Blink - Gaia Fast Deployment

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk120193
Technical Level
Product	Quantum Spark Appliances, Quantum Security Gateways, Quantum Appliances, Quantum Security Management
Version	R80.10 (EOL), R80.20 (EOL), R80.30 (EOL), R80.40, R81, R81.10, R81.20
OS	Gaia
Platform / Model	2000, 3000, 4000, 5000, 12000, 13000, 15000, 21000, 23000, Smart-1
Date Created	16-Oct-2017
Last Modified	17-Jan-2023

Solution

Table of Contents:

Introduction
Basic Usage
Advanced Usage (Command Line)
- Installation Instructions
- Answer.xml
  - File Description
  - The answers.xml version 1.1 default file
  - The answers.xml xml version 1.0 (for old Blink Security Gateway images) file
Downloads
Limitations
Revision History

Click Here to Show the Entire Article

Introduction

Blink deployment flow and images let customers do a multi-step upgrade or clean install with one image.
Blink images already contain a specific base version (for example, R81.10), a designated role (for example, Security Gateway), and more hotfixes/Jumbo HFA's.
With this image, you can onboard new appliances/upgrade existing appliances with one package.
You can see and install Blink images with CPUSE webUI / Clish commands.

Basic Usage

Important Note: Blink mechanism is intended only for Check Point appliance/servers and Open Servers, on which Check Point software has been installed.

To deploy a new appliance/server through the First Time Wizard

Connect to the appliance/server with a web browser and log in.
The First Time Configuration Wizard opens:
Select the option Install from Check Point cloud:
After configuring the external interface, the installation table shows a list of supported images.
The latest images use Blink mechanism to install the version.
The selected Blink image is downloaded and deployed on the appliance/server:

Using Blink with CPUSE (Clean Install / Upgrade)

Blink packages installation is equivalent to the Major version installation:

You see all the packages by categories and, by default, it shows the recommended packages only.
Note: Use the filter button near the help icon and select the packages you wish to see:
Find the related package in the Blink section in CPUSE packages list:
1. For offline packages, manually import the package to CPUSE by clicking on Import Package on the top-right corner of the page:
2. To download a package from the list, right-click on the related package that is Available for Download and click on Download.
After the download completes, right-click on the package and click on Clean Install or Upgrade (if available):
Installation/Upgrade starts, and you can follow the installation from CPUSE WebUI or CLI.

Advanced Usage (command line)

Show / Hide this Section

Installation Instructions

Show / Hide this Section

Important Note: If the appliance/server is not after a clean install (the First Time Configuration Wizard has been run already), the "--reimage" flag needs to be used (see the "Answer.xml" section).

Blink image contains:

The root partition of a pre-installed Check Point appliance/server
Simplified First Time Configuration Wizard (will be used in case of attended installation)
Installation logic

The main files in the Blink image are:

Directory / File	Description
BlinkInstaller	Main executable file that extracts and installs all the packages.
CheckPoint_Gaia_fd.tgz	This is the actual installation image.
installation_logic	Directory that contains internal installation logic: answers.xml - User's configuration file for unattended installation. fd_wizard_gateway.sh - (Internal) Shell script for unattended First Time Configuration Wizard. fd_wizard_gateway.sh.sha256 - (Internal) Check Point Signature file for the `fd_wizard_gateway.sh` script. Note: The answers.xml is the only file that user is allowed to modify - refer to section "Answer.xml".
manifest.xml	XML-based file that represents the structure of the Blink package (internal).
user_updates	Directory that may contain user shell scripts and binary files that should be executed and installed during the main installation process (after the reboot). The answers.xml file has to be edited to contain the name of the main shell script that will be executed (refer to section "Answer.xml").

Important Note: Blink mechanism is intended only Check Point appliance/servers and Open Servers, on which Check Point software has been installed.

Action plan (basic mode only):

Download all the required (and optional) files from the "Downloads" section.
Transfer all the files to the appliance/server (to a newly created directory).
Execute the Blink utility (reboot will be performed automatically).
Connect with your web browser to the Check Point appliance/server to complete the First Time Configuration Wizard.

