Firmware Upgrade Problems

[Jon_AK]

Hi.  Not sure if this is the correct place for this so please forgive me if it isn't.  Our Quantum Spark 1575 firmware just upgraded to version R81.10.08 (996001683) this morning.  Unfortunately, it has rendered our IKEv2 VPN connections to our remote clients unusable as well as some web sites.  The web sites come & go but the VPN's are down for the count.  Have never experienced an update like this that caused this kind of problem but trust there is an answer here as to what process is best to use to correct it.  I have disabled both the firewall as well as the application & url filtering to no avail.  The VPN's were working as of the end of my day yesterday at 5pm.  Unfortunately, I have never been able to perform a backup using SCP due to the 1575 not accepting the complex password for our server even though it is strictly alpha-numeric characters.... it's just 16 characters long.

Any recommendations?

[the_rock]

If I were you, would call TAC and see if you can do remote session, sounds like a pretty serious issue.

Andy

[Jon_AK]

Looking through the site for the phone number but, not having much success.

[the_rock]

Theres DTAC number, +1-972-444-6600 or toll free 1-888-361-5030

[Lesley]

Anything related here? https://support.checkpoint.com/results/sk/sk178604

Did you followed these steps or needed to?

• To manually upgrade the firmware R80.20.35 (or lower) to R81.10.08, you must follow the two-step upgrade:

  1. Upgrade from R80.20.35 (or lower) to one of the higher versions - R80.20.40 or R80.20.50 or R80.20.60 (see sk165734)

  2. Upgrade to R81.10.08

     You can also upgrade using the CLI.

[Jon_AK]

I believe it was already on a flavor of R81.  The last update I did for it was somewhere around a month ago.  At the moment, I don't recall any longer as I have never had an issue with the past 3 upgrades I manuall performed.

[the_rock]

Did you get a hold of TAC?

Andy

[Jon_AK]

No.  I waited on the phone for over an hour with no success.  have started to submit an online request though.

[the_rock]

I think you either got to another department or not sure, but I called same time I gave you the numbers and got through in 3 mins.

Andy

[Jon_AK]

I got right through this time.

[G_W_Albrecht]

I would suggest to step back to the last firmware:

WebGUI > Device > System Operations >Revert to previous image

And then disable the automatic upgrade:

WebGUI > Device > System Operations > Configure automatic upgrades...

Or using CLI:

revert to previous-image

set cloud-services-firmware-upgrade activate false

[Jon_AK · Accepted solution]

After a lengthy session with TAC, it was determined that it the Spark was not preventing outgoing VPN connections.  The VPN we use is not the typical L2TP but we use IKEv2 which does not use the in-built VPN functionality offered by the Spark.  Upon installing WireGuard & setting up a connection, the VPN was established quickly.  Unfortunately, there is something within the Windows 11 VPN settings that does not agree with the latest update on the Spark & is difficult to explain how 3 workstations IKEv2 VPN connection failed to connect.  I can live with it, it is Windoze we're talking about & not unusual to have something break after an update occurred somewhere.

On another note, we did attempt to perform a rollback which was listed in the Spark as September of last year but it did not rollback as expected.  Nothing is broken & everyone is a happy camper now.  Appreciate all the input from the group here.

[the_rock]

Good to hear!