QRadar M7 xSeries firmware V2.1.0 for 1U and 2U appliances (ISO/XClarity Controller remote installs)

Release Notes

Abstract

This firmware update (V2.1.0) provided by IBM updates QRadar® M6 appliances with updates for UEFI, XCC, RAID controllers, and HDD software fixes and enhancements. This firmware can be used on all QRadar M6 appliances, but requires that the administrator configures their XClarity Controller (XCC) for remote management.

Content

Important: Select a tab to read each step of the firmware procedure.

Part 1. About the M7 2U Firmware v2.1.0 ISO
Part 2. Installing Firmware Updates

Part 1: About the M7 firmware V2.1.0 update

The M7 firmware v2.1.0 ISO is intended to remotely update software through the XClarity Controller (XCC) user interface. Administrators must extract the EXE file and apply the uxz file to update their XClarity Controller, then the ISO can be mounted to apply the remainder of the firmware updates. The installation instructions are provided on tab named 'Part 2. Installing Firmware Updates'. These instructions guide customers through a remote upgrade of their firmware. If you are local to your appliances or have issues with your XClarity configuration, you can use the USB installation instructions for on-prem updates. For more information, see: M7 2.1.0 USB on-prem updates.

Important: If your appliance is in a HA pair, there are configuration steps required to set the status properly for your primary and secondary high-availability appliances. For more information, see: http://www.ibm.com/support/docview.wss?uid=swg27047121#HA.

Supported appliances, types, and model information

This firmware update applies to the following IBM Security QRadar M7 (1U and 2U form factor) appliance types:

Hardware	Details
Appliance and machine type model (MTM)	1U IBM QRadar Network Insights Appliance 1901 (MTM 4723-N9C) IBM QRadar XX05 1U (MTM 4723-Q7B) IBM QRadar Event/QFlow Collector Appliance 1501/1201 1U (MTM 4723-Q9C) IBM QRadar XX48 1U (MTM 4793-Q8D) 2U IBM QRadar Network Insights 1920 2U (MTM 4723-N2A) IBM QRadar Network Insights 1940 2U (MTM 4723-N4B) IBM QRadar XX29 M7 appliance 2U (4723-Q9A) IBM QRadar Incident Forensics Appliance 2U (MTM 4723-F1A) For capabilities on these appliances, see QRadar M7 appliance overview.
Server Type	M7
Server Machine Type	SR630 V2 / M7 1U SR650 V2 / M7 2U

Table 1: List of appliances the M7 appliance firmware V2.1.0 can update.

Important information and prerequisites in this firmware update

Administrators must ensure that their M7 appliance includes the minimum version outlined in the Prerequisite version column. If your M7 appliance does not meet the prerequisite versions outlined in the table, the administrator must contact IBM QRadar Support to discuss a custom upgrade path for your M7 appliance.

Component	Prerequisite version	Firmware version in this update	File name
UEFI/BIOS	None	afe122g-1.50	lnvgy_fw_uefi_afe122g-1.50_anyos_32-64.uxz
XCC	None	afot30m-2.90	oem_fw_xcc_afot30m-2.90_anyos_noarch.uxz
LXPM	None	xwl116g-3.19	lnvgy_fw_lxpm_xwl116g-3.19_anyos_noarch.uxz lnvgy_fw_drvln_xwl216d-3.19_anyos_noarch.uxz
RAID controller	None	940-52.22.0-4774-4 540-52.22.0-4775-2	lnvgy_fw_raid_mr3.5.940-52.22.0-4774-4_linux_x86-64.bin lnvgy_fw_raid_mr3.5.540-52.22.0-4775-2_linux_x86-64.bin
NIC	None	3.2-1.3146.0-6 5.70-1.3218.0-4	intc-lnvgy_fw_nic_e800.pcie-3.2-1.3146.0-6_linux_x86-64.bin ntc-lnvgy_fw_nic_net-8.70-5.70-1.3218.0-4_linux_x86-64.bin

Table 2: Firmware versions and any prerequisite for each component are provided in this table.

NOTES

A number of hard disk drives can be installed in this appliance. The HDD update tool examines the hard disk drives that are present and selects the latest firmware version that is available for your drive.
The base system pack might contain other firmware packages that are not present in QRadar appliances. Firmware updates from the base system pack can be listed when the tool compares available firmware to the hardware in the appliance and display a status of "undetected".
For general firmware questions and information, see our FAQ page at http://ibm.biz/qradarfirmware.

Security issues resolved in this firmware update

The table lists the software versions and CVEs addressed in the firmware release.

