PDA

View Full Version : R75.30 to R75.40 upgrade failure via WebGUI



SteveW
2014-10-03, 11:34
Iím trying to upgrade my HA Security Management Smart-1 5 appliances from Secure Platform R75.30 to Gaia R75.40 and then to R77.10. This is the only available upgrade path according to Check Pointís documentation.

Iíve taken both a migrate_export and a backup and moved the files off the primary appliance for safe keeping. I also tried to take a snapshot but it seems that is not an option on a Security Management appliance. I canít remember the exact wording of the error message.
I had to use the R75.30 Upgrade tools for the backups because itís the only version that would run. R76 and R77 tools donít work Ė possibly because itís not a valid direct upgrade path from R75.30. If I do trash the appliance Iíll have to do a fresh install of R75.30 and then recover from the backups.

I downloaded the upgrade package (Check_Point_Upgrade_for_R75.40.Splat_to_Gaia.tgz) from checkpoint.com and checked the file hash to ensure there was no corruption then uploaded the package to the primary appliance using the webgui.

When I attempt the upgrade the Pre-verification process runs successfully but it eventually fails with the error message ďFailed to extract upgrade package.Ē

The resulting CPupgrade.elg file indicates that there is not enough space on the drive. The following line appears towards the end of the log file just before the cleanup function removes all of the aborted files and directories

Error:CPsecplPtchMod:main Installation/Upgrade Failed - There is not enough space on drive!

The Primary node disk partitions are as follows:

System partition: 4.45GB of 20GB free
Logs and Backups partition: 333.36GB of 340GB free
Images partition: 57.61GB of 461.61GB free


When the package is expanded it appears to use the /var/log path because I can watch the Used space increase from 5.8G to 7.3G (using df -h) and there is still loads of free space in /var/log. The upgrade process automatically creates a backup image so that there is a rollback path if the upgrade fails. If this is created on the system partition the available 5.2G may be the cause of the failure. I havenít been able to find out where the backup files are held or what temporary space they need for compression.

There are three Images available from earlier upgrades and Iíve tried to delete them in case they occupying space on the System partition. One of them is the Factory default but I cannot delete any of them. The system just gives an error message - Failed to delete image.


Check Point article sk101490 documents the upgrade failure message (Failed to extract upgrade package) with possible causes of unsupported upgrade path or wrong package. But the path Iím using R75.30 to R75.40 is valid (assuming that I can go from Splat to Gaia at the same time) and Iím using the correct package.

Iíve also seen a blog article where upgrades have failed because licences for earlier NGX revisions were still attached to the Security Manager in the SmartUpdate console. Check Point licensing is not the easiest to understand but I checked SmartUpdate and Iím fairly sure that is not what is causing the upgrade to fail because the two HA Security Managers were installed clean in February 2012 starting with R71.30 (i.e. no NGX products attached)

What else should I check?

mcnallym
2014-10-03, 13:18
When running the Upgrade Wizard Tool on the Check Point Website then suggests the following route

R75.30 SPLAT -> R76 SPLAT
R76 SPLAT -> R77.10 Gaia

What message do you get when you try and run the R77.10 Management Migration Tools and then migrate export on the Smart-1

All I normally do is download the migration tools to a directory
Extract and then run

./migrate export filename.tgz

in that directory

SteveW
2014-10-03, 16:30
Both the R77.10 and R76 upgrade tools failed immediately with "Segmentation error." Because of the backup problems I was having tech support at my support provider suggested using the R75.30 tools so that I had a recovery option if the system got trashed. They also suggested the R75.30 > R75.40 > R77.10 upgrade route.

PhoneBoy
2014-10-05, 20:38
Did you happen to open an SR with TAC?
Please PM me the number so we can have a look.