topic Tips for upgrading HA clusters in GCP in Cloud Firewall

Tips for upgrading HA clusters in GCP

johnnyringo — Sat, 30 Jul 2022 23:37:07 GMT

We have some older R80.30 HA BYOL clusters deployed in Google Cloud and I need to start planning how to upgrade to R80.40 or R81.10 while preserving external IP addresses. I know this can be done by going to deployment manager, deleting the deployment, and selecting the "Keep resources created by it" option, and finally launching a new cluster with the same name.

The problem though is in Smart Console. It seems that just changing the management IP addresses and resetting SIC doesn't work. Instead, I have to completely remove the cluster from SmartConsole, set it up as if it were a new cluster, then re-install policy. This is fairly time consuming since any "Install on" rules need to be set to "Policy Targets" and then re-entered after the new cluster is up and running. The cluster also needs to be removed from any VPN communities and inspection rules, which takes additional time.

Is there an easier way to do this? I'm currently estimating 3-4 hours downtime per cluster and would really like to get that to under an hour if possible.

Re: Tips for upgrading HA clusters in GCP

Chris_Atkinson — Sun, 31 Jul 2022 02:38:52 GMT

Are you following the process outlined here or something else?

CloudGuard Network High Availability for Google Cloud Platform R80.30 and Higher Deployment Guide > Additional Information > Upgrading a Check Point CloudGuard IaaS High Availability Solution to a Newer Version.

Re: Tips for upgrading HA clusters in GCP

Nir_Shamir — Sun, 31 Jul 2022 09:57:20 GMT

Hi,

are you sure you can't just RESET SIC and ReSic the new GWs ? this is usually what I do in any Cluster upgrade in any cloud vendor .

do you get any errors or issues doing this process ?

Re: Tips for upgrading HA clusters in GCP

johnnyringo — Thu, 04 Aug 2022 04:44:27 GMT

I'd have to re-lab it, but the problem with just resetting SIC and changing the management IPs is the cluster never forms.

Re: Tips for upgrading HA clusters in GCP

johnnyringo — Thu, 04 Aug 2022 04:48:43 GMT

Thanks, I had not noticed this section. It will be a couple weeks before I have time to try this out, but it makes sense. The only caveat I can see is GCP doesn't allow instances in the same zone to have the same name, but I'd imagine this can be worked around by just selecting different zones for the old and new cluster members.