Important:

• Load Sharing modes are only supported with the required R80.20 Jumbo Hotfix Accumulator. For instructions, see sk162637.
• To upgrade a ClusterXL that works in a Load Sharing mode from a lower version to R80.20, follow these steps in the same maintenance window:
  1. Upgrade the ClusterXL to R80.20.
  2. Install the required R80.20 Jumbo Hotfix Accumulator. For instructions, see sk162637.

1

Back up your current configuration.

2

See the Upgrade Options and Prerequisites.

3

See the Planning a Cluster Upgrade.

4

Upgrade the Management Server and Log Servers to R80.20 version.

5

Schedule a full maintenance window to make sure you can make all the desired custom configurations again after the upgrade.

High Availability

The Cluster Member M1 is Active.

The Cluster Members M2 and M3 are Standby.

Action plan:

1. Upgrade, or Clean Install the Standby Cluster Members M2 and M3.

   The upgraded Cluster Members M2 and M3 change their cluster state to Ready.

   The old Cluster Member M1 changes its cluster state to Active Attention.

2. In SmartConsole, change the version of the cluster object to R80.20.
3. Install the Access Control Policy on the upgraded Cluster Members M2 and M3.
4. Perform a controlled cluster failover from the Active old Cluster Member M1.
5. The upgraded Cluster Member M2 (or M3) changes its cluster state to Active.

   The other upgraded Cluster Member M3 (or M2) changes its cluster state to Standby.

6. Upgrade, or Clean Install the old Cluster Member M1.
7. Install the Access Control Policy on the cluster object.
8. Cluster states of the Cluster Members are: one is Active, others are Standby.
9. On each Cluster Member, change the CCP mode to Auto.
10. Install the Threat Prevention Policy on the cluster object.

1

Connect to the command line on each Cluster Member.

2

Log in to the Expert mode.

3

Change the CCP mode to Broadcast:

cphaconf set_ccp broadcast

Notes:

• This change does not require a reboot.
• This change applies immediately and survives reboot.

4

Make sure the CCP mode is set to Broadcast:

cphaprob -a if

Upgrade to R80.20 with CPUSE

See Installing Software Packages on Gaia.

Follow the applicable action plan for the local or central installation.

Select the R80.20 package and perform Upgrade.

Clean Install of R80.20 with CPUSE

See Installing Software Packages on Gaia.

Follow the applicable action plan for the local or central installation.

Select the R80.20 package and perform Clean Install.

Clean Install of R80.20 from scratch

See Installing a ClusterXL Cluster, or Installing a VRRP Cluster.

In the Gaia First Time Configuration Wizard, for the Management Connection IP address, you must use the same IP address as was used by the previous Cluster Member (prior to the upgrade).

Upgrade to R80.20 with CPUSE

See Installing Software Packages on Gaia.

Follow the applicable action plan for the local or central installation.

Clean Install of R80.20

See Installing a ClusterXL Cluster, or Installing a VRRP Cluster.

In the Gaia First Time Configuration Wizard, for the Management Connection IP address, you must use the same IP address as was used by the previous Cluster Member (prior to the upgrade).

1

Connect with SmartConsole to the R80.20 Security Management Server or Domain Management Server that manages this cluster.

2

From the left navigation panel, click Gateways & Servers.

3

Open the Cluster object.

4

From the left navigation tree, click the General Properties page.

5

In the Platform section > Version field, select R80.20.

6

If you performed a Clean Install of R80.20 on the Cluster Member, then establish the Secure Internal Communication (SIC) between the Management Server and this Cluster Member:

1. From the left tree, click Cluster Members.
2. Select the Cluster Member object.
3. Click Edit.
4. On the General tab, click the Communication button.
5. Click Reset.
6. In the One-time password field, enter the same Activation Key you entered during the First Time Configuration Wizard of the Cluster Member.
7. In the Confirm one-time password field, enter the same Activation Key again.
8. Click Initialize.
9. The Trust state field must shows Trust established.
10. Click Close to close the Communication window.
11. Click OK to close the Cluster Member Properties window.

7

Click OK to close the Gateway Cluster Properties window.

1

Click Install Policy.

2

In the Install Policy window:

1. In the Policy field, select the applicable Access Control Policy
2. In the Install Mode section, configure these two options:
   • Select Install on each selected gateway independently.
   • Clear For gateway clusters, if installation on a cluster member fails, do not install on that cluster.
3. Click Install.