Detailed instructions:

Download all the required (and optional) files from the "Downloads" section to your computer:
1. Download the Blink utility
2. Download the Blink image
3. (Optional) Download the Blink Image updates package
Connect to the command line on the Check Point appliance/server.
Log in to the Expert mode.
Create some directory on the /var/log/ partition (largest partition):
[Expert@HostName:0]# mkdir -v /var/log/MyDIR
Transfer all the files from your computer to the newly created directory on the appliance/server.
- Either transfer the files over SCP (recommended).
  Note: This requires changing the default shell of the admin user from /etc/cli.sh to /bin/bash
  (by running the "set user admin shell /bin/bash" command in Gaia Clish - refer to Gaia Administration Guide (R77.X, R80.10))
- Or transfer the files to a USB storage device and mount it on Gaia OS.
  Note: This requires working in the Expert mode. In addition, refer to sk31657.
Go to the newly created directory:
[Expert@HostName:0]# cd /var/log/MyDIR
Unpack the Blink utility package:
[Expert@HostName:0]# tar -zxvf blink.tgz
Assign the execute permission to the Blink utility:
[Expert@HostName:0]# chmod -v +x blink

Execute the Blink utility by running the desired basic flow:

[Expert@HostName:0]# ./blink [-i <path to Blink Image>] [-b <path to Blink Image updates package>] [-u <path to user TGZ file>] [-a <path to answers.xml file>] [-d <output directory>] [-x]

where:

Argument Description

-i <path to Blink Image> Specifies the path to the Blink image.

If this path is not specified explicitly, then Blink will search in the current working directory
for a file with prefix blink_image.

-b <path to Blink Image updates package> Specifies the path to the Blink Image updates package (blink_updates_<OSVERSION>.tgz).

If this path is not specified explicitly, then Blink will search in the current working directory
for a file blades_updates_<OSVERSION>.tgz.

-u <path to user TGZ file> Specifies the path to the user TGZ file that contains user shell scripts and binary files
that should be executed and installed during the main installation process.

If this path is not specified explicitly, then Blink will search in the current working directory
for a file blink_custom_content.tgz.

Note: The package blink_custom_content.tgz must contain the main shell script as specified
in the answers.xml configuration file (by default, Blink will search for the script install_content.sh -
refer to section "Answer.xml").

-a <path to answers.xml file> Specifies the path to the user's configuration file for unattended installation (if needed).
Refer to section "Answer.xml".

-d <output directory> Specifies the output directory, into which the Blink image and all the other packages should be extracted.

If this path is not specified explicitly, then the Blink image and all the other packages will be extracted into the
/var/log/blink/launcher/files directory.

-x Specifies that Blink image should be only extracted, skipping the installation.

This option is for advanced users that wish to configure an unattended installation - refer to Step 9 below.

--reimage Using this flag will allow installation on appliance/servers that are already configured (performed First Time Wizard). By default, a snapshot of the old partition is saved, unless the "--delete-old-partition" flag is supplied.

--delete-old-partition Removes the old partition. Does not override the "--keep-old-partition" flag.

--keep-old-partition A snapshot of the old partition is saved if this flag is on.

Example commands and their results:

Extract the Blink image and Blink Image updates package into a temporary directory and start the main installation process, keeping the old partition as a snapshot:

[Expert@HostName:0]# ./blink [-i <path to Blink Image>] [-b <path to Blink Image updates package>] [-u <path to user TGZ file>] [-a <path to answers.xml file>] --keep-old-partition
1. A temporary directory /var/log/blink/launcher/files will be created.
2. The Blink Image will be extracted
  to the /var/log/blink/launcher/files/ directory.
3. The Blink Image updates package blink_updates_<OSVERSION>.tgz will be copied
  to the /var/log/blink/launcher/files/blades_updates/ directory.
4. The user update shell script and binary files will be copied
  to the /var/log/blink/launcher/files/user_updates/ directory.
5. The main installation process will be started.
6. A snapshot of the old partition will be saved.
Extract the Blink image and Blink Image updates package into a specified directory and start the main installation process, on an already configured appliance/server, and NOT saving the old partition as snapshot:

[Expert@HostName:0]# ./blink [-i <path to Blink Image>] [-b <path to Blink Image updates package>] [-u <path to user TGZ file>] [-a <path to answers.xml file>] -d <output directory> --reimage --delete-old-partition
1. The Blink Image will be extracted in the specified output directory.
2. The Blink Image updates package blink_updates_<OSVERSION>.tgz will be copied to the specified output directory.
3. The user update shell script and binary files will be copied to the specified output directory.
4. The main installation process will be started.
5. Validation for a configured appliance/server will be skipped.
6. A snapshot of the old partition will NOT be created.
Extract the Blink image into a a specified directory and do NOT start the main installation process:

[Expert@HostName:0]# ./blink [-i <path to Blink Image>] -x -d <output directory>
1. The Blink Image will be extracted to the specified output directory.
  If the output directory is not specified, then it will be extracted to the temporary directory /var/log/blink/launcher/files/.
2. The main installation process will NOT be started.

