topic Re: Stage R80 upgrades in Firewall and Security Management

Stage R80 upgrades

RCordova — Wed, 24 Nov 2021 13:56:13 GMT

We have a number of R80.30 firewalls that we need to upgrade to R80.40 and apply a certain JHF in addition. All of these have too be done during a change window. In order to reduce the amount of time that is required (downloading the OS and JHF during the window) is there a way to upload the R80.40 OS and JHF prior to the change window and do the upgrade from the CLI?

Thanks

Re: Stage R80 upgrades

_Val_ — Wed, 24 Nov 2021 14:07:49 GMT

Look here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111158. It is exactly what you need

Re: Stage R80 upgrades

Tal_Paz-Fridman — Wed, 24 Nov 2021 17:09:46 GMT

You can use CPUSE (in Gaia Portal) to download all the relevant packages and even run a verification before the upgrade.

Please refer to sk92449 - Check Point Upgrade Service Engine (CPUSE) - Gaia Deployment Agent:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449

BTW why not upgrade to R81 which is the default version widely recommended or R81.10?

Thanks

Tal

Re: Stage R80 upgrades

the_rock — Wed, 24 Nov 2021 14:54:49 GMT

@Tal_Paz-Fridman ...just wondering if you can give me honest feedback. Are lots of customers running R81.10 on the gateway side? I can tell the management seems to be working really well on that version with some pretty cool features.

Cheers,

Andy

Re: Stage R80 upgrades

Tomer_Noy — Wed, 24 Nov 2021 15:17:37 GMT

You might be interested in using Blink gateway images for your upgrade.

These images are used for upgrade in the same way as CPUSE images, except that they come pre-installed with the JHF and many of the binary components. The install time is faster, you don't need to separately download and install the JHF, and it saves you a reboot of the JHF installation.

They work really well and in the future we'll probably make these the default.

Note that you need to choose the correct flavor - in your case a gateway blink package. You can download them from the official JHF page.
Due to the "pre-installation" we need to prepare different packages for gateways / management / MDM.

You can import these in advance on the gateway, just like a CPUSE image. You can even run verify in advance to make sure there are no issues prior to the upgrade window.

Re: Stage R80 upgrades

Dorit_Dor — Wed, 24 Nov 2021 17:02:48 GMT

R81.10 Version that is not yet the default, will typically have less. R81.10 management - we see huge take of even large multi domains so confidence is very high. GWs we have above 1000 with good feedback (there are many quality improvements in R81.10 but its still new).

R81 have many thousands of GWs already as its already default version

Re: Stage R80 upgrades

the_rock — Wed, 24 Nov 2021 17:30:34 GMT

Thank you for the feedback @Dorit_Dor

Re: Stage R80 upgrades

JaySon_2021 — Fri, 26 Nov 2021 12:57:47 GMT

The issue with CPUSE is that the JHF for R80.40 do not show up as available until we do the OS upgrade.

Re: Stage R80 upgrades

JaySon_2021 — Fri, 26 Nov 2021 13:29:31 GMT

Thanks Tomer_Noy. It doesnt look like the OS/JHF combo I need is available (R80.40 and JHF take 118).

Re: Stage R80 upgrades

Dorit_Dor — Fri, 26 Nov 2021 15:40:00 GMT

The main version SK gives you the last recommended GA Jumbo as its the right choice usually.
We still offer access to archive versions at sk174185.