Aldan Security Blog

Security tools, tricks, tips and hands on

Problems to apply HFA60 on Flash-based systems

Posted by daniel_aldan on May 18, 2010

Recently, I needed to install HFA60 in Nokia IP290 (Flash-based) 1GB with NGX R65. I followed all procedures of HFA Release Notes document:

To install NGX R65 HFA 60 on IPSO Flash-based:

  1. If using 1GB RAM systems, run the following command to extend the /opt RAM disk partition: /sbin/mount -u -o extend_partition /dev/null /opt
    To verify that the /opt partition was extended to at least 500000 KB, run the df command.
  2. Verify that there is enough free disk space for the installation of the HFA packages:
    * For /preserve, you need at least 455000 KB free.
    (To find absolute free space: run the df -k /preserve command and subtract the 3rd column Used from the 2nd column 1K-blocks).
    * For /opt and /var, you need at least 382000 KB free.
  3. Create a temporary directory on /opt: mkdir /opt/hfa
  4. Navigate to the new directory: cd /opt/hfa
  5. Download Check_Point_NGX_R65_HFA_60.ipso.tgz (http://supportcontent.checkpoint.com/file_download?id=10349) to /opt/hfa and extract the contents.
  6. Delete the *.tgz file to save disk space.
  7. Execute: ./UnixInstallScript
  8. Reboot the machine.

Unfortunately, I had a lot if problems:

  1. After make a copy of hfa file, I didn’t extract it, because of lack of disk space.
  2. Looking for log files, I deleted some audit log from Nokia Voyager that allow me to extract all content from hfa file.
  3. When I tried to execute: ./UnixInstallScript , I got the error: “Can’t open /opt/CPshared/5.0/tmp/.CPprofile.sh”. I searched for this error on User Center and Google, and I didn’t find anything related with my problem.
  4. Looking for the Check Point packages, I found the CPInfo package, that I immediately deleted. Reboot. I tried again, getting the same error.
  5. I decided then to remove CPsuite-R65 (maybe this procedure will clean all temp files and directories). I rebooted and try to install the CPsuite-R65 again, using IPSO_wrapper_R65.tgz (according Check Point site: NGX R65 Package for Flash Based Platforms with 1GB of RAM or Disk Based Platforms on IPSO 4.1 and 4.2) with 186MB. I did the upload, extract and install. Didn’t install.
  6. After a few hours, I found the package fw1_R65_IPSO.tgz (NGX R65 Package for Flash Based Platforms with 512 MB of RAM on IPSO 4.1 and 4.2) with 77MB. So, I uploaded, extracted and installed, rebooted, and in the end, everything works.
  7. Immediately I applied the HFA60, following the procedures above, with success.
  8. I lost almost 4 hours with this little problem.

Conclusion

The Check Point site shows some confusing information about packages, ipso, and missing for Release Notes files.

One Response to “Problems to apply HFA60 on Flash-based systems”

  1. Mike said

    I have to agree with you, I’ve had nothing but problems loading R70.1 on a flash-based appliance. The same procedure works about 70% of them time, yet the appliances are wiped clean and are identical.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Connecting to %s

 
Follow

Get every new post delivered to your Inbox.