topic Re: Upgrade from R80.10 from 80.40 in Firewall and Security Management

Upgrade from R80.10 from 80.40

chvgms — Mon, 02 Aug 2021 14:01:56 GMT

Hi,

what is the recommended best practice to upgrade from R80.10 to R80.40 which is running in ClusterXL model.

Thanks,

Sridhar

Re: Upgrade from R80.10 from 80.40

PhoneBoy — Mon, 02 Aug 2021 16:03:55 GMT

Best to follow the install and upgrade guide: https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Installation_and_Upgrade_Guide/Default.htm
There are also several threads on CheckMates about this as well.
If you can provide more details about your environment, we can provide more specific advice.

Re: Upgrade from R80.10 from 80.40

the_rock — Mon, 02 Aug 2021 16:42:39 GMT

Personally, I always follow below document, and same applies to R80.40. Zero downtime upgrade, in my opinion, is the best option out there.

https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_Installation_and_Upgrade_Guide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/CP_R80.30_Installation_and_Upgrade_Guide/207427

Re: Upgrade from R80.10 from 80.40

genisis__ — Mon, 02 Aug 2021 16:47:54 GMT

Believe I've replied to a similar question in the forum, but for my pennies worth, I would do a clean build on standby member, ensure mvc is turned on and failover after SIC/Policy push etc has been done, including checking to ensure you have an active/standby status.

Re: Upgrade from R80.10 from 80.40

the_rock — Mon, 02 Aug 2021 17:08:20 GMT

O yea, good point for mvc...I forgot about that, though I never had to change that ever before, but still...better be safe than sorry : )

Re: Upgrade from R80.10 from 80.40

genisis__ — Tue, 03 Aug 2021 09:36:01 GMT

I believe the MVC pretty much does the same as changing the ccp mode, but its just easier to do. I've done a number of three node clusters during the working day using this (R77.30 to R80.40) and its worked a treat.

Re: Upgrade from R80.10 from 80.40

RamGuy239 — Tue, 03 Aug 2021 13:23:49 GMT

Utilising multi-version clustering is the same as doing a full connectivity upgrade and not a zero-downtime upgrade? The only difference is that mvc has replaced cpha cu making it even easier and more seamless compared to before.

I would always go with full connectivity upgrade over a zero-downtime upgrade. It's basically you typing cphacu start as one additional step and it ensures that you will have all the traffic synchronised before doing the failover.

https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_Installation_and_Upgrade_Guide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/CP_R80.30_Installation_and_Upgrade_Guide/207427

But this information is out-of-date. On R80.40+ this is known as multi-version clustering on R80.40+ and has replaced full connectivity upgrade entirely. But it achieves the same thing and is the recommended approach. It has just been made smart, easier and more seamless.

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Installation_and_Upgrade_Guide/Topics-IUG/MVC-Upgrade-of-ClusterXL-GW-mode.htm?tocpath=Upgrade%20of%20Security%20Gateways%20and%20Clusters%7CUpgrading%20ClusterXL%252C%20VSX%20Cluster%252C%20or%20VRRP%20Cluster%7CMulti-Version%20Cluster%20(MVC)%20Upgrade%7C_____4

Can't really think of any reason why someone would go with zero downtime upgrade over multi-version clustering upgrade / full connectivity upgrade, to be honest.

@chvgms You have to remember that R80.40 comes with 3.10 kernel and a new XFS filesystem. For you to get the new filesystem you will have to do a full re-install for ISO/USB instead of doing a cpuse or blink upgrade. If you do the upgrade you will be stuck with EXT3 filesystem. A full re-install is the only way to get it. A good thing to keep in mind.

Re: Upgrade from R80.10 from 80.40

the_rock — Tue, 03 Aug 2021 14:05:38 GMT

I think argument can be made for both methods, but I do see your point...its definitely true that with FCU, all connections are maintained and synced.

Re: Upgrade from R80.10 from 80.40

genisis__ — Tue, 03 Aug 2021 14:11:52 GMT

Basically use MVC. From a filesystem prospective, yes doing a clean build gives you XFS, but on a gateway this is not really that important from what I can tell. The main thing is the kernel update.

I would still do a clean build anyway, if the option is available to do so.