- CheckMates
- :
- Products
- :
- CloudMates Products
- :
- Cloud Network Security
- :
- Discussion
- :
- Re: Upgrading CloudGuard IaaS Security Gateway in ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Upgrading CloudGuard IaaS Security Gateway in Azure - What is your experience?
What is your experience with upgrading CGI Security Gateways in Azure?
I understand there are two options: -
1) Deploy new gateway with same IPs and migrate
- Deploy new gateway
- Stop the new GW in order to change the static IPs associated with the VM instance.
- Console on to the new GW to change the IPs in clish.
- Detach interfaces on old gateway.
- Attach interface on new gateway.
- Reset SIC
- Install policy
Advantages are that no changes in the routing in Azure is required but does require more downtime as you will need to detach the interfaces on the old GW before attached interfaces on the new GW.
2) Deploy new gateway with new IPs and update UDRs
- Deploy new gateway
- Create gateway object and set SIC
- Update policy with new gateway wherever old gateway is referenced
- Re-IP licence and re-attach to new gateway.
- Install policy
- Update all UDRs to reference new IP/VM
First of all, do the above steps look correct or if anyone can help identify any errors or omissions that would be great.
Secondly, if others have followed this to deploy new versions, how did it go? Any pitfalls, gotchas? What was the downtime?
Thanks
Scott
Advantage is that downtime is minimised as sessions will be interrupted but will then match the policy and connect. Disadvantage, significant more changes in preparation to migrate.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I moved this into the public Cloud spaces so more people can comment.
One thing to also be aware of with your second approach is you will, at least for a brief time, have extra managed gateways.
This could cause issues with your management license, which is capped at a specific number of gateways.
So...it's possible you may need to apply an eval license in some cases.
This might also drop established connections on the floor when the routes are swung over.
If that is problematic, it's probably a good idea to temporarily turn off the "drop out-of-state" Global Properties for a period of time to allow the connections to more gracefully recover.
![](/skins/images/A53DAF99EDBAFE11A1FC6E62F510C235/responsive_peak/images/icon_anonymous_message.png)