topic Re: MAESTRO upgrade with auto-clone in Hyperscale Firewall (Maestro)

MAESTRO upgrade with auto-clone

AkosBakos — Sun, 23 Feb 2025 11:15:31 GMT

Hi Team,

I have a simple question:

I have to install take 92 on a few SGMs and a portfix to all members. This is time consuming task.

What if I install to one of them (take92 and the portfix) then I switch on auto-clone, and reboot tge SGMs one by one? I have seen nowhere this idea, therefore i turn to the community:-)

It should work.

Akos

Re: MAESTRO upgrade with auto-clone

Chris_Atkinson — Sun, 23 Feb 2025 12:32:48 GMT

Similar was discussed here previously:

https://community.checkpoint.com/t5/Maestro/How-does-Image-auto-clone-really-work-How-often-does-a-SGM-needs/m-p/167188/highlight/true#M1358

Re: MAESTRO upgrade with auto-clone

emmap — Mon, 24 Feb 2025 02:05:04 GMT

We generally wouldn't recommend it, and instead recommend installing the JHF and patch to half the SGMs in the group at a time (so if you have 6 SGMs, do 3 and then 3). This way it takes no longer than a normal cluster to do it and you're not relying on the possible vagaries of trying to trigger auto-clone processes. This of course assumes you're doing it in a window when half your SGMs can carry all of the load if it's a single site deployment, but if that's not the case then trying to use auto-clone is even more dangerous because SGMs might just start cloning and rebooting by themselves.

Re: MAESTRO upgrade with auto-clone

AkosBakos — Mon, 24 Feb 2025 11:53:12 GMT

Thx @emmap @Chris_Atkinson