Quantum Spark 1600 Appliance(Downgrade from R81.10.x to R80.40)

[Hari122939_]

Hello Team,

Currently, I have 2 Quantum spark 1600 security gateway firewalls with version of R81.10.07. I want to downgrade those 2 firewalls to version of R80.40. So I have a query here that can I downgrade directly from R81.10.07 to R80.40 or is there any downgrade path to follow step by step?  Kindly share the document link if you have.

[Chris_Atkinson]

R80.40 is not a valid release for this hardware.

The recommended version is R81.10.08.

[Hari122939_]

Thank you for your valuable reply but I have gone through some checkpoint articles(Check Point Upgrade Path and Management Servers and Security Gateways Compatibility Maps) where I could find R80.20.x is compatible with quantum spark. Since I have 5000(R80.40) and 4000(R77.30) appliance too, and I am planning to add Quantum Spark 1600 security gateway with my management server(Smart Console) which is in R80.40. 

I am looking for a solution in which 5000 cluster XL(high availability) and Quantum Spark 1600 cluster XL(high availability) which is replacing 4000 cluster XL(high availability) appliances. 

Suggest me with a solution where I can migrate this 1600 with 4000 and the 5000 and 1600 both can be managed from management server with matching versions. since my 1600 is R81.10.07 is it possible to downgrade it to R80.20.X and integrate with the management server which is in R80.40?

Thank You

[PhoneBoy · Accepted solution]

R80.40 is about to be End of Support and you should upgrade.
Likewise, R80.20.x will be End of Support in a few months.
I imagine to downgrade the 1600 to R80.20.xx you will need to put the relevant firmware on a FAT32/xfat thumb drive and boot the appliance. 
This will perform a factory reset and load the version of firmware.

Having said all that, you should really upgrade to releases that will continue to be supported.

[Hari122939_]

Many thanks to your reply and Quantum spark 1600 is a new firewall. So, it's not a problem even factory reset happens during the downgrade process.

It will be very helpful for me that if you share the downgrade path map document.

[Lesley]

Is there no revert to previous image button at the firmware update page? Same place where you have updated the firmware? Unless you updated the machine via usb, then it is different story 

[Lesley]

[G_W_Albrecht]

No, this is possible only using CLI: https://sc1.checkpoint.com/documents/SMB_R81.10.X/CLI/EN/Content/Topics/revert-to-previous-image.htm...

[Lesley]

Why, if I may ask?

[G_W_Albrecht]

Ask CP, not me ! 😎 And of course: Why not ? WebGUI contains the most used functionality, and you only seldom will have to revert to the last firmware (if you did not enable automatic firmware upgrades, of course 😉).

But also, CLI is not so hard to use...

[Oliver_Fink]

Before I would downgrade a security gateway I would really(!) prefer to upgrade the Security Management Server (SMS). What speaks against upgrading the SMS?

[G_W_Albrecht · Accepted solution]

@PhoneBoy did tell you so already, but let me repeat it: Why do you want to work only with unsupported versions? All here at CheckMates is about Security, and unsupported means not secure anymore 😎 All versions you mentioned are found here:

Major Version	General Availability	Affected Versions	Support Until
Check Point R80.40**	January 2020	R80.40	April 2024
Check Point R80.20.00 and later for 1500, 1600 and 1800 Appliances	Oct 2019	R80.20.x	Mar 2024
Check Point R77.30	May 2015	R77.30	September 2019

So yes - you could downgrade and loose the complete configuration following sk98549: How to re-image SMB / Quantum Spark appliances firmware version using USB Flash Drive - but why do that anyway ?