topic Re: Difference between clean install and upgrade via CPUSE in Firewall and Security Management

Difference between clean install and upgrade via CPUSE

Malik1 — Fri, 24 Jul 2020 13:09:25 GMT

Hi Team,

I need to know what is the difference between clean install via CPUSE and upgrade via CPUSE on a security gateway.

As far i understand we have 3 ways to upgrade a security gateway.

1. CPUSE Upgrade

2.CPUSE - Clean Install

3.Clean install via USB

Using option 3 will get the system to xfs filesystem and the other two options wont. Option 3 is nearly impossible in our environment but are there a advantages of the new file system. If there is an SK or link that points out the difference between the existing file system and xfs file system,

Also,how upgrading via blink image make a difference and should it be considered . ?

Using option 3 (Clean install via USB) we cant revert back but if we use CPUSE - upgrade option we can revert back do we have the same option to revert back using CPUSE clean install.

Re: Difference between clean install and upgrade via CPUSE

HeikoAnkenbrand — Fri, 24 Jul 2020 14:07:35 GMT

Hi @Malik1,

All upgrade methods are described in detail here:

Installation and Upgrade Guide R80.40

Re: Difference between clean install and upgrade via CPUSE

Boaz_Orshav — Sun, 26 Jul 2020 05:22:38 GMT

A very short highlight of the differences:

USB - Reformatting the system. New file system. New definition of partition size. New IP. New role (i.e. GW can become management etc.) Nothing is left from the previous installation.

CPUSE Clean - Create a new partition for the new version and install it. The old partition still exists so you can easily revert. Partition sizes are kept as well as files which are not in the "current" partition.

CPUSE Upgrade - Exactly like clean install but at the end of the process a configuration migration is done so the machine expected to stay with same functionality (i.e. you can't change GW to Management etc.)

Blink - Mainly a shortcut to make installation faster in case installation of version + Jumbo is required. The terms clean/upgrade are same as any CPUSE installation (see above) but instead of installing version 80.40, reboot, install jumbo, reboot it can be done in one step (i.e. install 80.40 + jumbo and reboot).

Re: Difference between clean install and upgrade via CPUSE

JozkoMrkvicka — Sun, 26 Jul 2020 06:43:32 GMT

There is also one more option - Mount ISO file over LOM.

It will do the same like was mentioned by Boaz for USB option, but in case of LOM, you can do it remotely, without having physical access to the device.

Re: Difference between clean install and upgrade via CPUSE

Malik1 — Mon, 27 Jul 2020 07:44:08 GMT

Thanks @Boaz_Orshav

One more thing , can you point out some link or SK that mentions the process to revert . I have gone through the CPUSE guide and we can only uninstall hotfixes not major versions.

If you could help me with the process to revert as I plan to upgrade using CPUSE upgrade or CPUSE clean install. It seem the process to revert using CPUSE (upgrade or clean

Thanks

Re: Difference between clean install and upgrade via CPUSE

Boaz_Orshav — Wed, 29 Jul 2020 11:50:18 GMT

Sorry for the delay.

Snapshot management is described in: Gaia R80.40 Administration Guide -> Maintenance -> Snapshot management

Re: Difference between clean install and upgrade via CPUSE

CheckPointerXL — Thu, 28 Apr 2022 07:47:24 GMT

Hello Boaz,

which configuration are kept by doing CPUSE Clean? I guess mgmt IP and static route... also other stuff? custom files etc?

Thank you !

Re: Difference between clean install and upgrade via CPUSE

CheckPointerXL — Sun, 29 May 2022 08:48:35 GMT

solved:

When CPUSE is used to clean insall an OS Version it keeps a copy of the origional admin password, network interfaces and network routes. (sk157054)

Re: Difference between clean install and upgrade via CPUSE

dehaasm — Wed, 11 Jan 2023 10:15:56 GMT

CPUSE upgrade configuration migration what does it contain clish config and perhaps the fwkern.conf file? Is there any benefit of doing a clean install?

Re: Difference between clean install and upgrade via CPUSE

_Val_ — Wed, 11 Jan 2023 11:13:53 GMT

One difference is that clean-install re-images your device. For example, the default file system changed between R80.30 and R80.40 for Security GWs and between R80.20 and R80.30 for The management servers. When doing a clean-install, you can change your file system type in the process, unlike in the case of an in-place upgrade, where your device still uses the "old" file system after an upgrade.

Re: Difference between clean install and upgrade via CPUSE

PhoneBoy — Wed, 11 Jan 2023 19:55:59 GMT

CPUSE "Clean Install" does not change filesystems.
A Clean Install from ISO is necessary for that.