For advanced users that wish to configure custom settings:
1. Extract and configure the Blink image:
  1. Extract all the files from the Blink image (to get access to the internal configuration files) -
    either to the temporary directory /var/log/blink/launcher/files/,
    or to the specified directory:
    [Expert@HostName:0]# ./blink [-i <path to Blink Image>] -x [-d <output directory>]
  2. Configure the desired settings in the installation_logic/answers.xml file -
    refer to the "Answer.xml" section.
2. Add the Blink Image updates package:
  1. Add the package blades_updates/blink_updates_<OSVERSION>.tgz
3. Extract the desired user packages:
  1. Extract the desired user packages to the user_updates directory.
    Note: If the main user shell script is not called install_content.sh, then make sure it matches the script defined
    in the installation_logic/answers.xml file (refer to section "Answer.xml").
4. Start the main installation process:
  
  [Expert@HostName:0]# cd /path_to_extracted_Blink_Image/
  [Expert@HostName:0]# ./BlinkInstaller

You can monitor the Blink installation process in two ways (until the appliance/server is rebooted automatically):

Query the current state by running one of these commands:

[Expert@HostName:0]# ./BlinkInstaller -status <json | full | id>

where:

Option Description
./BlinkInstaller -status json
Returns the last recorded status in JSON format.

Example:
[Expert@HostName:0]# ./BlinkInstaller -status json
{
   "isCompleted" : "true",
   "stageEndTime" : "5:0:4",
   "stageID" : "finish_message",
   "stageName" : "BlinkInstaller Installation",
   "stageStartTime" : "4:56:39",
   "state" : "Success",
   "statusDescription" : "The installation has finished successfully and is pending reboot!"
}
./BlinkInstaller -status full
Returns the last recorded status in a single-string representation.

Example:

[Expert@HostName:0]# ./BlinkInstaller -status full BlinkInstaller Installation - The installation has finished successfully and is pending reboot! - Success [Started at: 4:56:39] [Ended at:5:0:4]

./BlinkInstaller -status id
Returns the last status recorded identifier as a string.

Example:

[Expert@HostName:0]# ./BlinkInstaller -status id finish_message

Check the output log and status files:
/var/log/blink/logs_<DATE>/Main_log.elg
/var/log/blink/status.txt

Reboot will be performed automatically.
Connect with your web browser to the Check Point appliance/server to complete the First Time Configuration Wizard (basic mode only).

Example of First Time Configuration Wizard after attended installation:

Answer.xml

Show / Hide this Section

File Description:
This is an XML-based file (located in the installation_logic directory) that contains user's configuration for unattended installation.

The answers.xml version 1.1 default file

Show / Hide this Section

Default File:


	<properties xmlVersion="1.1">
		<installation>
			<reboot_delay>10</reboot_delay>
		</installation>
		<machine_configuration>
			<perform>false</perform>
			<hostname>GWOBJECT_NAME_FIELD</hostname>
			<password_hash>PASSWORD_HASH_FIELD</password_hash>
			<network>
				<ipv4addr>IPV4_FIELD</ipv4addr>
				<masklength>IPV4_MASKLENGTH_FIELD</masklength>
				<interface>IPV4_INTERFACE_FIELD</interface>
				<default_gw>DEFAULTGW_FIELD</default_gw>
			</network>
			<role_configuration>
				<gateway>
					<!--  activation_key must be in base64 encoding -->
					<activation_key>SIC_BASED64_FIELD</activation_key>
					<cluster>false</cluster>
				</gateway>
				<management>
					<credentials>
						<use_gaia_admin>true</use_gaia_admin>
						<!--  Relevant only if use_gaia_admin is false -->
						<admin_name>MGMT_ADMIN_FIELD</admin_name>
						<!--  admin_password must be in base64 encoding -->
						<admin_password>MGMT_PASS_BASED64_FIELD</admin_password>
					</credentials>
				</management>
			</role_configuration>
			<send_data_to_usercenter>true</send_data_to_usercenter>
			<enable_download_from_checkpoint>true</enable_download_from_checkpoint>
		</machine_configuration>
		<user_updates>
			<entry_point>install_content.sh</entry_point>
		</user_updates>
		
