Upgrade Firmware

[Nishanthan]

After upgrading Check Point, the cleanup rule was moved to the top of the rulebase, which blocked access to the management portal. How can this issue be resolved?

[_Val_]

Please specify the sowftware versions, and some more details about your setup

[Nishanthan]

The issue occurred after we upgraded from R81.10 to R81.20

[_Val_]

Still not enough information. Do you use on-prem management or Smart-1 cloud? Did you push policy after upgrade? 

[Nishanthan]

I tried to upgrade the on-premises device, but I couldn’t push the policy because the firewall upgrade disabled login access while upgrade.

[the_rock]

In all my years dealing with CP, I personally had NEVER heard of something like that. If I were you, I would check the audit logs to be 100% sure that someone inadvertenaly did not make such a change.

Andy

[Lesley]

I assume you mean it went back to the initial policy? This can be checked with the CLI command cpstat fw

It should show your normal policy name. It could happen that it is unable to fetch the policy during bootup. Did you changed the version in SmartConsole and did a publish? Did you enable MVC? What Check Point guide you followed for upgrade? clean install or inplace upgrade?

Search for errors like this during boot:

going to fetch policy from MGMT...

Fetching FW1 Security Policy From: <IP>

Installing Security Policy <policy name>

Failed to Load Security Policy

Failed to Load Security Policy: Module version as defined by FW object,

does not match actual version installed

Fetching Security Policy Failed

Failed to fetch policy from masters in masters file

Fetching Threat Prevention Security Policy From: <IP>

Threat Prevention Security Policy wasn't loaded

Fetching Threat Prevention policy failed

[the_rock]

All super valid points @Lesley . Though this is what really surprised me what @Nishanthan said...

After upgrading Check Point, the cleanup rule was moved to the top of the rulebase...

Andy