topic Re: Automated software package installation in Ansible

Automated software package installation

Simon_Macpherso — Mon, 17 May 2021 04:42:14 GMT

Hi Checkmates,

We are aiming to automate gateway upgrades using the following modules that are part of the Checkpoint Ansible collection for Management.

cp_mgmt_show_software_package_details
cp_mgmt_verify_software_package
cp_mgmt_install_software_package

I have a few questions specifically concerning the cluster_installation_settings parameter and sub-parameters of the cp_mgmt_install_software_package module.

Parameter
cluster_installation_settings		installation settings for cluster.
	cluster_delay (integer)	the delay between end of installation on one cluster members and start of installation on the next cluster member.
	cluster_strategy (string)	the cluster installation strategy.

Questions

1. Are the cluster_strategy parameter values are based on sk107042?
2. Can you please outline the suggested values for both cluster_delay and cluster_strategy parameters when upgrading a Cluster XL HA cluster.
3. Is this effectively an automatic zero-touch upgrade procedure? i.e. do the cluster_installation_settings parameter values perform all steps performed during a manual, interactive upgrade

Regards,

Simon

Re: Automated software package installation

PhoneBoy — Mon, 17 May 2021 15:23:43 GMT

Yes, though it’s not exactly clear what cluster_strategy should contain. @Or_Soffer
The value of cluster strategy would depend what you’re upgrading from/to.
You can, for instance, use MVC on upgrading R77.30 and above to R80.40 and above.

Pretty sure the underlying API requires R81+ management, also.

Re: Automated software package installation

Simon_Macpherso — Tue, 18 May 2021 01:20:35 GMT

Initially we plan to perform major version upgrades from R80.30 (differing JHF versions) gateways to R80.40 and above, and JHF upgrades on the same gateways.

I notice on the module doco page, parameters only supported from R81 are denoted as such. Thus assuming other parameters are supported in previous versions i.e. R80.40.

I've also opened a TAC case for this.

Re: Automated software package installation

Boaz_Orshav — Tue, 18 May 2021 07:01:01 GMT

I assume your management is 81.00 (since in 80.40 the install package shall be applicable for HF/Jumbo only and not for version upgrade)

Hope this answers all three questions you asked - if not, please let me know

Also will appreciate feedback on the experience you had using these APIs (boazo@checkpoint.com)

Thanks

Boaz

The best practice is simply not to use these parameters as the default values are the best - install the first member, perform connection sync or activate the MVC (depends on the target version - we know which methodology to use) and then failover and second member installation.

Re: Automated software package installation

Simon_Macpherso — Tue, 18 May 2021 23:22:14 GMT

Hi,

Our management is R80.40 take 94.

Are you saying with R80.40 it is only possible to use the install package module to install JHF/HF only?

What are the default values for these parameters?

Regards,

Simon

Re: Automated software package installation

PhoneBoy — Wed, 19 May 2021 00:40:20 GMT

You are correct, the APIs to actually do an upgrade are only in R81, not R80.40.
You can only install JHFs with the APIs in R80.40.

Re: Automated software package installation

Boaz_Orshav — Wed, 19 May 2021 04:58:33 GMT

The default values are 0 for the delay and preserve-connectivity-when-possible for the cluster strategy.

Notice also that in 80.40 you should have management and GWs connected to internet since the installation also triggers download of the package.

In 81.00 there is also an option to use local package repository on the management machine

Re: Automated software package installation

Simon_Macpherso — Mon, 24 May 2021 00:59:33 GMT

Thanks @Boaz_Orshav

Re: Automated software package installation

Simon_Macpherso — Tue, 08 Jun 2021 04:56:05 GMT

When running the cp_mgmt_show_software_package_details module the task is failing.

Example playbook

---
- hosts: all
connection: httpapi
tasks:
- name: show available HFs
check_point.mgmt.cp_mgmt_show_software_package_details:
name: Check_Point_R80_30_JUMBO_HF_Bundle_T228_sk153152_Security_Gateway_and_Standalone_2_6_18_FULL.tgz

Re: Automated software package installation

Boaz_Orshav — Tue, 08 Jun 2021 06:34:26 GMT

Will appreciate if you can open service request so we can get logs and provide analysis.

Thanks

Re: Automated software package installation

Simon_Macpherso — Wed, 09 Jun 2021 00:15:48 GMT

Hi Boaz,

I've opened TAC 6-0002736618

Regards,

Simon