Re: Difference between clean install and upgrade via CPUSE

ikafka — Wed, 10 May 2023 10:58:31 GMT

I have a question here.

My SMS info

Prodcut version: Gaia R80.30, OS kernel: 3.10.0-957

I can upgrade this openserver SMS to R81.10 from gaia web gui. I see this:

The question is will lose any configuration when I do this upgrade? I will then upgrade two firewalls with R80.30 to 81.10.

Re: Difference between clean install and upgrade via CPUSE

Boaz_Orshav — Wed, 10 May 2023 11:17:51 GMT

As stated in previous response - notice that file system does not change while using CPUSE upgrade.

Configuration will not be lost.

Notice that it might be easier to use Smart Console: Select the firewalls, right click->actions->version upgrade

If you need more assistance - feel free to contact me at boazo@checkpoint.com

Re: Difference between clean install and upgrade via CPUSE

Matlu — Wed, 26 Jul 2023 17:44:58 GMT

Hello,

A question.

What is the method Checkpoint recommends to perform an upgrade?

I am currently in the habit of upgrading using CPUSE Upgrade (I have never tried to use Clean Install or Blink).

Does Checkpoint have any "recommendations"?
Can I keep my "old habit" of using the "CPUSE UPGRADE"?

Greetings.

Re: Difference between clean install and upgrade via CPUSE

PhoneBoy — Wed, 26 Jul 2023 18:43:28 GMT

To take advantage of certain changes made in certain releases (R80.40, R81.20), you will need to perform a fresh install + advanced migration.
These changes involve the filesystem (xfs in R80.40, partitioning alignment changes in R81.20) which cannot be done in-place.
Note these changes lead to improved performance, specifically on management where disk is used extensively.
Gateways also benefit, albeit to a lesser degree.

Re: Difference between clean install and upgrade via CPUSE

Matlu — Wed, 26 Jul 2023 18:49:36 GMT

Simply using CPUSE UPGRADE, does it not guarantee me to "benefit" from certain changes in the versions that you expose in the example (R81.20 and R80.40) ?

I understand that it would be the only "particularity", the fact that I do not have the new features of these versions, if I decide to use CPUSE UPGRADE, correct?

How could I align the update made by a CPUSE UPGRADE, so that it has all the benefits that a FRESH INSTALL would give you?

Because many times, for "x" reasons, it is not possible to access the equipment in a physical way, to do this kind of upgrade (Fresh Install).

Re: Difference between clean install and upgrade via CPUSE

JozkoMrkvicka — Wed, 26 Jul 2023 21:42:58 GMT

Is there some dedicated sk where is described what exactly is "partitioning alignment changes in R81.20"? To be honest, I had no idea about such a change which is activated only by using fresh install.

I have found sk180970 where something about SSDs and partition changes are mentioned, but not sure if this is the correct way to inform users.

It is also not explained in R81.20 released notes and even not mentioned that such a change requires fresh install. Is this partitioning alignment valid only for SSDs, or also for HDDs ?

It would be great to have one dedicated sk where are mentioned all changes/features which are not present on newer versions while upgrading using CPUSE and not doing fresh install (32bit vs 64bit, 2.6 kernel vs 3.10 kernel, XFS vs EXT3 file system, ...).

Re: Difference between clean install and upgrade via CPUSE

_Val_ — Thu, 27 Jul 2023 07:20:31 GMT

@JozkoMrkvicka The topic was thoroughly discussed in the community the last year: https://community.checkpoint.com/t5/Management/Gaia-partition-misalignment/m-p/160677#M32878

Re: Difference between clean install and upgrade via CPUSE

PhoneBoy — Thu, 27 Jul 2023 12:42:29 GMT

Converting from ext3 (default file system prior to R80.40) to xfs requires changing disk partitioning schemes.
Changing the alignment of partitions (R81.20) must be done during the establishment of the partitions.
Neither of these things are possible to change “in-place.”

Note these low-level changes are the only ones that require a fresh install to benefit from and they are most relevant to management.
They are less relevant/necessary on gateways, which as you said, may not always be easily accessible.

Re: Difference between clean install and upgrade via CPUSE

aloish — Thu, 15 Aug 2024 09:10:03 GMT

CPUSE Upgrade: ...configuration migration...the machine expected to sty with the same functionality... ?
why does checkpoint mention in the install and upgrade guide the following ?

On your Security Gateways and Cluster Members:

Make a copy of all custom configurations in the applicable directories and files.

The upgrade process replaces all existing files with default files. You must not copy the customized configuration files from the current version to the upgraded version, because these files can be unique for each version. You must make all the custom configurations again after the upgrade.