topic Re: CCP Mode: Cluster Upgrade in Firewall and Security Management

CCP Mode: Cluster Upgrade

ashah — Thu, 24 Jun 2021 15:59:48 GMT

Hello Experts,

I am upgrading checkpoint cluster form R80.10 to R80.30 via "connectivity upgrade" method.

while doing research and discovery, i found "zero down time" process suggests to change CCP mode to Broadcast before we start upgrade. but "connectivity upgrade" process does not.

Both the process suggest to turn CCP mode to Auto at the end of the upgrade process.

can you please suggest me how to deal CCP modes in "connectivity upgrade" method. do i need to change it to "broadcast" before starting upgrade.

currently CCP mode is unicast in this cluster.

thank you in advance.

Re: CCP Mode: Cluster Upgrade

PhoneBoy — Thu, 24 Jun 2021 22:35:53 GMT

Why R80.30 and not R80.40?
There you also have the Multi-Version Cluster method.
Also why Unicast?

Re: CCP Mode: Cluster Upgrade

ashah — Thu, 24 Jun 2021 23:27:36 GMT

Thank you for responding,

we have 4600 appliances and have some performance issue and that is the reason TAC suggested to go with R80.30.

i am still curious about CCP mode during the upgrade. Normally what mode it should be? since i have started managing this cluster it is in multicast mode.

Question: Should i change CCP mode to Auto or broadcast before/after firmware upgrade?

Re: CCP Mode: Cluster Upgrade

the_rock — Fri, 25 Jun 2021 01:40:51 GMT

Honestly, I upgraded lots of clusters and never changed CCP mode ever and all worked fine. Just follow zero downtime upgrade, its pretty straight forward. I would try to have console access to the boxes when doing this, just to be on the safe side.

Re: CCP Mode: Cluster Upgrade

ashah — Fri, 25 Jun 2021 01:45:12 GMT

since, zero down time method says connection initiated through active member drops when we fail over. i have planned to go for "connectivity upgrade" method. which is mostly similar to zero down time method. there is one extra step of connectivity method when standby member start sync with primary member.

should i continue with "connectivity method" ? please guide me

Re: CCP Mode: Cluster Upgrade

the_rock — Fri, 25 Jun 2021 01:51:24 GMT

Put it this way...you WANT zero downtime upgrade, because thats exactly what it is, no downtime. If you read the guide ( https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_Installation_and_Upgrade_Guide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/CP_R80.10_Installation_and_Upgrade_Guide/198779) it tells you exactly what you need to do.

I know this is for R80.10, but same applies to any version really. You upgrade backup, reboot, change cluster version in dashboard, install policy as per instructions, do same on current master and install policy again after reboot. If you read the guide I pasted the link for, you will see the instructions.