topic Re: Central Deployment Tool v1.5 (CDT) has been released in Firewall and Security Management

Central Deployment Tool v1.5 (CDT) has been released

PhoneBoy — Wed, 17 Jan 2018 19:32:57 GMT

I am happy to announce the release of version 1.5 of the CDT – Central Deployment Tool.

While previous versions of CDT introduced automatic upgrades or HF installations on multiple gateways and clusters, the new version introduces new ways to automate your deployments:

- Basic Flow – same as previous versions, and with the same syntax – you can use the CDT to upgrade or install hotfixes on multiple gateways. Clusters upgrades are performed automatically, and the management objects are upgraded automatically.

- Advanced Flow – you can now prepare a complete deployment plan that will be executed on all gateways and clusters by the CDT. The deployment plan is a set of actions such as: install a package, uninstall a package, download package from cloud, push/pull files, take snapshot, run script, etc. As with the basic flow, CDT automatically controls cluster upgrades, and upgrades the management objects as well.

- RMA – CDT now allows you to automate your RMA process. You can use the CDT to collect version and configuration information from all of your gateways, and use the CDT to automatically restore the GW on a new appliance after RMA. All you need to do is set the IP on the new appliance, and run CDT to restore the gateway.

Please visit SK111158 for download and usage instructions.

Re: Central Deployment Tool v1.5 (CDT) has been released

Yasushi_Kono1 — Fri, 26 Jan 2018 08:18:54 GMT

Hi Daemon,

I had spendid experience with the version 1.0 of this tool. It was a joy to upgrade many of Check Point clusters almost unattendedly. There was only one file to be configured (CentralDeploymentTool.xml) and everything was quite easy to accomplish upgrade procedures. You could specify whether to perform "MINOR" Upgrades (i.e. hotfix installations) or "MAJOR" Upgrades (i.e. from R77.30 to R80.10).

In the upgrade admin guide of v1.5, there is no mentioning about upgrading from R77.30 to R80.10 anymore. The only options mentioned there is SmartUpdate and CPUSE. Why not CDT?

Say 'hello' to Dmitry!

Kind regards,
Yasushi

Re: Central Deployment Tool v1.5 (CDT) has been released

PhoneBoy — Sat, 27 Jan 2018 05:11:09 GMT

I assume CDT would simply be using CPUSE to perform the major upgrade anyway, but maybe I'm missing something.

https://community.checkpoint.com/people/tsahi330fad5c-65ab-41ad-8761-bd74072bb273‌?

Re: Central Deployment Tool v1.5 (CDT) has been released

Tsahi_Etziony — Sat, 27 Jan 2018 09:41:13 GMT

Yasushi Kono wrote:
In the upgrade admin guide of v1.5, there is no mentioning about upgrading from R77.30 to R80.10 anymore. The only options mentioned there is SmartUpdate and CPUSE. Why not CDT?

Are you talking about the CDT admin guide or the R80.10 upgrade guide?

CDT v1.5 can do everything previous versions did and much more.

As a matter of fact, you don't even need to configure MINOR, MAJOR or HOTFIX anymore because CDT now examines the packages before sending them and automatically detects the upgrade type.

Tsahi

Re: Central Deployment Tool v1.5 (CDT) has been released

Vincent_Bacher — Tue, 30 Jan 2018 20:41:31 GMT

Yes, CDT just uses CPUSE for packet installation. All commands are being sent to the gateways using cprid.

Recently I upgraded round about 20 clusters from 77.30 to 80.10 and jumbo take 56 in one deployment plan and it worked well.

Re: Central Deployment Tool v1.5 (CDT) has been released

G_W_Albrecht — Tue, 06 Feb 2018 14:53:34 GMT

CDT is a powerfull tool that really can do a lot!

Re: Central Deployment Tool v1.5 (CDT) has been released

K__P__Kennedy — Thu, 01 Mar 2018 15:25:38 GMT

Can the CDT be used in conjunction with the API? It doesn't sound like it based on this. Are there any plans to allow the API to leverage the CDT?

