topic Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool in General Topics

Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

aheilmaier — Sat, 16 Mar 2024 10:42:00 GMT

Reading about upgrading a VSX Gateway from R80.20 to R81.10. Manager running R81.10.

Best practice is to use central deployment via manger gui.

(by the way image verification leads to an error without any helpful error message, but I think I will open a support case)

Now I found the CentralDeploymentTool https://support.checkpoint.com/results/sk/sk111158

Is the CentralDeploymentTool used under the hood with the manager gui ?

So do I need to update the CentralDeploymentTool to get the latest, bug fixed release ?

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

the_rock — Sat, 16 Mar 2024 12:03:48 GMT

You probably should update it, yes. Its sort of like how everyone would keep Gaia web UI DA updated, when you do upgrade through web gui.

Best,

Andy

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

Bob_Zimmerman — Sat, 16 Mar 2024 15:00:47 GMT

I've had trouble upgrading VSX firewalls with CDT. Haven't had the time to figure out what goes wrong, but something does with almost every VSX upgrade I've done. At this point, I just upgrade them with the manual process, and only use CDT on VSX for jumbos.

My team applies jumbos maybe four times as often as upgrades, so it still saves us a lot of time. Plus all the upgrades and jumbos on non-VSX firewalls.

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

aheilmaier — Sat, 16 Mar 2024 17:41:59 GMT

just compared the release notes R81.10 vs. R81.20. (supported upgrade path > upgrade methods)

I wonder, if R81.10 only supports Hotfix update and R81.20 does support all.

This would means I need to check every single word in the release notes. If the GUI shows the functionality it usually provides it.

R81.20	R81.10
Central Deployment in SmartConsole CPUSE Upgrade CPUSE Clean Install	Central Deployment of Hotfixes in SmartConsole CPUSE Upgrade CPUSE Clean Install

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

aheilmaier — Sat, 16 Mar 2024 18:19:57 GMT

just found an error, tcp port 18208 (cprid: checkpoint remote install daemon) from mgmt server to gateway is blocked.

will try to get it open, takes a day to get this done.

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

Boaz_Orshav — Sun, 17 Mar 2024 04:57:12 GMT

The Central Deployment using Smart Console is a mechanism highly integrated with all management infrastructure, hence it has management API commands, monitoring is by Task Details mechanism and much more.

This is also the reason why it is version dependent and every version there are new features and enhancements.

It is not using the CDT which is an executable tool, unversioned and not depending on the specific management version (same CDT can be installed on any supported management)

Bottom line - not need to update the CDT when using the Smart Console Deployment

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

aheilmaier — Sun, 17 Mar 2024 12:31:05 GMT

thank's for clarifying, there is a small difference in the documentation wording "Central Deployment" (the GUI one) and "Central Deployment Tool" (CLI)

Aditional question: does Central Deployment do a clean install or only upgrade ?

afaik normal upgrade does migrate all the configuration (kernel module configs etc) and clean install does not, but clean install upgrades Kernel Version and Filesystem from ext3 to xfs.

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

Bob_Zimmerman — Sun, 17 Mar 2024 13:41:07 GMT

Management versions R81, R81.10, and R81.20 all support using SmartConsole to distribute and install major version upgrades on firewalls. Management R80.40 and earlier only supported distributing and installing jumbos.

Yes, CDT uses CPRID to send files (the upgrade package) to and run commands (like to import the package, run the upgrade, etc.) on the firewalls. You need 18208 for it to work. Once you have CPRID working, you can use it to do some other interesting things. yourself, like my script to find differences between cluster members' configurations.

"Clean install" via CPUSE doesn't switch your filesystem. Only a clean install via ISOmorphic will do that.

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

aheilmaier — Sun, 17 Mar 2024 14:47:10 GMT

just saw from a comment of @PhoneBoy and interpretation of the website with images I can download...

There are 2 installation options:

fresh install with ISO/USB named "clean install" is the only way to add changes like file system e.g. ext3 to xfs.
But as we make a new system we also have a complete downtime. Its like a complete new install.

upgrade (in-place upgrade) no matter if it is clean install or upgrade, it does not change the file system but kernel should be changed also.
- clean install with CPUSE will not migrate the special configs e.g. kernel.conf
- upgrade with CPUSE will migrate all the configs

For Both there is a the Blink Image (Fast deployment) or a "normal" one, the blink has the latest hotfixes, the normal image almost has not hotfixes afaik.

Hope this is correct, whoever decided to use the term "clean install" for upgrade and also for real fresh install. Seeing repeating discussions in the community forum.

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

the_rock — Sun, 17 Mar 2024 14:52:30 GMT

That sounds about right. Also, keep in mind that when using blick image, upgrade seems to be faster.

Best,

Andy

Re: Gateway Upgrade: diff between manger GUI and CentralDeploymentTool

aheilmaier — Sun, 24 Mar 2024 14:57:02 GMT

do you know about any problems for upgrading vsx with blink ?

Just saw the hint in R81.20 sk https://support.checkpoint.com/results/sk/sk17390

section downloads and install. (not available for R81.10)

Really again a another restriction? Only for R81.20 because not restriction found for R81.10 in a document.

* Gaia Fast Deployment (Blink) does not support the VSX upgrade.