		<!--
		logging - Used in order to filter the logs saved to files, displayed on the screen or sent to the syslog.
		Supported logging levels: DEBUG, NORMAL, ERROR, ALWAYS, NEVER
		Colors - Should be set to true for displaying log messages in color on the screen.
		-->
		<logging>
			<file_level>DEBUG</file_level>
			<screen_level>NORMAL</screen_level>
			<sys_log_level>NEVER</sys_log_level>
			<colors>true</colors>
		</logging>
	</properties>

Supported XML elements:

The root XML element is "properties".

Enter the string to filter this table:

Section	Sub-Section	XML element	Description
`<installation>`		`<reboot_delay>`	Specifies the delay (in seconds) before rebooting the appliance/server after completing the installation process. The default delay is: 10 To suppress the reboot completely, define the value -1 (not recommended).
`<machine_configuration>`		`<perform>`	Specifies the whether to perform the unattended installation or not: true - perform the unattended installation false - (default) do not perform the unattended installation (other elements in the `<machine_configuration>` sub-section will be ignored)
		`<hostname>`	Specifies the appliance/server's HostName to configure during the unattended installation.
		`<password_hash>`	Specifies the appliance/server's admin password to configure during the unattended installation. hash value of the password string (e.g., 72ae25495a7981c40622d49f9a52e4f 1565c90f048f59027bd9c8c8900d5c3d8) Run the following command in the Expert mode to get the hash value of the admin password from the configured system (must use the same Gaia OS version): Either run: dbget passwd:admin:passwd Or run: grep admin /etc/shadow \| cut -d: -f2
	`<network>`		This sub-section specifies the network interface configurations that will apply during the unattended installation
	`<network>`	`<ipv4addr>`	Specifies the appliance/server's IPv4 address (X.X.X.X) to configure during the unattended installation
	`<network>`	`<masklength>`	Specifies the appliance/server's IPv4 address subnet mask length (0-32) to configure during the unattended installation.
	<network>	`<interface>`	Specifies the appliance/server's main management interface to configure during the unattended installation
	<network>	`<default_gw>`	Specifies the appliance/server's default gateway to configure during the unattended installation.
`<role_configuration>`			This sub-section specifies the role-based configurations that will apply during the unattended installation
	`<gateway>`		This sub-section specifies the Security Gateway related configurations
		`<activation_key>`	Specifies the appliance/server's SIC one-time key to configure during the unattended installation. SIC key must be provided in base64 encoding
		`<cluster>`	Flag that specifies whether to enable cluster membership for the gateway or not
	`<management>`		This sub-section specifies the Security Management related configurations
		`<credentials>`	This sub-section specifies the credentials for the Security Management administrator
		`<credentials> <use_gaia_admin>`	Constant flag that specifies whether to use the Gaia credentials as the Security Management administrator or define a new administrator: true - (default) use the Gaia credentials false - define a new administrator
		`<credentials> <admin_name>`	Specifies the username for the Security Management administrator. Relevant only if use_gaia_admin set to "false"
		`<credentials> <admin_password>`	Specifies the password for the Security Management administrator. Password must be provided in base64 encoding. Relevant only if "use_gaia_admin" is set to "false"
`<send_data_to_usercenter>`			Consent flag that specifies whether the appliance/server is allowed to send various statistics data to Check Point Cloud (refer to sk111080): true - (default) send various statistics data to Check Point Cloud false - do not send various statistics data to Check Point Cloud
`<enable_download_from_checkpoint>`			Consent flag that specifies whether the appliance/server is allowed to download various data (updates, latest packages, contracts, etc.) from Check Point Cloud (refer to sk111080): true - (default) download various data from Check Point Cloud false - do not download various data from Check Point Cloud
`<user_updates>`		`<entry_point>`	Specifies the main executable user shell script to call during the unattended installation, which will perform the desired operations. The default script name is: install_content.sh Example: The "user_updates" directory contains: The main user shell script install_content.sh with the following commands: `#!/bin/bash Log_File="/var/log/user_main_script.log" echo "Configuring Mgmt interface..." >> $Log_File clish -i -s -f "clish_commands.txt" >> $Log_File echo "Installing private RPMs..." >> $Log_File rpm -ihv some_private_RPM.rpm >> $Log_File exit 0` The file with relevant Gaia Clish commands `clish_commands.txt: lock database override set interface Mgmt auto-negotiation off set interface Mgmt state on set interface Mgmt link-speed 100M/full set interface Mgmt ipv4-address 192.168.1.1 subnet-mask 255.255.255.0` User RPM package some_private_RPM.rpm
`<logging>`	`<file_level>`		Specifies the desired priority to filter the log entries saved in the main log file /var/log/blink/logs_<DATE>/Main_log.elg (order below is from highest to lowest priority): DEBUG (default) NORMAL ERROR ALWAYS NONE For example, if "`file_level`" is set to "`ERROR`", then messages marked as "Debug" and "Normal" will not be written to the log file - only messages marked as "Errors" and "Always" will be written to the log file. If "`file_level`" is set to "`NONE`", then no messages will be written to the log file.
	`<screen_level>`		Specifies the desired priority to filter the log entries displayed on the screen (order below is from highest to lowest priority): DEBUG NORMAL (default) ERROR ALWAYS NONE For example, if "`screen_level`" is set to "`ERROR`", then messages marked as "Debug" and "Normal" will not be displayed on the screen - only messages marked as "Errors" and "Always" will be displayed on the screen. If "`screen_level`" is set to "`NONE`", then no messages will be displayed on the screen.
	`<sys_log_level>`		Specifies the desired priority to filter the log entries sent to Syslog server (order below is from highest to lowest priority): DEBUG NORMAL ERROR ALWAYS NONE (default) For example, if "`sys_log_level`" is set to "`ERROR`", then messages marked as "Debug" and "Normal" will not be sent to Syslog server - only messages marked as "Errors" and "Always" will be sent to Syslog server. If "`sys_log_level`" is set to "`NONE`", then no messages be sent to Syslog server.
	`<colors>`		Specifies the whether to use colors on the screen or not (refer to the `<screen_level>`): true - (default) use colors on the screen false - do not use colors on the screen

