Questions on upgrading from R80.10 to R80.40 or R81

[r1der]

Hi Everyone,

First off, thanks for reading my post and what a great community CheckMates has here. I hope you all are safe and have a Merry Christmas/Happy New Year! I have only been using CheckPoint for about 5 months now, please bear with me while I learn. If this is the wrong area, sorry for posting it in the wrong place!

I was hoping I could get some guidance on upgrading them from R80.10 to R80.40 or R81, with little or no downtime, if possible. If I am not mistaken, I can upgrade the Gateways from R80.10 to R81, but the Smart-1 210 hardware or “SMS” will need a two-step upgrade - R80.40 then R81.

Hardware: (1) Smart-1 210 R80.10 build 031 and (2) 5600 SG R80.10 build 124. SGs are setup as High Availability/ClusterXL.

Should I be installing any hotfixes, minor versions, Blink Packages prior? These are what I have currently recommended: Hotfixes - R80.10 Jumbo Hotfix Accumulator General Availability (Take 287), Minor Versions- R80.10 SmartConsole Build 183, Blink Packages – R80.40 Security Management + JHF T89 for Appliances and Open Servers, Major versions (will do this) - R80.40 Gaia Fresh Install and Upgrade.

Here is what I believe the steps should be:

• Backup SMS and the two SGs.
• Verify/Update CPUSE – SMS and Gateways currently on Deployment Agent build 1999 R80.10 take 479. I believe this is latest, so we are good.
• On Smart-1 210/SMS update via Web GUI -> Upgrades (CPUSE) Status and Actions -> Major Versions -> select “R80.40…” Download and assuming Install will be the next option.
• Upgrade SmartConsole on my PC. Download via SMS WebGUI or CheckPoint
• Upgrade Security Gateways using this procedure. I am assuming it’s like #3.
  --- I'm reading there are several ways to upgrade, “connectivity upgrade” and “multi-version cluster upgrade”, but then also read from a post that SGs can be updated via SmartConsole on R81. So I'm a bit confused here trying to find out the best method.
• Post-upgrade checks (I’ll need to do more research on what else needs to be done here).

I am sure I am missing a lot of things to check or do. Please feel free to add anything you think I should be aware of.
Also if R80.40 is more stable, I'd be fine with at least upgrading to that version.

Thank you,

[motiami · Accepted solution]

Thanks a lot, much appriciate!
I'll run this in a LAB environment.

[motiami · Accepted solution]

Hi again,

I have just completed the upgrade process successfully in a LAB environment.

the gateways were running R80.10 and I have added some OSPF neighbors.

it turns out that the MVC process document was exactly what I was doing besides adding this command 'set cluster member mvc on' on the upgraded module just before the policy installation.

On my LAB, I could reproduce the OSPF issue but immediately after applying the command, OSPF came up and the cluster got synced.

Cheers!