Clean install vs upgrade

[Martin_Valenta]

Is there any SK or documentation page, where would be summarized benefits of clean installation vs upgrade via CPUSE ?

[Jerry]

If I remember well I don't think there is any but I might be mistaken.

Pros and Cons are always out there. Fresh install is always recommended but not always possible from obvious reasons, however should you have any chance and opportunities to make it "fresh" I would strongly encourage you to do that. Instead upgrade_path is also not-that-complicated though, it all depends what are you upgrading "from" and how much data need to be "migrated" to the new environment.

Upgrade via CPUSE can be tricky and not always the best way going forward. It all depends on many factors and how much time you've got to have all tasks completed.

In my personal opinion migration (called upgrade) to new Management is most likely to be the most complicated one.

Migration however of new "gateway" - can be bypassed by installing a new one instead. As I said - it all depends.

Tell us more about what you'd like to migrate/install-fresh so we can elaborate a little bit more on that.

Jerry

[Martin_Valenta]

In case of management servers, there is no doubt that clean install is better. My question is aiming on gateway upgrades from r77.30 to r80.10

[Jerry]

great. in that case there is 1 sk if I recon ... I've used sk107042 for ClusterXL (HA) VSX as well as Standalone R77.30.

Let me see if there are more such sk's ...

[Jerry]

plus very well known PDF from

https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_Installation_and_Upgrade_Gui...

should be ok but I'll keep searching for you if you like  

[Jerry]

don't forget to get trough sk111841 btw. it is important to have  all pre-reqs in hande before starting "production" migration. just my last 5 cents.

hope you'll ok with those sk's/pages. all the best !

[PhoneBoy]

One reason to "clean install" R80.20.M1 is to use the xfs filesystem.

Clean installs are also useful for practicing upgrades, upgrading hardware, and other similar activities.

[Tsahi_Etziony]

With CPUSE upgrades you benefit of having your configuration migrated automatically to the new version, plus you get an automatic snapshot of the old version in case you want to revert the upgrade. the content of /var/log is also kept for the new version.

Anything that is not performed by the upgrade and makes you want to prefer a fresh install is considered a bug in the upgrade process and this is something we should and will fix. 

The only reason I'd recommend a fresh install is what Dameon wrote - taking advantage of the new xfs file system. CPUSE upgrade can't migrate the file system so ext3 is still being used after the upgrade. 

[PP26]

Hi

I don't think that Clean Install via CPUSE changes the file system to xfs, if clean install is via CPUSE the file system will still be ext3

[Tomer_Noy]

I strongly support @Tsahi_Etziony 's statement.

We want to make the upgrade process very simple and the way to do that is via CPUSE, which will take care of everything without manual steps. 

There are several cases where "clean install" is preferred over a standard CPUSE upgrade:
1) You are switching to a different machine / HW. Obviously in this case clean-install is the only option.
2) You are running a pre-R80.20 environment and you want to get the new xfs filesystem for better performance. Only a clean install from an ISO will give you that. However, in future upgrades, this is no longer relevant as you will already be using xfs.
3) You want to run the upgrade process with the jumbo HF installed. Sometimes we find bugs after the release and fix them in the jumbo. When doing clean-install + import, you have the chance to install the jumbo before the import and get these fixes. If you encountered an issue in your upgrade, we may recommend to do it again with the jumbo.

Note that for #3, we are working on ways in the roadmap that will allow you to do a CPUSE upgrade and still get the jumbo fixes in the process.

Beyond these 3 considerations, if you have other requirements or reasons why you prefer a clean installation, we would be happy to hear and improve.

[PP26]

@Tomer_Noy  I could not agree more with @Tsahi_Etziony  either 🙂 but I completely understand that my file system will still be the same with Clean Install via CPUSE, however as I already mentioned in the other thread (where you have your inputs too 🙂 ) my reason for doing this is what you said in your point 3 ,as well as I have already run the pre-verifiers and exported management and event db. I understand that automation is very good, however reason for going with this option was that I prefer to do manual verification as if something is not right we can stop it and resolve before moving further, also like in any case I believe manual would give you a bit more control and say over process. Specially when Checkpoint has some really cool tools to assist.

Coming back to the main question in this thread 🙂 What are major differences between the 2 type of CPUSE upgrades  ?

