topic Re: Clean install vs upgrade in Firewall and Security Management

Clean install vs upgrade

Martin_Valenta — Tue, 31 Jul 2018 14:29:59 GMT

Is there any SK or documentation page, where would be summarized benefits of clean installation vs upgrade via CPUSE ?

Re: Clean install vs upgrade

Jerry — Tue, 31 Jul 2018 15:33:09 GMT

If I remember well I don't think there is any but I might be mistaken.

Pros and Cons are always out there. Fresh install is always recommended but not always possible from obvious reasons, however should you have any chance and opportunities to make it "fresh" I would strongly encourage you to do that. Instead upgrade_path is also not-that-complicated though, it all depends what are you upgrading "from" and how much data need to be "migrated" to the new environment.

Upgrade via CPUSE can be tricky and not always the best way going forward. It all depends on many factors and how much time you've got to have all tasks completed.

In my personal opinion migration (called upgrade) to new Management is most likely to be the most complicated one.

Migration however of new "gateway" - can be bypassed by installing a new one instead. As I said - it all depends.

Tell us more about what you'd like to migrate/install-fresh so we can elaborate a little bit more on that.

Jerry

Re: Clean install vs upgrade

Martin_Valenta — Tue, 31 Jul 2018 15:46:00 GMT

In case of management servers, there is no doubt that clean install is better. My question is aiming on gateway upgrades from r77.30 to r80.10

Re: Clean install vs upgrade

Jerry — Tue, 31 Jul 2018 15:50:05 GMT

great. in that case there is 1 sk if I recon ... I've used sk107042 for ClusterXL (HA) VSX as well as Standalone R77.30.

Let me see if there are more such sk's ...

Re: Clean install vs upgrade

Jerry — Tue, 31 Jul 2018 15:51:41 GMT

plus very well known PDF from

https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_Installation_and_Upgrade_Guide/html_frameset.htm

should be ok but I'll keep searching for you if you like

Re: Clean install vs upgrade

Jerry — Tue, 31 Jul 2018 15:58:35 GMT

don't forget to get trough sk111841 btw. it is important to have all pre-reqs in hande before starting "production" migration. just my last 5 cents.

hope you'll ok with those sk's/pages. all the best !

Re: Clean install vs upgrade

PhoneBoy — Tue, 31 Jul 2018 17:19:23 GMT

One reason to "clean install" R80.20.M1 is to use the xfs filesystem.

Clean installs are also useful for practicing upgrades, upgrading hardware, and other similar activities.

Re: Clean install vs upgrade

Tsahi_Etziony — Wed, 01 Aug 2018 08:56:17 GMT

With CPUSE upgrades you benefit of having your configuration migrated automatically to the new version, plus you get an automatic snapshot of the old version in case you want to revert the upgrade. the content of /var/log is also kept for the new version.

Anything that is not performed by the upgrade and makes you want to prefer a fresh install is considered a bug in the upgrade process and this is something we should and will fix.

The only reason I'd recommend a fresh install is what Dameon wrote - taking advantage of the new xfs file system. CPUSE upgrade can't migrate the file system so ext3 is still being used after the upgrade.

Re: Clean install vs upgrade

PP26 — Thu, 12 Sep 2019 00:38:18 GMT

I don't think that Clean Install via CPUSE changes the file system to xfs, if clean install is via CPUSE the file system will still be ext3

Re: Clean install vs upgrade

Tomer_Noy — Thu, 12 Sep 2019 06:51:29 GMT

I strongly support @Tsahi_Etziony 's statement.

We want to make the upgrade process very simple and the way to do that is via CPUSE, which will take care of everything without manual steps.

There are several cases where "clean install" is preferred over a standard CPUSE upgrade:
1) You are switching to a different machine / HW. Obviously in this case clean-install is the only option.
2) You are running a pre-R80.20 environment and you want to get the new xfs filesystem for better performance. Only a clean install from an ISO will give you that. However, in future upgrades, this is no longer relevant as you will already be using xfs.
3) You want to run the upgrade process with the jumbo HF installed. Sometimes we find bugs after the release and fix them in the jumbo. When doing clean-install + import, you have the chance to install the jumbo before the import and get these fixes. If you encountered an issue in your upgrade, we may recommend to do it again with the jumbo.

Note that for #3, we are working on ways in the roadmap that will allow you to do a CPUSE upgrade and still get the jumbo fixes in the process.

Beyond these 3 considerations, if you have other requirements or reasons why you prefer a clean installation, we would be happy to hear and improve.

Re: Clean install vs upgrade

G_W_Albrecht — Thu, 12 Sep 2019 07:21:26 GMT

As elaborated here already, things do differ a lot when comparing use cases. Out of my personal experience / view, i would dare to say:

- On the Gateway, CPUSE is well enough for installation - as long as you have sufficient disk space and partitions left, as the previous version will remain in a separate partition so you can revert back to it (see the discussion here: How to advance Upgrade Smart-1 210 SMS r77.30 to 80.20). On the other hand, if the GAiA configuration is rather simple, a fresh install, FTW and policy install is a quick way to a clean GW with much free space (remember situations of spontaneous local logging ?).

- One criteria i find very important is the age of the installation on the specific hardware and the detailed installation history. Although the residues of older versions on SMS are much smaller nowadays (😉), i prefer SMS Advanced Upgrade especially for major version changes. New FS can also be an argument here in larger scale environments.

- with VMs we do not need to ask such questions 😊

- with VSX we often do not dare to ask such questions 😕

- with StandAlone deployment we just did get only the short end of the stick 😞

Re: Clean install vs upgrade

Maarten_Sjouw — Thu, 12 Sep 2019 07:24:55 GMT

I think PP26 did not want to start the actual discussion again, but make a note that when you use the CPUSE option "Clean Install" you will NOT get the new file system xfs.
So there is a difference between Clean Install (through USB from ISO) and the CPUSE Clean Install.