Management example file:

<properties xmlVersion="1.1">

	<installation>
		<reboot_delay>10</reboot_delay>
	</installation>

	<machine_configuration>
		<perform>false</perform>
		<hostname>MyGW123</hostname>
		<password_hash>$1$Es1wXWZ8$vVK0iT0nXRiGdYZ9zb6ah/</password_hash>
		<network>
			<ipv4addr>192.168.1.22</ipv4addr>
			<masklength>24</masklength>
			<interface>Mgmt</interface>
			<default_gw>192.168.1.254</default_gw>
		</network>
		<role_configuration>
			<gateway>
				<!-- activation_key must be in base64 encoding -->
				<activation_key>SIC_BASED64_FIELD</activation_key>
				<cluster>false</cluster>
			</gateway>
			<management>
				<credentials>
					<use_gaia_admin>false</use_gaia_admin>
					<!--  Relevant only if use_gaia_admin is false -->
					<admin_name>myadmin</admin_name>
					<!--  admin_password must be in base64 encoding -->
					<admin_password>YWRtaW5wYXNzMTIz</admin_password>
				</credentials>
			</management>
		</role_configuration>
		<send_data_to_usercenter>true</send_data_to_usercenter>
		<enable_download_from_checkpoint>true</enable_download_from_checkpoint>
	</machine_configuration>
	<user_updates>
		<entry_point>install_content.sh</entry_point>
	</user_updates>

	<!--
	logging - Used in order to filter the logs saved to files, displayed on the screen or sent to the syslog.
	Supported logging levels: DEBUG, NORMAL, ERROR, ALWAYS, NEVER
	Colors - Should be set to true for displaying log messages in color on the screen.
	-->
	<logging>
		<file_level>DEBUG</file_level>
		<screen_level>NORMAL</screen_level>
		<sys_log_level>NEVER</sys_log_level>
		<colors>true</colors>
	</logging>
</properties>

The answers.xml xml version 1.0 (for old Blink Security Gateway images) file

Show / Hide this Section

Default File:

