R81.10 New Recommended Jumbo - Take #170

[eranzo]

Hi All,

R81.10 Jumbo HF Take #170 is now our Recommended Jumbo take and is available for download to all via CPUSE (as recommended) and via Jumbo documentation (R81.10 ) 

A full list of resolved issues can be found in the Jumbo documentation ( R81.10 ) 

Note:

• Central Deployment allows you to perform a batch deployment of Hotfixes on your Security Gateways and clusters from SmartConsole!! For more information, see sk168597.
• With Blink images, you can upgrade your environment to the required Major version including its recommended Jumbo hotfix in one Step, using a single image file.

You can install Blink images using CPUSE – More details can be found in sk120193

Thanks,

Release Operations Group

[the_rock]

Hopefully at this point, most people are on R81.20. But, I read the notes about that jumbo, excellent work.

Andy

[Will_H]

Take 170 in our lab testing had issues with VSX cluster health. Upgrading to the new take 171 fixed it for us. My guess it had to do with 

PRJ-58111, PMTR-102962 in the release notes.

[the_rock]

@Will_H 100% thats correct. TAC actually confirmed it for customer I worked with that had same problem.

[Magnus-Holmberg]

Having issues with failover all over the place in large VSX clusters, to have this as recommended is just crazy.

[the_rock]

@Magnus-Holmberg 

I do see below in take 171, though nothing specific about failovers 😞

Andy

 

[Magnus-Holmberg]

Yes we installed HFA169 instead when we did see the forum post.
But before that we had failovers every 10 seconds or so on multiple VS in a 50 VS, VSX Cluster.
Causing very high CPU loads and not funny things.

[the_rock]

Wow, every 10 seconds, thats terrible : - (

Lets hope its fixed soon.

Andy

[Magnus-Holmberg]

yes and HFA130 that we where on before upgrade to HFA170 takes 1hour and 5min before the VS start to starts.
In this HFA169 they starts to start after 3min and then all done after about 40min. (with 50VS)

[Arne_Boettger]

I share your observations regarding startup times in R81.10 with many VSes - we have about 40, and while it used to take up to 45 Minutes until all VSes were started, now it seems like all are started in parallel, causing high load and sometimes strange temporary lockups.

Currently, we are using three OpenServers, I am curious how it will behave once we switch to two Appliances next year.

[Magnus-Holmberg]

yes it feels like when check point is testing the software they use 10-15vs because that works without an issue.
issues starts when going above 25-30vs, 

Not sure if appliances act differently, we uses openservers for all big vsx systems.

[Hrvoje_Brlek]

@Magnus-Holmberg @Arne_Boettger  did you maybe upgrade to Take 171 or 172, does the issue with failovers still occur? 
We have an environment with around 30 VSes and a downtime scheduled soon, so would like to install the latest JHF if possible (still on Take 128 currently). 

[Arne_Boettger]

Our Three-Gateway VSX Cluster is running with HFA Take 171 without significant issues.

We do see some interfaces missing their IPv6 configuration, and a TPD on a backup instance is running 100% CPU again, but no lockups or unexpected failovers.

But in the past, we used to observe the start process by running "watch -d cphaprob stat" on one clustermember to see the VSes come up, but in recent versions this seems to interfere with the startup process, so we didn't do that in the last maintenance window.