topic Re: Azure Cloudguard Cluster Upgrade from R81.10 to R81.20 in Firewall and Security Management

Azure Cloudguard Cluster Upgrade from R81.10 to R81.20

Olusegun_Adekun — Fri, 12 Jan 2024 17:46:43 GMT

Hi All,

I need to upgrade our Azure CloudGuard Cluster from R81.10 to R81.20, however I need to install the Latest Jumbo Hotfix Take 130 First.

My question is, can I install on the Standby first the Jumbo Hotfix and immediately R81.20 image. Then failover to this upgraded firewall, leave for some few days and install on the other firewall.

I should install Jumbo Hotfix take 130 on both Firewall first and next day install the R81.20.

Am thinking it's better to install JHF T130 on both first for consistency of software images on both firewalls.

Any suggestion please?

Regards,

Olu

Re: Azure Cloudguard Cluster Upgrade from R81.10 to R81.20

gto_gary — Fri, 12 Jan 2024 22:02:41 GMT

Hi,

I would definitely recommend do this in 2 steps to ensure stability.

1. Install the JHF you require on each cluster member.

https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/R81.10/Installation-Uninstall.htm

2. Once both nodes are complete and the cluster is verified as healthy and working move forward with the version upgrade. Upgrades for Azure CG clusters can now be done as an in place upgrade, and works quite well.

https://support.checkpoint.com/results/sk/sk177714

All the best,

gto_gary

Re: Azure Cloudguard Cluster Upgrade from R81.10 to R81.20

the_rock — Sat, 13 Jan 2024 00:13:08 GMT

You are luck if you are doing it now, because back few months ago, only mgmt upgrade was possible, NOT gateways.

Best,

Andy

Re: Azure Cloudguard Cluster Upgrade from R81.10 to R81.20

Olusegun_Adekun — Sun, 14 Jan 2024 12:30:58 GMT

Hi Gary,

Thanks very much for the information. Much Appreciated.

Regards,

Olu

Re: Azure Cloudguard Cluster Upgrade from R81.10 to R81.20

Olusegun_Adekun — Sun, 14 Jan 2024 12:32:53 GMT

Hi the_rock,

I believe that am lucky.

Thanks,

Olu

Re: Azure Cloudguard Cluster Upgrade from R81.10 to R81.20

the_rock — Sun, 14 Jan 2024 14:08:35 GMT

Well, makes it easier, for sure, rather than deploying brand new instance in parallel.

Best,

Andy

Re: Azure Cloudguard Cluster Upgrade from R81.10 to R81.20

John_Richards — Tue, 13 Feb 2024 16:33:04 GMT

We have tried to upgrade a R81.10 Azure Cluster to R81.20. The upgrade was successful but all traffic stopped going through the FW. We could not ping any VM's behind the FW (we could before the upgrade). We rolled back to R81.10 and traffic started flowing. We were NOT on JHF T130 before the upgrade. We did an in place upgrade using the following package (azure_Check_Point_ivory_main_T631_R81.20_Gaia_3_10_Install_and_Upgrade.tar). I now see that there is a newer one (aio_Check_Point_ivory_main_T631_R81.20_Gaia_3_10_Install_and_Upgrade.tar).

1. Do you need to apply JHF 130 before upgrading to R81.20?

2. Does anyone know the difference between all these Azure releases (Ivory, aio etc). I would normally use the Blink package, which does work. All the various releases are available on support when you search for R81.20 azure downloads.

Thanks

Re: Azure Cloudguard Cluster Upgrade from R81.10 to R81.20

the_rock — Tue, 13 Feb 2024 16:52:27 GMT

I cant say if thats process for gateways these days in Azure, but my colleague and I never had to do it that way for mgmt server, just us actual upgrade image from the sk @gto_gary provided.

Best,

Andy