Re: Central Deployment Tool v1.5 (CDT) has been released

Tsahi_Etziony — Thu, 01 Mar 2018 16:47:05 GMT

The CDT is not based on the API because it supports different versions including versions without API. However, based on the success of the CDT, we are working on adding central deployment capabilities as part of SmartConsole, and all of these capabilities will have APIs.

Re: Central Deployment Tool v1.5 (CDT) has been released

Vincent_Bacher — Tue, 13 Mar 2018 18:44:24 GMT

Just for info in case anybody runs into the same issues: i just faced two issues in cdt.

Cdt hung in post policy preparation stage.

First issue was that fingerprint changed and cdt could not handle to answer the question to accept the new fingerprint. In our case it was because of migrate import and upgrade before cdt was run.

Solution was to run the mgmt_cli command manually and accept the fingerprint, then run cdt again.

Second issue was because of Gaia portal runs on different port than 443 on sms. So cdt was stuck.

Entering "export MGMT_CLI_PORT=<port number> solved it.

Cdt team will fix that.

Re: Central Deployment Tool v1.5 (CDT) has been released

Robert_Decker — Tue, 13 Mar 2018 18:52:09 GMT

Hi Vincent,

Your actions to the problems listed are accurate.

How did you come to these actions? On your own or got some help?

Robert.

Re: Central Deployment Tool v1.5 (CDT) has been released

Vincent_Bacher — Tue, 13 Mar 2018 18:55:49 GMT

Hi Robert,

unfortunately not on myself.

A guy from cdt team and one of the management team helped me.

Best regards

Vincent

Re: Central Deployment Tool v1.5 (CDT) has been released

Borut — Thu, 28 Jun 2018 11:16:15 GMT

I'm trying to learn and use CDT and stumble on the first step - Candidate list generation.

When trying the syntax from the manual, CDT reports Invalid number of arguments:

[Expert@mgmt:0]# ./CentralDeploymentTool -generate -candidates=test.csv
Thu Jun 28 13:01:27 2018 *A* [Main]: Central Deployment Tool (version 1.5.2 build #990180476)
Thu Jun 28 13:01:27 2018 *A* [Main]: ========================================================
Thu Jun 28 13:01:27 2018 *A* [Main]: Current execution logs are in: /var/log/CPcdt/logs_2018-06-28-13-01-26/
Thu Jun 28 13:01:27 2018 *E* [Main]: Invalid number of arguments.
Advanced (Deployment Plan) Usage:
=================================
Candidate list generation:
Generates the installation candidates list and saves it to a file.
-generate -candidates=<file name> -deploymentplan=<filename.xml> [-server=<Domain Management Server IP>] [-filter=<file name>]
generate candidate list following deployment plan [using a Domain Management Server] and save it to a file.
optional - use a filter list to generate a candidate list on the machines in the filter list.

I then try the syntax proposed by CDT itself:

[Expert@mgmt:0]# ./CentralDeploymentTool -generate -candidates=test.csv -deploymentplan=CentralDeploymentTool.xml
Thu Jun 28 13:02:04 2018 *A* [Main]: Central Deployment Tool (version 1.5.2 build #990180476)
Thu Jun 28 13:02:04 2018 *A* [Main]: ========================================================
Thu Jun 28 13:02:04 2018 *A* [Main]: Current execution logs are in: /var/log/CPcdt/logs_2018-06-28-13-02-03/
Thu Jun 28 13:02:04 2018 *E* [Main]:
************************************************
Deployment Plan error has occurred:
Error code 23 - Error loading deployment plan file.
Make sure that the deployment plan file is valid.
Details:
--------
Failed to get the root of DeploymentPlan configuration file: CentralDeploymentTool.xml

I'm stuck at this point and don't know what to do. Can someone point me in the right direction?

The management server is running R80.10 Jumbo 103 and CDT v1.5.2.