<?xml version="1.0" encoding="UTF-8"?>

<properties xmlVersion="1.0">
	<installation>
		<reboot_delay>10</reboot_delay>
	</installation>
	<machine_configuration>
		<perform>false</perform>
		<hostname>GWOBJECT_NAME_FIELD</hostname>
		<password>
			<value>PASSWORD_FIELD</value>
			<is_hash>true</is_hash>
		</password>
		<network>
			<ipv4addr>IPV4_FIELD</ipv4addr>
			<masklength>IPV4_MASKLENGTH_FIELD</masklength>
			<interface>IPV4_INTERFACE_FIELD</interface>
			<default_gw>DEFAULTGW_FIELD</default_gw>
		</network>
		<activation_key>SIC_FIELD</activation_key>
		<cluster>false</cluster>
		<send_data_to_usercenter>true</send_data_to_usercenter>
		<enable_download_from_checkpoint>true</enable_download_from_checkpoint>
	... ...
	</machine_configuration>

	<user_updates>
		<entry_point>install_content.sh</entry_point>
	</user_updates>

	<!--
	logging - Used in order to filter the logs saved to files, displayed on the screen or sent to the syslog.
	Supported logging levels: DEBUG, NORMAL, ERROR, ALWAYS, NEVER
	Colors - Should be set to true for displaying log messages in color on the screen.
	-->
	<logging>
		<file_level>DEBUG</file_level>
		<screen_level>NORMAL</screen_level>
		<sys_log_level>NEVER</sys_log_level>
		<colors>true</colors>
	</logging>
</properties>

Supported XML elements:

The root XML element is "properties".

Enter the string to filter this table:

Section	Sub-Section	XML element	Description
`<installation>`		`<reboot_delay>`	Specifies the delay (in seconds) before rebooting the appliance/server after completing the installation process. The default delay is: 10 To suppress the reboot completely, define the value -1 (not recommended).
`<machine_configuration>`		`<perform>`	Specifies the whether to perform the unattended installation or not: true - perform the unattended installation false - (default) do not perform the unattended installation (other elements in the `<machine_configuration>` sub-section will be ignored)
		`<hostname>`	Specifies the appliance/server's HostName to configure during the unattended installation.
	`<password>`		This sub-subsection specifies the appliance/server's admin password to configure during the unattended installation.
	`<password>`	`<value>`	Specifies the appliance/server's admin password string: either plain-text string (e.g., `password123`) or hash value of the password string (e.g., `72ae25495a7981c40622d49f9a52e4f1565c90f048f59027bd9c8c8900d5c3d8`) Run the following command in the Expert mode to get the hash value of the admin password from the configured system (must use the same Gaia OS version): Either run: `dbget passwd:admin:passwd` Or run: `grep admin /etc/shadow \| cut -d: -f2`
	`<password>`	`<is_hash>`	Specifies how the appliance/server's admin password string was defined in the <value> element: false - the defined appliance/server's admin password string is a plain-text string true - (default) the defined appliance/server's admin password string is a hash value of the password string
	`<network>`		This sub-section specifies the network interface configurations that will apply during the unattended installation
	`<network>`	`<ipv4addr>`	Specifies the appliance/server's IPv4 address (X.X.X.X) to configure during the unattended installation.
	`<network>`	`<masklength>`	Specifies the appliance/server's IPv4 address subnet mask length (0-32) to configure during the unattended installation.
	`<network>`	`<interface>`	Specifies the appliance/server's main management interface to configure during the unattended installation.
	`<network>`	`<default_gw>`	Specifies the appliance/server's default gateway to configure during the unattended installation.
		`<activation_key>`	Specifies the appliance/server's SIC one-time key to configure during the unattended installation.
		`<cluster>`	Flag that specifies whether to enable cluster membership for the gateway or not.
		`<send_data_to_usercenter>`	Consent flag that specifies whether the appliance/server is allowed to send various statistics data to Check Point Cloud (refer to sk111080): true - (default) send various statistics data to Check Point Cloud false - do not send various statistics data to Check Point Cloud
		`<enable_download_from_checkpoint>`	Consent flag that specifies whether the appliance/server is allowed to download various data (updates, latest packages, contracts, etc.) from Check Point Cloud (refer to sk111080): true - (default) download various data from Check Point Cloud false - do not download various data from Check Point Cloud
`<user_updates>`		`<entry_point>`	Specifies the main executable user shell script to call during the unattended installation, which will perform the desired operations. The default script name is: install_content.sh Example: The "`user_updates`" directory contains: The main user shell script `install_content.sh` with the following commands: `#!/bin/bash Log_File="/var/log/user_main_script.log" echo "Configuring Mgmt interface..." >> $Log_File clish -i -s -f "clish_commands.txt" >> $Log_File echo "Installing private RPMs..." >> $Log_File rpm -ihv some_private_RPM.rpm >> $Log_File exit 0` The file with relevant Gaia Clish commands `clish_commands.txt`: `lock database override set interface Mgmt auto-negotiation off set interface Mgmt state on set interface Mgmt link-speed 100M/full set interface Mgmt ipv4-address 192.168.1.1 subnet-mask 255.255.255.0` User RPM package `some_private_RPM.rpm`
`<logging>`		`<file_level>`	Specifies the desired priority to filter the log entries saved in the main log file /var/log/blink/logs_<DATE>/Main_log.elg (order below is from highest to lowest priority): DEBUG (default) NORMAL ERROR ALWAYS NONE For example, if "`file_level`" is set to "`ERROR`", then messages marked as "Debug" and "Normal" will not be written to the log file - only messages marked as "Errors" and "Always" will be written to the log file. If "`file_level`" is set to "`NONE`", then no messages will be written to the log file.
		`<screen_level>`	Specifies the desired priority to filter the log entries displayed on the screen (order below is from highest to lowest priority): DEBUG NORMAL (default) ERROR ALWAYS NONE For example, if "`screen_level`" is set to "`ERROR`", then messages marked as "Debug" and "Normal" will not be displayed on the screen - only messages marked as "Errors" and "Always" will be displayed on the screen. If "`screen_level`" is set to "`NONE`", then no messages will be displayed on the screen.
		`<sys_log_level>`	Specifies the desired priority to filter the log entries sent to Syslog server (order below is from highest to lowest priority): DEBUG NORMAL ERROR ALWAYS NONE (default) For example, if "`sys_log_level`" is set to "`ERROR`", then messages marked as "Debug" and "Normal" will not be sent to Syslog server - only messages marked as "Errors" and "Always" will be sent to Syslog server. If "`sys_log_level`" is set to "`NONE`", then no messages be sent to Syslog server.
		`<colors>`	Specifies the whether to use colors on the screen or not (refer to the `<screen_level>`): true - (default) use colors on the screen false - do not use colors on the screen

