: Starting from R80.40, Central Deployment allows you to perform a batch deployment of Hotfixes on your Security Gateways and clusters from SmartConsole!!

For more information, see sk168597.

Thanks,

Release Operations Group

[RamGuy239]

clish> installer install 1
The machine will automatically reboot after install of Check_Point_R81_10_JUMBO_HF_MAIN_Bundle_T75_FULL.tgz.
Do you want to continue? ([y]es / [n]o / [s]uppress reboot) yes

Info: Initiating install of Check_Point_R81_10_JUMBO_HF_MAIN_Bundle_T75_FULL.tgz...
Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)
Result: Verify install of package Check_Point_R81_10_JUMBO_HF_MAIN_Bundle_T75_FULL.tgz Failed
This package conflicts with previously installed packages:
Installed hotfixes are missing from this package.
Uninstall the conflicting packages and try again.

This is on a CPAP-SG5900 appliance that was just freshly installed with R81.10 using ISO. The currently installed packages are:

clish> installer uninstall
** ************************************************************************* **
** Hotfixes **
** ************************************************************************* **
Num Display name Type
1 R81.10 Jumbo Hotfix Accumulator General Availability (Take 66) Hotfix
2 cvpn_HOTFIX_R81_10_JHF_T9_049_MAIN_GA_FULL.tgz Package
3 cvpn_HOTFIX_R81_10_JS_THROTTLING_V3_289_MAIN_GA_FULL.tgz Package

It's not capable of telling what's conflicting, but I suppose it has to be 2. or 3., if not both.

clish> installer verify 1
Info: Initiating verify of Check_Point_R81_10_JUMBO_HF_MAIN_Bundle_T75_FULL.tgz...
Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)
Result: Installation is not allowed. Reason: Installed hotfixes are missing from this package. Contact Check Point Technical Services for further assistance.

[Chris_Atkinson]

@RamGuy239 Are you certain you need this Jumbo versus a GA take?

Note it's normal to have to remove any out of band fixes installed over the Jumbo and have to reinstall them after an upgrade.

In the case of the SNX fix from sk173765 this is straight forward, other fixes might have to be ported for the specific version in consultation with TAC.

Suggest consulting them in your specific scenario to understand what all the fixes are and the path forward.

[RamGuy239]

It was cvpn_HOTFIX_R81_10_JS_THROTTLING_V3_289_MAIN_GA_FULL.tgz causing the issue.

We've had cvpn_HOTFIX_R81_10_JS_THROTTLING_V3_289_MAIN_GA_FULL.tgz installed since JHF Take 45 and it did not cause conflicts when updating to JHF Take 55 or 66.

cvpn_HOTFIX_R81_10_JHF_T9_049_MAIN_GA_FULL.tgz has never caused conflicts, we've had it since JHF Take 9.

The biggest problem here is how cpuse is not able to actually tell us what hotfix is causing the conflict. Shouldn't it be able to tell us that cvpn_HOTFIX_R81_10_JS_THROTTLING_V3_289_MAIN_GA_FULL.tgz was causing the conflict?

I removed cvpn_HOTFIX_R81_10_JS_THROTTLING_V3_289_MAIN_GA_FULL.tgz and was able to install JHF Take 75.

[the_rock]

I installed it in the lab, so far, so good...fingers crossed : - )

[CaseyB]

Is there anymore information on these anywhere?

PRJ-32681,PMTR-66706
An IKEv1 tunnel may be deleted after the Dead Peer Detection (DPD) exchange and can cause an outage.

PRJ-37556,PMTR-77042
An outage may occur when using IKEv2.

PRJ-39817,PMTR-81965
The Security Gateway may crash when running UDP and TCP SIP traffic.

[Gregory_Azratz]

Hi @RamGuy239 ,

regarding your question -
previously we did showed the version which conflicts (but after many request we had to redesign the output)
In the webUI we have added a button that will allow you to download a files which contains information that can be used in order to solve the installation conflicts by CP support.

having said that we will align Clish to provide similar option as well

Our motivation for the removal was that majority of the customer are using only public content (like the jumbos)
so no conflicts should ever happen

In case customer gets private HF, which is not included in the jumbo it might cause issue down the road.
Uninstalling the HF and installing the jumbo will solve the conflict issue 
BUT it might cause specific content to be removed.
By contacting CP support will try to mitigate the issue of losing private content.

Gregory