After upgrading to R70.20 Dashboard not running

[quartino]

Hi,
I just upgrade my cluster to R70.20.
The system i running but if I try to run the Dashboard after 5 minutes I get the following errror:
fwm-unregistered-netobj-status-summary
All the other tools are running well.
Any idea what's the problem?
Thank you.

[quartino]

I just tryed again and now I get another timeout error:
"Timed out elapsed!
Command "load-encryption-methods" could not be completed."
Any idea?
Thank you!

[belvdr]

It is not uncommon to be unable to connect for 10-15 minutes after an upgrade. If you check the processes, watch fwm. Once its utilization goes down, you should be able to connect.

Be patient.

[cciesec2006]

Originally Posted by belvdr

It is not uncommon to be unable to connect for 10-15 minutes after an upgrade. If you check the processes, watch fwm. Once its utilization goes down, you should be able to connect.

Be patient.

Run "vmstat 1" on the system. Once you see the "idle" column get to 100%, you know you can connect to the system with the SmartDashboard.

Or you may have legit issue after the upgrade.

[MrSnakey]

I am unsure whether a client upgrade is needed (however normally you get a nag error specifying client server version mismatch or the like).

If running SPLAT, connect to the webUI and download and install the GUI it presents there. This way you'll be sure to be running the correct GUI build.

[sisu-up]

I run P1 and have also seen a message that delayed a Dashboard from firing up even after the MDS settled down. This took about 5 minutes to return the following message.

Message Window

"Timed out elapsed!
Command 'get-installed-candidates' could not be completed."

I feel that R70 and the Patch R70.20 for P1 is riddled with bugs still. I have been doing a lot of initial testing in a lab and have found various problems doing a IN-PLACE upgrade from R65.

[Thorpuse]

Originally Posted by sisu-up

I feel that R70 and the Patch R70.20 for P1 is riddled with bugs still. I have been doing a lot of initial testing in a lab and have found various problems doing a IN-PLACE upgrade from R65.

I would do everything in my power to avoid an in-place upgrade for a major version. Every major version upgrade is a risky change (this would apply to many products, not just CP). CP has some pretty good export/import tools - it makes a lot more sense to use these and use the upgrade as a chance for hardware refresh/cleanup etc.

[cciesec2006]

Originally Posted by Thorpuse

I would do everything in my power to avoid an in-place upgrade for a major version. Every major version upgrade is a risky change (this would apply to many products, not just CP). CP has some pretty good export/import tools - it makes a lot more sense to use these and use the upgrade as a chance for hardware refresh/cleanup etc.

I think it is easier if you just have single P-1 (manager+container).

However, in an MSSP environment where you have multiple Managers, multiple
containers (at least 5) with at least 200 CMAs on each containers and multiple MLMs, it is a VERY costly to put up new hardware for this, especially when you
are talking about the diskspace for these MLMs. Some MSSPs has no choice but to perform in-place upgrade. But I think they have solid agreement with CP with these things and they also have MUCH better supports from Checkpoint R&D than regular mortal folks like myself.

[Thorpuse]

Originally Posted by cciesec2006

I think it is easier if you just have single P-1 (manager+container).

However, in an MSSP environment where you have multiple Managers, multiple
containers (at least 5) with at least 200 CMAs on each containers and multiple MLMs, it is a VERY costly to put up new hardware for this, especially when you
are talking about the diskspace for these MLMs. Some MSSPs has no choice but to perform in-place upgrade. But I think they have solid agreement with CP with these things and they also have MUCH better supports from Checkpoint R&D than regular mortal folks like myself.

This is the sort of thing where an N+1 redundancy setup would be appropriate. To each their own, I would think that with that level of software expenditure, the cost of some additional test/migration hardware is comparatively small vs the risk.

[sisu-up]

I need to review the migration aspect. I'm a VSX only shop so not sure what my options are because of this. My in-place upgrade from P1 R61 to R65 went very smooth. Right now I'm investigate what my options are for R70.