Upgrade export issues

[SamuelB]

I am currently running a dedicated SmartCenter server.

It is running NG AI R55 on SecurePlatform.

When I run upgrade_export from the upgrade_tools directory, I receive the following error:

Error: FWDIR key is not define. Please fix it and try again

I have downloaded the upgrade tools from the website to be sure I have the latest version and I receive the same error. The Secure Knowledgebase does not have any solutions for this. Has anyone ever seen this before?

Thanks for your help!

[chillyjim]

Check to make sure $FWDIR is set (%FWDIR% for windows). This should point to the directory where FW1 is installed (where the "conf" directory is located).

[Youngy]

I could not find anything about this in the secure knowledgebase either! I guess it might be something simple - well I hope so. Were all the CP processes stopped before you did the export command?

[SamuelB]

chillyjim,

$FWDIR is set. That is the first thing that I checked.

Youngy,

I tried the command with the CP processes running and then again while all the CP processes were stopped. That is the second thing I checked/tried. :)

Thanks for the suggestions. Any other ideas?

[chillyjim]

Did you see this one?

Symptoms

* The upgrade_export command fails following the upgrade to HFA_01 of NGX R60
* Upon launching the command, the following error message is displayed: "The procedure entry point CPPROD_SetHFSilentUninstall could not be located in the dynamic link library cpprod50.dll"
* Upon pressing the OK button of the error message window, a subsequent error message is displayed: "Error: FWDIR key is not define. Please fix it and try again"

Cause
The SmartCenter Server, residing on a Windows 2003 server, was upgraded from NGX R60 to HFA_01 of NGX R60. The SNMP daemon process remained running during this upgrade and had already locked the cpprod50.dll dynamic link library (dll) file. Consequently, this dll file could not be replaced with the newer one.
NOTE: This issue was only reported on Windows 2003 servers.
Solution
There are 2 available options to resolve the issue:
# Option 1 - Replace the existing cpprod50.dll file with the NGX R60 HFA_01 file version:

1. Obtain the needed cpprod50.dll file from the Check Point Download Center. Save the file to the SmartCenter Server host


2. Go to the "Program Files"\CheckPoint\CPShared\R60\lib\ directory and backup the existing cpprod50.dll file to a file named cpprod50.dll.r60bkp


3. Stop the SNMP process that is running on the SmartCenter Server host:

* Select Start menu > Settings > Control Panel > Administrative Tools > Services tool


* In the Services (Local) window, locate and select the SNMP service


* In the General tab, go to the Service status section (Service status displays as "Started"). Select the "Stop" button and then select the "OK" button
4. In this directory, replace the existing cpprod50.dll file with the downloaded, NGX R60 HFA_01 version of this file


5. Re-start the SNMP process on the SmartCenter Server host:
* Select Start menu > Settings > Control Panel > Administrative Tools > Services tool


* In the Services (Local) window, locate and select the SNMP service


* In the General tab, go to the Service status section (Service status displays as "Stopped"). Select the "Start" button and then select the "OK" button

# Option 2 - Re-perform the upgrade to HFA_01 of NGX R60:

1. Follow the installation guide procedure to uninstall HFA_01 of NGX R60 from the SmartCenter Server host


2. Reboot the SmartCenter Server host


3. Stop the SNMP process that is running on the SmartCenter Server host:

* Select Start menu > Settings > Control Panel > Administrative Tools > Services tool


* In the Services (Local) window, locate and select the SNMP service


* In the General tab, go to the Service status section (Service status displays as "Started"). Select the "Stop" button and then select the "OK" button

4. Follow the installation guide procedure to install HFA_01 of NGX R60

Check Point recommends implementing option 2, due to the concern that there may be other dll files which were locked during the initial upgrade and, therefore, not replaced.
NOTE: Starting with HFA_02 of NGX R60, Check Point will incorporate an upgrade process mechanism that will not allow the upgrade process to continue, if it identifies that certain processes are running. In such a case, the upgrade process will guide the security administrator to stop these processes before proceeding with the upgrade.

[SamuelB]

Did you see this one?

Yes, I saw that one but it does not pertain to SecurePlatform. That is only for Windows Server 2003. I looked to see if there were any correlations I could make between that solution and something I could fix on SPLAT. But it seems that it is a Windows specific .dll problem. I have now opened up a case with Checkpoint. I will post my findings/solution here when they come up with one.

