topic Re: Failed cluster cloudguard upgrade in Cloud Firewall

Failed cluster cloudguard upgrade

flachance — Sat, 24 Sep 2022 13:49:34 GMT

Hi,

We have a Cloudguard cluster in Azure running R80.40. We are attempting to upgrade to R81.10.

So we installed R81.10 on the standby member with “installer install <Package_Number>”

It went through the install and rebooted. But if we login to that server we get “In order to configure your system, please access the Web UI and finish the First Time Wizard.”

We just found that installer install is only good for upgrade to a minor version and that we should have used “installer upgrade”.

Anyway so now we have a cloudguard cluster with only one working member.

Is there any ways out of this without redeploying a fresh cluster? Snapshot didn't work and Azure backup didn't work.

Any ways to just deploy one and add it to the cluster?

Thanks

Re: Failed cluster cloudguard upgrade

Dmitry_Gorn — Sun, 25 Sep 2022 08:02:49 GMT

Hi,

A snapshot should work and let you revert to the previous state. Can you explain what happens/what message do you get when trying to revert?

Consider continuing to upgrade the cluster using the side-by-side upgrading procedure for the cluster as explained in the admin guide here (the procedure is relatively simple to follow and you will end with a clean new version cluster):

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_IaaS_HighAvailability_for_Azure/Content/Topics-Azure-HA/Additional-Information.htm?tocpath=Additional%20Information%7C_____8#Upgrading_a_Check_Point_CloudGuard_IaaS_High_Availability_Solution_to_a_Newer...

Regarding a cluster member replacement, we do not have an official and documented procedure for Azure HA. If you would like to get assistance with recovery please open a support case - please also the SR number here.

Thanks

Re: Failed cluster cloudguard upgrade

flachance — Mon, 26 Sep 2022 19:28:06 GMT

Snapshot

I login, go to expert and type set snapshot revert<SPACE><TAB>

And don’t see any snapshot file. Although I was assured there was one, there doesn’t seem to be one.

Thanks for pointing me to the side by side upgrade procedures, it looks like this is going to be our best solution.

Re: Failed cluster cloudguard upgrade

Boaz_Orshav — Wed, 28 Sep 2022 11:56:02 GMT

I'd like to verify the exact flow that brought to this situation in order to prevent other customers from getting there.

Tried " installer install" + tab and got "no packages to display" while only installer upgrade and installer clean-install resulted in the valid version to upgrade or to clean install.

Will appreciate info like which DA version did you use ("da_cli da_status" can show that)

Thanks for the cooperation

Re: Failed cluster cloudguard upgrade

flachance — Wed, 28 Sep 2022 12:22:06 GMT

Hi,

thanks for the follow up.

We did

installer verify<spacekey><tabkey>

got the list of package

installer verify <Package_number>

It verified ok.

installer install <Package_Number>

[Expert@gw-f30bf6:0]# da_cli da_status
{
"Action ID" : "0",
"DABuildNumber" : "2229",
"DAService State" : "ready",
"Last Update Time" : "Wed Sep 28 03:11:50 2022",
"New DA Availability" : "up to date",
"Update Status" : "not allowed"
}

Re: Failed cluster cloudguard upgrade

flachance — Wed, 28 Sep 2022 15:26:14 GMT

Hi,

going through the side-by-side upgrade and I find this part to be confusing what is that long path to originalHAClusterIp? Do we just change the IP to the old one or do we also need to put that?

Re: Failed cluster cloudguard upgrade

Dmitry_Gorn — Thu, 29 Sep 2022 06:43:04 GMT

If the new cluster members are in the same Resource Group as the public IP, you only need to type the public IP resource name.

If it's in another resource group, put the full resource id here (as in the example). The resource id is available when you click on the resource. Note that you will need to provide proper permissions to the old RG with the public IP so that failover will work.