Cluster-specific workflow for R80.40 remote hotfix/JHA installation

[Garrett_DirSec]

Hello -

What's New in R80.40 HERE includes central hotfix/JHA deployment.    This is great news and very attractive new feature for customers with sizable numbers of gateways.    Nice this includes central JFA install on R80.30, R80.20 gateways as well.

The workflow section of admin guide glosses over the specific procedure used when upgrading a cluster.

Can we assume the remote cluster JHA install would happen based on best practice procedures as documented in release notes (ie. zero downtime -- install on gatewayA, failover, and then install on gatewayB)?

Please update the workflow diagram in admin guide for cluster upgrade.

Side topic:   will be be able to TEST/DEMO this on DEMOPOINT?

reference:

R80.40 admin guide reference for central hotfix install HERE (with requirements).  

Thanks in adv. -GA

[Boaz_Orshav · Accepted solution]

Hi

  Yes, your assumption regarding cluster installation is correct.

  We will add it to documentation.

  Thanks for the tip and will be glad if you have more after using it.....

Boaz

[Garrett_DirSec]

Hello @Boaz_Orshav  -- thanks for quick reply. 

I'm curious on topics of (a) error handling, and (b) pre-verification?

Will there be able to easily "check" group of target gateways if a JHA "should" install without issues (example:  identify an installed hotfix that may block install of JHA)?

How will failures be handled?   Will logs be collected for central view -- will central status provide more information than "failed"?

thanks -GA 

[Boaz_Orshav]

Hi

  Regarding verification - the action "Verify" actually runs the Deployment Agent verify option on the gateway so every pre-verification that is done by CPUSE (like conflict with current HF, disk space etc.) will be identified and reported as is (the central deployment will show the message the CPUSE on the gateway is issuing).

  Logs - we are aware of the need to centrally collect logs in error cases. The Central Deployment GUI has lot's of required functionality and in order not to wait for all to be ready we deliver it in phases.

  R81 shall include much more than R80.40 and so on.

  The logs collection is on the short list for the next version (after 81)

[Maarten_Sjouw]

In a MUliti Domain environment with losts of domains with just 1 GW or 1 cluster, will the packages be loaded once on the global level and then redistributable per domain?

[Boaz_Orshav]

On 80.40 the packages are downloaded to the GW from the Check Point Download Center.
On 81 the management can manage a repository and in this version the repository shall be one per MDS (from global context) and installation shall be per domain (package will be taken from the global repository and transferred to the GW)

[Garrett_DirSec]

hello @Boaz_Orshav --  thanks for additional details.

Is this new mechanism leveraging BLINK subsystem?   Or did you have to code from scratch? 

thanks -GA

[Boaz_Orshav]

The remote (central) installation is orchestrating the Deployment Agent (CPUSE) on the Gateways side, hence supports also Blink packages deployment.
Notice this ability shall be released as part of 81.00

[G_W_Albrecht]

Dashboard tells me that TX appliances are unsupported - this is not mentioned in current documentation...

[Dale_Lobb]

What about taking a backup/snapshot before the installation?  Is or can that be part of the automatic deployment?

[Boaz_Orshav]

Taking automatic snapshot is already part of version upgrade flow.
Do you mean you would like to have it also for Jumbo/HF installation?

[Garrett_DirSec]

hello @Boaz_Orshav -- this would be nice option.