[Tsahi_Etziony]

@PP26,

"Coming back to the main question in this thread  What are major differences between the 2 type of CPUSE upgrades  ?"

I'll answer.

CPUSE upgrade is just like CPUSE clean install, which is followed by migration of the configuration. since this is the same mechanism, you get the same benefits like automatic snapshot of the previous partition, but you have similar limitations like required disk space and the fact that you can't change the FS. 

I think there are only two real reasons for preferring CPUSE clean install over CPUSE upgrade:

1. Moving to an older version - CPUSE cannot downgrade. 
2. Changing First Time Wizard configuration such as changing the machine role. 

As I wrote before, I consider any other consideration that leads you to prefer CPUSE clean install as something we should examine and probably fix. I am concerned with @G_W_Albrecht 's statements regarding stand alone and VSX and I do agree we need to improve the experience. I hope that CDT helps with VSX experience, as one of the main pain points is the need to perform the upgrade on the management as well, and CDT does that for you. 

Please share any suggestion for improving the upgrades. We are constantly working on upgrade improvements!

[PP26]

@Tsahi_Etziony  option 3 which was given by @Tomer_Noy  is 3rd option why we would need to do Clean Intall via CPUSE and that is indeed my reason as explained in my previous response. Also I am sure there should be more advantage to do this as even the CP installation and upgrade guide mentions this option , but unfortunately does not tell in detail about the actual difference, hence I am trying to understand 🙂 

[Tsahi_Etziony]

@PP26 , you are right, of course 🙂.

@Tomer_Noy also mentioned that we are working on a solution for that, so I really hope it won't be relevant in the future. 

and let me share some details:

Blink is also a type of image that CPUSE can install, just like the version upgrade image. the difference between a Blink image and a version upgrade image is that the Blink image is specific for a machine role (we have Blink for GWs, SMS, and soon we'll have Blink images for other types of management and MDS), and Blink can include also hotfixes and Jumbos. 

Currently CPUSE can only use Blink images for clean installation, but soon we will release Blink images that can be used for upgrades as well. When we release a management Blink image that supports CPUSE upgrade, the DB import will be performed on a version that already has the Jumbo installed. Hopefully, this will eliminate option #3. 

[PP26]

@Tsahi_Etziony I am glad to hear that is being worked upon and hopefully we will only have one option via CPUSE which would be to upgrade and that would do it all 🙂 

I am a little confuse about your statement "the difference between a Blink image and a version upgrade image is that the Blink image is specific for a machine role (we have Blink for GWs, SMS, and soon we'll have Blink images for other types of management and MDS)" . Even the GA images which I believe you referred as version upgrade image are specific for SMS and GWs so the only real difference I see is that Blink will have HF and Jumbo but the version upgrade (a.k.a GA) will not have those HF and Jumbo, please correct me if I am wrong.

Also, thanks a lot for confirming that we can use Blink Image to do a Clean Install via CPUSE on GWs (5000), as the upgrade of GW that I am planning to do , I saw an available blink image for that , so I will use that, which will save time as well as install all the needed HF in one go.

Do you know if there is a Blink available for SMS "Smart 1 - 210" for R80.20?

Thanks again for your input !!

[Tsahi_Etziony]

@PP26 ,

Usually we do not release separate files for management and GWs, but with the move to the new kernel and filesystem we had to release two images, since the R80.20 GW image is based on kernel 2.6.18 and the R80.20 management image is based on kernel 3.10. So indeed, we had to release two different images also for the "regular" upgrade image. 

You can check the available Blink images on the Blink SK - SK120193, and also on the specific machine - when you go to the CPUSE page on the WebUI, and select to view ALL packages, you can see the relevant Blink images. we have a mechanism that will only display images that are relevant for the specific machine, so it will help you making sure the right image is there.

We are about to release new images in the next 1-2 weeks with the addition of the latest Jumbos.

And one last thing - GW Blink image for clean install is indeed available, but GW upgrades using Blink (install the version and the jumbo without losing configuration) is just around the block.

[PP26]

@Tsahi_Etziony  thanks for answering my queries and passing more relevant as well as useful information. Based on your previous response I had a couple of doubts, wondering if you can shed some light on that please?