Re: Clean install vs upgrade

PP26 — Thu, 12 Sep 2019 11:44:57 GMT

@Tomer_Noy I could not agree more with @Tsahi_Etziony either 🙂 but I completely understand that my file system will still be the same with Clean Install via CPUSE, however as I already mentioned in the other thread (where you have your inputs too 🙂 ) my reason for doing this is what you said in your point 3 ,as well as I have already run the pre-verifiers and exported management and event db. I understand that automation is very good, however reason for going with this option was that I prefer to do manual verification as if something is not right we can stop it and resolve before moving further, also like in any case I believe manual would give you a bit more control and say over process. Specially when Checkpoint has some really cool tools to assist.

Coming back to the main question in this thread 🙂 What are major differences between the 2 type of CPUSE upgrades ?

Re: Clean install vs upgrade

PP26 — Thu, 12 Sep 2019 11:51:13 GMT

@G_W_Albrecht hi mate , I have already taken snapshot of the gateway, which I can use to restore I believe , if something goes wrong during the upgrade , so if I do not want to retain old partition , will Clean Install via CPUSE make sure it is removed ? Or do I need a installation using ISO ?

For SMS I am indeed planning Clean Install via CPUSE (a.k.a Advanced Upgrade) but yeah I am not sure if that will remove the older versions, any ideas ?

Thanks a lot for your help and input !!

Re: Clean install vs upgrade

PP26 — Thu, 12 Sep 2019 11:56:14 GMT

hi @Maarten_Sjouw yep I have read about the file system difference as that is a part of the documentation available in the upgrade guide. However I put the comments in this thread as I could not find more info (online or even in any sk) about the difference between the 2 types of CPUSE upgrade process (Upgrade vs Clean Install) and to understand how they are different in terms of changes happening to files, directory , configuration etc etc

Any ideas there from your experience ?

Re: Clean install vs upgrade

Tsahi_Etziony — Thu, 12 Sep 2019 12:01:07 GMT

@PP26,

"Coming back to the main question in this thread What are major differences between the 2 type of CPUSE upgrades ?"

I'll answer.

CPUSE upgrade is just like CPUSE clean install, which is followed by migration of the configuration. since this is the same mechanism, you get the same benefits like automatic snapshot of the previous partition, but you have similar limitations like required disk space and the fact that you can't change the FS.

I think there are only two real reasons for preferring CPUSE clean install over CPUSE upgrade:

Moving to an older version - CPUSE cannot downgrade.
Changing First Time Wizard configuration such as changing the machine role.

As I wrote before, I consider any other consideration that leads you to prefer CPUSE clean install as something we should examine and probably fix. I am concerned with @G_W_Albrecht 's statements regarding stand alone and VSX and I do agree we need to improve the experience. I hope that CDT helps with VSX experience, as one of the main pain points is the need to perform the upgrade on the management as well, and CDT does that for you.

Please share any suggestion for improving the upgrades. We are constantly working on upgrade improvements!

Re: Clean install vs upgrade

G_W_Albrecht — Thu, 12 Sep 2019 12:04:45 GMT

For CPUSE Installation details, see the discussion here: How to advance Upgrade Smart-1 210 SMS r77.30 to 80.20.

And yes, CPUSE can do an Advanced Upgrade for SMS - migrate export, fresh install on a new partition and migrate import. But the old installation always is kept on the old partition, as CPUSE can revert in case the upgrade fails 😁 - very good with enough disk space...

Otherwise, ISO or Blink are good ways to do a fresh install without leaving old partitions.

Re: Clean install vs upgrade

PP26 — Thu, 12 Sep 2019 12:40:14 GMT

@G_W_Albrecht actually my SMS is Smart -1 210 and it is not supporting Blink 😞 but I can certainly use one of the blink image for my gateway as they are supported. On that note I Just wanted to check something which I have already asked in that other thread you posted the link for "can we do a Clean Install via CPUSE using Blink Image? or that only supports Clean install via USB where it wipes off everything and is a complete format giving you a new xfs file system?"

PS: I've actually started that thread you have referred to 🙂 so yeah I am tracking that too for answers and help 🙂

thanks for your time again!!

Re: Clean install vs upgrade

PP26 — Thu, 12 Sep 2019 12:45:39 GMT

@Tsahi_Etziony option 3 which was given by @Tomer_Noy is 3rd option why we would need to do Clean Intall via CPUSE and that is indeed my reason as explained in my previous response. Also I am sure there should be more advantage to do this as even the CP installation and upgrade guide mentions this option , but unfortunately does not tell in detail about the actual difference, hence I am trying to understand 🙂

Re: Clean install vs upgrade

Tsahi_Etziony — Thu, 12 Sep 2019 13:03:35 GMT

@PP26 , you are right, of course 🙂.

@Tomer_Noy also mentioned that we are working on a solution for that, so I really hope it won't be relevant in the future.

and let me share some details:

Blink is also a type of image that CPUSE can install, just like the version upgrade image. the difference between a Blink image and a version upgrade image is that the Blink image is specific for a machine role (we have Blink for GWs, SMS, and soon we'll have Blink images for other types of management and MDS), and Blink can include also hotfixes and Jumbos.

Currently CPUSE can only use Blink images for clean installation, but soon we will release Blink images that can be used for upgrades as well. When we release a management Blink image that supports CPUSE upgrade, the DB import will be performed on a version that already has the Jumbo installed. Hopefully, this will eliminate option #3.