Managing Packages | The Best Damn Firewall Book Period

Nokia packages are software bundles that are in a tarred, gzipped format ready to be installed on an IPSO system. You can get packages compatible with IPSO from Nokia, with the exception of Check Point FireWall-1, which must be obtained from Check Point or one of its resellers.

All Nokia packages are stored in the /opt file system. This is also the directory for administrators to put optional software.

Installing New Packages

When you download a new package to your NSP, you should not uncompress or extract the package files in any way prior to starting the installation. The IPSO tools provided expect to find most packages with a .tgz extension and will extract the files necessary as part of the package installation procedure.

Voyager

First, let's walk through the process of installing a new package using the Voyager Web interface. (If you want to use the command line instead, skip to the next section.) When installing packages through Voyager, you must specify an FTP server that you can use to download the package:

Log in to Voyager and click Config.
Select Manage Installed Packages from under the System Configuration section.
Click the link to FTP and Install Packages from the Manage Packages configuration page.
Fill in the required fields for the FTP session. This information includes the FTP server name or IP address, the directory where the packages are stored on that server, and a login name/password. You may leave the username and password fields blank if you want to use anonymous FTP. See the example illustrated in Figure 20.2. If you want to use the login directory, you might need to enter a single period (.) in the FTP dir box.

Figure 20.2: FTP Packages
Click Apply. The page will update once a connection has been made to the FTP server. A list of packages available on that server will be displayed in the Site Listing box.
Choose the packages that you want to download by highlighting them in the Site Listing box (see Figure 20.3).

Figure 20.3: Selecting a Package for Download
Click Apply again. This time, the Nokia device will begin to download the files. The page will update every 15 seconds during the download so you know that it is in progress. You will also see a message on the top of the screen similar to the following:
```
Last FTP Attempt: /opt/packages/RSNS_NokiaRelease_6_5_2001_353a.tgz Status: Downloading Status Can Be Refreshed By Either Waiting 15 Seconds or Clicking Apply
```
When the download is complete, you will see the message "Status: Download Successful" at the top of the page. Scroll down to the box now displayed that is labeled Select a package to unpack. You should see the package(s) that you retrieved in the previous step. Highlight the package you want to install.
Click Apply. Doing so will extract the package and list some package details on the screen, as shown in Figure 20.4.

Figure 20.4: Unpacked Package Details
Select the link Click here to install/upgrade, which ends with the package name. In this example, the package used is /opt/packages/RSNS_NokiaRelease_6_5_2001_353a.tgz. You will see a page similar to the one shown in Figure 20.5.

Figure 20.5: Installing the New Package in Voyager
Toggle the radio button to Yes to install a new package. If you want to upgrade the package from one already installed instead, choose Yes under the Upgrade option and from the list provided, select the software package that you want to upgrade.
Click Apply. The package is now installed and active. You can now view this package on the Manage Packages configuration screen along with all the other installed packages.
Click Save.

Warning

If you are installing NG for the first time, you must install Check Point FireWall-1 NG FP2 using the bundled wrapper file named CP_FP2_IPSO.tgz instead of trying to install the individual packages. The wrapper will install NG FP1 and then update to FP2 automatically. If you are already running NG FP1, you shouldn't have any problem upgrading to FP2 using the separate packages.

The Command Line

The command-line tool that is used to install new images is newpkg. Follow these steps to install a package using the newpkg utility. To use this procedure, you should already have the package downloaded to the system in the /var/admin directory. Available command-line options for this tool are described in Table 20.1. Do the following:

From a command prompt on the Nokia device, type newpkg –i. The following options will be displayed:

Load new package from: 1. Install from CD-ROM. 2. Install from anonymous FTP server. 3. Install from FTP server with user and password. 4. Install from local filesystem. 5. Exit new package installation.

Type 4 at the Choose an installation method (1-5): prompt and press Enter.

