topic Re: Does anyone ever go back and review install guides for relevance? in General Topics

Does anyone ever go back and review install guides for relevance?

Tommy_Forrest — Thu, 09 Mar 2023 00:50:01 GMT

Are there any processes Check Point follows to go back and review install guides?

Reason I ask - this install guide is out of date with regards to "zero downtime" updates.

https://downloads.checkpoint.com/fileserver/SOURCE/direct/ID/103841/FILE/CP_R81_Installation_and_Upgrade_Guide.pdf

Page 406 is where it starts talking about doing a zero downtime upgrade by setting ccp to broadcast.

Problem is in R80.40 that's deprecated for mvc.

Now, it's been a super long minute. Probably an hour since I've upgraded stand alone clusters. And I'd totally forgotten about mvc. A quick dip into clish and abusing the tab key reminded me about mvc.

For which a search on my favorite search engine returned this version of the R81 install & upgrade guide:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Installation_and_Upgrade_Guide/Topics-IUG/MVC-Upgrade-of-ClusterXL-GW-mode.htm?tocpath=Upgrade%20of%20Security%20Gateways%20and%20Clusters%7CUpgrading%20ClusterXL%252C%20VSX%20Cluster%252C%20or%20VRRP%20Cluster%7CMulti-Version%20Cluster%20(MVC)%20Upgrade%7C_____4

Which talks about using mvc.

So, why 2 versions of the admin guide? And why isn't the first admin guide removed or updated when things are deprecated?

Re: Does anyone ever go back and review install guides for relevance?

PhoneBoy — Thu, 09 Mar 2023 01:21:10 GMT

The web and PDF versions should be generated from the same source and contain the same content.
If you look here, you'll see the same section you referred to by page number: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Installation_and_Upgrade_Guide/Topics-IUG/Zero-Downtime-Upgrade-of-Security-Gateway-Cluster.htm?Highlight=zero%20downtime

To answer the question about the process for reviewing the Install and Upgrade Guide, I can't comment specifically on that.
However, I recommend you send specific feedback to our Tech Pubs team and they can address the issue.

Re: Does anyone ever go back and review install guides for relevance?

Tommy_Forrest — Thu, 09 Mar 2023 01:28:11 GMT

Thanks PhoneBoy, I'll reach out to them.

Seems like someone should go in and remove content that is clearly deprecated. Or put a pointer in to send you to mvc.

Re: Does anyone ever go back and review install guides for relevance?

the_rock — Thu, 09 Mar 2023 01:36:25 GMT

Agree 100%. I will say though when it comes to cluster upgrades, I always do zero downtime upgrade and works flawlessly. I never even bother changing CCP mode.

Re: Does anyone ever go back and review install guides for relevance?

Tommy_Forrest — Thu, 09 Mar 2023 01:45:47 GMT

In my experience if you don't use MVC, it'll "work". But you're going to have an interruption in services while the newly upgraded firewall gets back on its feet and reestablishes session states.

If you're just supporting people web browsing, it's no big deal, they'll likely never notice. But other traffic flows aren't so forgiving (thinking things like SIP here) in that disruption and people will notice.

Re: Does anyone ever go back and review install guides for relevance?

the_rock — Thu, 09 Mar 2023 01:48:07 GMT

Had done few cluster upgrades with lots of voip traffic goint through them and never had a problem, always done zero downtime upgrade method.

Re: Does anyone ever go back and review install guides for relevance?

_Val_ — Thu, 09 Mar 2023 08:38:04 GMT

AFAIK, zero downtime upgrade path is still valid. Why would you say it is deprecated? Based on what?

Re: Does anyone ever go back and review install guides for relevance?

G_W_Albrecht — Thu, 09 Mar 2023 08:54:56 GMT

Important - The Multi-Version Cluster Upgrade replaced the Connectivity Upgrade.

So, Minimal Effort Upgrade and Zero Downtime Upgrade are still supported procedures...

Re: Does anyone ever go back and review install guides for relevance?

Tommy_Forrest — Thu, 09 Mar 2023 12:47:51 GMT

Step 1 - "On each Cluster Member, change the CCP mode to Broadcast"

A gateway running 80.40 promptly returns CCP mode is deprecated and invalid when you attempt to set CCP mode to Broadcast.

Re: Does anyone ever go back and review install guides for relevance?

_Val_ — Thu, 09 Mar 2023 12:55:19 GMT

You have a point. Tech writes are looking into this.

Re: Does anyone ever go back and review install guides for relevance?

Tommy_Forrest — Thu, 09 Mar 2023 13:02:27 GMT

Thanks, Val. I reached out to them last night as well.

I've seen other cases in the past where stuff like this gets by and was just curious if there were any procedures to keep these docs up to date. In some cases, like SK articles, it's easy to notify someone. PDF's not so much.

Re: Does anyone ever go back and review install guides for relevance?

the_rock — Thu, 09 Mar 2023 13:44:11 GMT

You are 100% correct. I experienced same in my lab before and when I chose to ignore it (meaning I omitted that command), still worked fine.

Re: Does anyone ever go back and review install guides for relevance?

Sergei_Shir — Sat, 11 Mar 2023 19:38:23 GMT

You can submit your feedback from any Admin Guide (HTML or PDF)

Because PDF is a more limited format, you need to go to the page "Important Information" - above the table "Revision History" there is a link to send us feedback

In HTML, you can send us feedback from each page - from the topic top toolbar, click the "envelope" icon

Thank you