topic Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster in Firewall and Security Management

Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Mon, 06 Nov 2023 15:08:01 GMT

Hi gents,

Based on practical experience and leaving aside the R81.20 release notes, would you recommend R81.20 on centrally-managed 3200 appliances or should I stick to R81.10?

I have tried R81.20 on a standalone (locally-managed) 3200 appliance and it almost brought it to its knees, SmartConsole was mostly unresponsive and the appliance itself was very much struggling.

I'm worried that R81.20 might be too heavy for the 3200 even if it's centrally-managed?

Thanks,

Daniel

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Chris_Atkinson — Mon, 06 Nov 2023 15:48:52 GMT

For context how much traffic is the appliance expected to see and what blades are you planning to enabled?

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

G_W_Albrecht — Mon, 06 Nov 2023 15:57:13 GMT

It can run on the 3200 with R81.20 but this is according to load / enabled blades. As Engineering support ends next December i would rather trade them in 😉

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Mon, 06 Nov 2023 23:19:46 GMT

It's running Firewall, IPSec, APPCTRL, IA and IPS

Below load is in off-hours, I didn't get the chance to check it during the day:

CPU User Time (%): 2
CPU System Time (%): 11
CPU Idle Time (%): 87
CPU Usage (%): 13
CPU Queue Length: -
CPU Interrupts/Sec: 6691
CPUs Number: 4

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Mon, 06 Nov 2023 23:21:22 GMT

Noted, replacements will for sure be purchaset at a later time; for now I need these 3200 appliances upgraded asap.

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Chris_Atkinson — Tue, 07 Nov 2023 00:39:12 GMT

In general, it should work but please allow me to rephrase. What is the expected throughput?

Note HCP will help to identify any gotchas with the current configuration.

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Jim_Holmes — Tue, 07 Nov 2023 07:17:20 GMT

Also run a cpsizeme (sk88160), it gives a good performance overview (send to your SE)

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

G_W_Albrecht — Tue, 07 Nov 2023 08:54:26 GMT

If R81.10 + Rec JT works as expected i would just stay - but that is a personal decision. NCARS 😉

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Tue, 07 Nov 2023 09:00:37 GMT

Thank you, I'll give that a go and evaluate it.

On a first attempt, it seems to have failed; CPUSE gives me following error without any other information:

Upgrade of package Check_Point_R81.20_T631_Fresh_Install_and_Upgrade.tgz Failed Failed during export process. Contact Check Point Technical Services for further assistance.

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Tue, 07 Nov 2023 09:01:34 GMT

Might indeed be the way to go, I was optimistic and hoping to have it on R81.20 🙂

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Tue, 07 Nov 2023 10:37:11 GMT

Now this is new to me.. if it would have somewhat made sense on R81.20, but for R81.10 it comes as a surprise.

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

_Val_ — Tue, 07 Nov 2023 10:44:53 GMT

Please open a support call with TAC for this.

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

G_W_Albrecht — Tue, 07 Nov 2023 11:04:15 GMT

What is the reason, low disk space ?

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Chris_Atkinson — Tue, 07 Nov 2023 12:53:14 GMT

What is the current source version & Jumbo that you are upgrading from?

How much disk space is free and is the Deployment Agent up to date?

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Tue, 07 Nov 2023 13:42:32 GMT

Already on it, managet to get an SR registered for this. Thanks 🙂

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Tue, 07 Nov 2023 13:45:28 GMT

Doesn't seem so to me 😕

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Tue, 07 Nov 2023 13:47:40 GMT

Upgrading from R80.40 JHF 196; doesn't look like a free disk space issue to me at least (see image shared above).

Agent: Enabled
Build number: 2337 (agent build is up to date)
Network connection: connected
Update from cloud: Last updated on Tue Nov 7 10:49:27 2023
License: Valid

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Chris_Atkinson — Tue, 07 Nov 2023 13:55:18 GMT

Thanks as Val suggests please contact TAC who can assist in reviewing the logs for the upgrade failure/s.

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Daniel_Cimpeanu — Wed, 29 Nov 2023 10:35:14 GMT

A fast update on this issue - Checkpoint TAC didn't manage to pinpoint the root cause for this upgrade failure. A lot of hours got used on this issue and I was forced to move on, so a R81.10 fresh install was done for the appliance.

Without a root cause, there's not much to learn from this fault unfortunately, except for the fact that one can be lucky or unlucky with TAC depending on the skills of the enginner assigned for the SR.

Re: Gaia R81.20 Titan on centrally-managed 3200 HA cluster

Jim_Holmes — Wed, 29 Nov 2023 18:07:42 GMT

You can always ask for the case to be escalated if you stall out. Whenever you are doing upgrades, let your SE know ahead of time (we hate getting calls for something we didn't know was happening), and you can also open a proactive case and pre-load it with all the information about what you are doing.

*** ALWAYS include the following when opening an SR ***

cpinfo from management and all devices involved. ***This is always going to be asked for***

A "show configuration" from all devices involved.

A "migrate export" of the manager.

I will normally open the ticket online, add the above, then call into TAC.