Example File:

<?xml version="1.0" encoding="UTF-8"?>

<properties xmlVersion="1.0">

	<installation>
		<reboot_delay>10</reboot_delay>
	</installation>

	<machine_configuration>
		<perform>true</perform>
		<hostname>MyGW123</hostname>
		<password>
			<value>mypassword</value>
			<is_hash>false</is_hash>
		</password>
		<network>
			<ipv4addr>192.168.1.22</ipv4addr>
			<masklength>24</masklength>
			<interface>Mgmt</interface>
			<default_gw>192.168.1.254</default_gw>
		</network>
		<activation_key>12345</activation_key>
		<cluster>true</cluster>
		<send_data_to_usercenter>true</send_data_to_usercenter>
		<enable_download_from_checkpoint>true</enable_download_from_checkpoint>
	</machine_configuration>

	<user_updates>
		<entry_point>install_content.sh</entry_point>
	</user_updates>

	<!--
	logging - Used in order to filter the logs saved to files, displayed on the screen or sent to the syslog.
	Supported logging levels: DEBUG, NORMAL, ERROR, ALWAYS, NEVER
	Colors - Should be set to true for displaying log messages in color on the screen.
	-->
	<logging>
		<file_level>DEBUG</file_level>
		<screen_level>NORMAL</screen_level>
		<sys_log_level>NEVER</sys_log_level>
		<colors>true</colors>
	</logging>
</properties>

Downloads

Show / Hide this Section

Fast Deployment Image (Blink) Utility

Blink Utility - the main utility that extracts the Blink Image and other packages, and installs them. Starting from R80.20, Blink Utility is a part of release.

Description	Link to download
Blink Utility version 1.1	(TGZ)

To verify the version of the Blink Utility you have, run the below command from the Expert mode:

[Expert@Host:0]# blink --version
Blink Utility version: 1.1

Use --help for help.

