topic Re: SMS Azure Upgrade in Cloud Firewall

SMS Azure Upgrade

DanielEl — Mon, 17 Feb 2025 03:52:19 GMT

Hi Team,

I’m after some insights about upgrading a SMS in Azure from R81.10 to R81.20 as I’ve got entry level experience with Azure.

In place upgrade (https://support.checkpoint.com/results/download/133468) didn’t work throwing an error about partition “Your partitions are not in Check Point standard format, and an upgrade is not possible. Reinstall your system and verify correct partitioning.” As per sk180769, it looks in place upgrade is not supported.

We're currently considering carrying out an advanced upgrade, however I'm unsure about a few points in Azure. My approach is as follows:

download and install R81.20 upgrade tools on R81.10 SMS
run an upgrade verify, followed by addressing any error, warnings, etc.
export the DB, and copy it out verifying its checksum
shut down the R81.10 SMS, de-associating it’s vNIC
build the new R81.20 SMS from marketplace in the same region (do we need to create a new resource group for it?), having the same name as the R81.10 SMS
associate R81.10’s NIC to R81.20 SMS
install the latest HFA
import the DB

Points 4-6 are bit blurry to me, is this the right approach, did anyone out there go through the same?

Just to note that I went through sk155632 our SMS doesn't have a public ip address as alias just a single private ip address

Re: SMS Azure Upgrade

Nir_Shamir — Sun, 16 Feb 2025 05:45:00 GMT

Hi,

1-3 are OK.

then you just build a new r81.20 SMS, you don't need to change it's IP address. Just import the DB file to it and import the DB to build you old SMS.

Then change the license to the new IP address and install it on the new SMS and you are set. You will have SIC connectivity with your GW because it's the same DB and certificates.

Re: SMS Azure Upgrade

the_rock — Sun, 16 Feb 2025 12:16:25 GMT

I had done in-place upgrade couple times and worked without any issues.

Andy

Re: SMS Azure Upgrade

Amir_Senn — Sun, 16 Feb 2025 13:06:05 GMT

We have a dedicated admin guide for upgrading, I suggest following them:

sk162365: Upgrade/Update documentation for CloudGuard Network Security in Public Cloud

sk155632: How to perform Advanced Upgrade for CloudGuard Network Security Management in AWS, Azure, GCP, or Huawei Cloud (Side-by-Side upgrade)

Re: SMS Azure Upgrade

the_rock — Sun, 16 Feb 2025 13:31:19 GMT

I remember following 1st link both times.

Andy

Re: SMS Azure Upgrade

DanielEl — Mon, 17 Feb 2025 03:56:55 GMT

Thanks Andy,

We did raise a ticket with TAC to get their confirmation "I verified the in-place upgrade method would not work for that Azure image, which was deployed in 2022. The only method for this upgrade would be the side-by-side upgrade"

Re: SMS Azure Upgrade

the_rock — Mon, 17 Feb 2025 03:58:46 GMT

Makes sense...I can totally see logic in what they told you, since I believe in place upgrade became available in 2023, if I recall correctly.

Andy

Re: SMS Azure Upgrade

Amir_Senn — Mon, 17 Feb 2025 14:23:50 GMT

It's because of the multiple partitions. Also not supported for on-prem for upgrading to R81.20.

Re: SMS Azure Upgrade

DanielEl — Wed, 19 Feb 2025 00:50:50 GMT

Came across a fantastic video for Chris Martel showing exactly what we're after: https://www.youtube.com/watch?v=dm80UUlsKTI

Re: SMS Azure Upgrade

the_rock — Wed, 19 Feb 2025 01:44:58 GMT

Amazing reference, thank you for that!

Andy