topic Re: Replace/Upgrade Cluster in Firewall and Security Management

Replace/Upgrade Cluster

Kevin_Orrison — Tue, 03 Dec 2019 16:51:27 GMT

I currently have two 4800s in a cluster on R80.10. I am looking to utilize the same cluster name/configuration and replace these gateways with two 6500s on R80.30. I just wanted to brain storm on the easiest way to accomplish this.

Also, seems like this should be a common ask. Are there any Check Point guides for something like this?

Re: Replace/Upgrade Cluster

Tommy_Forrest — Tue, 03 Dec 2019 17:47:56 GMT

Can you tolerate downtime?

If so, shut down old gateways, move name's/IP's to new ones, re-SIC, change your hardware and OS version/type and push policy. Throw in a ARP table clear command as necessary.

If you can't tolerate downtime, then maybe a Connectivity Upgrade? Though, the document doesn't note that a 80.10->80.30 upgrade is possible, yet.

https://dl3.checkpoint.com/paid/c8/c87af75dc02bd9852017cdfc763b923f/CP_Cluster_ConnectivityUpgrade_BestPractices.pdf?HashKey=1575402212_d682167b02c9697f0cafe75764bf3903&xtn=.pdf

Re: Replace/Upgrade Cluster

Wolfgang — Tue, 03 Dec 2019 18:06:17 GMT

Kevin,

like Tommy mentioned, preconfigure the new nodes with the same configuration ( IPs, VLANs, routing etc. )

Maybee you can too preconfigure new switchports, connect the new gateways and have ports shutdown.

In a maintenance schedule you have to disable the old switchports, enable the new one, reset SIC and change version and appliance type in the cluster object.

I think a zero downtime upgrade is not possible, because of the different architecture and CPU of 4800 and 6xxx appliances.

Wolfgang

Re: Replace/Upgrade Cluster

Maarten_Sjouw — Tue, 03 Dec 2019 19:23:45 GMT

Is management on the gateways or do you have a separate management server?
The installation and upgrade guide from Check Point, per version, is a very comprehensive and complete guide.

Re: Replace/Upgrade Cluster

Kevin_Orrison — Tue, 03 Dec 2019 19:56:16 GMT

Separate management. Unless I missed something, I don't really see something that covers the scenario I described.

Re: Replace/Upgrade Cluster

HeikoAnkenbrand — Wed, 04 Dec 2019 06:39:11 GMT

[4800 A] -> active

[4800 B] -> standby

1. [4800 B] Poweroff the R80.10 the standby cluster member (4800 B)

2. [6500 B] Connect to R80.30 new member and configure interfaces and routes,... with the same settings from the old [4800 B].

3. Install SIC, add license, change cluster version, fix cluster member topology, install policy on gateway [6500 B] (remove flag "if fails")

Note: The member with the lower CCP version (GAIA version) remains active [4800 A].

4. [4800 A] Poweroff the R80.10 appliance (4800 A)

Note: Now you're losing all your sessions and the [6500 B] should become active. If the number of cores (under CoreXL) is the same, you can do a fcu if necessary. This synchronized the sessions on both gateways.

5. If possible delete all ARP entries on all participating routers in real time.

6. (6500 A) Connect to R80.30 new second member and configure interfaces and routes,... with the same settings from the old [4800 A]

7. Install SIC, add license, fix cluster member topology, install policy on both new gateways (add flag "if fails")

Re: Replace/Upgrade Cluster

Pascal_Greditor — Wed, 04 Dec 2019 14:47:43 GMT

All in one (management+gw) or dist. installation?

Re: Replace/Upgrade Cluster

Kevin_Orrison — Wed, 04 Dec 2019 14:57:38 GMT

Thanks for all the replies. What exactly do you mean about the "fix cluster member topology" step?

