Upgrade CloudGuard Network for Azure VMSS GWLB

This section provides instructions for upgrading an already deployed CloudGuard Gateway Load Balancer VMSS solution.

The upgrade procedure includes these steps:

Deploying a new version of the CloudGuard Gateway Load Balancer VMSS solution alongside the older version (a side-by-side upgrade).
Reconfiguring Azure resources and Check Point configuration to use this new version of the CloudGuard Gateway Load Balancer VMSS solution.
Deleting the older version of the CloudGuard Gateway Load Balancer VMSS solution.

Note:

Do not upgrade the CloudGuard Gateway Load Balancer VMSS solution to get newer images of the same Check Point CloudGuard version. During each Scale Out operation, an instance with the latest available image for the current version (the most recent build within the same major version of CloudGuard Network for Azure VMSS) deploys automatically.
Make sure your current Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Multi-Domain Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. is compatible with the newer CloudGuard Gateway Load Balancer VMSS image you are deploying.

Terms:

Source - The original template and solution (with the lower version)
Target - The new template and solution (with the higher version)

To upgrade the CloudGuard Gateway Load Balancer VMSS solution

Step

Description

Open the resource group of the source CloudGuard Gateway Load Balancer VMSS solution.

For the Gateway Load Balancer ("frontend-lb"):

Create an empty backend pool.
Get the new backend pool's resource ID and write it down for future reference.
Add a new Frontend IP Configuration.

Deploy a target CloudGuard Gateway Load Balancer VMSS solution from the Azure Marketplace. To do this:

On the Basics tab, fill in the fields based on the Deployment Guide.
On the Check Point VMSS settings tab:
1. Select "Yes" in "Are you upgrading your CloudGuard VMSS solution?"
2. Use the same Security Management Server name as for the source CloudGuard Gateway Load Balancer VMSS solution.
3. Use a different configuration template name than in the source CloudGuard Gateway Load Balancer VMSS solution.
4. Enter the saved resource ID (from Step 3).
5. Enter name of the related backend pool (from Step 3).
On the Check Point CloudGuard settings tab, fill in the fields based on the Deployment Guide.
On the Network settings tab, use the same network settings (VNET and subnets) as for the source CloudGuard Gateway Load Balancer VMSS solution.
On the Tags tab, fill in the fields based on the Deployment Guide.

Add a new Load Balancing Rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session.:

Protocol: All, Frontend Port: 0, Backend Port: 0.
Backend Pool: The backend pool that you created in Step 3.
Frontend IP: The Frontend IP that you created in Step 3.
Associate with: The VMSS that you deployed in Step 4.

Configure the CME template.

For this, run:

autoprov_cfg add template -tn "<Template-Name>" -otp "<SIC-key>" -ver <Version> -po "<Policy-Name>"

Wait for provisioning to complete and for the policy to install on the new CloudGuard VMSS instances.

To use the new backend pools, change the Standard Load Balancer to point to the new Frontend IP configuration.

Note - In this step, all open connections on the source CloudGuard Gateway Load Balancer VMSS become closed.

Shut down the source CloudGuard Gateway Load Balancer VMSS and make sure that traffic flows correctly.

Note - Before proceeding, make sure the target VMSS handles all traffic (inbound, outbound, East-West) as expected.

Delete the CME template of the source CloudGuard Gateway Load Balancer VMSS.

For this, run:

autoprov_cfg delete template -tn "<Template-Name>"

Delete the corresponding VMSS resource.

Important - Do NOT delete the resource group of the source CloudGuard Gateway Load Balancer VMSS, as it can contain the VNET resource and Load Balancers currently in use.

Remove the backend pools referencing the source VMSS from the Gateway Load Balancer.