Problem with installing HFA03 NGX on IPSO 4.1 IP390 Flash based

[Zabry]

Hi,
I just completed Fresh instalation on IP 390 Flash based with IPSO 4.1

> uname -a
IPSO host_name 4.1-BUILD019 releng 1515 09.01.2006-021932 i386

I've installed NGX and I tried to install HFA03, downlaod to /var/tmp/ and untar Comprehensive_R60_HFA_03.ipso.tgz, untar fw1_R60_HFA_03.ipso.tgz
and run
./fw1_HOTFIX_R60_03_591603015_6

As a results I've got message like below:
"
Host_name[admin]# ./fw1_HOTFIX_R60_03_591603015_6
Can't open logfile: /opt/CPInstLog/install.log.
Trying /var/log/CPInstLog/install.log.
Do you want to proceed with installation of Check Point VPN-1 Pro/Express NGX R60 Hotfix R60_03 for Check Point VPN-1 Pro/Express NGX R60 on this computer?
If you choose to proceed, installation will perform CPSTOP.
(y-yes, else no):y
Stopping SmartView Monitor daemon ...
SmartView Monitor daemon is not running
Stopping SmartView Monitor kernel ...
Driver is Down.
FloodGate-1 is already stopped.
Cannot find pid of vpnd
VPN-1/FW-1 stopped
SVN Foundation: cpd stopped
SVN Foundation: cpWatchDog stopped
SVN Foundation stopped

************************************************** *************************
ERROR: Check Point VPN-1 Pro/Express NGX R60 Hotfix R60_03 installation failed.
************************************************** *************************

Installation was successful.
"

Result of "fw ver"
This is Check Point VPN-1(TM) & FireWall-1(R) NGX (R60) HFA_03, Hotfix 603 - Build 015

So it's seems that HFA03 was installed but I would like to be sure that all components were installed properly.
Someone has any hint what should I check or what could be the reoson og this problem.

Thanks a lot for helping
Piotr.

[northlandboy]

Two things:

* HFA 04 is the most recent HFA for R60 - I would plan on deploying that instead.

* Notice the second line of output:
"Trying /var/log/CPInstLog/install.log"
Have you looked in that log?

Since this is a flash-based platform, I'd be checking available free space. Make sure /preserve/opt/tmp is emptied out.

[Zabry]

Hi,
In /var/log/CPInstLog/install.log is massage "Installation was successful."

Space in catalogs looks ok:

Filesystem 1K-blocks Used Avail Capacity Mounted on
/dev/wd0h 664831 172417 439228 28% /preserve
v9fs 233316 111724 121592 48% /opt

I hope it was installed. Do you have any other ideas ?
Thanks in advance
Piotr.

[northlandboy]

I vaguely recall seeing some similar behaviour with a box I was working on a few months ago. I think it was OK in the end. If you can't see any errors in the logs in /var/log/CPInstlog, it's probably OK. Check all the recent logs in that directory.

Oh and remember that those logs get deleted on reboot

You should still probably do HFA 04 though.

[Zabry]

Actually in /var/log/CPInstLog

install.log shows - Installation was successful.
but install_fw1_HOTFIX_R60_03.elg shows:


host_name[admin]# more install_fw1_HOTFIX_R60_03.elg
This is the HOTFIX_R60_03 installation log
Starting replace files
Diskless - skipping HF backup
/opt/CPsuite-R60/svn/util/gtar: Could not create file fw1/bin/ifwd : Text file b
usy
/opt/CPsuite-R60/svn/util/gtar: Could not create file svn/bin/cprid : Text file
busy
Diskless - skipping SVN backup
Starting diskless
The tar ball for CPsuite-R60 does not found
Diskless - Could not find CPsuite.tgz !
Hotfix installtion abort.


Line Diskless - Could not find CPsuite.tgz !
is suspicious for me.
What do you think ?
Piotr.

[northlandboy]

Have you read the patch notes about CPsuite.tgz, and needing symlinks?

Your HFA has definitely not been installed. It might say it has, but if you reboot, it will go back to using the old binaries.

[Zabry]

Nordhlandboy,
Thanks for your helping. I just noticed your answer in other thread:

The problem is related to the way that Check Point was initially installed, and the way that the upgrade script works.

Remember that for flash-based platforms, it unpacks the package in /opt/packages/installed/ every time it boots, and puts the files in the appropriate locations under /opt/CPsuite-R60

So when a patch is installed, it needs to unpack that tarball, replace all the patched files, then pack it back up again. Depending on how you installed the initial package, you may have your firewall package as /opt/packages/installed/fw1_xxx.tgz, or it may be /opt/packages/installed/CPsuite.tgz.

The patch script is looking fo CPsuite.tgz. If it's not there, you can just create a symlink to the actual package, so the script works. What packages do you have under /opt/packages/installed?



And this is the reason and solution at the same time.
Thanks again, now thanks to you, it works.
Have a nice day.
Regards
Piotr.