QRadar M7 xSeries firmware V2.1.0 for 1U and 2U appliances (IMG for USB On-prem installations)

Release Notes

Abstract

This firmware update (v2.1.0) provided by IBM is intended for xSeries firmware updates on your IBM® Security QRadar® M7 appliances. This update is intended for M7 1U and 2U form factor QRadar appliances where administrators want to update appliances with a bootable USB drive to complete an on-premise firmware update.

Content

Important: Select a tab to read each step of the firmware procedure.

Part 1: About the M7 firmware 2.1.0 update

Creating your USB flash drive for the firmware update requires a Windows™ host and the administrator must be on-site with the appliance. The firmware update can take up to 60 minutes complete per appliance and the administrator is required to reboot the appliance after the firmware installation completes. The firmware upgrade procedures are intended to be completed during scheduled maintenance hours for your QRadar appliances. If your Data Center does not allow USB keys, instructions and a download are available for administrators to install firmware remotely with the XClarity interface. For information on how to install the ISO with your XClarity interface, see QRadar M7 xSeries firmware V2.1.0 for 1U and 2U appliances (ISO/XClarity Controller remote installs).

Supported appliances, types, and model information

This firmware update applies to the following IBM Security QRadar M7 (1U and 2U form factor) appliance types:

Hardware	Details
Appliance and machine type model (MTM)	1U IBM QRadar Network Insights Appliance 1901 (MTM 4723-N9C) IBM QRadar XX05 1U (MTM 4723-Q7B) IBM QRadar Event/QFlow Collector Appliance 1501/1201 1U (MTM 4723-Q9C) IBM QRadar XX48 1U (MTM 4793-Q8D) 2U IBM QRadar Network Insights 1920 2U (MTM 4723-N2A) IBM QRadar Network Insights 1940 2U (MTM 4723-N4B) IBM QRadar XX29 M7 appliance 2U (4723-Q9A) IBM QRadar Incident Forensics Appliance 2U (MTM 4723-F1A) For capabilities on these appliances, see QRadar M7 appliance overview.
Server Type	M7
Server Machine Type	SR630 V2 / M7 1U SR650 V2 / M7 2U

Table 1: List of appliances the M7 appliance firmware V2.1.0 can update.

Important information and prerequisites in this firmware update

Administrators must ensure that their M7 appliance includes the minimum version outlined in the Prerequisite version column. If your M7 appliance does not meet the prerequisite versions outlined in the table, the administrator must contact IBM QRadar Support to discuss a custom upgrade path for your M7 appliance.

Component	Prerequisites	Firmware version in this update	File name
UEFI/BIOS	None	afe122g-1.50	lnvgy_fw_uefi_afe122g-1.50_anyos_32-64.uxz
XCC	None	afot30m-2.90	oem_fw_xcc_afot30m-2.90_anyos_noarch.uxz
LXPM	None	xwl116g-3.19	lnvgy_fw_lxpm_xwl116g-3.19_anyos_noarch.uxz lnvgy_fw_drvln_xwl216d-3.19_anyos_noarch.uxz
RAID controller	None	940-52.22.0-4774-4 540-52.22.0-4775-2	lnvgy_fw_raid_mr3.5.940-52.22.0-4774-4_linux_x86-64.bin lnvgy_fw_raid_mr3.5.540-52.22.0-4775-2_linux_x86-64.bin
NIC	None	3.2-1.3146.0-6 5.70-1.3218.0-4	intc-lnvgy_fw_nic_e800.pcie-3.2-1.3146.0-6_linux_x86-64.bin ntc-lnvgy_fw_nic_net-8.70-5.70-1.3218.0-4_linux_x86-64.bin

Table 2: Firmware versions and any prerequisite for each component are provided in this table.

NOTES

A number of hard disk drives can be installed in this appliance. The HDD update tool examines the hard disk drives that are present and selects the latest firmware version that is available for your drive.
The base system pack might contain other firmware packages that are not present in QRadar appliances. Firmware updates from the base system pack can be listed when the tool compares available firmware to the hardware in the appliance and display a status of "undetected".
For general firmware questions and information, see our FAQ page at http://ibm.biz/qradarfirmware.

Security issues resolved in this firmware update

The table lists the software versions and CVEs addressed in the firmware release.

