topic Upgrading 5800 Appliances R80.20 to R80.40 in Firewall and Security Management

Upgrading 5800 Appliances R80.20 to R80.40

dwilliams-dmu — Wed, 17 Feb 2021 19:38:07 GMT

I am looking for any and all advise regarding upgrading a clustered pair of 5800 series appliances from R80.20 to R80.40. I am just beginning my search for documentation, procedures, and other experiences doing the same. While I am basically fishing for experiences performing this upgrade and what kind of things to look out for I welcome all links to documentation or blogs that may be useful.

Questions and Concerns:

What features have caused you trouble while upgrading from R80.20 to any other version?
Do you have a preferred upgrade method? Why?
Does upgrade path help or should I just rip off the band aid and go straight to R80.40?

Re: Upgrading 5800 Appliances R80.20 to R80.40

Vladimir — Thu, 18 Feb 2021 03:21:39 GMT

If your 5800s were gradually upgraded from R77 to R80.20 and if you can afford downtime window, better way, in my opinion is:

-2. Perform backup on the management server (s)

-1. Perform snapshots on the 5800s

0. Record current cluster networking topology and antispoofing parameters

1. dump Gaia configs from both cluster members (save configuration <filename>,

2. clean it up,

3. fresh install R80.40 + JHFAs (current ongoing release 92 looks better than GA 91)

4. rerun FTW

5. load the Gaia configs

6. Re-establish sic with cluster members

7. Verify and adjust topology data (if necessary)

8. Publish changes and install policy

Otherwise, simply follow upgrade guide and it is pretty trivial:

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Installation_and_Upgrade_Guide/Content/Topics-IUG/Upgrading-ClusterXL-VSX-Cluster-VRRP-Cluster.htm

Re: Upgrading 5800 Appliances R80.20 to R80.40

Chris_Atkinson — Thu, 18 Feb 2021 06:15:45 GMT

Is the management already upgraded to R80.40?

Otherwise keep the following SKs in mind regarding Identity Awareness otherwise should be pretty standard stuff.

sk170516 / sk168066

Re: Upgrading 5800 Appliances R80.20 to R80.40

Kaspars_Zibarts — Thu, 18 Feb 2021 06:46:55 GMT

Apart from what @Vladimir wrote, I normally go with CPUSE upgrade, not fresh install. Plus multi-version cluster upgrade option from admin guide. Works like a charm. If you are not using Identity Awareness Captive Portal, I even would go with CPUSE Blink upgrade as you get R80.40 + T91 in one go.

I wrote about captive portal issues here: https://community.checkpoint.com/t5/Security-Gateways/IA-Captive-Portal-missing-after-upgrade-to-R80-40-Take-91/m-p/110900#M15258

Re: Upgrading 5800 Appliances R80.20 to R80.40

dwilliams-dmu — Thu, 18 Feb 2021 18:32:28 GMT

So, I am reading that from R80.20 to R80.40, that an in place upgrade will leave the file system at ext3 instead of going to xfs. I'm not a big filesystem guy. Are there benefits either directly or indirectly that could be left on the table if we don't do a clean install?