topic Enable MVC During Cluster Upgrade in Firewall and Security Management

Enable MVC During Cluster Upgrade

Wyman — Mon, 17 May 2021 10:07:12 GMT

Hi. We're going to be upgrading our 2 gateway cluster from R80.30 to R80.40 and I see that enabling MVC is recommended during this process. I'm not completely sure where it fits into the process - please can someone verify if the process below is correct or not? Thanks very much.

1) Upgrade backup gateway to R80.40

2) Install access control policy (unchecking the cluster install fail check box)

3) Enable MVC on the upgraded gateway?

4) Check cluster status to confirm 'Active(!)' status on upgraded gateway and 'Standby' status on other gateway

5) Failover to the upgraded gateway

6) Upgrade the older R80.30 gateway

7) Install the access control and threat prevention policies (tick the cluster install fail check box)

8) Disable MVC on the gateway that was upgraded first?

Re: Enable MVC During Cluster Upgrade

Timothy_Hall — Mon, 17 May 2021 11:47:09 GMT

This is nicely covered in the R80.40 Installation and Upgrade guide, section "Multi-Version Cluster Upgrade Procedure - Gateway Mode"; see the attached screenshot which is the non-VSX procedure for a 3-node cluster. Note that there is a slightly different procedure for VSX clusters (which is also provided in that same document).

Re: Enable MVC During Cluster Upgrade

Baasanjargal_Ts — Wed, 19 May 2021 03:25:13 GMT

Hello Wyman,

I believe you've gotten back up your current configuration.

Workflow:

On each Cluster Member - Change the CCP mode to Broadcast
On the Cluster Member M2 - Upgrade to R80.30 with CPUSE
In SmartConsole - Change the version of the cluster object
In SmartConsole - Install the Access Control Policy
On each Cluster Member - Examine the cluster state
On the old Cluster Member M1 - Stop all Check Point services
On the upgraded Cluster Member M2 - Examine the cluster state
On the old Cluster Member M1 - Upgrade to R80.30 with CPUSE
In SmartConsole - Establish SIC with the former old Cluster Member M1
In SmartConsole - Install the Access Control Policy
On each Cluster Member - Examine the cluster state
On each Cluster Member - Change the CCP mode to Auto
In SmartConsole - Install the Threat Prevention Policy
Test the functionality

There is a great guide for upgrading cluster zero downtime: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_Installation_and_Upgrade_Guide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/CP_R80.30_Installation_and_Upgrade_Guide/198950