Best regards

Re: Central Deployment Tool v1.5 (CDT) has been released

Yasushi_Kono1 — Thu, 28 Jun 2018 11:28:03 GMT

Hi Borut,

you need to insert the DepPlan.xml als Deployment Plan.

Kind regards

Yasushi

Von: Borut Vozelj

Gesendet: Donnerstag, 28. Juni 2018 13:18

An: Yasushi Kono <Yasushi.Kono@experteach.de>

Betreff: Re: - Re: Central Deployment Tool v1.5 (CDT) has been released

CheckMates <https://community.checkpoint.com/?et=watches.email.thread>

Re: Central Deployment Tool v1.5 (CDT) has been released

reply from Borut Vozelj<https://community.checkpoint.com/people/boruta2cd43c4-f354-4a4f-8972-1f498da0b38a?et=watches.email.thread> in Appliances and Gaia - View the full discussion<https://community.checkpoint.com/message/22309-re-central-deployment-tool-v15-cdt-has-been-released?commentID=22309&et=watches.email.thread#comment-22309>

Re: Central Deployment Tool v1.5 (CDT) has been released

Arik_Ovtracht — Thu, 28 Jun 2018 11:32:23 GMT

Hi,

The candidates list generation can be done in 2 ways - the Basic mode and the Advanced mode. They have different syntax, so I'll describe both:

In the Basic mode, all you need to do is to specify that you want to generate a candidates list, and specify the file to contain that list, without the prefix '-candidates='. So the command will be:

./CentralDeploymentTool -generate test.csv

In the Advanced mode, you first must create a 'deployment plan' - this is an .xml file which instructs CDT on the sequence of actions to do on each GW/cluster member. You can use one of the example deployment plans found in the admin guide, and edit it to fit your needs. After you have done it, you can use the Advanced mode syntax as follows:

./CentralDeploymentTool -generate -candidates=test.csv -deploymentplan=DepPlan.xml

Re: Central Deployment Tool v1.5 (CDT) has been released

Borut — Thu, 28 Jun 2018 12:09:08 GMT

The first command you propose for basic mode is not working for me

[Expert@mgmt:0]# ./CentralDeploymentTool -generate test.csv
Thu Jun 28 14:00:37 2018 *A* [Main]: Central Deployment Tool (version 1.5.2 build #990180476)
Thu Jun 28 14:00:37 2018 *A* [Main]: ========================================================
Thu Jun 28 14:00:37 2018 *A* [Main]: Current execution logs are in: /var/log/CPcdt/logs_2018-06-28-14-00-36/
Thu Jun 28 14:00:37 2018 *E* [Main]: Invalid number of arguments.
Advanced (Deployment Plan) Usage:
=================================
Candidate list generation:
Generates the installation candidates list and saves it to a file.
-generate -candidates=<file name> -deploymentplan=<filename.xml> [-server=<Domain Management Server IP>] [-filter=<file name>]
generate candidate list following deployment plan [using a Domain Management Server] and save it to a file.
optional - use a filter list to generate a candidate list on the machines in the filter list.

[Expert@mgmt:0]# ./CentralDeploymentTool -b -generate test.csv
Basic Usage:
============
Candidate list generation:
Generates the installation candidates list and saves it to a file.
-generate <file name> [Domain Management Server IP]
generate candidate list from [Domain] management server and save it to a file.

Not sure what I'm missing here.

Re: Central Deployment Tool v1.5 (CDT) has been released

Arik_Ovtracht — Thu, 28 Jun 2018 12:57:07 GMT

I forgot to add this: For Basic mode, you must specify which package to install in the main configuration file (CentralDeploymentTool.xml), otherwise CDT assumes you are using Advnaced mode. Use the PackageToInstall entry to do that - you can see an example in the admin guide.

Note that you must remove that entry if you wish to use the Advanced mode.

