- Products
- Learn
- Local User Groups
- Partners
- More
Maestro Masters
Round Table session with Maestro experts
We are running a Maestro environment 2x MHOs, 5 SGMs in one security group, VSX, R81.10 Jumbo take 95, 5 private hotfixes.
We want to update the whole environment to Jumbo take 130. 4 of the private fixes are included in take 130. For one we need a new private hotfix. The normal update procedure:
- uninstall all 5 private hotfixes one by one
- install take 130
- install the one private hotfix (customizeded for take 130)
Every install requires a reboot and the whole process takes around 20min for every install / uninstall. This will result in very long running process for 5 SGMs (140min per SGM).
Can we speed up the process removing SGMs from SG and adding them back ?
Is it possible to update the SGM holding the SMO first and then update the other via image-cloning ?
We had an advice from PS not using auto-image-cloning with VSX. Auto-cloning is now disabled but maybe we can enable this temporarily for the update process?
Any other advice to speed up the update process is welcome.
Several options, one of them being that you can do patch operations on multiple SGMs at once and if you do it via CLI you may be able to suppress the reboot for the uninstalls (but still good to have a reboot between the uninstalls and the JHF install), so that will save a little time.
The auto-clone option should also work as long as you do it on the right SGM. Remember that SMO role will always move to the lowest SGM ID that is active, so while SGM 1_1 is down, SGM 1_2 will be SMO. Just remember to keep auto-clone disabled until 1_1 is finished, and know that when you enable auto-clone the other SGMs may take it upon themselves to check at any time and start the auto-clone/reboot operation of their own free will. So it's possible that you'll end up running on one SGM for a time. Hence we don't recommend using auto-clone for patching operations, as there's no guarantee that you'll be able to control the process fully.
Ultimately the recommended process will be the manual process on multiple SGMs at a time in a window where there's low traffic, due to the unpredictable nature of doing it via auto-clone.
Several options, one of them being that you can do patch operations on multiple SGMs at once and if you do it via CLI you may be able to suppress the reboot for the uninstalls (but still good to have a reboot between the uninstalls and the JHF install), so that will save a little time.
The auto-clone option should also work as long as you do it on the right SGM. Remember that SMO role will always move to the lowest SGM ID that is active, so while SGM 1_1 is down, SGM 1_2 will be SMO. Just remember to keep auto-clone disabled until 1_1 is finished, and know that when you enable auto-clone the other SGMs may take it upon themselves to check at any time and start the auto-clone/reboot operation of their own free will. So it's possible that you'll end up running on one SGM for a time. Hence we don't recommend using auto-clone for patching operations, as there's no guarantee that you'll be able to control the process fully.
Ultimately the recommended process will be the manual process on multiple SGMs at a time in a window where there's low traffic, due to the unpredictable nature of doing it via auto-clone.
I have heard the same rumors from PS not to use image autoclone, but when asking R&D nobody is aware of this.
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
User | Count |
---|---|
19 | |
3 | |
2 | |
2 | |
2 | |
1 | |
1 | |
1 | |
1 | |
1 |
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY