ClusterXL Gateway Upgrade

[Neck]

I have an older pair of R81.20 HA ClusterXL gateways that I need to upgrade to R82.10. I’ve already built a new management server and migrated the database. This is a KVM environment.

Originally, I planned to do an in-place upgrade on the gateways, but now I’m considering building new gateways instead.

My current thought process is:

1) Shut down the current standby gateway.
2) Deploy a new R82.10 VM to replace it.
3) Assign it the same hostname, interfaces, and IP addresses as the old standby.
4) Re-establish/verify SIC with the management server.
5) Push policy and verify functionality.
6) If everything looks good, fail over traffic to the new gateway.
7) Repeat the process for the second gateway.

Does this sound like a valid approach, or is there a better recommended method for upgrading ClusterXL gateways in a KVM environment?

Thanks!

[PhoneBoy]

I've seen a similar process being followed for physical gateways.
Don't see why it wouldn't work here.

[morris]

Yes this sound like a valid approach. Don't forget to manual copy custom scripts, configs, cronjobs etc.

Before Failover with step 6), enable Multi-Version Cluster and pay attention to the Limitations:

Multi-Version Cluster Limitations

[Martijn]

Hi,

When performing major upgrades, most of the time we re-image the gateways via USB with the new version.
Especially when the gateways have gone through a lot of upgrades and hotfix installations in the past.

The procedure you describe is well documented in the Check Point upgrade guides and is basically a Multi Version Cluster ugrade. When following the MVC procedure, you are good to go.

Good luck!

Martijn 

[Don_Paterson]

That's a good plan. 

Its the cloud way, destroy and redeploy. 

While you are doing the project you could look into automation procedures for the future projects. 

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Gaia_AdminGuide/Content/Topics-GAG...

And/or blink and load configuration clish. 

[the_rock]

See if below would apply?

https://community.checkpoint.com/t5/Firewall-and-Security-Management/Replace-Upgrade-Cluster/td-p/69...