3

The Access Control Policy successfully installs on the upgraded Cluster Members M2 and M3.

The Access Control Policy installation fails on the old Cluster Member M1 with a warning. Ignore this warning.

1

Connect to the command line on each Cluster Member.

2

Examine the cluster state in one of these ways:

• In Gaia Clish (R80.20 and above), run:

  show cluster state

• In Expert mode, run:

  cphaprob state

Notes:

• The cluster states of the upgraded Cluster Members M2 and M3 are Ready.
• The cluster state of the old Cluster Member M1 is Active Attention.

1

Connect to the command line on the Cluster Member M1.

2

Stop all Check Point services:

cpstop

Notes:

• This forces a controlled cluster failover from the old Cluster Member M1 to one of the upgraded Cluster Members.
• At this moment, all connections that were initiated through the old Cluster Member M1 are dropped (because Cluster Members with different software versions cannot synchronize).

1

Connect to the command line on each Cluster Member.

2

Examine the cluster state in one of these ways:

• In Gaia Clish (R80.20 and above), run:

  show cluster state

• In Expert mode, run:

  cphaprob state

Notes:

• In High Availability mode, one of the upgraded Cluster Members (M2 or M3) changes its cluster state to Active.
• The other upgraded Cluster Member (M3 or M2) changes its cluster state to Standby.
• In Load Sharing mode, the upgraded Cluster Members M2 and M3 change their cluster state to Active.

Upgrade to R80.20 with CPUSE

See Installing Software Packages on Gaia.

Follow the applicable action plan for the local or central installation.

Clean Install of R80.20

See Installing a ClusterXL Cluster, or Installing a VRRP Cluster.

In the Gaia First Time Configuration Wizard, for the Management Connection IP address, you must use the same IP address as was used by the previous Cluster Member (prior to the upgrade).

1

Connect with SmartConsole to the R80.20 Security Management Server or Main Domain Management Server that manages this Cluster.

2

From the left navigation panel, click Gateways & Servers.

3

Open the cluster object.

4

From the left tree, click Cluster Members.

5

Select the object of the Cluster Member M1.

6

Click Edit.

7

On the General tab, click the Communication button.

8

Click Reset.

9

In the One-time password field, enter the same Activation Key you entered during the First Time Configuration Wizard of the Cluster Member.

10

In the Confirm one-time password field, enter the same Activation Key again.

11

Click Initialize.

12

The Trust state field must shows Trust established.

13

Click Close to close the Communication window.

14

Click OK to close the Cluster Member Properties window.

1

Connect with SmartConsole to the R80.20 Security Management Server or Domain Management Server that manages this cluster.

2

From the left navigation panel, click Gateways & Servers.

3

Click Install Policy.

4

In the Install Policy window:

1. In the Policy field, select the applicable Access Control Policy
2. In the Install Mode section, select these two options:
   • Install on each selected gateway independently
   • For gateway clusters, if installation on a cluster member fails, do not install on that cluster
3. Click Install.

5

The Access Control Policy successfully installs on all the Cluster Members.

1

Connect to the command line on each Cluster Member.

2

Examine the cluster state:

• In Gaia Clish (R80.20 and above), run:

  show cluster state

• In Expert mode, run:

  cphaprob state

Notes:

• In High Availability mode, cluster states of the Cluster Members are: one is Active, others are Standby.
• In Load Sharing mode, cluster states of all the Cluster Members are Active.

1

Connect to the command line on each Cluster Member.

2

Change the CCP mode:

• In Gaia Clish, run:

  set cluster member ccp auto

  save config

• In Expert mode, run:

  cphaconf set_ccp auto

Notes:

• This change does not require a reboot.
• This change applies immediately and survives reboot.

3

Make sure the CCP mode is set to Auto:

• In Gaia Clish, run:

  show cluster members interfaces all

• In Expert mode, run:

  cphaprob -a if

1

Connect with SmartConsole to the R80.20 Security Management Server or Domain Management Server that manages this cluster.

2

From the left navigation panel, click Gateways & Servers.

3

Click Install Policy.

4

In the Policy field, select the applicable Threat Prevention Policy.

5

Click Install.

1

Connect with SmartConsole to the R80.20 Security Management Server or Domain Management Server that manages this cluster.

2

From the left navigation panel, click Logs & Monitor > Logs.

3

Examine the logs from this Cluster to make sure it inspects the traffic as expected.