CloudGuard Upgrades support

[Don_Paterson]

Hello Check Mates and Cloud Mates,

Anyone got the latest on upgrading SMS and/or SGs and Clusters in public cloud?

I know is has been technically blocked to do major version upgrades but I understand that was something that might change in Q4 2021.

Thanks,

Don

[Don_Paterson]

Update:
This SK is very good for reference for public cloud upgrades (bigger VMs, bigger disks and version upgrades).

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

It is implied that technical upgrades of major versions are still not supported in public cloud.

Another interesting point. Not a new topic but still interesting:
If an R81 SMS gets JHFA TAKE 42 then in theory it can manage an R81.10 SG

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

[Chris_Atkinson]

sk177714: CloudGuard for Public Cloud In-Place upgrade packages

I believe similar is also imminent for Azure as it is for AWS.

[Don_Paterson]

Thanks Chris. Much appreciated. 🙂

[StuartGreen]

Hey Don,

For AWS gateways this is available now using CPUSE (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...) as an in-place upgrade. Azure gateways are due any time now but this has been pushed back a few times so don't hold me to that 😉

Management is coming around H2 I believe (but side-by-side upgrades for management tend to be easier so probably not as urgent).

Stu

[Don_Paterson]

Superb.
Thanks Stu


I could ask the SK team to add R81.10 to the top of that SK (Version field) and also link this SK -> sk155632 but I have Feedback spammed them enough this week (and proved humanity) so I can only suggest it in here 🙂

Regards,

Don

[PhoneBoy]

See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 
TL;DR: You have to use specific images to perform the upgrades. 

[Don_Paterson]

And I see that they are Blink images. 🙂

aws_blink_image_1.1_Check_Point_R80.40_T294_JHF_T139_SecurityGateway.tgz

aws_blink_image_1.1_Check_Point_R81_T392_JHF_T44_SecurityGateway.tgz

aws_blink_image_1.1_Check_Point_R81.10_T335_JHF_T30_SecurityGateway.tgz

Thanks Dameon.

Don

[StuartGreen]

oh sorry @Chris_Atkinson - I missed your reply basically saying the same thing. Must have left the tab open too long before managing to type a post 🙂

[Hezi_Bahry]

Hi,
Right now, in-place upgrade (IPU) of security GWs on static constructs (non-scale sets) is supported on AWS (released 2 months ago) and Azure (release is planned for this week). The IPU process is enabled for any SRC to any DST starting at R80.30 and above on released versions (versions under EA are not supported).
Management in place upgrade is not supported yet, it is on the roadmap for end of Q3.

Please visit this resource for further exploration - IPU

Hezi

PS - feel free to contact me at hezib@checkpoint.com

[John_Richards]

Is there any ability to do in-place upgrade of single GW's in Azure currently? The above doc is only for AWS.

[Hezi_Bahry]

The in place upgrade was supposed to be released this week, unfortunately, delayed to next week. If you need this urgently, where the target version is R80.40, please mail me privately. If you can wait another week, the new timeline for the release is June 28.

Hezi

[John_Richards]

So the GW is R80.40 and want to go to R81.10 but told not possible to in place upgrade. I can wait till after the 28th.

[avivs]

Just in - In-place upgrade for Azure is now released.

Upgrade packages, supported upgrade flows, versions and configurations are available in sk177714 - CloudGuard for Public Cloud In-Place upgrade packages

We will be more than happy to receive feedback or requests.

[John_Richards]

Thanks for this. Will provide feedback as we upgrade move to upgrade customers. This will certainly make things easier.