R80.20 CDT Versus SmartUpdate (FIGHT!)

[AntiSpoofing]

Hello all,

First post so please take it easy on me...

Why can't we upgrade managed firewalls (Service Packs and various updates) through a SmartUpdate-like utility?  Forgive me if this has been asked before.

>AntiSpoofing

[PhoneBoy]

For the last several years, we've distributed patches via CPUSE.
SmartUpdate was never updated to leverage this mechanism.
CDT can distribute CPUSE packages (among other things) to multiple gateways, but doesn't have a SmartUpdate GUI.
I suspect, though don't know the exact timelines, that we will integrate this function into SmartConsole in a later release.

[Dorit_Dor]

We took a different route this time. We focused on robust core upgrades (with CPUSE and automation with CDT), all with APIs first and later UI.

We understand that a UI component is needed and phase 1 is coming in R80.40 (why phase 1? because it will not cover all the richness of CDT - it will enable simple update scenario). The UI will be based on UI extension and therefore part of Smart Console and not a separate application.    

In general the richness of CDT comes with strong automation (which wasnt part of SmartUpdate and is less UI relevant) but for CPUSE surely a UI is expected 

Dorit 

BTW you are welcome to join the early availability in a month or two

[Tomer_Noy · Accepted solution]

Yup, just a few clicks to install the latest Jumbo HF (without even having to search for it). Will automatically install cluster members one-by-one and take care of an orderly fail over.

Join our R80.40 EA!

We do have even more cool stuff coming 🙂

And here is a teaser:

[AntiSpoofing]

Thank-You, yes, that was what I expected. I just thought that the CPUSE approach was a tad laborious since you are downloading multiple times the same package whereas the Management distribute and scheduled application was much-to-be-desired function.

Thanks!

[AntiSpoofing]

Thanks Dorit!

BTW - Former Employee (Roger, Diamond TAC, Team 1)

[Lewis_Ryan]

Hi,

I thought CDT in GUI form was going to be part of R80.30 is this now not the case?  We are not yet on this release but were planning to be due to CDT availability in the console.

I have just checked on the SmartConsole for R80.30 on Demopoint but couldn't find CDT in the console, unless I am missing it or does it require an extension of some sort?

[PhoneBoy]

Hadn't heard this MIGHT be in R80.30.
In any case, it's planned for R80.40 and you are encouraged to join the EA.

[Lewis_Ryan]

That's what I was told at the Demo at CPX Vienna. Will consider EA

[AntiSpoofing]

Thank-you sir!
I got word that it's coming.

It was just that it seemed like a step back from where "we" were...

[M_Ruszkowski]

Right now...I am on the CDT side.   So please don't take my CDT away!!!!

The CDT has worked very well for us. We have upgraded more that 135 firewalls in three months. Keep in mind, we can only do these upgrades on weekends. It used to take us more than a year to upgrade everything. The upgrades have been from R77.20 and R77.30 to R80.20 with Jumbo Take. And we are using CDT to roll out HFA's as well. We have already started patching with Take 118, which was recently released. This has dramatically sped up our upgrades and patching cycles.   This will be the first time in over 10 Years that all of our firewalls will be on the same version and HFA!    

If you have not tried CDT, I would recommend just skipping the basic method and go right to the advanced method and define a deployment plan. Not very hard to do it, and you are going to end up doing this way anyway. So don't bother with basic method.