topic Re: Which format to use. in General Topics

Which format to use.

marki — Mon, 18 Mar 2024 14:35:20 GMT

What is the difference between

sk124401 Check Point R81.20 Gaia Fresh Install and upgrade
Check_Point_R81.20_T631_Fresh_Install_and_Upgrade.tar

sk130114 Blink Image for R81.20 Security Gateway including R81.20 Jumbo Hotfix Accumulator Take 41
blink_image_1.1_Check_Point_R81.20_T631_JHF_T41_SecurityGateway.tgz

sk130103 R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 41
Check_Point_R81_20_JUMBO_HF_MAIN_Bundle_T41_FULL.tar

Which do I use for upgrade i.e. retaining configuration (both management server and gateways)?

There seem to be methods and formats added all the time. If you only do this once a year it's quite confusing.
I see they have now added CDT into the mix.

Thanks.

Re: Which format to use.

Lesley — Mon, 18 Mar 2024 14:38:29 GMT

sk124401 Check Point R81.20 Gaia Fresh Install and upgrade
Check_Point_R81.20_T631_Fresh_Install_and_Upgrade.tar

This one give you 2 options either fresh install or upgrade(this one will keep config)

sk130114 Blink Image for R81.20 Security Gateway including R81.20 Jumbo Hotfix Accumulator Take 41
blink_image_1.1_Check_Point_R81.20_T631_JHF_T41_SecurityGateway.tgz

This is an image with already Jumbo in it (take 41)

Blink deployment flow and images let customers do a multi-step upgrade or clean install with one image.
Blink images already contain a specific base version (for example, R81.10), a designated role (for example, Security Gateway), and more hotfixes/Jumbo HFA's.
With this image, you can onboard new appliances/upgrade existing appliances with one package.
You can see and install Blink images with CPUSE WebUI / Clish commands.

sk130103 R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 41
Check_Point_R81_20_JUMBO_HF_MAIN_Bundle_T41_FULL.tar

This is normal Jumbo update to take 41 with keeping config

Re: Which format to use.

marki — Mon, 18 Mar 2024 14:42:29 GMT

Thanks,

What is the definition of "normal" in "normal Jumbo update"

Re: Which format to use.

Lesley — Mon, 18 Mar 2024 14:45:43 GMT

So if you are running R81.20 for example with Jumbo take with 38 and you would like to update to take 41. This is a normal Jumbo update. So minor update to later take version. (you can check version with this CLI: cpinfo -y all)

Config will stay on the box

Re: Which format to use.

marki — Mon, 18 Mar 2024 14:54:18 GMT

But "blink" would also do the upgrade and keep the config?

So essentially they can all be used to do both installs and updates?

Let me then rephrase the question: which "format" would you _not_ use under what circumstances?

Re: Which format to use.

Lesley — Mon, 18 Mar 2024 15:18:25 GMT

Most blink images are clean install:

https://support.checkpoint.com/results/sk/sk120193

What options is best is sometimes personal and or depending on the setup (size etc)

Re: Which format to use.

Tsahi_Etziony — Tue, 19 Mar 2024 16:32:44 GMT

Yes. Blink gives you the same two options - either "clean install" and then the configuration is not kept (other than what is needed for remote connectivity to the device) or "upgrade" which keeps the configuration.

We always advice customers who are upgrading to a new version to use the Blink image for the upgrade and get the new version with the latest recommended Jumbo in one go.

Re: Which format to use.

Bob_Zimmerman — Tue, 19 Mar 2024 19:15:21 GMT

Check_Point_R81_20_JUMBO_HF_MAIN_Bundle_T41_FULL.tar

This one is only the jumbo. You install it on top of any version of R81.20, and it will take you to R81.20 jumbo 41. It's not useful if you're on an earlier major version like R81.10.

Check_Point_R81.20_T631_Fresh_Install_and_Upgrade.tar

This package will take a different major version (like R81.10) to R81.20 jumbo 0.

blink_image_1.1_Check_Point_R81.20_T631_JHF_T41_SecurityGateway.tgz

This package will take a different major version or a different version of R81.20 to R81.20 jumbo 41.

In my environment (~70 clusters, some VSX), I do the "Fresh_Install_and_Upgrade" packages followed by the jumbo in a separate step for upgrades. We use central deployment in SmartConsole almost exclusively (we still upgrade VSX manually, but all normal firewall upgrades and all jumbos are done through SmartConsole).