Upgrading from a Minor Release

In This Section:

Upgrading a Dual-Chassis System from a Minor Release

Upgrading a Single Chassis System from a Minor Release

To upgrade from a minor release, use an HFA Upgrade package. Download it from the R76SP.50 60000/40000 Security Platforms Home Page.

Upgrading a Dual-Chassis System from a Minor Release

Use this procedure to upgrade to R76SP.50 from: R76SP.10, R76SP.20, R76SP.30 and R76SP.40.

Notes:

The minor upgrade procedure from R76SP should be done as a major upgrade.
Before you upgrade from R76SP.10 or R76SP.20, check that there are no Virtual Systems running with the Initial Policy. Run: vsx stat -v
In this procedure, upgrade one Chassis at a time. The other Chassis continues to handle traffic.
Upgrade Chassis B through an SGM on Chassis A, and then upgrade Chassis A through an SGM on Chassis B.
Bond interfaces that are not connected to any Virtual System, should be deleted from the topology before the upgrade procedure.
Important for the VSX System in VSLS mode: The upgrade procedure will change the system to the VSX High Availability mode.
Change the system back to VSX VSLS mode when the upgrade procedure is complete.
When the command includes -c, enter the Chassis ID only, not the word chassis.
For example: # asg chassis_admin -c 1 down
When the command includes -b, enter the word Chassis and its ID of Chassis1 or Chassis2.
For example: # g_reboot -a -b chassis1

Preliminary Steps


Step	Operation	Command
1	Make sure that all SGMs and SSMs are up to date and that the system is configured correctly.	`# asg diag verify`
2	Copy the HFA Upgrade package to the SMO.	`Check_Point_R76SP_50_upgrade.linux.tgz`
3	Create a temporary directory on the SMO in: `/home/admin/`	`# mkdir -v /home/admin/temp` If a temporary directory already exists, delete it first with this command: `# g_all rm -rf /home/admin/temp`
4	Extract the HFA Upgrade package to the temporary directory.	`# tar -xvzf /home/admin/Check_Point_R76SP_50_upgrade.linux.tgz -C /home/admin/temp/`
Best Practice - Connect over a console to the SMO and run the next steps through the console connection.
5	Run the pre-installation script.	`# cd /home/admin/temp/` `# ./AsgInstallScript pre_install`

Upgrading Chassis B


Step	Operation	Command
6	Set Chassis B to administratively DOWN state.	`> asg chassis_admin -c <`Chassis_B_ID`> down`
7	Make sure that Chassis B is in administratively DOWN state.	`> asg monitor -all`
8	Upgrade Chassis B. Note - Make sure to run the script from Chassis A and not Chassis B.	`# cd /home/admin/temp/` `# ./AsgInstallScript –b chassis`<Chassis_B_ID>
Confirm that the HFA Upgrade installation procedure completed successfully. A summary message shows when the upgrade is complete.
9	If the installation was successful: a. You are prompted to upgrade the SSM firmware. You can do this now or later. b. Reboot the SGMs when prompted. Wait until all SGMs are UP.	If you do not upgrade the firmware now at the prompt, upgrade it later with: `#` `asg_ssm_upgrade`
10	Make sure that all SGMs show the correct version. Note - SGMs on Chassis A show as failed, or show the previous version. This is normal, and you can continue to the next step.	`# asg_version -v`

Failing Over to Chassis B

Step	Operation	Command
11	Set Chassis B to administratively UP state.	`> asg chassis_admin -c` <Chassis_B_ID> `up`
12	Run the diagnostics.	`# asg policy verify –a [-vs all]` `# asg_route -a [--vs all]`
13	Make sure that Chassis B is UP and enforces security. Important - You must correct all errors shown by the diagnostics before you continue to the next step.	`> asg stat -v`
14	Set Chassis A to administratively DOWN state.	`> asg chassis_admin -c` <Chassis_A_ID> `down`
15	Make sure that all SGMs are UP, and that traffic flows normally on Chassis B. Important - Make sure Chassis B works correctly before you upgrade Chassis A.	`> asg monitor [-vs all]` `> asg perf [-vs all] -v`

