Hi Romain! I'm not Checkpoint but will try to help - it's not a straight forward case as it depends on many factors like how many cluster members you have or if you use dynamic routing. I will just assume simple case - two cluster members and no dynamic routing and all VSes are active on one box.
Ideally test all your upgrades in the VM lab if that's an option for you. I don't have exact screenshots as we did long time ago but hopefully it helps.
Make sure your gateway has connectivity to CP (manually or you can use script sk83520 how to check connectivity to CP )
CPUSE reference guide is here Check Point Upgrade Service Engine (CPUSE) - Gaia Deployment Agent
1. Backup all your systems - gateways and management so you have solid rollback
2. Update VSX cluster object version on management server using vsx_util upgrade command:
When prompted, enter this information:
a) Security Gateway or main Domain Management Server IP address
b) Administrator name and password
c) Cluster name (if the VSX Gateway is a cluster member)
d) Version to upgrade to: R80.10
3. Log into standby VSX member CLISH and perform CPUSE upgrade:
HostName:0> show installer packages available-for-download
HostName:0> installer download <Package_Number for R80.10>
HostName:0> installer verify[press Space key][press Tab key]
HostName:0> installer verify <Package_Number for R80.10>
You should see something like this:
Result: Verifier results: Clean Install: Installation is allowed. Upgrade: Upgrade is allowed.
Status: Available for Install
HostName:0> installer upgrade[press Space key][press Tab key]
HostName:0> installer upgrade <Package_Number>
It should reboot itself at the end
Wait till VSX is up again and verify that you are running on R80.10
4. Cutover from R77 to R80 (reference here Connectivity Upgrade R77.x and R80.x Versions Best Practices )
On the upgraded member, run: cphaprob state
Make sure that this cluster member is in the Ready state.
On the cluster member that still runs the previous version, run: cphaprob state
Make sure that this cluster member is in Active or Active Attention state, and that the upgraded member is in Down state.
On the upgraded member, run: cphacu start no_dr
Make sure that the Connectivity Upgrade is complete.
On the cluster member that still runs the previous version, run:
fwaccel off -a
fwaccel stat -a
Make sure the SecureXL is disabled (off). This is required to synchronize delayed connections.
cpstop (this is cutover!)
On the upgraded cluster member, run: cphaprob state
Make sure this cluster member is in Active state.
Make sure this cluster member handles the traffic.
5. Do your testing on newly upgraded member
6. Upgrade remaining cluster member just like in step 3. Once upgrade is complete and all VSes are up it should automatically fail back to it.
Hope it helps!