topic Re: Upgrading to R80.30, looking for options and feedback in Firewall and Security Management

Upgrading to R80.30, looking for options and feedback

David_C1 — Thu, 07 May 2020 18:48:30 GMT

Hi everyone,

We are planning to upgrade our environment from R80.20 (currently with JHFA Take 134) to R80.30 (and whatever is the GA JHFA at the time we upgrade). I'm looking for some feedback on paths forward. In most of our upgrades, we have essentially "wiped clean" done clean installs of the next version (both for management and gateways). This has worked well for us but does require plenty of planning, etc. to execute. I'd like to hear experiences of moving to R80.30. I'm contemplating several options:

For management (HA Check Point hardware appliances, 3.10 kernel, ext3 filesystem):

1. Upgrade in place

2. Clean install via CPUSE (exporting the database, etc)

3. Clean install via ISO image (exporting the database, etc) - pondering this so we can move to xfs - wondering if it's worth it

For gateways (ClusterXL Check Point hardware appliances, 2.6 kernel, ext3 filesystem)

1. Upgrade in place

2. Clean install via CPUSE (saving configuration, etc.)

I understand that R80.30 is considered a "minor" release, and I'm leaning toward straightforward upgrade, at least for the gateways. What is everyone's experience. Also, is moving management to xfs worth it?

Thanks,

Dave

Re: Upgrading to R80.30, looking for options and feedback

Maarten_Sjouw — Thu, 07 May 2020 20:38:25 GMT

Why not move on directly to R80.40? Wait a little while longer for the first JHF to come out and run a clean install. Biggest advantage you can take is by using your current backup Mgmt server as your new primary, export from R80.20 and import to R80.40 with the new upgrade tools.
For the gateways just do an inplace upgrade.

Re: Upgrading to R80.30, looking for options and feedback

David_C1 — Thu, 07 May 2020 20:56:32 GMT

We recently took delivery of some new 6900 gateways to replace some 12200s. These models only support R80.30 or R80.40. We are pretty conservative with our upgrade timelines, and since R80.40 has only been out for three months, and no GA JHFA has been released yet, we decided to go with R80.30. Waiting for enough GA JHFAs for R80.40 would push our timeline a bit too far down the line for us.

Dave

Re: Upgrading to R80.30, looking for options and feedback

shlomip — Fri, 08 May 2020 06:45:44 GMT

@David_C1 ,

Not sure what your time frame is, but R80.40 about to have a GA JHF soon

and not far after, R80.40 will become our default version.

This is plan to this month time frame.

Re: Upgrading to R80.30, looking for options and feedback

David_C1 — Wed, 10 Jun 2020 12:24:38 GMT

Our timeline shifted enough such that we will be going to R80.40, at least on management. Question about clean install via bootable ISO: if we choose this method, will the installer by default change the filesystem to xfs, or is there a setting which needs to be configured? Our management is currently on ext3, and we would like to move to xfs.

Thanks,

Dave

Re: Upgrading to R80.30, looking for options and feedback

FedericoMeiners — Wed, 10 Jun 2020 13:48:18 GMT

Hello,

For gateways R80.30 with kernel 2.6 is the way to go for me. My last 4 upgrades from R80.x were performed with CPUSE (Inplace) without issues.

Tried R80.40 with 2 customers and we are already evaluating rollback due to crashes.

For management both R80.30 and R80.40 are fine. For this case I would recommend fresh install + export. CPUSE upgrade works fine but it takes a long time in my experience.

Regards,

Re: Upgrading to R80.30, looking for options and feedback

shlomip — Wed, 10 Jun 2020 13:50:25 GMT

Hi @David_C1 ,

When you use the ISO image, you are doing a clean install. in this case, the file system will change to xfs

if your current file system is ext3, i assume you are upgrading from a version that is lower then R80.20

since only starting R80.20, xfs is the file system on the Security Management server.

You can also see the below, in R80.40 Release notes:

When you perform a Clean Install, or Advanced Upgrade to R80.40 from versions prior to R80.20, it
uses the xfs file system.
After an in-place upgrade (using CPUSE), the file system remains ext3 except for Smart-1 525,
5050, 5150 appliances, which use the xfs file system.

Re: Upgrading to R80.30, looking for options and feedback

David_C1 — Wed, 10 Jun 2020 14:22:34 GMT

We are currently on R80.20 and have the ext3 filesystem. Last time we upgraded our management appliances (from R77.30) we used the "Clean Install" option via CPUSE. It's my understanding we can only go to xfs if we do a "Clean Install" via the bootable ISO, this is the only way the entire filesystem is wiped away so that the new filesystem (xfs) can be implemented.

Dave

Re: Upgrading to R80.30, looking for options and feedback

shlomip — Thu, 11 Jun 2020 04:53:26 GMT

@David_C1 ,

That is indeed correct.

You have to use the ISO and do clean install/advanced upgrade for the xfs file system to take place

Shlomi

Re: Upgrading to R80.30, looking for options and feedback

shlomip — Thu, 11 Jun 2020 06:36:37 GMT

@FedericoMeiners

Thanks for the feedback,

I will contact you offline to get more information about the crashes you mentioned.

Shlomi

Re: Upgrading to R80.30, looking for options and feedback

FedericoMeiners — Mon, 22 Jun 2020 19:30:42 GMT

Shlomi,

I want to publicly thank you and your team for the support given on the R80.40 case.
Issue was solved.

Thanks!

Re: Upgrading to R80.30, looking for options and feedback

shlomip — Tue, 23 Jun 2020 06:09:28 GMT

@FedericoMeiners

I am glad to hear this was solved. Thanks for the feedback.

we're sorry for the trouble and we will be glad to help at any time.

Thank you!