Package Installation in Clusters

When all Cluster Members are marked for installation in the Installation Candidates List File, the CDT upgrades all Cluster Members automatically:

  • In ClusterXL High Availability mode - the CDT first upgrades the Standby members, and then the CDT upgrades the former Active member.

  • In VRRP Cluster - the CDT first upgrades the VRRP Backup member, and then the CDT upgrades the former VRRP Master member.

  • In VSX Virtual System Load Sharing (VSLS) cluster - the CDT first upgrades all the members listed as VSLS member in the Installation Candidates List File, and then the CDT upgrades the member listed as the VSLS active member in the Installation Candidates List File.

CDT and the cluster Connectivity Upgrade:

For version upgrades (not installation of Hotfixes), the CDT runs the cluster Connectivity Upgrade (CU) by default. Meaning that the connections are synchronized between the Cluster Members.

If you wish to disable this behavior, follow the instructions below:

In the CDT primary configuration file (see CDT Primary Configuration File), add the "<PackageToInstall>" element, with both the attribute "Path="..."" and the attribute "ConnectivityUpgrade="false"":

<PackageToInstall Path="/<Your_Path_To>/<File_Name_of_CPUSE_Offline_Package>.<File_Extension>" ConnectivityUpgrade="false" />

In the Deployment Plan File (see Deployment Plan File), in the element "<plan_settings>", add the attribute "<ConnectivityUpgrade value="false" />" (see Example 5 - Run a Script, Uninstall a Hotfix, Upgrade, Install a Hotfix, Log and Send Email, Pull a File).

Cluster Upgrade

Workflow

Automatic

cluster

upgrade

  1. Upgrade these Cluster Members:

    • In ClusterXL High Availability mode - the Standby members.

    • In VRRP Cluster - the VRRP Backup member.

    • In VSX VSLS cluster - the members listed as VSLS member in the Installation Candidates List File.

  2. Run the Connectivity Upgrade (if it is enabled in the Deployment Plan File).

    The Connectivity Upgrade performs the cluster failover.

  3. Upgrade these Cluster Members:

    • In ClusterXL High Availability mode - the former Active member.

    • In VRRP Cluster - the former VRRP Master member.

    • In VSX VSLS cluster - the member listed as VSLS active member in the Installation Candidates List File.

Note - Cluster health checks make sure that the cluster is upgraded successfully.

Semi-automatic

cluster

upgrade

  1. Exclude this Cluster Member from the upgrade in the Installation Candidates List File:

    • In ClusterXL High Availability mode - the member listed as "active" in the Installation Candidates List File.

    • In VRRP Cluster - the member listed as "master" in the Installation Candidates List File.

    • In VSX VSLS cluster - the member listed as "VSLS active member" in the Installation Candidates List File.

    To exclude a Cluster Member from a package installation, enter the "-" (minus) character in the "Upgrade Order" column.

             Object Name ,         Cluster Name ,      IP Address ,  Version/JHF Take ,                 State , Upgrade Order
=========================================================================================================================
          MEM-68.146 ,     ClusterXL-68.148 ,  192.168.68.146 ,        R80.20/205 ,                active ,             -
          MEM-68.147 ,     ClusterXL-68.148 ,  192.168.68.147 ,        R80.20/205 ,               standby ,             1

  2. Install the upgrade package. This upgrades only these Cluster Members:

    • In ClusterXL High Availability mode - the Standby members.

    • In VRRP Cluster - the VRRP Backup member.

    • In VSX VSLS cluster - the members listed as VSLS member in the Installation Candidates List File.

    Important - If the target version is R80.40 in a ClusterXL High Availability, you must enable the Multi Version Cluster mode on the upgraded Cluster Member with the "cphaconf mvc on" command.

  3. Generate the Installation Candidates List File again.

  4. The CDT marks these Cluster Members as installed:

    • In ClusterXL High Availability mode - the Standby members.

    • In VRRP Cluster - the VRRP Backup member.

    • In VSX VSLS cluster - the members listed as VSLS member in the Installation Candidates List File.

  5. The CDT marks these Cluster Members with "1":

    • In ClusterXL High Availability mode - the Active member.

    • In VRRP Cluster - the VRRP Master member.

    • In VSX VSLS cluster - the member listed as VSLS active member in the Installation Candidates List File.

  6. Install the upgrade package again. The CDT runs the upgrade automatically.

    This upgrades only these Cluster Members:

    • In ClusterXL High Availability mode - the former Active member.

    • In VRRP Cluster - the former VRRP Master member.

    • In VSX VSLS cluster - the member listed as VSLS active member in the Installation Candidates List File.

Notes:

  • Upgrade in clusters follows a specific order.

    • In ClusterXL High Availability mode - You cannot upgrade the ClusterXL Active member before you upgrade all the ClusterXL Standby members.

    • In VRRP Cluster - You cannot upgrade the VRRP Master member before you upgrade the VRRP Backup member.

    • In VSX VSLS cluster - You cannot upgrade the Cluster Members listed as "VSLS active member" in the Installation Candidates List File before you upgrade the Cluster Members listed as "VSLS member" in the Installation Candidates List File.

  • Cluster installation stops in specific cases.

    • In ClusterXL High Availability mode - If the upgrade of the ClusterXL Standby members fails.

    • In VRRP Cluster - If the upgrade of the VRRP Backup member fails.

    • In VSX VSLS cluster - If the upgrade of the Cluster Members listed as "VSLS member" in the Installation Candidates List File fails.

  • If the installation succeeds on the first Cluster Member, but fails on others, the CDT does not revert it.

    If the installation on the first Cluster Member succeeds, but the installation on the other Cluster Members fails, the CDT does not revert the first Cluster Member.

  • The Full Connectivity Upgrade for VRRP Clusters is supported only when you upgrade to R80.10 or R80.30 versions.

    Important - This note applies only to CDT versions 1.9.4 and lower.

    When you upgrade to R77.30 or R80.20, there are two options:

    Option

    Description

    A

    Disable the Connectivity Upgrade (otherwise, the cluster is marked as "N/A").

    To disable the Connectivity Upgrade in the Deployment Plan File, in the element "<plan_settings>", add the attribute "<ConnectivityUpgrade value="false" /> " (see Example 5 - Run a Script, Uninstall a Hotfix, Upgrade, Install a Hotfix, Log and Send Email, Pull a File).

    B

    Run the Connectivity Upgrade:

    1. In the $CDTDIR/CentralDeploymentTool.xml file, add this debug configuration (see Debug Configuration):

      <Debug CUSyncForVRRP="true">

    2. In the Deployment Plan File, after the installation of an upgrade package, add the installation of a Jumbo Hotfix Accumulator package:

      • For Security Gateways R77.30, you must use the Jumbo Hotfix Accumulator Take 342 or above. See sk106162.

      • For Security Gateways R80.20, you must use the Jumbo Hotfix Accumulator Take 17 or above. See Jumbo Hotfix Accumulator for R80.20.

    Copy
    Example for a Security Gateway R80.20 (the instructions contain four lines):
    <import_package path="/home/admin/Check_Point_R80.20_T101_Fresh_Install_and_Upgrade_Security_Gateway.tgz" />
    <install_package path="/home/admin/Check_Point_R80.20_T101_Fresh_Install_and_Upgrade_Security_Gateway.tgz" />
    <import_package path="/home/admin/Check_Point_R80_20_JUMBO_HF_Bundle_T17_sk137592_FULL.tgz" />
    <install_package path="/home/admin/Check_Point_R80_20_JUMBO_HF_Bundle_T17_sk137592_FULL.tgz" />