topic Re: Maestro MVC CCME question in Hyperscale Firewall (Maestro)

Maestro MVC CCME question

Ryan_Ryan — Mon, 14 Oct 2024 21:33:29 GMT

Hello, ill be sitting the CCME exam this week and I have conflicting information in regards to a test question "During an upgrade is Multi Version cluster supported"

The course documentation states:

If this is a major version upgrade, such as upgrading from R80.30SP to R81.10, there is a non-stateful failover from the original version into the newly
upgraded version. All open connections are dropped by the newly upgraded SGMs when failover occurs.
Although with R80.40 Multi-Version Clustering (MVC) or full connectivity upgrade was released, Maestro does not support MVC.
To blunt this impact as much as possible and allow most connections to survive this event, in SmartConsole Global Properties under Stateful Inspection, disable drop out of state TCP packets. Prior to beginning the upgrade, re-install the Access Control Policy on the SG.

But the upgrade guide (https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Maestro_AdminGuide/Content/Topics-Maestro-AG/Upgrading-Maestro-Zero-Downtime-MVC.htm?Highlight=multi%20cluster)

States:

This section describes the steps for upgrading a Maestro environment (the Quantum Maestro Orchestrators and the Security Groups) with Zero Downtime - as a Multi-Version Cluster (MVC).

This procedure supports only these upgrade paths for Security Groups:

Upgrade of a Security Group from R81.10 to R81.20
Upgrade of a Security Group from R81 to R81.20
Warning - Multi-Version Cluster (Zero Downtime) upgrade from R81 to R81.20 is not supported if a Security Group has Bond interfaces in the 802.3ad (LACP) mode on Uplink ports (Known Limitation PMTR-88191).

Re: Maestro MVC CCME question

PhoneBoy — Mon, 14 Oct 2024 23:45:47 GMT

The example given in the courseware is correct: you can't use MVC to go from R80.30SP to R81.10.
You can, however, use MVC on Maestro starting from R81.
So the answer is...version dependent.

Re: Maestro MVC CCME question

Timothy_Hall — Tue, 15 Oct 2024 13:25:12 GMT

Full MVC support was not added to Maestro until R81.20; see sk148074. The current Maestro exam was written for version R81.10. Starting in R81 there was an MVC-like mechanism for upgrades into R81.10 and R81.20, and it was separately documented in the Maestro admin guide. It was quite involved and not nearly as seamless as a regular MVC upgrade.

Re: Maestro MVC CCME question

HeikoAnkenbrand — Tue, 29 Oct 2024 12:20:16 GMT

Hi @Ryan_Ryan,

In my view, this is also a somewhat dubious question;-)

I agree with @Timothy_Hall.

I had to think about this question for a very long time in the CCME R81 exam.
I then decided that MVC is not possible in R81.10.
As I have reached 100% in the upgrade area, I assume that the answer is correct.

Maybe @Jason_Tugwell can say something about it;-)

Re: Maestro MVC CCME question

Nicholas_Cuba — Wed, 16 Apr 2025 21:56:17 GMT

Warning - Multi-Version Cluster (Zero Downtime) upgrade from R81 to R81.20 is not supported if a Security Group has Bond interfaces in the 802.3ad (LACP) mode on Uplink ports (Known Limitation PMTR-88191).

Another thing to note: I did a handful of R81.10 to R81.20 Maestro upgrades early fall 2024. This warning applies to R81.10 as well as R81.