Upgrading Cloud Firewall NVA for Azure Virtual WAN

There are two options to upgrade Cloud Firewall NVA Network Virtual Appliance - A resource deployed in Azure's Virtual Hub that includes Security Gateways and other networking infrastructure. for Azure Virtual WAN:

• Side-by-side upgrade - Choose side-by-side upgrade if you prefer to deploy a new upgraded cluster Two or more Check Point Firewalls that work together in a redundant configuration - High Availability, or Load Sharing. and migrate traffic by updating the routing intent.

• In-place upgrade - Choose in-place upgrade when you must preserve the existing public IP address of the NVA.This method is required in the following scenarios:

• Site-to-Site VPN - Changing the public IP address requires you to update all remote VPN peer configurations.

• Client-to-Site VPN - Changing the public IP address requires you to update VPN clients or update the FQDN that points to the public IP address.

• SD-WAN Software Defined – Wide Area Network (WAN), more information on this solution: https://www.checkpoint.com/cyber-hub/network-security/what-is-sd-wan/ deployments - SD-WAN relies on VPN overlay networks that are tied to the existing IP address.

• Third-party allow-list configurations - External systems allow traffic only from your current public IP address.

Side-by-Side Upgrade

Side-by-Side upgrade results in a new NVA with new Cloud Firewall Gateways deployed.

The IP addresses of the new Cloud Firewall Gateways are different from the old Cloud Firewall Gateways' IP addresses.

Follow this procedure:

1. Deploy a new NVA in the Virtual Hub (with a public IP address if you need ingress traffic.).

   When performing an upgrade, select Yes for the "Are you upgrading your Cloud Firewall NVA deployment?" parameter.

   

   Refer to Step 4: Deploy new Cloud Firewall NVA in the Virtual WAN Hub for more information.

2. Custom configurations adjustments (if required)

   • Configure the Cloud Firewall Gateways of the NVA with SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on.: Adjust the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. to include the new Cloud Firewall Gateways' IP addresses.

   • If there is configuration on related machines, update them to use the updated IP addresses (for example BGP settings).

3. If Ingress traffic is configured:

   1. Delete the configured ingress rules using CME API.

   2. Detach the public IP address from the old NVA SLB Software Load Balancer, used to distribute tenant and tenant customer network traffic to virtual network resources. SLB enables multiple servers to host the same workload, providing high availability and scalability.

   3. Attach the public IP address to the new NVA.

   4. Establish the load balancing and NSG rules.

   5. Confirm that the NAT rules are correctly aligned.

4. Install the policy on the new Cloud Firewall Gateways.

5. Navigate to the Virtual Hub and select Routing Intent and Routing Policies.

6. In Next Hop Resource select the new NVA instead of the previous NVA.

In-Place-Upgrade

Follow this procedure to upgrade Security Gateway instances one at a time and reduce impact to production traffic.

Important considerations:

• Serial Console access to NVAs is not available in Azure Virtual WAN.

• You can reboot an NVA from the Azure Portal.

• You can re-image an NVA from the Azure Portal. Re-image restores the factory default image and requires full reconfiguration.

• Always back up each NVA before you begin the upgrade.

• In-place upgrade does not cause a full outage. However, the remaining NVAs must handle all traffic while each NVA is being upgraded.

Pre-upgrade checklist:

Complete these steps before you upgrade each NVA.

1. In SmartConsole, open the Logs view and confirm that all NVAs are actively passing traffic.

2. Make sure that all private hotfixes applied to the current version are included in the target version.

3. Back up each NVA before you start the upgrade. For backup instructions, see sk108902 - Best Practices - Backup on Gaia OS.

4. Check available disk space. You need at least 15 GB of free disk space in the /var/log directory. To check disk space, run this command:

   df -h

   If free disk space is insufficient:

   1. Follow the instructions in sk63361 - How to clean up disk space on a Security Gateway or Security Management Server.

   2. If disk space cannot be recovered, re-image the NVA from the Azure Portal. Note that re-imaging requires full reconfiguration of the NVA.

Upgrade Flow

Upgrade one NVA at a time to minimize traffic disruption and ensure redundancy. Complete all four steps for each NVA before you move to the next one.

Step 1: Remove the NVA from rotation

1. Disable the Azure Load Balancer health probes for the NVA you are upgrading. This prevents new traffic from being sent to it.

2. Perform connection draining to allow existing connections to complete before the upgrade begins. For instructions, see sk170304 - Azure network load balancer and connection draining to Check Point Gateways.

Step 2: Perform the upgrade

1. Download and install the upgrade package (as described in sk177714 - In-Place Upgrade packages for Cloud Firewall).

2. Allow the NVA to reboot.

3. Wait for post-upgrade initialization to complete.

4. In SmartConsole, update the Cloud Firewall object to reflect the new version and install the security policy.

Step 3: Return the NVA to service

1. Re-enable the Azure Load Balancer health probes for the upgraded NVA.

2. Confirm that the Cloud Firewall Gateway Check Point Virtual Security Gateway that protects dynamic virtual environments with policy enforcement. Cloud Firewall Gateway inspects traffic between Virtual Machines to enforce security, without changing the Virtual Network topology. passes health checks and receives traffic..

Step 4: Repeat for each remaining NVA

Repeat Steps 1 through 3 for every remaining NVA in the cluster.

Recovery

If an NVA becomes unresponsive during the upgrade, see Troubleshooting of Cloud Firewall NVA for Azure Virtual WAN.