Upgrade Azure CloudGuard IaaS Single Gateway

[Alex-]

Context: Azure CloudGuard IaaS running R81 Take 68 managed by Smart-1 Cloud running R81.20.

Upgrade is planned to R81.20.

How to Upgrade a CloudGuard Network Single Gateway for Azure (checkpoint.com)

This SK indicates that for all versions, a new deployment needs to be done in parallel to the existing one but it's from 2021.

In-Place Upgrade packages for CloudGuard Network (checkpoint.com)

This SK on the contrary describes that R81 can be upgraded to R81.20 using the well-known CPUSE process and this SK was modified in 2023.

Is it then correct that I can just use the Azure R81.20 image with CPUSE on the R81 gateway? There are no other hotfixes than the JHF installed on this instance.

[Chris_Atkinson]

Per the SK, IPU is supported between these versions.

As always we recommend taking the necessary precautions and where possible performing prior testing of the scenario specific to your deployment.

[Alex-]

Thanks Chris.

The Azure infrastructure is managed by a third-party, I just take care of the CP on which it's running, so I will ask them to follow How to create an Azure disk snapshot for CloudGuard Network Security Gateway (checkpoint.com) and I will proceed with  the IPU, running the verifier and so on.

[Dmitry_Gorn]

Hi,

It's recommended to use the In-Place Upgrade package for this scenario.

The SK was updated to reflect this recommendation.

In addition, please refer to https://support.checkpoint.com/results/sk/sk162365 for updated documentation for upgrading CloudGuard Network Security solutions.

Regards,

Dmitry

[Alex-]

Thanks for updating the SK, much clearer now.

[Arskaz]

We have an Azure gateway in version R80.40. Wanted to upgrade it to R81.10 this time. Was going to do In-Place upgrade, but local Checkpoint technician warned about it and recommended to do side-by-side upgrade.

Has anyone had problems with In-Place Upgrade?

Just thinking, what could be reasons for that recommendation...

BR, A

[Edan_Leventhal · Accepted solution]

Hi Arskaz,

When in-place upgrade was new, some customers had faced some issues in the installation method done (using blink images).

We have since  changed our method of installation and the process is generally stable now, so you shouldn't face issues in the process.

[Arskaz]

Hi Edan,

That was great news!

I was even thinking to change vendor, because of this 😉

Thank You for this information!

BR, A