topic Upgrade cluster hardware in Firewall and Security Management

Upgrade cluster hardware

flachance — Wed, 22 Mar 2023 17:30:00 GMT

Hi,

we have a cluster of two Open Servers running R80.40. We need to replace the servers with new ones. And we'd like to upgrade to R81.10

Would it be less disruptive to install R80.40 on the new hardware and after the new servers are up and running in the cluster upgrade to R81.10?

I'm looking at sk107042 and for multi-version cluster upgrade it says VPN connections won't survive a failover and we would like to avoid that.

thanks

Re: Upgrade cluster hardware

the_rock — Wed, 22 Mar 2023 17:38:13 GMT

Thats exactly what I did once with the customer. We installed same version and then upgraded...OR, you can follow below method, its also super useful and it does work

Andy

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/td-p/69216

Re: Upgrade cluster hardware

Bob_Zimmerman — Wed, 22 Mar 2023 18:52:01 GMT

It would be smaller steps, so easier to confirm things are working. If you're going to do this, I would install R81.20 on the new systems and downgrade them to R80.40. The R81.20 installer fixes a bug which resulted in misaligned partition layouts on all earlier versions. This greatly impacts storage I/O performance, most noticeable with small file operations.

This doesn't affect the MVC limitation. At some point, you will have a cluster with one member at R80.40 and one member at R81.10. When you fail over, you hit all the same MVC limitations regardless of the hardware situation. That said, I don't see anything about dropping site-to-site VPN connections unless they're traditional mode. Remote access connections drop.

Re: Upgrade cluster hardware

flachance — Fri, 24 Mar 2023 14:04:02 GMT

I wasn't aware of that bug. thanks.