Upgrading Chassis A


Step	Operation	Command
16	Copy the HFA Upgrade package to the SMO.	`Check_Point_R76SP_50_upgrade.linux.tgz`
17	Create a temporary directory on the SMO in: `/home/admin/`	`# mkdir -v /home/admin/temp` If a temporary directory already exists, delete it first with this command: `# g_all rm -rf /home/admin/temp`
18	Extract the HFA Upgrade package to the temporary directory.	`# tar -xvzf /home/admin/Check_Point_R76SP_50_upgrade.linux.tgz -C /home/admin/temp/`
Best Practice - Connect over a console to the SMO and run the next steps through the console connection.
19	Make sure that Chassis A is in administratively DOWN state.	`> asg monitor -all`
20	Upgrade Chassis A. Note - Make sure to run the script from Chassis B and not Chassis A.	`# cd /home/admin/temp/` `# ./AsgInstallScript -b chassis`<Chassis_A_ID>
Confirm that the HFA Upgrade installation procedure completed successfully. A summary message shows when the upgrade is complete.
21	If the installation was successful: a. You are prompted to upgrade the SSM firmware. You can do this now or later. b. Reboot the SGMs when prompted. Wait until all SGMs are UP.	If you do not upgrade the firmware now at the prompt, upgrade it later with: `# asg_ssm_upgrade`

Failing Over to Chassis A

Step	Operation	Command
22	Set Chassis A to administratively UP state.	`> asg chassis_admin -c` <Chassis_A_ID> `up`
23	Run the diagnostics.	`# asg policy verify –v [-vs all]` `# asg_route`
24	Make sure that Chassis A is UP and enforces security. Important - You must correct all errors shown by the diagnostics before you continue to the next step.	`> asg stat -v`

Completing the Upgrade

Step	Operation	Command
25	Run the finalize step. Note - This is a mandatory step.	`# ./AsgInstallScript finalize`
26	Make sure all SGMs and SSMs are up to date, and that the system is configured correctly.	`# asg diag verify`
27	Delete the upgrade files from all relevant SGMs.	`# g_all rm -r /home/admin/temp/` `# g_rm /home/admin/Check_Point_R76SP_50_upgrade.linux.tgz`

Upgrading a Single Chassis System from a Minor Release

To upgrade the Chassis, you must use two SGM groups.

You should not upgrade all the SGMs at the same time.

With this procedure, upgrade half of the SGMs at one time.

The other half continues to handle traffic.

Upgrade Group B SGMs through an SGM of Group A, and then upgrade Group A SGMs through an SGM of Group B.

Preliminary Steps

Step	Operation	Command

1	Make sure that all SGMs and SSMs are up to date, and that the system is configured correctly.	`> asg diag verify`
2	Divide the SGMs into two groups (A and B). SGMs in Group A remain Active and continue to handle traffic while you upgrade SGMs in Group B. Then, fail over between SGMs from Group A to Group B, which handles traffic while you upgrade SGMs in Group A.
3	Copy the HFA Upgrade package to the SMO: `Check_Point_R76SP_50_upgrade.linux.tgz` Important - The SMO must be an SGM of Group A.
4	Create a temporary directory on the SMO in: `/home/admin/`	`# mkdir -v /home/admin/temp` If a temporary directory already exists, delete it first with this command: `# g_all rm -rf /home/admin/temp`
5	Extract the HFA Upgrade package to the temporary directory.	`# tar -xvzf /home/admin/Check_Point_R76SP_50_upgrade.linux.tgz -C /home/admin/temp/`
Best Practice - Connect over a console to the SMO and run the next steps through the console connection. Console connection is not mandatory, if you skip the SSM firmware upgrade step in the upgrade process.
6	Run the pre-installation procedure.	`# cd /home/admin/temp/` `#./AsgInstallScript pre_install`

