Failed cluster cloudguard upgrade

[flachance]

Hi,

We have a Cloudguard cluster in Azure running R80.40. We are attempting to upgrade to R81.10.

So we installed R81.10 on the standby member with “installer install <Package_Number>”

It went through the install and rebooted. But if we login to that server we get “In order to configure your system, please access the Web UI and finish the First Time Wizard.”

We just found that installer install is only good for upgrade to a minor version and that we should have used “installer upgrade”.

Anyway so now we have a cloudguard cluster with only one working member.

Is there any ways out of this without redeploying a fresh cluster? Snapshot didn't work and Azure backup didn't work.

Any ways to just deploy one and add it to the cluster?

Thanks

[Dmitry_Gorn · Accepted solution]

Hi,

A snapshot should work and let you revert to the previous state. Can you explain what happens/what message do you get when trying to revert?

Consider continuing to upgrade the cluster using the side-by-side upgrading procedure for the cluster as explained in the admin guide here (the procedure is relatively simple to follow and you will end with a clean new version cluster):

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_IaaS_HighAvailability_for_....

Regarding a cluster member replacement, we do not have an official and documented procedure for Azure HA. If you would like to get assistance with recovery please open a support case - please also the SR number here.

Thanks

[flachance]

Snapshot

I login, go to expert and type set snapshot revert<SPACE><TAB>

And don’t see any snapshot file. Although I was assured there was one, there doesn’t seem to be one.

Thanks for pointing me to the side by side upgrade procedures, it looks like this is going to be our best solution.

[flachance]

Hi, 

going through the side-by-side upgrade and I find this part to be confusing what is that long path to originalHAClusterIp? Do we just change the IP to the old one or do we also need to put that?

[Dmitry_Gorn]

If the new cluster members are in the same Resource Group as the public IP, you only need to type the public IP resource name.

If it's in another resource group, put the full resource id here (as in the example). The resource id is available when you click on the resource. Note that you will need to provide proper permissions to the old RG with the public IP so that failover will work.

[Boaz_Orshav]

Hi

  I'd like to verify the exact flow that brought to this situation in order to prevent other customers from getting there.

  Tried " installer install" + tab and got "no packages to display" while only installer upgrade and installer clean-install resulted in the valid version to upgrade or to clean install.

  Will appreciate info like which DA version did you use ("da_cli da_status" can show that)

Thanks for the cooperation

[flachance]

Hi,

thanks for the follow up.

We did

installer verify<spacekey><tabkey>

got the list of package

installer verify <Package_number>

It verified ok.

installer install <Package_Number>

[Expert@gw-f30bf6:0]# da_cli da_status
{
"Action ID" : "0",
"DABuildNumber" : "2229",
"DAService State" : "ready",
"Last Update Time" : "Wed Sep 28 03:11:50 2022",
"New DA Availability" : "up to date",
"Update Status" : "not allowed"
}