Type a single period (.) and press Enter at the Enter pathname to the packages [ or 'exit' to exit ]: prompt. You will see the following output:

Loading Package List     Processing package nic-doc3.6.tgz ... Package Description: Documentation for Nokia IPSO 3.6 07/08/02     Would you like to :      1. Install this as a new package 2. Skip this package 3. Exit new package installation     Choose (1-3):

Type 1 and press Enter to install the new package. You will then see the following output:

Installing nic-doc3.6.tgz nic_doc36 does not exist previously. Proceeding with Installation. Done installing nic_doc36     End of new package installation cleaning up ..done Use Voyager to activate packages

Table 20.1: newpkg Command-Line Arguments
Switch for newpkg	Description
-i	Installs the package but does not activate it. Prompts you for media type, new packages, and old packages that you want to install or upgrade.
-s <server>	Specifies the FTP server IP address.
-l <username>	Enter the FTP username. (You don't need to enter a username if you will be using anonymous FTP.)
-p <password>	Enter the FTP user's password.
-m <CDROM \| AFTP \| FTP \| LOCAL>	Choose your media type. Your options are CDROM, AFTP, FTP or LOCAL.
-d	Prints debug messages.
-v	Verbose mode for FTP.
-n <new package>	Enter the full pathname to the new package you are installing.
-o <old package>	Enter the full pathname to the package from which you are upgrading.
-S	Sets the newpkg to install the package silently. If you enable silent mode, you must specify the following arguments: -o, -m, -n, and possibly –s and -l, –p if the media type is not LOCAL.
-h	Prints the usage for newpkg (help).

Enabling and Disabling Packages

Once you have installed packages, you might need to go into Voyager to enable them. Likewise, you can easily disable packages from the same screen:

Log in to Voyager and click Config.
Click Manage Installed Packages from the System Configuration heading (see Figure 20.6).

Figure 20.6: Enabling and Disabling Packages
All the installed packages are listed with the option of being turned Off or On. Their current state is displayed. To enable a package that is disabled, toggle to the On position. Enabling a package will start any relevant processes so you can start using the software immediately.
To disable a package that is currently enabled, toggle the button to the Off position. You may enable or disable one or more packages at one time from this screen. Disabling a package will kill any running processes related to that package but will not uninstall it, so you may enable it again later.
Click Apply and then click Save.

Note

Using the Manage Installed Packages tool in Voyager, you have an easy method of toggling packages off and on, giving you the ability to disable one version of installed software and enable another. This tool is ideal for administrators since it provides a quick and simple way to back out of new package upgrades, if necessary.

For example, consider that you are running Check Point FireWall-1 4.1 SP-5 and you are planning an upgrade to FireWall-1 NG. As part of your upgrade procedure, it is always prudent to have a contingency plan in case the upgrade is not successful for any reason. With your Nokia system, you can simply toggle the new Check Point NG package to Off and toggle the Check Point 4.1 SP-5 package to On. Click Apply and then click Save, and the system will switch to running whatever package you have enabled at that time. The entire configuration will be saved in the old package. If you want to try NG again at a later time, just reverse the procedure.

After enabling a package, you will receive notification at the top of the Manage Packages configuration screen that the package has been registered and that the Voyager environment has been changed due to the new package. Any necessary environment variables have been updated within the login environment as well, but you might need to end your session and start a new one for these settings to take effect on the command line. This is because these settings are updated in the users' .cshrc or .profile and are run once at the beginning of each login session. You may also source these files to initiate the new variables into your current environment. To do this, simply type source .cshrc from the /var/admin directory.

Removing Packages

To remove previously installed packages, follow these instructions after logging in to Voyager:

Click Config.
Click Manage Installed Packages from the System Configuration heading.
Click the link to Delete Packages.
Select the packages you want to delete by selecting the option button for Delete instead of Keep. You may choose any packages from the list that are not currently active, so you won't be able to accidentally remove a package you are using (see Figure 20.7).

Figure 20.7: Deleting Packages
Click Apply and then click Save.