Difference between clean install and upgrade via CPUSE

[Malik1]

Hi Team, 

I need to know what is the difference between clean install via CPUSE and upgrade via CPUSE on a security gateway.  

As far i understand we have 3 ways to upgrade a security gateway.

1. CPUSE Upgrade 

2.CPUSE - Clean Install

3.Clean install via USB 

Using  option 3  will get the system to xfs filesystem and the other two options wont. Option 3 is nearly impossible in our environment  but are there a advantages of the new file system. If there is an SK or link that points out the difference between the existing file system and xfs file system,

Also,how upgrading via blink image make a difference and should it be considered .  ?

Using  option 3 (Clean install via USB)  we cant revert back but if we use CPUSE - upgrade option we can revert back do we have the same option to revert back using CPUSE clean install. 

[HeikoAnkenbrand]

Hi @Malik1,

All upgrade methods are described in detail here:

Installation and Upgrade Guide R80.40 

[Boaz_Orshav · Accepted solution]

Hi

A very short highlight of the differences:

USB - Reformatting the system. New file system. New definition of partition size. New IP. New role (i.e. GW can become management etc.) Nothing is left from the previous installation.

CPUSE Clean - Create a new partition for the new version and install it. The old partition still exists so you can easily revert. Partition sizes are kept as well as files which are not in the "current" partition.

CPUSE Upgrade - Exactly like clean install but at the end of the process a configuration migration is done so the machine expected to stay with same functionality (i.e. you can't change GW to Management etc.)

Blink - Mainly a shortcut to make installation faster in case installation of version + Jumbo is required. The terms clean/upgrade are same as any CPUSE installation (see above) but instead of installing version 80.40, reboot, install jumbo, reboot it can be done in one step (i.e. install 80.40 + jumbo and reboot).

[JozkoMrkvicka · Accepted solution]

There is also one more option - Mount ISO file over LOM.

It will do the same like was mentioned by Boaz for USB option, but in case of LOM, you can do it remotely, without having physical access to the device.

[Malik1]

Thanks @Boaz_Orshav 

One more thing , can you point out some link or SK that mentions the process to revert . I have gone through the CPUSE guide and we can only uninstall hotfixes not major versions. 

If you could help me with the process to revert as I plan to upgrade using CPUSE upgrade or CPUSE clean install. It seem the process to revert using CPUSE (upgrade or clean

Thanks

[Boaz_Orshav]

Sorry for the delay.

Snapshot management is described in: Gaia R80.40 Administration Guide -> Maintenance -> Snapshot management

[CheckPointerXL]

Hello Boaz,

which configuration are kept by doing CPUSE Clean? I guess mgmt IP and static route... also other stuff? custom files etc?

Thank you !

[CheckPointerXL]

solved:

When CPUSE is used to clean insall an OS Version it keeps a copy of the origional admin password, network interfaces and network routes. (sk157054)

[dehaasm]

CPUSE upgrade configuration migration what does it contain clish config and perhaps the fwkern.conf file? Is there any benefit of doing a clean install?

[_Val_]

One difference is that clean-install re-images your device. For example, the default file system changed between R80.30 and R80.40 for Security GWs and between R80.20 and R80.30 for The management servers. When doing a clean-install, you can change your file system type in the process, unlike in the case of an in-place upgrade, where your device still uses the "old" file system after an upgrade.

[PhoneBoy]

CPUSE "Clean Install" does not change filesystems.
A Clean Install from ISO is necessary for that.

[ikafka]

I have a question here. 

My SMS info

Prodcut version: Gaia R80.30, OS kernel: 3.10.0-957

I can upgrade this openserver SMS to R81.10 from gaia web gui. I see this:

The question is will lose any configuration when I do this upgrade? I will then upgrade two firewalls with R80.30 to 81.10.

[Boaz_Orshav · Accepted solution]

Hi

  As stated in previous response - notice that file system does not change while using CPUSE upgrade.

  Configuration will not be lost.

  Notice that it might be easier to use Smart Console: Select the firewalls, right click->actions->version upgrade

  If you need more assistance - feel free to contact me at boazo@checkpoint.com

[Matlu]

Hello,

A question.

What is the method Checkpoint recommends to perform an upgrade?

I am currently in the habit of upgrading using CPUSE Upgrade (I have never tried to use Clean Install or Blink).

Does Checkpoint have any "recommendations"?
Can I keep my "old habit" of using the "CPUSE UPGRADE"?

Greetings.

[PhoneBoy]

To take advantage of certain changes made in certain releases (R80.40, R81.20), you will need to perform a fresh install + advanced migration.
These changes involve the filesystem (xfs in R80.40, partitioning alignment changes in R81.20) which cannot be done in-place.
Note these changes lead to improved performance, specifically on management where disk is used extensively.
Gateways also benefit, albeit to a lesser degree.

[Matlu]

Simply using CPUSE UPGRADE, does it not guarantee me to "benefit" from certain changes in the versions that you expose in the example (R81.20 and R80.40) ?

I understand that it would be the only "particularity", the fact that I do not have the new features of these versions, if I decide to use CPUSE UPGRADE, correct?

How could I align the update made by a CPUSE UPGRADE, so that it has all the benefits that a FRESH INSTALL would give you?

Because many times, for "x" reasons, it is not possible to access the equipment in a physical way, to do this kind of upgrade (Fresh Install).

[PhoneBoy]

Converting from ext3 (default file system prior to R80.40) to xfs requires changing disk partitioning schemes.
Changing the alignment of partitions (R81.20) must be done during the establishment of the partitions.
Neither of these things are possible to change “in-place.”

Note these low-level changes are the only ones that require a fresh install to benefit from and they are most relevant to management.
They are less relevant/necessary on gateways, which as you said, may not always be easily accessible.

[JozkoMrkvicka]

Is there some dedicated sk where is described what exactly is "partitioning alignment changes in R81.20"? To be honest, I had no idea about such a change which is activated only by using fresh install.

I have found sk180970 where something about  SSDs and partition changes are mentioned, but not sure if this is the correct way to inform users.

It is also not explained in R81.20 released notes and even not mentioned that such a change requires fresh install. Is this partitioning alignment valid only for SSDs, or also for HDDs ?

It would be great to have one dedicated sk where are mentioned all changes/features which are not present on newer versions while upgrading using CPUSE and not doing fresh install (32bit vs 64bit, 2.6 kernel vs 3.10 kernel, XFS vs EXT3 file system, ...).

[_Val_]

@JozkoMrkvicka The topic was thoroughly discussed in the community the last year: https://community.checkpoint.com/t5/Management/Gaia-partition-misalignment/m-p/160677#M32878

[aloish]

CPUSE Upgrade: ...configuration migration...the machine expected to sty with the same functionality... ?
why does checkpoint mention in the install and upgrade guide the following ?

On your Security Gateways and Cluster Members:

Make a copy of all custom configurations in the applicable directories and files.

The upgrade process replaces all existing files with default files. You must not copy the customized configuration files from the current version to the upgraded version, because these files can be unique for each version. You must make all the custom configurations again after the upgrade.

[_Val_]

The note is about very special config that you might introduce to your FW, such as specific kernel parameters, cluster fine-tuning, etc. Such changes will not be copied over during BLINK upgrade, and you will have to re-do them.

If you did not make those, nothing else to do.