Component	File name	Updates
UEFI/BIOS	lnvgy_fw_uefi_afe122g-1.50_anyos_32-64.uxz	Resolved CVEs CVE-2022-21216, CVE-2022-33196, CVE-2022-38090, CVE-2022-33972, CVE-2021-0187, CVE-2022-26837, CVE-2022-36348 Enhancements Added SMBIOS Type 39 to provide PSU info. Enable AMT (Advanced Memory Test) for Brazil SMART DIMMs Modular Added "LLC Prefetcher" and "L2 RFO Prefetcher" setup menus in "System Setting > Processors" System Setup page. Added Processors.LLCPrefetcher and Processors.L2RFO Prefetcher in OneCLI. Support DIMM SPD info in dmidecode -t 17 output screen. IPU 2023.1 update Updated SPS to SPS_E5_04.04.04.301.0 Updated MCU to m_87_606a6_0d000389 Supported MPFA (Memory Predictive Failure Analysis) feature. Enhanced FQXSFMA0008M to show DIMM slot number while uncorrectable error happened on Intel PMEM. Updated user interface text in the Setup menu. Pop up an error message box for "System Settings > Network > iSCSI > Target IP Address" if wrong IP address is set. Updated the help text of "System Settings > Processors > IntelSpeedSelect". Fixes Fixed the issue that when onboard VGA is disabled, it was still visible in the Windows OS 2019 Device Manager. For more information, see HT514683. Fixed the blue screen issue if Win2022 is used and "System Settings > Devices and I/O Ports > Onboard SATA Mode" or DevicesandIOPorts.OnboardSATAMode is selected as "RAID". Fixed the issue that "BMC Settings > Network Settings > Fail-Over Rule" is not synced with IMM.FailoverMode. Fixed the issue that the USB device is not bootable in legacy boot mode. Fixed the issue that after system reset, "BMC Settings > Network Settings > Network Interface Port" is changed to default value "Dedicated" automatically when "BMC Settings > Network Settings > Share NIC on" is changed and saved. Show "Data rate" and "Duplex" setup menus only when "BMC Settings > Network Settings > Network Interface Port > Advanced Setting for BMC Ethernet > Autonegotiation" is "No". Fixed the issue that FQXSFMA0009K is reported while "System Settings > Memory > Mirror Mode" is selected as "Partial". Disable failed DIMM with runtime uncorrectable error even when AC cycle. Fixed the issue that existing HTTP boot option would be gone in "Start Options" when you create a new HTTP boot option "System Settings > Network > HTTP Boot Configuration > MAC:XXXX- HTTP Boot Configuration". Modified the options to be 1-based numbering for "BMC Settings > Network Settings > Fail-Over Rule" and "BMC Settings > Network Settings > Share NIC on" to match with XCC web UI when OCP adapters are installed. Limitations The user cannot hot-add a P5800X drive under VMWare. For more information, see HT512461.
XCC	oem_fw_xcc_afot30m-2.90_anyos_noarch.uxz	Resolved CVEs CVE-2023-0286, CVE-2022-25258, CVE-2022-25375, CVE-2022-24448, CVE-2022-43680, CVE-2022-37454, CVE-2022-45061, CVE-2022-40674, CVE-2022-44638, CVE-2022-29824, CVE-2022-40304, CVE-2022-40303, CVE-2022-47015, CVE-2022-2068, CVE-2022-2097, CVE-2022-4450, CVE-2022-4304, CVE-2022-35737, CVE-2022-2509, CVE-2022- 32207, CVE-2022-32205, CVE-2022-32208, CVE-2022-32206, CVE-2022-43551, CVE-2022- 32221, CVE-2022-42915, CVE-2022-42916, CVE-2022-35252, CVE-2022-28391, CVE-2021-4209, CVE-2021-42380, CVE-2021-42376, CVE-2021-42386, CVE-2021-42378, CVE-2021-42374, CVE-2021-42384, CVE-2021-42385, CVE-2021-42382, CVE-2021-42381, CVE-2021-42379, CVE-2018-1000500 Fixes Fixed a problem that Call Home service request might not include fatal errors in the service log. Improved SAS HDD drive control to allow drive go into idle_b state when there is no I/O traffic. Enhancements Added support to clear CMOS thru Redfish API and OneCLI command. Added support with configurable control for XCC users with operator role to use remote console. Added more contact information to the XCC Call Home configuration. Added support of minimum and maximum strip size of RAID controller thru Redfish. Added support to show FPGA firmware version on XCC webGUI Added support of service data log with user configurable log content. Added OOB management support for Napatech NT100A01 and NT200A02 adapters. Added policy settings for system secure boot enable or disable over KCS. Added support to use retimer in slot 2 of riser 1.
LXPM	lnvgy_fw_lxpm_xwl116g-3.19_anyos_noarch.uxz lnvgy_fw_drvln_xwl216d-3.19_anyos_noarch.uxz	None
RAID controller	lnvgy_fw_raid_mr3.5.940-52.22.0-4774-4_linux_x86-64.bin lnvgy_fw_raid_mr3.5.540-52.22.0-4775-2_linux_x86-64.bin	None
PCi and LOM adapters	intc-lnvgy_fw_nic_net-8.60-5.60-1.3141.0-all-8_linux_x86-64.bin	None
Emulex	elx-lnvgy_fw_fc_lp.31-14.0.376.10-4_linux_x86-64.bin	None

Table 3: Security issues resolved in the M7 firmware update 2.1.0.

