View Full Version : smartupdate showing all HFA's for one of the gateways

2011-01-21, 10:20

we have a ClusterXL environment, NGX R65, HFA70.

I noticed that in the SmartUpdate, under the second firewall (standby) beside the installed packages, also the old HFA_50 packages were shown.
I uninstalled the Performance Pack R65_50 and now after the restart I have all installed HFA's.

I don't like this situation, especially as I plan to upgrade to 71.10 tomorrow.

Does anybody knows why has this happened?

The printscreens of the before/after situation are zipped in the attach.


2011-01-21, 12:03
It seems that someone have installed R65 HFA70 on you cluster member without inform you.

In any case you can make clean install of R71.10 (we have not evaluate this), be sure about physical access to you HW , you will have to change cabling (in 99% ) just because interfaces will be remaped.

In case of using NGX lic - be ready to use only 2 Core..

Good luck to not have any issues after installation of R71.10...

2011-01-22, 06:23
nobody else can install anything on them, i hope :)

The problem is that both the gateways have the same installed HFA's, but the information in Smartupdate is strange.


2011-01-22, 10:11
The before_uninstall.jpg file contained IP address of SMC, probably you would like remove this information...

Normaly , if you have installed HFA70 on all GWs you should also see this in SmartUpdate.
Some times even after uninstall some HFAs you will still see this in SmartUpdate window.

Have you rerun *Get GW information* after uninstall HFA50 PPK?
Could you provide output of *fw ver -k* command for both cluster member and SMS?

2011-01-24, 05:23
Yes, I removed the IP information for security purposes.

I upgraded to the R71.10 this weekend, and the list of HFA's grew up :)

Should I uninstall the R65 HFA's ?

This is Check Point VPN-1(TM) & FireWall-1(R) R71.10 - Build 008
kernel: R71.10 - Build 008


2011-01-24, 10:03
I upgraded to the R71.10 this weekend, and the list of HFA's grew up :)

Should I uninstall the R65 HFA's ?

Congratulation !!!

Please do not even try to uninstall R65 HFAs, be happy your systems working now, make backup , snapshoot and store somewhere..

Be ready in case of using backup on new HW to change cabling or interfaces, R65 has (in 99% cases) other interface order as R70 or R71.. (search CPUG for interface order for more information).

example >http://www.cpug.org/forums/installing-upgrading/14659-splat-upgrade-interface-re-ordering.html#post64315