Component	File name	Updates
UEFI/BIOS	lnvgy_fw_uefi_afe122g-1.50_anyos_32-64.uxz	Resolved CVEs CVE-2022-21216, CVE-2022-33196, CVE-2022-38090, CVE-2022-33972, CVE-2021-0187, CVE-2022-26837, CVE-2022-36348 Enhancements Added SMBIOS Type 39 to provide PSU info. Enable AMT (Advanced Memory Test) for Brazil SMART DIMMs Modular Added "LLC Prefetcher" and "L2 RFO Prefetcher" setup menus in "System Setting > Processors" System Setup page. Added Processors.LLCPrefetcher and Processors.L2RFO Prefetcher in OneCLI. Support DIMM SPD info in dmidecode -t 17 output screen. IPU 2023.1 update Updated SPS to SPS_E5_04.04.04.301.0 Updated MCU to m_87_606a6_0d000389 Supported MPFA (Memory Predictive Failure Analysis) feature. Enhanced FQXSFMA0008M to show DIMM slot number while uncorrectable error happened on Intel PMEM. Updated user interface text in the Setup menu. Pop up an error message box for "System Settings > Network > iSCSI > Target IP Address" if wrong IP address is set. Updated the help text of "System Settings > Processors > IntelSpeedSelect". Fixes Fixed the issue that when onboard VGA is disabled, it was still visible in the Windows OS 2019 Device Manager. For more information, see HT514683. Fixed the blue screen issue if Win2022 is used and "System Settings > Devices and I/O Ports > Onboard SATA Mode" or DevicesandIOPorts.OnboardSATAMode is selected as "RAID". Fixed the issue that "BMC Settings > Network Settings > Fail-Over Rule" is not synced with IMM.FailoverMode. Fixed the issue that the USB device is not bootable in legacy boot mode. Fixed the issue that after system reset, "BMC Settings > Network Settings > Network Interface Port" is changed to default value "Dedicated" automatically when "BMC Settings > Network Settings > Share NIC on" is changed and saved. Show "Data rate" and "Duplex" setup menus only when "BMC Settings > Network Settings > Network Interface Port > Advanced Setting for BMC Ethernet > Autonegotiation" is "No". Fixed the issue that FQXSFMA0009K is reported while "System Settings > Memory > Mirror Mode" is selected as "Partial". Disable failed DIMM with runtime uncorrectable error even when AC cycle. Fixed the issue that existing HTTP boot option would be gone in "Start Options" when you create a new HTTP boot option "System Settings > Network > HTTP Boot Configuration > MAC:XXXX- HTTP Boot Configuration". Modified the options to be 1-based numbering for "BMC Settings > Network Settings > Fail-Over Rule" and "BMC Settings > Network Settings > Share NIC on" to match with XCC web UI when OCP adapters are installed. Limitations The user cannot hot-add a P5800X drive under VMWare. For more information, see HT512461.
XCC	oem_fw_xcc_afot30m-2.90_anyos_noarch.uxz	Resolved CVEs CVE-2023-0286, CVE-2022-25258, CVE-2022-25375, CVE-2022-24448, CVE-2022-43680, CVE-2022-37454, CVE-2022-45061, CVE-2022-40674, CVE-2022-44638, CVE-2022-29824, CVE-2022-40304, CVE-2022-40303, CVE-2022-47015, CVE-2022-2068, CVE-2022-2097, CVE-2022-4450, CVE-2022-4304, CVE-2022-35737, CVE-2022-2509, CVE-2022- 32207, CVE-2022-32205, CVE-2022-32208, CVE-2022-32206, CVE-2022-43551, CVE-2022- 32221, CVE-2022-42915, CVE-2022-42916, CVE-2022-35252, CVE-2022-28391, CVE-2021-4209, CVE-2021-42380, CVE-2021-42376, CVE-2021-42386, CVE-2021-42378, CVE-2021-42374, CVE-2021-42384, CVE-2021-42385, CVE-2021-42382, CVE-2021-42381, CVE-2021-42379, CVE-2018-1000500 Fixes Fixed a problem that Call Home service request might not include fatal errors in the service log. Improved SAS HDD drive control to allow drive go into idle_b state when there is no I/O traffic. Enhancements Added support to clear CMOS thru Redfish API and OneCLI command. Added support with configurable control for XCC users with operator role to use remote console. Added more contact information to the XCC Call Home configuration. Added support of minimum and maximum strip size of RAID controller thru Redfish. Added support to show FPGA firmware version on XCC webGUI Added support of service data log with user configurable log content. Added OOB management support for Napatech NT100A01 and NT200A02 adapters. Added policy settings for system secure boot enable or disable over KCS. Added support to use retimer in slot 2 of riser 1.
LXPM	lnvgy_fw_lxpm_xwl116g-3.19_anyos_noarch.uxz lnvgy_fw_drvln_xwl216d-3.19_anyos_noarch.uxz	None
RAID controller	lnvgy_fw_raid_mr3.5.940-52.22.0-4774-4_linux_x86-64.bin lnvgy_fw_raid_mr3.5.540-52.22.0-4775-2_linux_x86-64.bin	None
HDD	lnvgy_fw_drives_all-1.39.11-0_linux_x86-64.bin	None
PCi and LOM adapters	intc-lnvgy_fw_nic_net-8.60-5.60-1.3141.0-all-8_linux_x86-64.bin	None
Emulex	elx-lnvgy_fw_fc_lp.31-14.0.376.10-4_linux_x86-64.bin	None