Re: Central Deployment Tool v1.5 (CDT) has been released

Vincent_Bacher — Tue, 07 Aug 2018 07:18:43 GMT

Hi,
just upgrading some clusters from R77.30 to R8.10 using CDT 1.5.2 . Send R80.10 package does not work on some of the nodes.

        ************************************************
        Remote Control error has occurred. IP = ***.***.***.***, command =

        Error code 15 - Error sending a file to a remote machine.
        Check SIC connectivity.

        Details:
        --------
        File is too large.
        ************************************************

Any idea what to do?
At the affected nodes i transfered the file using scp as workaround. Using cdt would be better, indeed

Re: Central Deployment Tool v1.5 (CDT) has been released

Vincent_Bacher — Wed, 08 Aug 2018 14:37:39 GMT

Just found the cause of the issue (thanks to Eliran):
I upgraded from beta to ga release of cdt.

The package was originally in /home/admin/ and I copied it (with the split files and the split_info.txt file) to $CDTDIR (and newly created subdirectory). The content of the split file still contain /home/admin paths.

So had to delete these file and keep only the FCS package.

Re: Central Deployment Tool v1.5 (CDT) has been released

JozkoMrkvicka — Fri, 05 Oct 2018 18:56:38 GMT

Okay, so I am trying to test CDT 1.5.2 from single SMS R80.10 management and I have to say that I am very confused. The instructions are very bad written and admin is totally confused how to simply generate candidate list and so on...

After 30 minutes I figured out that candidate list can be generated via following command:

./CentralDeploymentTool -generate -candidates=list.csv -deploymentplan=DepPlan.xml

All needed options have been modified (commented) in DepPlan.xml and CentralDeploymentTool.xml.

The candidate list has been generated.

Now, I want to move both packages (RPM + TGZ) to the candidate members, install RPM and verify TGZ - means I need to use EXTENDED PREPARATIONS option of BASIC mode.

According to manual, I need to use following syntax:

I have tried following variants:

./CentralDeploymentTool -execute -extended_preparations -candidates=list.csv -deploymentplan=DepPlan.xml
./CentralDeploymentTool -execute -extended_preparations -candidates=list.csv
./CentralDeploymentTool -execute -extended_preparations list.csv
./CentralDeploymentTool -extended_preparations list.csv

None of above mentioned commands are working (Invalid argument: -extended_preparations).

Can someone, please, figure out for me what is the correct syntax ?

EDIT:

So, finally I solved it What I did was .... read whole documentation from page 1 to the last page

What I need is just modify CentralDeploymentTool.xml, NOT DepPlan.xml. I modified both.

After that, the candidate list was generated:

./CentralDeploymentTool -generate test.csv

And at the moment the extended_preparations is in progress:

./CentralDeploymentTool -extended_preparations test.csv

Re: Central Deployment Tool v1.5 (CDT) has been released

Arik_Ovtracht — Sun, 07 Oct 2018 05:30:13 GMT

Hi Jozko,

Sorry to hear about the confusion in our documentation. I will try to make it clearer.

Meanwhile, let me explain:

The CDT Basic Mode command ‘extended_preparations’, as you have figured out, is used to send packages from the management machine to the connected firewalls. The same could also be done in the Advanced Mode, but in a different way – In Advanced Mode, you can construct a Deployment Plan (the xml file which contains a list of actions to perform on each machine) with any combination of actions you want. If you just need to send the packages to the firewalls, you can create a deployment plan with just 1 action (import_package) and then execute it. You can create another deployment plan to do the actual installation.

Most of your commands have not worked because you were trying to use an Advanced Mode command (-execute) with a Basic Mode parameter (-extended_preparations). The 4th command you mentioned (with just the –extended_preparations parameter) should have worked. Do you remember if you used a copy&pasted command? If you did, that could have been the issue. If not – please share the exact output that you get when trying to run ./CentralDeploymentTool -extended_preparations list.csv

Regards,

Arik Ovtracht

Packaging Team Leader

Device Operations Group