Installing HFA_04 on Check Point NGX R60

[GreDek]

Hello,

I need some help concerning the installation of HFA 04 on a check point NGX R60A (VPN-1 Pro/Express). I extracted 'VPN-1_R60_HFA_04_wrapper.windows.tgz' Then i executed to following executable '.\CPvpn\Disk_Images\Disk1\Setup.exe' . But i receive the following error:



this is the output of the fw ver command ('fw ver -k' output):



I hope there's someone who can help me with this problem.

Thanks in advance!!!

[chillyjim]

Only thing I can think of is to make sure CPDIR and FWDIR are set for the user trying to install the HFA

[GreDek]

Hello chillyjim, first of all thanks for the reply! I checked the 2 variables that you said but they're set correct I think:

CPDIR = C:\Program Files\CheckPoint\CPShared\R60
FWDIR = C:\WINDOWS\FW1\R60\fw1

Hopely someone has some other thoughts about it.

Thanks in advance!

[kva.kva]

"HFA 04 on a check point NGX R60A" - I think it's impossible. There aren't HFAs for R60A.

[northlandboy]

Nice catch kva kva - right you are - no HFAs for R60A. A very good reason to not use R60A.

[GreDek]

thanks for the replies!

Could someone tell me what is the differents between NGX R60 and NGX R60A. Our former it employee left me with this firewall and I was just looking how to update it to keep it up to date.

So if i'm right, it's not possible to update it?

Thanks in advance

[northlandboy]

The differences were to do with VSX mgmt. Vanilla R60 can't manage VSX platforms. R61 wasn't ready, so Check Point put out R60A as basically a patch to R60 to allow mgmt of VSX systems. VSX mgmt went mainstream with R61.

If you don't have any of those, there was really no point in going to R60A. Some people just installed it anyway, assuming that it was the most current, and the one they should use.

Check Point has stated (there's an SK article on it somewhere) that there will be no general release HFAs for R60A. There are patches for R60 and R61 out though. They will release special fixes if you demand them.

If I was in your position, I would probably think about upgrading to R62, so that you're on the mainstream code, and will be able to get HFAs.

[thebuffman]

I wanted to piggy back off of this post because i am receiving the same installation failure except I am on IPSO 3.9 NGX R60 HFA_03. I am attempting to upgrade to HFA_04 but it keeps giving me the "unsuitable for installation" error message with all of the installs failing.

I have looked high and low but cannot find a remedy. I haven't had a problem with my other upgrades; they have gone smoothly. No idea why this one is failing.

Any insight would be greatly appreciated.

edit: This is also interesting. With this particular firewall I am unable to poll it for smartupdate information. When I select "Get Gateway Data" it returns an "unable to connect..." error message. I think it is time to dial up Nokia support and ship off some CPInfo log information.

[northlandboy]

Are you trying to use SmartUpdate to upgrade? Check that cprid is running on the module. Try restarting cprid, and see if SmartUpdate can get the node data

[thebuffman]

Originally Posted by northlandboy

Are you trying to use SmartUpdate to upgrade? Check that cprid is running on the module. Try restarting cprid, and see if SmartUpdate can get the node data

No, I am not using SmartUpdate to perform the upgrade process. I am using SmartUpdate to grab version data. I do the upgrade via cli. I've tried it both manually and using the unixinstallscript. Both ways fail.