A. Before you begin

This installation method uses the hardware's integrated XCC interface to remotely update firmware. If XCC network speeds are not sufficient, or the upgrade fails, use USB installation instead.
If your appliances are in a HA pair, you must prepare your high-availability appliances by using the instructions found here: http://www.ibm.com/support/docview.wss?uid=swg27047121#HA .
A number of hard disk drives can be installed in this appliance. The HDD update tool examines the hard disk drives that are present and selects the most current firmware level that is available.

B. Downloading and extracting the firmware update

Download the QRadar M7 appliance firmware from IBM Fix Central: M7 firmware 2.1.0 EXE download.
Copy the M7 appliance firmware EXE to a directory on the Windows host.
Double-click the file Qradar_EXE_M7_1U_SR630V2_7Z71_2U_SR650V2_7Z73_2_1_0.exe.
Select or type a directory path for the firmware update and click Extract.
The following files are extracted:

C. Updating the XCC firmware

Log in to the XClarity interface on your QRadar M7 appliance.
From the navigation sidebar, click Firmware Update.
Click Update Firmware.
Click Browse and choose the XClarity (XCC) firmware update oem_fw_xcc_afot30m-2.90_anyos_noarch.uxz.
Click Next to upload and verify the XCC firmware file.
Select the BMC (Primary) check box and click Next.
Important: The backup firmware bank is automatically updated. Administrators must ensure the BMC (Backup) check box is cleared (not selected). Administrators who select both check boxes must reinstall their firmware to ensure the primary bank updates properly.
Wait for the update the primary firmware banks to complete.
Click Restart BMC and clear your browser cache.

Results
Wait for 5 minutes for the XCC interface to restart and log in. Continue to the next section to mount the firmware ISO and configure the boot options.

D. Mounting the M7 Firmware ISO

From the OEM Controller menu, click Remote Console.
Click Remote Console Preview.
IMPORTANT: Confirm the following parameters:
2a. Launch the session in Single User Mode.
2b. Clear the Allow others to request my remote session disconnect check box.
2c. Click Launch Remote Console to connect to the appliance.
To open the file mount options, click Diagnostic > Media.
IMPORTANT: Confirm the following parameters:
3a. Verify that the First Boot Device is set to CD/DVD Rom.
3b. Verify that the Boot Mode drop-down is set as Legacy Mode.
Click Mount Local Media, and click Activate.
Click Browse and select Qradar_ISO_M7_1U_SR630V2_7Z71_2U_SR650V2_7Z73_2_1_0.iso.
Click Mount all local media.
Note: If successful, a checkmark appears next to the uploaded ISO file.
From the OEM Controller menu, click OS Installation.
Select Power > Boot Server to System Startup.
Wait for the setup menu to display.
From the navigation menu, click UEFI Setup.
Click Start Options, then CD/DVD Rom.
In the Update Settings menu, verify that all check boxes are clear (not selected) and click Next.
From the Update Comparison menu, click Begin.
The IBM UpdateXpress System Pack Installer compares the current package with the installed firmware.
Review the list of updates.
Important: In the next step, administrators must confirm that all recommended updates are CHECKED, except for Lenovo/XClarify Controller XCC as this firmware was updated manually by the administrator in previous steps.
Verify the check box for Lenovo/XClarity Controller (XCC) is clear (not selected) and click Next.
Wait for the firmware updates to load.
Click Begin Update to install the firmware.

NOTE: Administrators might be prompted with a confirmation dialogue and need to click Yes to continue.
Verify that all updates complete successfully and click Next.
Click Finish to exit.
The appliance must reboot to complete the firmware installation.
Log in to the XClarity interface and connect to the appliance with the Remote Console.
Click Diagnostic > Media and click Unmount.

Results
After the ISO file is unmounted, the administrator can log out and complete this procedure on other QRadar appliances. If you experience any installation issues, you can contact QRadar Support for assistance and open a software support case for your appliance. The support representative can request the firmware logs for review to determine the root cause of the issue or if replacement hardware is required. If the issue is hardware-related, the support representative can change the case type and involve the proper teams to schedule replacement parts.

Troubleshooting

A green screen is not indicative of failure by itself, press CTRL on your keyboard to wake up the screen saver. If CTRL does not wake up the screensaver, you might need to press ENTER key. After ENTER key is pressed, if the Green background screen remains, check the power state of the XCC by going to the OEM Controller home page to view the power status in the upper left screen.

Note: If you can't reconnect to the IMM, or XCC, you need to send someone to the site to check on the machine status. In some rare circumstances, IMM can disconnect and the server maybe waiting for someone to press ENTER key locally.

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtcAAA","label":"Hardware"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]

Tips