Upgrade

Log in to the Azure portal.

Provide an access role with Contributor permission for the new CloudGuard Network High Availability members to these resource groups:

1. The resource group that contains the original VNet.

2. The resource group that contains the old Cluster IP addresses and the Load Balancer.

For more information, see Step 2: Set Credentials in Azure.

Note - Access is granted after a few minutes to an hour.

You have two options to use the old Cluster VIP address:

• Option one: Move the old Cluster VIP resource to the new resource group:

  1. From the Azure Portal > original resource group, access the public IP resource of the VIP.

  2. In the Overview tab, click (move) next to the resource group.

  3. Below Target, next to Resource group, select the name of the new resource group.

  4. Click Next.

  5. Click Move.

  6. Edit the configuration file $FWDIR/conf/azure-ha.json as shown in Option two below, and replace the public IP name with the original cluster VIP resource name.

• Option two: Reference the old Cluster VIP from the old resource group:

  On each Cluster Member, edit the configuration file located at $FWDIR/conf/azure-ha.json

  • Starting from image build number 1266 the configuration schema is modified.

    Under "clusterNetworkInterfaces" > "eth0" > "pub", replace the public IP name with the original cluster VIP resource id.

    Example:

    • Old:

      "clusterNetworkInterfaces": { "eth0": [ { "name":"cluster-vip", "addr":"10.4.0.6", "pub":"ClusterNameTest" { ] },

    • New:

      "clusterNetworkInterfaces": { "eth0": [ { "name":"cluster-vip", "addr":"10.4.0.6", "pub":"/subscriptions/123/resourceGroups/ha-rg/providers/Microsoft.Network/publicIPAddresses/originalHAClusterIp" } ] },

  • For image build number 1265 and lower, under "clusterNetworkInterfaces" > "etho", replace the public IP name with the original Cluster VIP resource id.

    Example:

    • Old:

      "clusterNetworkInterfaces": { "eth0": [ "10.72.0.6", "newHAClusterIp" ] },

    • New:

      "clusterNetworkInterfaces": { "eth0": [ "10.72.0.6", "/subscriptions/123/resourceGroups/ha-rg/providers/Microsoft.Network/publicIPAddresses/originalHAClusterIp" ] },

Delete the External Load Balancer and the Internal Load Balancer. Dissociate the public Cluster address created in the deployment of the new Check Point CloudGuard Network Security High Availability (step 1), then delete it as well. All of the above are located in the new Check Point CloudGuard Network Security High Availability resource group.

Add the new Check Point CloudGuard Network Security High Availability's members to the backend pools:

For each Load Balancer used in the original solution, add the new members to the existing backend pools.

Make sure to select the right IP address (private internal for the backend Load Balancer and private external to the frontend Load Balancer).

Delete the old Check Point CloudGuard Network Security High Availability's members from the backend pools of each Load Balancer used in the original solution.

Detach the Cluster VIP from the original Check Point CloudGuard Network High Availability's members:

1. Stop both original Check Point CloudGuard Network High Availability's members from the Azure portal.

2. Select the Active Cluster Member's primary NIC > IP configuration > "cluster-vip" in the original Check Point CloudGuard Network Cluster and delete it.

Initiate a failover in the new CloudGuard Network High Availability to attach the original Cluster VIP to the new members.

Deploy a new Check Point CloudGuard Network Security High Availability solution.

Use the same network configurations as in the existing CloudGuard Network Security Cluster solution.

Important - When deploying an existing VNet, you must either create or change the Network Security Groups, as they are not automatically created.

Setup routes on Cluster Members to the Internal Subnets.

To set up routes on the Cluster Members to the internal subnets:

Step	Description
1	Connect over SSH to each of the Cluster Members.
2	Log in to Gaia Clish, or Expert mode.
3	Add this route: In Gaia Clish, run these two commands: set static-route <Virtual-Network-IP-address/Prefix> nexthop gateway address <eth1-router-IP-address> on save config In Expert mode, run this command: clish -c 'set static-route <Virtual-Network-IP-address/Prefix> nexthop gateway address <eth1-router-IP-address> on' -s Example: set static-route 10.0.0.0/16 nexthop gateway address 10.0.2.1 on

Parameters:

Parameter	Description
<Virtual-Network-IP-address/Prefix>	Specifies the prefix of the entire Virtual Network. Example: 10.0.0.0/16
<eth1-router-IP-address>	Specifies the first unicast IP address on the subnet, to which the eth1 is connected. Example: 10.0.2.1

Notes:

• Routes to the private address space IP ranges specified in RFC 1918 are configured automatically.

• If the Virtual Network has several non-contiguous address prefixes, repeat the command for each prefix.

• For vNET Peering:

  • Add a compatible route on each peer network.

  • Add the route for vNET peering to each Cluster Member.

Update your existing Cluster object in SmartConsole:

Important - Do not install policy.

1. In SmartConsole, double-click on the existing Cluster object.

2. In General Properties:

   1. In the Virtual IPv4 address, enter the public address allocated for the new CloudGuardNetwork Security High Availability.
      Note - The Cluster IP address is found in the Azure portal by selecting the Active Cluster Member's NIC > IP configuration > "cluster-vip".

   2. If necessary, update the version.

3. Under Cluster Members update each member to match the compatible member of the new Check Point Network Security High Availability. Enter the IPv4 address and then create a SIC connection (after resetting the current communication).

   If you manage the Cluster from the same Virtual Network, enter the Cluster Member's private IP address. Otherwise, enter the Cluster Member's public IP address.

4. In Network Management:

   1. Double-click the interface eth0: In the Virtual IPv4 field, and then enter the private VIP address and subnet mask of the new Network Security High Availability.

   2. For both eth0 and eth1, Modify the Members IPs to match the new IP addresses of Network Security High Availability members.

      Enter the external private IP address in eth0 and internal private IP address in eth1.

5. For a VPN configuration, click IPsec VPN > Link selection.

   In the Outgoing Route Selection:

   1. Click Source IP address settings.

   2. Select Manual.

   3. Click Selected address from topology table.

   4. Select the private Cluster VIP address of the new Network Security High Availability.

Install the applicable Policy on the Cluster object.