"We are about to release new images in the next 1-2 weeks with the addition of the latest Jumbos."  << Do you mean normal GA image or Blink Image ? If you mean Blink Image, in that case if someone would do an upgrade on the GW tomorrow using the available Blink Image shown in CPUSE/WebGui will they be able to separately download and install the new HF/Jumbo that are in the new Blink image?

"And one last thing - GW Blink image for clean install is indeed available" << Do you mean clean install via CPUSE or a clean install like ISO where it wipes off complete Hard Disk ?

Reason I wanted to ask above is because in one of the other thread I read that when you use Blink Image to do a clean install then we need to do some manual steps (apply OS config, reestablish SIC), but when I use a GA image to do a clean Install via CPUSE then those manual steps are not needed (correct me if I am wrong, I have not read anywhere that they are needed). I would have thought the only difference in using "Blink Image vs GA Image" when doing Clean Install via CPUSE is that former has all the HF and Jumbox and is much faster way, while later will be a it slow and we need to install HF and Jumbo on top of that .

Thank you in advance!!

[Subrk]

Hi,  Most of the major OS version Available on CPUSE.  There is a message mentioned on all the packages that upgrade to this Version is "prohibited " use clean install. 

Why they mention such a comment and made option to upgrade the image? 

[G_W_Albrecht]

As elaborated here already, things do differ a lot when comparing use cases. Out of my personal experience / view, i would dare to say:

- On the Gateway, CPUSE is well enough for installation - as long as you have sufficient disk space and partitions left, as the previous version will remain in a separate partition so you can revert back to it (see the discussion here: How to advance Upgrade Smart-1 210 SMS r77.30 to 80.20). On the other hand, if the GAiA configuration is rather simple, a fresh install, FTW and policy install is a quick way to a clean GW with much free space (remember situations of spontaneous local logging ?).

- One criteria i find very important is the age of the installation on the specific hardware and the detailed installation history. Although the residues of older versions on SMS are much smaller nowadays (😉), i prefer SMS Advanced Upgrade especially for major version changes. New FS can also be an argument here in larger scale environments.

- with VMs we do not need to ask such questions 😊

- with VSX we often do not dare to ask such questions 😕

- with StandAlone deployment we just did get only the short end of the stick 😞

[Maarten_Sjouw]

I think PP26 did not want to start the actual discussion again, but make a note that when you use the CPUSE option "Clean Install" you will NOT get the new file system xfs.
So there is a difference between Clean Install (through USB from ISO) and the CPUSE Clean Install.

[PP26]

hi @Maarten_Sjouw  yep I have read about the file system difference as that is a part of the documentation available in the upgrade guide. However I put the comments in this thread as I could not find more info (online or even in any sk) about the difference between the 2 types of CPUSE upgrade process (Upgrade vs Clean Install) and to understand how they are different in terms of changes happening to files, directory , configuration etc etc 

 Any ideas there from your experience ?

[PP26]

@G_W_Albrecht  hi mate , I have already taken snapshot of the gateway, which I can use to restore I believe , if something goes wrong during the upgrade , so if I do not want to retain old partition , will Clean Install via CPUSE  make sure it is removed ? Or do I need a installation using ISO ?

For SMS I am indeed planning Clean Install via CPUSE (a.k.a Advanced Upgrade) but yeah I am not sure if that will remove the older versions, any ideas ?

Thanks a lot for your help and input !!

[G_W_Albrecht]

For CPUSE Installation details, see the discussion here: How to advance Upgrade Smart-1 210 SMS r77.30 to 80.20.

And yes, CPUSE can do an Advanced Upgrade for SMS - migrate export, fresh install on a new partition and migrate import. But the old installation always is kept on the old partition, as CPUSE can revert in case the upgrade fails 😁 - very good with enough disk space...

Otherwise, ISO or Blink are good ways to do a fresh install without leaving old partitions.

[PP26]

@G_W_Albrecht  actually my SMS is Smart -1 210 and it is not supporting Blink 😞  but I can certainly use one of the blink image for my gateway as they are supported. On that note I Just  wanted to check something which I have already asked in that other thread you posted the link for "can we do a Clean Install via CPUSE using Blink Image? or that only supports Clean install via USB where it wipes off everything and is a complete format giving you a new xfs file system?"

PS:  I've actually started that thread you have referred to 🙂 so yeah I am tracking that too for answers and help 🙂 

thanks for your time again!!