topic Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258) in Firewall and Security Management

VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

StackCap43382 — Fri, 23 Jan 2026 17:43:38 GMT

Hi All,

I need to upgrade a R81.10 VSX cluster to R81.20 or R82 (Still being decided).

With Normal HA Gateways I've historically BLINK'ed one member to the latest version and recommended hotfix and then done the other one.

However as this is VSX I'm concerned about: https://support.checkpoint.com/results/sk/sk164258

For instance in the SK Matrix R81.10 Take 183 aligns with R81.20 JHF Take 122 or R82 JHF Take 60.

My confusion is JHFs are accumulative as long as B > A it should be fine?

Surly as long as we are upgrading to a newer hotfix then what was on the original installation we should be good?

Or do we need to upgrade to an aligned JHF and then patch after?

Thanks.

EDIT!!!

- Discussion has turned to the best method for the upgrade; In-Place Vs Rebuild.

- SE has said In-Place is perfectly acceptable.

Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

Vincent_Bacher — Fri, 23 Jan 2026 16:50:53 GMT

Hi,

dunno what CP recommends but in our organisation on vsx devices we usually recommend clean install, jumbo, if required private hf and then vsx reconfigure.

Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

Alex- — Fri, 23 Jan 2026 16:53:43 GMT

Blink will install the new OS and latest Recommended JHF so I don't think it depends that much of the current version.

It's of course important that your CPUSE is up to date.

We did a few VSX clusters with Blink and no issues to report.

Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

the_rock — Fri, 23 Jan 2026 17:00:07 GMT

I second what Vince had said. Im no VSX expert by any means, but his process sounds familiar, thats what I always see people do.

Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

Bob_Zimmerman — Fri, 23 Jan 2026 17:03:48 GMT

Concurring, a totally clean reinstall is our preferred way of upgrading VSX clusters.

My team can't always get somebody into the datacenter for upgrades, and the ISO is big enough reinstallation over LOM takes several hours per member, so we often have to upgrade in-place. We've never had luck with Blink for upgrades. We typically try to upgrade to the major-version-with-no-jumbo package via CDT in SmartConsole (runs 'vsx_util upgrade', upgrades one member, fails over, upgrades the other member). If that doesn't work, we do the upgrade manually.

We do all jumbos via CDT except when building a new (or cleanly-rebuilt) member.

Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

Vincent_Bacher — Fri, 23 Jan 2026 17:07:12 GMT

"Yes, from a technical perspective it should work fine.

Just a note: If a new file system is introduced, I would prefer a clean install anyway.

Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

Vincent_Bacher — Fri, 23 Jan 2026 17:08:12 GMT

Yes. The point is that one works and one is considered as better.

Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

the_rock — Fri, 23 Jan 2026 17:14:49 GMT

100%. Have a great weekend, Vince!

Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

Vincent_Bacher — Fri, 23 Jan 2026 17:34:09 GMT

That doesn't mean you always do the best thing; you weigh up what to do depending on the situation.
Have a nice weekend too!

Re: VSX - Blink Upgrades & Jumbo HFA Compatibility (sk164258)

Vincent_Bacher — Fri, 23 Jan 2026 17:41:22 GMT

I understand your point of view.

btw: CDT is a very useful tool.