R82 - ElasticXL upgrade

[Magnus-Holmberg]

Hi,

Currently there are missing instructions on how to upgrade HFA on R82 running ElasticXL.
When can we expect the documentation to be updated as its diff from when running ClusterXL.

https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/R82.00/Installation-Uninstall.htm?tocpath=_____6

Regards
Magnus

[the_rock]

I am pretty sure that same process in clish worked for me when I had elasticxl lab while ago, but I could be mistaken.

Andy

[Magnus-Holmberg]

Its very similar, (if i remember correct its not the same commands) but there should still be documentation about it 🙂

[_Val_]

All, thanks for your feedback. We notified the relevant teams internally, we are fixing this.

[Magnus-Holmberg]

Thanks, i think the biggest thing is that there is no CPUSE within Gaia portal, so that really need to be highlighted.

[the_rock]

Agree with that, it definitely should be noted.

Andy

[Sergei_Shir · Accepted solution]

The relevant procedure was updated - it now applies to Maestro and to ElasticXL

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ScalablePlatforms_AdminGuide/Conte...

Please provide your feedbacks directly in that topic - on the top toolbar, click the envelope icon.

Thank you.

[Magnus-Holmberg]

Honestly based on that ElasticXL is planned to be the new ClusterXL.
I would write in the headline 
https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/R82.00/Installation-Uninstall.htm?tocpath=_____6


"Installation and Uninstall Instructions for Scalable Platforms"

To be changed to

"Installation and Uninstall Instructions for Scalable Platforms, ElasticXL"


Secondly it need to be updated in the smart console to not permit "central deployment from smartconsole" on elasticXL Clusters.
Because the feature itself says it works and it will upgrade the SMO within the ElasticXL Cluster, and it will say its successfull even that the rest of the members are not updated.

[JacWev]

Hi Magnus, 

We want to upgrade ElasticXL R82 to R82.10. The SMS is Smart-1 Cloud. Do you know if there is a correct procedure. Because when we change the Firewall object to R82.10. We getting a failure during the installation.  due to installation failed, Reason TCP connectivity failure Port 18191. And we followed the correct URL. 

Jaco Wevers Security Engineer. 

[Bob_Zimmerman]

There are two separate upgrade procedures to upgrade an ElasticXL cluster from R82 to R82.10, depending on whether it's running as a normal firewall or in VSNext mode.

[JacWev]

Hi Bob, 

That's correct, we have a Smart-1 Cloud management environment with an ElasticXL cluster across two sites, with one gateway per site. If we want to upgrade this environment and follow the steps, there is a step where you need to set the gateway to R82.10. Because the SMO connects to Smart-1 Cloud, you can't manage to install a policy on just one gateway. If you'd like to know more, I can explain further.

[Bob_Zimmerman]

That's not specific to Smart-1 Cloud. An ElasticXL cluster object can only have one version on any management server.

For non-VSNext, check out step 8. For VSNext, you have to do something similar, but for every VS on the box individually.

[JacWev]

I will explain the environment to you in more detail. The customer has an ElasticXL environment with two sites, and one gateway per site. The active site holds the SMO role.

When you want to upgrade the standby site with the active node, you bring this node down, which allows you to proceed with the upgrade. Then you reach the point where you need to install the policy. That is point 8 you mentioned.

You change the firewall object to R82.10 and then run the installation. However, this fails because the node running R82.10 has no connection to the management server.

Hopefully, I have made it clear now what issue I am running into.

[emmap]

We have this workaround for Maestro, it should apply to EXL as well. If this is no good please open a TAC case for assistance.

https://support.checkpoint.com/results/sk/sk184660 

[JacWev]

Hi Emmap,

I think this is what we need. Thanks for pointing the SK184660. Very helpfull. 

Let you know of this is working.