topic Re: Upgradation for Security Management Server and 2 Security Gateway Clusters(1600 & 5200) in Firewall and Security Management

Upgradation for Security Management Server and 2 Security Gateway Clusters(1600 & 5200)

Hari122939_ — Tue, 13 Feb 2024 18:58:01 GMT

Hello Team,

I have a requirement to upgrade the Security management server and 2 clusters(1600 and 5200).My client want to go upgrade to latest version(R81.20) for both SMS and Security Gateways because current versions are going to expire in next 2 months.

I placed my client current versions below:

Appliance Current Version Upgrade Version

1.Security Management Server (or) Console open server - R80.40 81.10.X or 81.20.X

2.Quantum Spark 1600 Security Gateway(Cluster) 1600 - R80.20.50 81.10.X or 81.20.X

3.Enterprise 5200 Security Gateway(Cluster) 5200 - R80.40 81.10.X or 81.20.X

Please share the Supported Upgradation Path document for both Security Management Server and Security Gateways.

Thank You.

Re: Upgradation for Security Management Server and 2 Security Gateway Clusters(1600 & 5200)

the_rock — Tue, 13 Feb 2024 19:12:21 GMT

Personally, I always do zero downtime upgrade, which is replaced these days with MVC (multi version cluster). In short, I would upgrade mgmt first to R81.20 (whatever recommended jumbo is now, I think 41), then after reboot, follow below process for the clusters.

Andy

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Installation_and_Upgrade_Guide/Topics-IUG/MVC-Upgrade-of-ClusterXL-GW-mode.htm?tocpath=Upgrade%20of%20Security%20Gateways%20and%20Clusters%7CUpgrading%20ClusterXL%252C%20VSX%20Cluster%252C%20or%20VRRP%20Cluster%7CMulti-Version%20Cluster%20(MVC)%20Upgrade%7C_____4

This part, SUPER important you follow the steps how they are outlined.

Re: Upgradation for Security Management Server and 2 Security Gateway Clusters(1600 & 5200)

genisis__ — Tue, 13 Feb 2024 19:59:07 GMT

Manager first for sure, and I would also suggest clean build to take advantage of XFS filesystems, also keep in mind I believe there is a kernel version change, and I've seen issue with this in the past, so suggest clean build on the GWs, however MVC will ensure you have service.

Lates JHFA is Take 45 which I suspect will go to GA soon.

Re: Upgradation for Security Management Server and 2 Security Gateway Clusters(1600 & 5200)

the_rock — Tue, 13 Feb 2024 20:00:44 GMT

I know people who prefer back up the config, then do clean innstall, then do restore. Thats fine too, no issues with that.

Andy

Re: Upgradation for Security Management Server and 2 Security Gateway Clusters(1600 & 5200)

genisis__ — Tue, 13 Feb 2024 20:03:20 GMT

I generally do backup and then an export of the manager, GW's really just take a copy of the GAIA config and an custom edits if there are any.

Re: Upgradation for Security Management Server and 2 Security Gateway Clusters(1600 & 5200)

the_rock — Tue, 13 Feb 2024 20:05:01 GMT

I would say one thing to pay attention to is if you have custom modified files, such as table.def or user.def, as that may not work with the upgrade from R80.40 to R81.10 or R81.20

Andy

Re: Upgradation for Security Management Server and 2 Security Gateway Clusters(1600 & 5200)

genisis__ — Wed, 14 Feb 2024 09:32:36 GMT

100%!

Re: Upgradation for Security Management Server and 2 Security Gateway Clusters(1600 & 5200)

the_rock — Wed, 14 Feb 2024 12:13:07 GMT

I think its fine say from R81 upgrading to later codes, but before R81, it was an issue.

Andy