Fast Deployment Image (Blink) Images - the Gaia OS images

Security Management Fast Deployment Image GA Images

Version	Date	Download Link
R81.20 (GA Take 631)	21 Nov 2022	(TGZ)
R81.10 (GA Take 335)	06 Jul 2021	(TGZ)
R81 (GA Take 392)	22 Oct 2020	(TGZ)
R80.40 (GA Take 294)	28 Jan 2020	(TGZ)
R80.30 (GA Take 200)	06 Jun 2019	(TGZ)
R80.20 (GA Take 117)	15 Oct 2019	(TGZ)
R80.10 (GA Take 479) (except Smart-1 525/5150)	05 Apr 2020	(TGZ)
R80.10 for Smart-1 525/5150 appliance/servers	17 Sep 2018	(TGZ)

To check if a custom Blink image that includes specific ad-hoc hotfixes can be created, you can contact Check Point Support.
To download the latest Blink Image for Security Management including Jumbo Hotfix, refer to

Security Gateway Fast Deployment Image GA Images

Version	Date	Download Link
R81.20 (GA Take 631)	21 Nov 2022	(TGZ)
R81.10 (GA Take 335)	06 Jul 2021	(TGZ)
R81 (GA Take 392)	22 Oct 2020	(TGZ)
R80.40 (GA Take 294)	28 Jan 2019	(TGZ)
R80.30 (GA Take 200)	06 Jun 2019	(TGZ)
R80.20 (GA Take 117)	23 Sep 2019	(TGZ)
R80.10 (GA Take 479)	05 Apr 2020	(TGZ)

To check if a custom Blink image that includes specific ad-hoc hotfixes can be created, you can contact Check Point Support.
To download the latest Blink Image for Security Gateway including Jumbo Hotfix, refer to

Limitations

ID	Symptoms
PMTR-47403	When performing advanced upgrade with Blink, make sure to configure the correct timezone on the new installed appliance/server.
-	Default value for "Management GUI Clients" property is set to "Any"
DP-2884	Using Blink images to downgrade from kernel 3.10 to 2.6.18 is prohibited. Use "revert to snapshot" to return to the old version
DP-1644	Reimage: Blink reimage is blocked from running on VSX Gateways.
PMTR-41564	You can install Blink images on VSX Gateways only of blink images are R80.40 and up.
-	No automatic Cleanup in case of un-normal progress interruption (power problem, early reboot, etc...). In case interruption, perform the following (in expert mode): Unmount blink new partition. Run: umount /mnt/fcd/proc /mnt/fcd/sys /mnt/fcd/dev /mnt/fcd/var/log /mnt/fcd/tmp /mnt/fcd /mnt/BlinkPlugAndPlay_usb Remove blink new partition: lvremove /dev/vg_splat/lv_fcd_new Re-run the process
-	Bond Configuration is not preserved during Blink installation.

Revision History

Show / Hide revision history

Date	Description
17 Jan 2023	Updated Limitation section
15 Jan 2023	Revised article. Added Basic Usage and Advanced Usage sections
05 Nov 2020	Updated the Supported deployments section
22 Oct 2020	Added support for R81
05 Apr 2020	Added Security Gateway and Management images for R80.10 (GA Take 479)
28 Jan 2020	Added support for R80.40
19 Dec 2019	Added PMTR-47403 to the list of Limitations
11 Dec 2019	Added support for Upgrade of R80.30 Security Gateways
13 Nov 2019	Added Security Gateway and Management images for R80.20 with R80.20 Jumbo Hotfix Take 118
02 Oct 2019	Added Security Gateway and Management images for R80.20 with R80.20 Jumbo Hotfix Take 103
23 Sep 2010	R80.20 Security Gateway image was updated to Take 117
06 June 2019	Added support for R80.30
26 May 2019	Added "Blink image installation" section
27 Mar 2019	List of Known Limitations was updated
18 Dec 2018	Added R80.20 Security Gateway and Security Management images
14 Oct 2018	Security Gateway Images have been replaced
17 Sep 2018	Added Blink Security Management Images and new answers.xml file instructions
18 Jul 2018	Added the "Deploying Check Point NG Firewalls just got easier with the Blink utility" video
14 May 2018	Added Blink Image for R80.10 Jumbo Hotfix Take 103 and R77.30 Jumbo Hotfix Take 302
07 May 2018	Updated the "How to use the Blink mechanism" section
19 Mar 2018	Added Blink Image for R80.10 Jumbo Hotfix Take 70
24 Jan 2018	All images were updated to support software RAID appliance/servers
21 Jan 2018	Added Blink Image for R80.10 (GA Take 462)
31 Dec 2017	First release of this article

Give us Feedback

Please rate this document

[1=Worst,5=Best]

Comment
	Submitting rating