topic Re: During upgrade from 80.40 to R81.10 with MVC on Cluster XL gateway ssh is not possible in Firewall and Security Management

During upgrade from 80.40 to R81.10 with MVC on Cluster XL gateway ssh is not possible

smismi — Wed, 31 May 2023 13:32:47 GMT

We followed the upgrade guide and after installing standby gw to R81,10, after reboot ssh was not possible any more.

Action plan:

In SmartConsole
, change the cluster object version to R81.10.
On the Cluster Member
M3:
1. Upgrade to R81.10
  Note - If you perform a Clean Install
  of R81.10, then you must establish SIC
  in SmartConsole with this Cluster Member
2. Enable the MVC

Message was

[Expert@n.n.n.n]# ssh n.n.n.n

This system is for authorized use only.

admin@n.n.n.n: Permission denied (publickey).

Before upgrade login with user passwort was possible and we do not use key auth.

Only way to connect to 81,10 GW was via smart console, actions , "open shell" and enable MVC this way.

Is this expected behaviour?

The installation was done on a test system and for production we need to know if smart console is the only way to enable MVC or should ssh working.

Serial console is not available in this scenario.

Thanks for help in advance.

Re: During upgrade from 80.40 to R81.10 with MVC on Cluster XL gateway ssh is not possible

G_W_Albrecht — Wed, 31 May 2023 13:43:03 GMT

Which Jumbo Take is installed ? Recommended Take is 95.

Re: During upgrade from 80.40 to R81.10 with MVC on Cluster XL gateway ssh is not possible

smismi — Wed, 31 May 2023 14:32:50 GMT

Installed was JHF192 or higher.

Re: During upgrade from 80.40 to R81.10 with MVC on Cluster XL gateway ssh is not possible

Bob_Zimmerman — Wed, 31 May 2023 14:56:23 GMT

This can happen if you're connecting through the firewall to some other interface on the standby member. Unless you're running VSX, Check Point firewalls put all interfaces into a single routing table, so they don't really have a "management interface". You should always SSH to the closest interface to you from a routing perspective.

Re: During upgrade from 80.40 to R81.10 with MVC on Cluster XL gateway ssh is not possible

the_rock — Wed, 31 May 2023 15:08:36 GMT

Can you see if you can ssh from the other member to this one? ssh admin@x.x.x.x

Andy

Re: During upgrade from 80.40 to R81.10 with MVC on Cluster XL gateway ssh is not possible

PhoneBoy — Thu, 01 Jun 2023 00:38:11 GMT

When you do a version upgrade, the system will not have a valid policy until a new one compiled against the target version is pushed from SmartConsole.
That will definitely break SSH (among other things).

Re: During upgrade from 80.40 to R81.10 with MVC on Cluster XL gateway ssh is not possible

just13pro — Thu, 01 Jun 2023 01:38:09 GMT

JHF 192 is mostly like version R80.40.

Cause R81.10 currently only in take 95.

Re: During upgrade from 80.40 to R81.10 with MVC on Cluster XL gateway ssh is not possible

the_rock — Thu, 01 Jun 2023 11:22:48 GMT

I dont ever recall losing ssh access when doing cluster upgrade (had done many of them), though I could be mistaken when I say this, but Im pretty positive that even with initial policy loaded, ssh still works, just defaultfilter would block it.

Andy