Upgrading the Checkpoint VSX cluster (VSLS) from R77.30 to R80.10 with Clean install

[paulastya]

We are going to upgrade the Checkpoint VSX Cluster from R77.30 to R80.10 with a clean install on a 13500 appliances. The Management Gateway is already upgraded to R80.20 version. 

My question is can we do the clean installation of VSX cluster using the CPUSE ?

While checking the documentation I found the following,

From R75.40, R75.45, R75.46, R75.47, R75.40VS, R76, R77, R77.10, R77.20, R77.30 to R80.10:

ComponentSupported Methods

Security Management Server	CPUSE Upgrade CPUSE Clean Install Advanced Database Migration
Multi-Domain Server
Security Gateway	CPUSE Upgrade CPUSE Clean Install
VSX	CPUSE Upgrade (from R77 only) Earlier versions: Use instructions in sk101518
CloudGuard Controller	CPUSE Upgrade (from R77.30 only)

So, the documentation says that CPUSE upgrade is possible not clarified about the Clean installation.

[Wolfgang]

Paulastya,

Connectivity Upgrade R77.x and R80.x Versions Best Practices  shows all steps you need, including the clean install way.

Last VSX upgrade we did from 77.30 to 80.20  we had some problems and changed the procedure.

1. Did an inplace upgrade of the VSX-cluster to 80.20.

2. After successfull upgrade we followed Reconfigure VSX Cluster member and refreshed the VSX-cluster nodes with a clean install of R80.20.

Wolfgang

[paulastya]

The Connectivity Upgrade R77.x and R80.x Versions Best Practices document gives a detailed step by step of performing the upgrade for the VSX cluster.

In this document after the performing the Clean install on the Standby cluster member it says perform the following:

Step 5 of 20: In SmartConsole - Install the Access Control Policy.

My question is if after the clean install and completing the first time configuration wizard if I perform the vsx_util reconfigure command to reconfgure the the standby gateway member then do i need to Install the access control policy.

Because in this document i do not see any step for the reconfgure the VSX cluster members using the vsx_util reconfigure command.

[PhoneBoy]

I'm curious why you're choosing R80.10 when R80.30 is the current recommended release?
Even R80.20 would be a better choice here.

[paulastya]

While checking the Connecvity Upgrade Document from R77.X and R80.X version I found the following:

Connectivity Upgrade of a Security Gateway Cluster
Warning - The R80.20 ClusterXL does not support the Load Sharing mode (R80.20 Known
Limitation MB-30). If your ClusterXL R80.10 and lower works in the Load Sharing mode, then
before you upgrade it to R80.20, change the configuration to the High Availability mode and make
sure it works correctly

This is from the document which is published on 11th June 2019.

Our VSX Cluster is running in VSLS mode and our MDS is currently running in R80.20. So in the current scenario, it seems only updrading to R80.10 is possible.

Please, correct me if I am missing something.

[Maarten_Sjouw]

Yes you are missing something, they are not talking about VSLS, they are talking about a plain cluster where both members are actively processing traffic.
So, Yes you can upgrade to R80.20 with VSX in VSLS mode. You will get more benefits (over R80.10) from this upgrade, 64bit mode per VS and dynamic dispatching as the most important ones..

[Wolfgang]

paulastya,

VSLS under VSX ist not ClusterXL-LoadSharing.

With VSX ClusterXL is always running in HA-mode, VSLS is a feature of VSX and allows running virtual systems on all of your VSX nodes in a cluster.

You are able to upgrade to R80.20 with VSX VSLS without loosing LoadSharing for your VSX environment.

Wolfgang

[Wolfgang]

I saw, Maarten was answering, same time of my writing here 😁

[paulastya]

Thank you guys for clarifying.