[jamesliao]

For csh

setenv CPDIR "/opt/CPshrd-R55"
if ( $?LD_LIBRARY_PATH ) then
/bin/echo "${LD_LIBRARY_PATH}" | /bin/grep "${CPDIR}" >& /dev/null
if ( $status != 0 ) then
setenv LD_LIBRARY_PATH "${CPDIR}/lib:${LD_LIBRARY_PATH}"
endif
else
setenv LD_LIBRARY_PATH "${CPDIR}/lib"
endif
if ( $?PATH ) then
/bin/echo "${PATH}" | /bin/grep "${CPDIR}/bin" >& /dev/null
if ( $status != 0 ) then
setenv PATH "${CPDIR}/bin:${PATH}"
endif
/bin/echo "${PATH}" | /bin/grep "${CPDIR}/util" >& /dev/null
if ( $status != 0 ) then
setenv PATH "${CPDIR}/util:${PATH}"
endif
else
setenv PATH "${CPDIR}/bin:${CPDIR}/util"
endif
setenv FWDIR "/opt/CPfw1-R55"
setenv CPMDIR "/opt/CPfw1-R55"
setenv SUDIR "/opt/CPfw1-R55/sup"
setenv SUROOT "/var/suroot"
setenv PATH "${FWDIR}/bin:${PATH}"
setenv LD_LIBRARY_PATH "${FWDIR}/lib:${LD_LIBRARY_PATH}"
setenv FW_BOOT_DIR "/etc/fw.boot"
setenv FGDIR "/opt/CPfg1-R55"
setenv PATH "${FGDIR}/bin:${PATH}"
setenv LD_LIBRARY_PATH "${FGDIR}/lib:${LD_LIBRARY_PATH}"


For sh
CPDIR=/opt/CPshrd-R55 ; export CPDIR
if [ $LD_LIBRARY_PATH ]; then
/bin/echo ${LD_LIBRARY_PATH} | /bin/grep ${CPDIR} 1>/dev/null 2>&1
if [ $? -ne 0 ] ; then
LD_LIBRARY_PATH=${CPDIR}/lib:${LD_LIBRARY_PATH}
export LD_LIBRARY_PATH
fi
else
LD_LIBRARY_PATH=${CPDIR}/lib
export LD_LIBRARY_PATH
fi
if [ $PATH ]; then
/bin/echo ${PATH} | /bin/grep ${CPDIR}/bin 1>/dev/null 2>&1
if [ $? -ne 0 ] ; then
PATH=${CPDIR}/bin:${PATH}
export PATH
fi
/bin/echo ${PATH} | /bin/grep ${CPDIR}/util 1>/dev/null 2>&1
if [ $? -ne 0 ] ; then
PATH=${CPDIR}/util:${PATH}
export PATH
fi
else
PATH=${CPDIR}/bin:${CPDIR}/util
export PATH
fi
hash 1>/dev/null 2>&1
FWDIR=/opt/CPfw1-R55 ; export FWDIR
CPMDIR=/opt/CPfw1-R55 ; export CPMDIR
SUDIR=/opt/CPfw1-R55/sup ; export SUDIR
SUROOT=/var/suroot ; export SUROOT
PATH=${FWDIR}/bin:${PATH} ; export PATH ; hash 1>/dev/null 2>&1
LD_LIBRARY_PATH=${FWDIR}/lib:${LD_LIBRARY_PATH} ; export LD_LIBRARY_PATH ; hash
1>/dev/null 2>&1
FW_BOOT_DIR=/etc/fw.boot ; export FW_BOOT_DIR
FGDIR=/opt/CPfg1-R55 ; export FGDIR
PATH=${FGDIR}/bin:${PATH} ; export PATH ; hash 1>/dev/null 2>&1
LD_LIBRARY_PATH=${FGDIR}/lib:${LD_LIBRARY_PATH} ; export LD_LIBRARY_PATH ; hash
1>/dev/null 2>&1

[SamuelB]

jamesliao,

That is awesome! upgrade_export completes successfully now. Using the information from your script I just fixed my LD_LIBRARY_PATH and PATH and that was enough to fix my problem. Thank you very much for solving a problem that Checkpoint Support is still working on. I will have to let them know.

[cuervo18k]

This is pretty good except the detection does not work for the HP server Smart Start software that loads an SNMP client or server within its inner workings if the normal Windows SNMP is not loaded. It is a gotcha to watch out for.