Other Cluster Upgrade Methods

Minimal Effort Upgrade

Select this method, if you have a period of time, during which network downtime is allowed.

This method is the simplest, because it lets you upgrade each Cluster Member as an independent Security Gateway. All connections that were initiated before the upgrade, are dropped during the upgrade.

You can select this method, if you upgrade a ClusterXL or a VSX Cluster.

You can select this method, if you upgrade a 3rd party cluster (VRRP on Gaia).

Zero Downtime

Select this method, if you cannot have any network downtime and need to complete the upgrade quickly, with a minimal number of dropped connections.

During this type of upgrade, there is always at least one Active Cluster Member in cluster that handles traffic.

All connections that were initiated through a Cluster Member that runs the old version, are dropped when you upgrade that Cluster Member to a new version, because Cluster Members that run different Check Point software versions, cannot synchronize connections.

Network connectivity, however, remains available during the upgrade, and connections initiated through an upgraded cluster member are not dropped.

You can select this method, if you upgrade a ClusterXL or a VSX Cluster.

You can select this method, if you upgrade a 3rd party cluster (VRRP on Gaia).

Optimal Service Upgrade (OSU)

Select this method, if security is of utmost concern.

During this type of upgrade, all Cluster Members process the network traffic.

Connections that are initiated during the upgrade stay up through the upgrade. A minimal number of connections that were initiated before the upgrade and were not closed during the upgrade procedure, are dropped after the upgrade.

Newly established connections are forwarded to the upgraded cluster members while the cluster members running the previous version continue to inspect the old existing connections. The more time the upgrade procedure takes, the less old connections exist, and upon stopping the cluster members running the previous version, the connection drop is minimal. Despite long duration of this upgrade procedure, security and connectivity are fully maintained.

You can select this method, if you upgrade a ClusterXL or a VSX Cluster.

This method does not support a 3rd party cluster (VRRP on Gaia).