Solved: Re: Jumbo on Check Point R80.30 with Gaia 3.10 Tak...

Kaland · ‎2019-11-05

Hi,

Has anyone tried installing Jumbo Take_50 or Take_76 on Open Server with R80.30 3.10 kernel running VSX?

Take does not show up in CPUSE at all. CPUSE Agent is at required build 1786

maybe we have overlooked something, but can`t seem to find any answer this.

Hope someone can help. We`re moving from project into production soon, and I want to make sure at we have patched for potential bugs that may appear when load is put on the cluster.

Best regards

Bjørn Andre Kaland

Dorit_Dor · ‎2019-11-05

Indeed my mistake -

the new appliances require 76 both 273 and 300

View solution in original post

Nick_Doropoulos · ‎2019-11-05

Hi Kaland,

Are you 100% sure that the device is communicating with the Check Point online web services?

Kaland · ‎2019-11-05

fw01-1:0]# curl_cli http://cws.checkpoint.com
<html><body><h1>It works!</h1></body></html>fw01-1:0]#

fw01-1:0]#
fw01-1:0]# ping updates.checkpoint.com
PING e17340.dscd.akamaiedge.net (2.18.32.227) 56(84) bytes of data.
64 bytes from a2-18-32-227.deploy.static.akamaitechnologies.com (2.18.32.227): icmp_seq=1 ttl=54 time=47.4 ms
64 bytes from a2-18-32-227.deploy.static.akamaitechnologies.com (2.18.32.227): icmp_seq=2 ttl=54 time=47.3 ms
^C
--- e17340.dscd.akamaiedge.net ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 47.388/47.403/47.419/0.218 ms
fw01-1:0]#

mdjmcnally · ‎2019-11-05

Would expect that Take 50 shows up under the command

show installer packages

What do you see when run that command in CLISH on the VSX box.

Does it show anything at all for available packages.

Take 76 is an ongoing so won't appear by default as available as only recommended packages appear normally. You would have to import the link for Take 76 manually.

As suggested check that can actually connect to the Check Point update site

sk83520 is the one you want for checking connectivity for various updates

Kaland · ‎2019-11-05

installer check-for-updates INFO: Checking for new available packages.

Result: Did not find any new packages

show installer status
Agent: Enabled
Build number: 1786 (agent build is up to date)
Network connection: connected
Update from cloud: Last updated on Tue Nov 5 18:15:40 2019
License: Valid

show installer packages
Show packages: no packages to display

mdjmcnally · ‎2019-11-05

Only boxes I have with 3.10 kernel are Azure based and they showed the Jumbo Take 50 which was able to install.

Doesn't show any other available patches other then SmartConsole update.

You have connection ad license so no issue there.

what does

show installer installed

come back with

After that then at a loss as have connectivity so should see the Jumbo Take 50 as available.

Dorit_Dor · ‎2019-11-05

Cpuse prevent you for using wrong pkg and only show ga pkges (doesnt show “on going jumbo that you can still use if you explicitly reference it)

so

(1) jumbo 50 is ga and will “show” on all r80.30 unless you are on new appliance w take 300 because take 300 came later and have more fixes

(2) take 300 require jumbo 76 thag you can use but doesnt show in cpuse because its still “on going”

clear?

Kaland · ‎2019-11-05

Hi,

ok, thanks. That explains why it doesn`t show up on the Take300 Build Cluster, but we`re also running Take273 on the other clusters, and Take 50 does not show up there either. Also tried a local import of Take 50

fw01-1:0> show version all
Product version Check Point Gaia R80.30
OS build 273
OS kernel version 3.10.0-693cpx86_64
OS edition 64-bit

fw01-1:0> installer import local /home/admin/Check_Point_R80_30_JUMBO_HF_Bundle_T50_sk153152_Security_Gateway_3_10_FULL.tgz
Preparing package for import. This operation might take a few moments
Note: The selected package will be copied into CPUSE repository
Info: Initiating import of Check_Point_R80_30_JUMBO_HF_Bundle_T50_sk153152_Security_Gateway_3_10_FULL.tgz...
Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)
Result: Package is not supported on your machine:
Refer to sk159713 for more details
fw01-1:0>

Dorit_Dor · ‎2019-11-05

Indeed my mistake -

the new appliances require 76 both 273 and 300

Sigbjorn · ‎2019-11-18

Shouldn't we be able to manually import the ongoing T76?

fw01-1:0> show installer status
Agent: Enabled
Build number: 1786 (agent build is up to date)
Network connection: connected
Update from cloud: Last updated on Tue Nov 19 03:06:30 2019
License: Valid
fw01-1:0> show ver
fw01-1:0> show version all
Product version Check Point Gaia R80.30
OS build 273
OS kernel version 3.10.0-693cpx86_64
OS edition 64-bit
fw01-1:0> installer import cloud Check_Point_R80_30_JUMBO_HF_Bundle_T76_sk153152_Security_Gateway_3_10_FULL.tgz
Info: Initiating Import from cloud of Check_Point_R80_30_JUMBO_HF_Bundle_T76_sk153152_Security_Gateway_3_10_FULL.tgz...
Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)
Result: Failed to add the package (Check_Point_R80_30_JUMBO_HF_Bundle_T76_sk153152_Security_Gateway_3_10_FULL.tgz)
Package is not supported on your machine:
Refer to sk159713 for more details
fw01-1:0>

Tsahi_Etziony · ‎2019-11-19

This error is for a specific (and rare) use case which is described in sk159713. In this specific case, no CPUSE HF installation would work without a manual change.
I noticed that the SK did not show a clear solution, and we have changed the SK - customers with this issue should contact Check Point support.

To give you some background - when you try to import or to install a package using CPUSE, CPUSE checks in advance the status of the machine and blocks the action if there are problems, with an appropriate error message. In this specific case, we added the check to the import stage, because we want the user to fix the problem prior to the planned installation instead of being surprised during a planned change window.

Are you a member of CheckMates?

Jumbo on Check Point R80.30 with Gaia 3.10 Take 273 or Take300