R55 and IPSO upgrade

[ssmith763]

Hi

I have a Nokia IP350 running IPSO 3.8 build 039. I have FW1 R55 on the Nokia with no HFA's installed. I would like to upgrade the IPSO and FW1 to R61. As I understand it I will need to install HFA08 which will then allow me to upgrade IPSO to 3.9. What I would like to know is how to install the HFA and how to upgrade the IPSO. Any help is much appreciated.

[RobertGraham]

Nokia is image based, so there's no real dependency here. But,first thing's first:
are you running a stand-alone installation?

This means, is the management database located on the same host? I always recommend a distributed installation. This way, you can do with the enforcement point as you like without having to worry about the management database.

Here's the basic order of operations:

1. Upgrade the management station to R61. See the notes on upgrades for this.
2. Upgrade the IPSO on the enforcement. You do this by downloading the latest and greatest code from www.nokia.com/connect. Then, you use the command newimage for this.
3. Copy the NGX wrapper to the enforcement and use the command: newpkg -m LOCAL -n <NameofWrapper>.
4. Set the SIC and push the most recent policy and you are done. Go have a beer.

If the management is on the enforcement point, then you have to execute the same basic procedure as for an upgrade of management alone. The recommended way is to have a second machine that you install with the old version. Use the export command (search these forums for this) and import it to the second box. Then, shift the production to the second (now identical) box. You take the original offline, upgrade it using the proper procedure as outlined in the Check Point release notes/PDFs.

[rubber_chicken]

Originally Posted by RobertGraham

4. Set the SIC and push the most recent policy and you are done. Go have a beer.
.

LOL! I like your style. I wish all instructions were like this :-)

[ssmith763]

The management station is on the nokia. Am I correct in thinking I need to apply the HFA before I can upgrade the IPSO image? I was going to apply the hfa, upgrade IPSO then upgrade to R61.

[northlandboy]

No, I don't think you'll need to do the HFA.

Since you've got management on the box, it makes it more of a pain. Make sure you have a good backup before starting.

That said, I think the steps will be something like this:
* Upgrade IPSO first (I would go to 4.1 personally)
* The upgrade will probably deactivate the package. I think you need to reactivate it, then install the R61 package, but install it as an upgrade.
From the command line, it will be something like:
newpkg -m LOCAL -n <pkg_name> -o $FWDIR
The -o $FWDIR tells it to do an upgrade.

But read through the release notes carefully before doing it. Read the release notes for both IPSO and R61.

[BarryStiefel]

Originally Posted by rubber_chicken

LOL! I like your style. I wish all instructions were like this :-)

I propose that from now on, all instructions posted in this discussion board must end with "You're done. Go have a beer." Let's consider that the first entry in the CPUG discussion board style guide.

[RayPesek]

You're supposed to wait until you're done before you have a beer?

Ray