Re: Replace/Upgrade Cluster

mdjmcnally — Wed, 04 Dec 2019 15:56:52 GMT

Interface names may not match between the 4800 and the 6000 Appliance so will need to update the Interface Names on the Cluster and Member so that match the name of the interface on the 6000 appliance as opposed to what named on the 4800.

Re: Replace/Upgrade Cluster

Kevin_Orrison — Wed, 04 Dec 2019 16:16:58 GMT

Gotcha.

Re: Replace/Upgrade Cluster

Kevin_Orrison — Wed, 04 Dec 2019 16:17:13 GMT

Distributed.

Re: Replace/Upgrade Cluster

Kevin_Orrison — Wed, 04 Dec 2019 16:26:20 GMT

Could I restore a backup of each 4800 into the 6500s? Just checking for faster configuration. Since this is a cluster, the current 4800s are in a cloning group too. Or should I look at using the "Load configuration" CLI utility?

As mentioned in a previous post, the only difference I see in interface name/topology is the 6500s have a new interface named "sync".

Re: Replace/Upgrade Cluster

mdjmcnally — Wed, 04 Dec 2019 16:43:12 GMT

Backups are for restoration to the same model appliance, ie 4800 to 4800.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk91400

From SK

Restore is only allowed using the same appliance model on the source and target computers.

Providing you make sure that is on the same version of code ie not upgrading

then you could save a config file on the 4800 and import onto the 6500 but should be the same version.

This will get the Gaia OS config only. Any Check Point tweaks will still have to do manually.

Re: Replace/Upgrade Cluster

Kevin_Orrison — Wed, 04 Dec 2019 16:57:57 GMT

Changing the topic a little bit. The only other hiccup I can think of is this cluster has Remote Access VPN using the SSL Network Extender, primarily. Does anyone have any experience on how this kind of HW replacement will access Remote Access? Anything to look out for?

Re: Replace/Upgrade Cluster

mdjmcnally — Wed, 04 Dec 2019 17:06:44 GMT

Providing using the same Certificates for VPN and ICA etc then should be good to go still. If using the same Object then these should all remain the same.

Re: Replace/Upgrade Cluster

Kevin_Orrison — Wed, 04 Dec 2019 17:09:57 GMT

OK, that's what I figured. Yah, that's all staying the same.

Re: Replace/Upgrade Cluster

Kevin_Orrison — Fri, 06 Dec 2019 14:40:34 GMT

Can anyone speak to their experience with this type of replacement and upgrading the SNX client? If force update is off, would the R80.10 client connect to an R80.30 gateway? Would you just grab the .msi files off the R80.30 gateway to push out to clients?

Re: Replace/Upgrade Cluster

Kevin_Orrison — Thu, 09 Jan 2020 20:58:23 GMT

Thanks so much for all the replies to my question! My replacement went very well!

Re: Replace/Upgrade Cluster

K_montalvo — Mon, 20 Dec 2021 19:06:54 GMT

Hello @Kevin_Orrison

Hope you are well,

Can you confirm which method did you use that where suggested by HeikoAnkenbrand, Tommy_Forest or Wolfgang?

Can you share any notes on the steps used for the process with me?

Thanks!

Re: Replace/Upgrade Cluster

Kevin_Orrison — Tue, 21 Dec 2021 16:03:41 GMT

More or less I followed Heiko's steps. Check if the new firewall model is using different interface names like mentioned above.

Going back to my notes.

Make sure FW-01 is active
Power off the standby 4800 (FW-02)
Connect the new 6500 standby member with same settings as FW-02
Install SIC, add license, change cluster version, fix cluster topology, install policy removing the check box.
1. Check sync/HA
2. Verify license with cplic print
Power off the active 4800
1. The 6500 should become active
Connect the new 6500 with the same settings as FW-01
Install SIC, add license, fix cluster topology, install policy adding the check box.
1. Change sync/HA to new “sync” interface
2. Verify license with cplic print
Install Threat Policy
Check if receiving logs
Create cloning group
Test cluster failover