topic ClusterXL Gateway Upgrade in Firewall and Security Management

ClusterXL Gateway Upgrade

Neck — Thu, 21 May 2026 20:33:15 GMT

I have an older pair of R81.20 HA ClusterXL gateways that I need to upgrade to R82.10. I’ve already built a new management server and migrated the database. This is a KVM environment.

Originally, I planned to do an in-place upgrade on the gateways, but now I’m considering building new gateways instead.

My current thought process is:

1) Shut down the current standby gateway.
2) Deploy a new R82.10 VM to replace it.
3) Assign it the same hostname, interfaces, and IP addresses as the old standby.
4) Re-establish/verify SIC with the management server.
5) Push policy and verify functionality.
6) If everything looks good, fail over traffic to the new gateway.
7) Repeat the process for the second gateway.

Does this sound like a valid approach, or is there a better recommended method for upgrading ClusterXL gateways in a KVM environment?

Thanks!

Re: ClusterXL Gateway Upgrade

PhoneBoy — Thu, 21 May 2026 23:35:53 GMT

I've seen a similar process being followed for physical gateways.
Don't see why it wouldn't work here.

Re: ClusterXL Gateway Upgrade

morris — Fri, 22 May 2026 06:32:50 GMT

Yes this sound like a valid approach. Don't forget to manual copy custom scripts, configs, cronjobs etc.

Before Failover with step 6), enable Multi-Version Cluster and pay attention to the Limitations:

Multi-Version Cluster Limitations

Re: ClusterXL Gateway Upgrade

Martijn — Fri, 22 May 2026 07:54:31 GMT

Hi,

When performing major upgrades, most of the time we re-image the gateways via USB with the new version.
Especially when the gateways have gone through a lot of upgrades and hotfix installations in the past.

The procedure you describe is well documented in the Check Point upgrade guides and is basically a Multi Version Cluster ugrade. When following the MVC procedure, you are good to go.

Good luck!

Martijn

Re: ClusterXL Gateway Upgrade

Don_Paterson — Fri, 22 May 2026 14:34:20 GMT

That's a good plan.

Its the cloud way, destroy and redeploy.

While you are doing the project you could look into automation procedures for the future projects.

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Gaia_AdminGuide/Content/Topics-GAG/Running-FTCW-in-CLI-Expert-Mode.htm

And/or blink and load configuration clish.

Re: ClusterXL Gateway Upgrade

the_rock — Fri, 22 May 2026 18:18:03 GMT

See if below would apply?

https://community.checkpoint.com/t5/Firewall-and-Security-Management/Replace-Upgrade-Cluster/td-p/69216