Cloud Firewall VMSS Solution Upgrade

This section provides instructions for upgrading an already deployed Cloud Firewall VMSS solution.

The upgrade procedure includes these steps:

  1. Deploying a new version of the Cloud Firewall VMSS solution alongside the older version (a side-by-side upgrade).

  2. Reconfiguring Azure resources and Check Point configuration to use this new version of the Cloud Firewall VMSS solution.

    Note - This procedure includes a connection draining mechanism which allows in-flight sessions to complete gracefully before de-allocating Virtual Machines. This ensures continuous service availability and supports zero-downtime deployments during instance scale-in, maintenance, or updates.

  3. Deleting the older version of the Cloud Firewall VMSS solution.

Note:

Terms:

  • Source - The original template and solution (with the lower version)

  • Target - The new template and solution (with the higher version)

Step

Description

1

Log in to the Azure portal.

2

Open the resource group of the source Cloud Firewall VMSS solution.

3

For the External Load Balancer ("frontend-lb") and the Internal Load Balancer ("backend-lb"):

  1. Get resource IDs of those load balancers and write them down for future reference.

  2. Get the names of their related backend pools and write them down for future reference.

4

Deploy a target Cloud Firewall VMSS solution from the Azure Marketplace. To do this:

  1. On the Basics tab, fill in the fields based on the Deployment Guide.

  2. On the Check Point VMSS settings tab:

    1. Select "Yes" in "Are you upgrading your CloudGuard VMSS solution?"

    2. Use the same Security Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. name as for the source Cloud Firewall VMSS solution.

    3. Use a different configuration template name than in the source Cloud Firewall VMSS solution.

    4. Select the same Load Balancers deployment mode as for the source Cloud Firewall VMSS solution.

    5. Enter resource IDs of the External Load Balancer and Internal Load Balancer (from Step 3).

    6. Enter names of the related backend pools (from Step 3).

  3. On the Check Point Cloud Firewall settings tab, fill in the fields based on the Deployment Guide.

  4. On the Network settings tab, use the same network settings (VNET and subnets) as for the source Cloud Firewall VMSS solution.

  5. On the Tags tab, fill in the fields based on the Deployment Guide.

5

Configure the CME template.

For this, use SmartConsole or CME API.

Note - We do not recommend using autoprov_cfg. Though you can still use this command:

autoprov_cfg add template -tn "<Template-Name>" -otp "<SIC-key>" -ver <Version> -po "<Policy-Name>"

6

Wait for provisioning to complete and for the policy to install on the new Cloud Firewall VMSS instances.

7

Make sure the new Cloud Firewall GatewayClosed Check Point Virtual Security Gateway that protects dynamic virtual environments with policy enforcement. Cloud Firewall Gateway inspects traffic between Virtual Machines to enforce security, without changing the Virtual Network topology. instances are added to the Frontend-LB and Backend-LB backend pools and new Cloud Firewall Gateway objects appear in SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

8

Drain connections from source Cloud Firewall VMSS instances:

  1. Connect to the sourceCloud Firewall VMSS instance via SSH.

  2. Check if there are active connections to that instance.

    For that, in Expert mode, run the following command to view the number of active connections:

    fw tab -t connections -s

  3. Check the current Load Balancer health probe port number with this command:

    fw ctl get int cloud_balancer_port

    The default port number is 8117.

  4. Disable Cloud Firewall VMSS instance responses to Load Balancer health probes. This stops creation of new connections. For that, run:

    fw ctl set int cloud_balancer_port 0

9

Monitor traffic drain with this command:

fw tab -t connections -s

Wait until the number of active connections decreases significantly.

Note - System connections usually persist so the value will never be 0.

10

Note - In this step, all open connections on the source Cloud Firewall VMSS become closed.

Shut down the source Cloud Firewall VMSS and make sure that traffic flows correctly:

  1. In the Azure Portal, go to the Virtual Machine Scale Set.

  2. Select the source Scale Set.

  3. Go to the Scaling section.

  4. Set Instance Limits to Minimum 0, Maximum 0, Default 0.

11

Note - Before proceeding, make sure the target VMSS handles all traffic (inbound, outbound, East-West) as expected.

Delete the CME template of the source Cloud Firewall VMSS.

For this, use SmartConsole or CME API.

Note - We do not recommend using autoprov_cfg. Though you can still use this command:

autoprov_cfg delete template -tn "<Template-Name>"

12

Delete the corresponding VMSS resource.

Important - Do NOT delete the resource group of the source Cloud Firewall VMSS, as it can contain the VNET resource and Load Balancers currently in use.

Additional Information

Major upgrades:

Major upgrades happen when a new product version is installed (for example, when R81.20 is upgraded to R82.10).

During a scale-out event, the latest available image in the marketplace (the most recent build within the same major version of Cloud Firewall for Azure VMSS) is deployed on the new Virtual Machines.

Check Point recommends using the latest image for the best security and performance, but you can deploy a specific version of Azure image using this guide for reference.

For the latest versions of Cloud Firewall for Azure VMSS, see sk132192.

Minor upgrades:

Minor upgrades are performed with Jumbo HotfixClosed Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior. Accumulators - special packages which contain stability and quality fixes, and enhancements that resolve multiple issues across different products.

To install Jumbo Hotfix AccumulatorClosed Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA., see this guide.

If you have questions about the Jumbo Hotfix Accumulator deployment, see sk98028.