Upgrading SGMs in Group B

Step	Operation	Command

7	Set SGMs in Group B to administratively DOWN state.	`> asg sgm_admin -b` <Group_B_SGM_IDs> `down -p`
8	Make sure that all SGMs in Group B are DOWN.	`> asg monitor -all`
9	Upgrade SGMs in Group B.	`# cd /home/admin/temp/` `# ./AsgInstallScript –b <`Group_B_SGM_IDs`> -a`
Confirm that the HFA Upgrade installation procedure completed successfully. A summary message shows when the upgrade is complete. If the installation was successful, you are prompted to run SSM firmware upgrade checks. Do not do that at this time.
10	When prompted, reboot SGMs in Group B. After reboot, the SGMs on Group B stay in the administratively DOWN state.

Failing Over to SGMs in Group B

Step	Operation	Command
11	Run the diagnostics.	`> asg policy verify –a [-vs all] -v` `> asg_route -a`
12	Set SGMs in Group B to administratively UP state.	`> asg sgm_admin -b` <Group_B_SGM_IDs> `up -p`
13	Make sure that all SGMs in Group B are UP and enforce security.	`> asg stat -v`
14	Set SGMs in Group A to administratively DOWN state.	`> asg sgm_admin -b <`Group_A_SGM_IDs> `down -p`
15	Make sure that the SGMs in Group B are UP and enforce security. Important - Make sure SGMs in Group B work correctly before you upgrade SGMs in Group A.	`> asg monitor [-vs all]` `> asg perf [-vs all] -v`

Upgrading SGMs in Group A

Step	Operation	Command

16	Copy the HFA Upgrade package to the SMO: `Check_Point_R76SP_50_upgrade.linux.tgz` Note - The SMO must be an SGM of Group B.
17	Create a temporary directory on the SMO in: `/home/admin/`	`# mkdir -v /home/admin/temp` If a temporary directory already exists, delete it first with this command: `# g_all rm -rf /home/admin/temp`
18	Extract the HFA Upgrade package to the temporary directory.	`# tar -xvzf /home/admin/Check_Point_R76SP_50_upgrade.linux.tgz -C /home/admin/temp/`
Best Practice - Connect over a console to the SMO and run the next steps through the console connection. A console connection is not mandatory, if you skip the SSM firmware upgrade step in the upgrade process.
19	Make sure that all SGMs in Group A are DOWN.	`> asg monitor -all`
20	Upgrade SGMs in Group A.	`# cd /home/admin/temp/` `# ./AsgInstallScript –b` <Group_A_SGM_IDs> `-a`
Confirm that the HFA Upgrade installation procedure completed successfully. A summary message shows when the upgrade is complete. If the installation was successful, you are prompted to run SSM firmware upgrade checks. Do not do this at this time.
21	When prompted, reboot Group A SGMs. After reboot, the Group A SGMs stay in the Admin DOWN state.

Note - You can run the SSM firmware upgrade now. Press Y at the prompt. This will cause some downtime.

Completing the Upgrade

Step	Operation	Command
22	Run the finalize step. Note - This is a mandatory step.	`# ./AsgInstallScript finalize`
23	Make sure all SGMs and SSMs are up to date, and that the system is configured correctly.	`# asg diag verify`
24	Delete the upgrade files on all SGMs on both the Active and Standby Chassis.	`# g_all rm -r /home/admin/temp/` `# g_rm /home/admin/Check_Point_R76SP_50_upgrade.linux.tgz`

Step

Operation

Command

Run the finalize step.

Note - This is a mandatory step.

# ./AsgInstallScript finalize

Make sure all SGMs and SSMs are up to date, and that the system is configured correctly.

# asg diag verify

Delete the upgrade files on all SGMs on both the Active and Standby Chassis.

# g_all rm -r /home/admin/temp/

# g_rm /home/admin/Check_Point_R76SP_50_upgrade.linux.tgz