Table 3: Security issues resolved in the M7 firmware update 2.1.0.

Part 2: Requirements to create a bootable USB drive

To create a bootable USB key, you must have access to the following items:

An 8 GB or larger USB flash drive.
Entitlement for IBM Fix Central is required download firmware for QRadar appliances.
A workstation or laptop running one the following operating systems:
- Windows™ 10
- Windows™ 7
- Windows™ Server 2008R2
- Windows™ Server 20016
  NOTE: Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

Creating the bootable USB drive

Download the M7 2.1.0 firmware IMG file from IBM Fix Central: M7 firmware 2.1.0 IMG download.
Download the Rufus Bootable USB Tool.
Insert the USB flash drive into a USB port on your Windows™ laptop or workstation.

Open Rufus and configure the properties.

Parameter	Value
Device	Select your USB drive
Boot Selection	Select Qradar_IMG_M7_1U_SR630V2_7Z71_2U_SR650V2_7Z73_2_1_0.img
Partition scheme	MBR (Default)
Target system	BIOS (or UEFI-CSM) (Default)
File system	FAT32 (Default)
Cluster size	This value defaults to the best option based on size of the USB drive.

For example,
image-20230525163240-1

Click Start. The image is loaded on the USB drive.
After the installation finishes, safely eject the USB flash drive from your computer.

Results
The bootable drive is ready to be used to install firmware on the M7 appliance.

Part 3. Installing the Firmware on the QRadar M7 appliance

The instructions are intended for M7 appliances that are not configured as HA (high-availability) pairs. If your appliance is in a HA pair, you must use the High-Availability update instructions found here: http://www.ibm.com/support/docview.wss?uid=swg27047121#HA .

Booting from the USB Drive

Insert the USB drive that has the bootable image into the QRadar appliance.
IMPORTANT: Do not remove the USB flash drive until the IBM ToolsCenter completes the firmware installation.
From the terminal or the KVM switch for the appliance, log in with root user credentials.
From the command prompt, type: reboot
As the appliance reboots, press F12.
From the Boot Devices Manager, verify the Legacy Mode check box is clear (NOT selected).
Locate your USB drive in the Boot Devices Menu and press Enter.
In the Update Settings menu, verify all check boxes are clear (not selected) and click Next.
In the Update Comparison menu, click Begin.
The IBM UpdateXpress System Pack Installer compares the current package with the installed firmware.
Verify all check boxes are selected where new firmware versions are available and click Next.
IMPORTANT: Administrators must review the New Version column and confirm the firmware update is selected (checked). Issues were reported where firmware changes were not installed in prior releases.
Wait for the firmware updates to load.
Click Begin Update to install the firmware.

NOTE: Administrators might be prompted with a confirmation dialogue and need to click Next to continue.
Verify that all updates complete successfully and click Next.
If you experienced any errors, click Save Log or click Finish to exit after a successful installation.
The appliance must reboot to complete the firmware installation.

Results
The appliance reboots and is available for use in the QRadar deployment. If you experience any installation issues, you can contact QRadar Support for assistance and open a software support case for your appliance. The support representative can request the firmware logs for review to determine the root cause of the issue or if replacement hardware is required. If the issue is hardware related, the support representative can change the case type and involve the proper teams to schedule replacement parts.

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtcAAA","label":"Hardware"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]

Tips