Updating the latest version of Jumbo General Availability gives an error

[nastiakhon]

Good afternoon, please help me upgrade to the latest version of Jumbo General Availability.
I have a link
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

But when executing this script, I get an error: central deployment is not supported from standalone servers.

Can I update somehow differently, or what do I need for this?

Thanks!

[Boaz_Orshav]

Hi

  Can you please specify which script do you use?

  If you use the Smart Console GUI - indeed the central deployment is not supported for a Stand Alone machine

[nastiakhon]

Hello, yes we use Smart Console.

Please tell me how can we update? and can we do without stopping services?
Thanks!

[Chris_Atkinson]

Gateway & Management combined?

Other update methods are via Web UI or CLI using CPUSE.

[G_W_Albrecht]

Second is first: No Jumbo without Reboot, sorry for that !

Central Deployment is a way to update / upgrade other CP devices from the SMS that downloads Jumbo or install image, transfers it to the device and after reboot checks if the update was successfull.

That mechanism is not able to upgrade the SMS itself out of obvious reasons 😉 The same is true with StandAlone Deployments (that are not suggested anyway...). So you have to use GAiA WebGUI.

[the_rock]

As @Chris_Atkinson advised, use web UI, thats your best bet, it will work 100%.

Andy

[nastiakhon]

Yes, that's right, Gateway & Management combined

I'm new to Checkpoint, and I don't quite know how to do it so that the service remains in a working state. Could you please advise.

If you say that through the web interface, then this is the control of the checkpoint itself?

Here?
Thanks!

[the_rock]

Hey, its all good, we are here to help, there are no insignificant or stupid questions as far as Im concerned. Yea, you got it, so screenshot you attached is what I meant...thats web UI. You just right click on the version you wish to upgrade, do verify first, to make sure its good to go and then you can click upgrade.

Message me privately if you need help, we can do remote session.

Andy

[nastiakhon]

Thanks for understanding)
I'm currently in the process of preparing for the update, I need to tell the management whether there will be a downtime during this update), can you tell me?)

[the_rock · Accepted solution]

Yes, 100% there will be. Ok, so let me explain in layman's terms the differences, just in case if you were not clear.

Management server - separate entity used to manage CP gateways

Single gateway - just one firewall, no cluster

Cluster - 2 or more firewalls either in HA or load sharing

Standalone - Management + gateway in one entity

Now, as it sounds like you have standalone, any time there is upgrade, reboot is needed, meaning there will be downtime, as any traffic going through it wont work for the time during reboot. One thing to remember, its possible device may not fetch latest policy, meaning it may default back to initial one, which blocks most things, so make sure you have physical access to unload it if that happens by running fw unloadlocal command

Andy

[nastiakhon]

Thanks!
But I do not quite understand what "may default back to initial one" means, does this mean that all settings will be lost?
Unfortunately, I have just such a situation that I do not have physical access to the equipment. Can I somehow prevent the checkpoint from getting and updating the latest version?

[the_rock]

Here is what that means...usually, when box reboots, it would fetch latest known policy before the reboot. So say if you installed policy March 20th and you upgraded March 22nd, then after the reboot upon the upgrade, firewall would try to get last know policy from March 20th. Sadly, that does not happen 100% of the time, so to be 100% safe, I always recommend people to have some way to physically access the box in case that happens, because if it loads initial policy, you wont be able to connect to it.

Andy

[nastiakhon]

By policy do you mean when we press the "install policy" button?

 

[the_rock]

yes...you can also run fw stat from expert to get current policy.

[nastiakhon]

I understand you, thank you very much for your help, I will inform my management that it is not safe for us to update now and that a physical presence is very desirable))) Maybe we will now postpone updates))

And thanks again!))

[the_rock]

Any time...My motto is always "Better be safe than sorry" ; - )

Andy

[nastiakhon]

I had a thought, is it possible to make some minor change, for example, create a rule that will not affect the network in any way, set a policy, and then update, in this case, even if the checkpoint returns to the previous policy, this will not affect it in any way on him. Or won't it work like that?
Thanks!

[the_rock]

Dont do that, I will tell you why...let me give you example that happened to me in my lab couple of months back. What happened was this...I created brand new R81.10 lab with mgmt and firewall, but same happened even with R81 base standalone. I left policy as any any allow, upgraded, rebooted and first time, it kept the policy, but when I applied jumbo hotfix, it reverted to initial policy, which blocked pings, I could not web UI on custom port, only ssh and obviously, no traffic worked. 

What Im trying to tell you is this...does not matter if your policy is one rule any any allow all or 10000 rules, it wont make a difference. This is just me, I wont speak for anyone else, but I had customers tell me before after I insist they have physical access on site...no no, nothing will happen and then when it does (in rare cases), they have to drive 2 hours to get access. Trust me when I say this, you do NOT want to be one of those people.

[nastiakhon]

Yes, okay, I realized that it is really dangerous, especially that this equipment is 600 km away and it is located in another city)))
THANK YOU!!))

[the_rock]

Well, if you dont mind driving 600 kms, by all means : - ). My record is 1400 kms in one day, but certainly NOT for this reason, haha.

Andy