Who rated this post

You don't technically need to, but pushes should be frequent anyway, otherwise you risk accumulating latent issues. That is, if you only push a given firewall's policy once per quarter, and you have a problem after a push, you have three months of changes to look through.

In my environment, we push every single policy almost every single weekday. Most are pushed M-F, some (from mergers) are only M-R. That way, if something breaks, we only need to review a few sessions to see what it could be.

The rest of this isn't directly related to updating the management server.

I find the best way to prevent outages is to test stuff as frequently as I realistically can. We do all updates and most upgrades with CDT, which has an automatic failover. We update everything at least twice per year, so every cluster gets at least two failovers per year to make sure both members actually work.

You may want to check out my cluster config diff tool. It runs on a management server, finds all the clusters which report to it, dumps their clish configurations, and checks for differences. This helps spot things which could be an issue (like a route on one member which was forgotten on the other member) before you fail over.