Boot issue 'Invalid Opcode' upgrading physical HP servers R77.30 > R81.20 via blink image

[ibrown]

Hello All,

I've just tried an in-place upgrade for the second time;

the first attempt was with the non blink image for R81.20 which failed updating the bootloader

Check_Point_R81.20_T631_Fresh_Install_and_Upgrade.tgz

; this time was with the blink copy

blink_image_1.1_Check_Point_R81.20_T631_JHF_T53_SecurityGateway.tgz

this upgraded successfully, according to the task in Smart management, but on the first boot fails with an invalid opcode

on mounting a red hat rescue iso to look at the bootloader, it looks like it is pointing to a pointer of something which does not exist, but I'm not much of a linux/grub person. Sadly it's a remote console link, so I just have screenshots, which are here;

Has anyone seen this issue or got any good ideas ?

Thanks

Ian

[_Val_]

You cannot use BLINK image to upgrade to R81.20 from R77.30. You also cannot upgrade directly from R77.30 to R81.20. Please make sure you follow the installation and upgrade guides. You will have to have an intermediate upgrade step

[ibrown]

Thanks Val,

I assumed I could as https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_RN/Topics-RN/Supported-Upgrade-Pat... says you can for security gateways.  If I do it on my VMware test environment it works fine. This is physical kit so i suspect a driver issue. This is a active/standby cluster of two nodes, we have management and logging elsewhere.

[_Val_]

First, R81 is not R81.20. You want to look into this one:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RN/Content/Topics-RN/Support...

Second, both documents clearly say: "Requires a 2-step upgrade path". Also, mind the footnotes

Third, nowhere in RN it says you can use blink image to go from R77.30 to anything R8X.xx

[ibrown]

Hi Val,

thanks for that. Although I am potentially confusing the issue. I've upgraded our mgmt to 81.20, which was 2 stage, already, so that is handling the logging and central management. The security gateways don't have carrier security enabled either, so I read that as saying it's not 2 stage. The Blink image was the recommendation of the company we have checkpoint support with.

I've run both methods, the blink and non-blink version in a test vm environment and all worked. I think there might be a problem in the way it is handling the config of the grub loader. The non-blink method fails to update it correctly and fails the upgrade at that point, the blink method converts grub to grub2 as expected but then the server fails to boot. Both of which points to the handling of the hp raid controller presented partitions as the vmware versions work perfectly. I'm pushing the update image out with management in both cases.

I'll keep hassling my support provider. So far they recommended a clean install, which is not top of my list as it makes it much more complicated and manual to deploy.

[_Val_]

If you did in-place upgrade from R77.30 and then tried to install through blink, it will fail. File systems of freshly installed Gaia are completely different between R77 and R81.X

Also, why do you think clean install is more complicated? Blink is effectively reimaging your GW as a freshly installed, and them applying config files. You could do exactly the same manually. 

I would suggest checking if your open server is still in the HCL, including all periphery and the disk raid controller. It may be the main source of your issues.

Is still struggling, support ticket it is.

[ibrown]

Thank you

checking the HCL https://www.checkpoint.com/support-services/hcl/proliant-dl360p-gen8/ so, the raid controller is supported. That though links to https://support.checkpoint.com/results/sk/sk77660 which implies a custom install, but it doesn't seem to apply to R81. This https://support.checkpoint.com/results/sk/sk108200 implies there are bios settings to check, so i'll go there next. As it's already running gaia, I hadn't considered bios settings for later versions.