Important:

• Load Sharing modes are only supported with the required R80.20 Jumbo Hotfix Accumulator. For instructions, see sk162637.
• To upgrade a ClusterXL that works in a Load Sharing mode from a lower version to R80.20, follow these steps in the same maintenance window:
  1. Upgrade the ClusterXL to R80.20.
  2. Install the required R80.20 Jumbo Hotfix Accumulator. For instructions, see sk162637.

The cluster member M1 is the Active member.

The cluster members M2 and M3 are Standby.

1. Upgrade, or Clean Install the Standby cluster members M2 and M3.

   The cluster members M2 and M3 change their cluster state to Ready.

   The cluster member M1 changes its cluster state to Active(!).

2. In SmartConsole, change the version of the cluster object to R80.20.
3. Install the Access Control Policy on the upgraded cluster members M2 and M3.
4. Stop all the upgraded cluster members (for example, M3), except one (for example, M2).
5. Start and finish the Connectivity Upgrade on the working upgraded cluster member M2.
6. Perform a controlled cluster failover from the Active old cluster member M1 to the upgraded and synchronized cluster member M2.
7. The upgraded cluster member M2 changes its cluster state to Active.
8. Start the upgraded cluster members that were stopped (M3).
9. Upgrade, or Clean Install the old cluster member M1.
10. Install the Access Control Policy on the cluster object.
11. Cluster states of the members are: one is Active, others are Standby.
12. On each cluster member, change the CCP mode to Auto.
13. Install the Threat Prevention Policy on the cluster object.

1

Connect with SmartConsole to the R80.20 Security Management Server or Domain Management Server that manages this cluster.

2

From the left navigation panel, click Gateways & Servers.

3

Open the Cluster object.

4

From the left navigation tree, click the General Properties page.

5

In the Platform section > Version field, select R80.20.

6

Click OK.

7

Click Install Policy.

8

In the Install Policy window:

1. In the Policy field, select the applicable Access Control Policy
2. In the Install Mode section, configure these two options:
   • Select Install on each selected gateway independently.
   • Clear For gateway clusters, if installation on a cluster member fails, do not install on that cluster.
3. Click Install.

9

The Access Control Policy successfully installs on the upgraded cluster members M2 and M3.

The Access Control Policy installation fails on the old cluster member M1 with a warning. Ignore this warning.

1

Connect to the command line on each cluster member.

2

Examine the cluster state:

• In Gaia Clish (R80.20 and above), run:

  show cluster state

• In Expert mode, run:

  cphaprob state

Notes:

• The cluster states of the upgraded members M2 and M3 are Ready.
• The cluster state of the old member M1 is Active(!).

1

Connect to the command line on all the upgraded cluster members (for example, M3), except one (for example, M2).

2

Stop all Check Point services on all the upgraded members (for example, M3), except one (for example, M2):

cpstop

1

Connect to the command line on each cluster member.

2

Examine the cluster state:

• In Gaia Clish (R80.20 and above), run:

  show cluster state

• In Expert mode, run:

  cphaprob state

Notes:

• The cluster state of the working upgraded member (M2) is Ready.
• The cluster state of the stopped upgraded members (M3) is HA not started.
• The cluster state of the old member M1 is Active(!).

1

Connect to the command line on the working upgraded cluster member M2.

2

Log in to the Expert mode.

3

Start the Connectivity Upgrade:

• If you wish to synchronize the dynamic routing information during the upgrade:

  cphacu start

• If you do not wish to synchronize the dynamic routing information during the upgrade:

  cphacu start no_dr

1

Connect to the command line on the Active old cluster member M1.

2

Log in to the Expert mode.

3

Make sure it handles the traffic:

cphacu stat

1

When the Connectivity Upgrade finishes on the working upgraded cluster member M2, this message shows:

Connectivity upgrade status: Ready for Failover

2

If you synchronized the Dynamic Routing information:

1. Connect to the command line on both the working upgraded cluster member M2 and on the Active old cluster member M1.
2. Log in to Gaia Clish.
3. Examine the routes:

   show route summary

Make sure that the dynamic routes on the working upgraded cluster member M2 match the dynamic routes on the Active old cluster member M1.

1

Connect to the command line on the stopped upgraded cluster members (in our example, M3).

2

Start all Check Point services:

cpstart

1

Connect to the command line on each cluster member.

2

Examine the cluster state:

• In Gaia Clish (R80.20 and above), run:

  show cluster state

• In Expert mode, run:

  cphaprob state

Notes:

• The cluster states of the upgraded members M2 and M3 are Down.
• The cluster state of the old member M1 is Active(!).

1

Connect to the command line on the Active old cluster member M1.

2

Stop all Check Point services:

cpstop

Important - At this moment, the connections fail over from the old cluster member M1 to the Active upgraded cluster member (M2 or M3).

1

Connect to the command line on the upgraded cluster members M2 and M3.

2

Examine the cluster state:

• In Gaia Clish (R80.20 and above), run:

  show cluster state

• In Expert mode, run:

  cphaprob state

Notes:

• The cluster states of the upgraded members M2 and M3 are: one is Active, the other is Standby.
• The cluster state of the old member M1 is either ClusterXL is inactive, or the machine is down, or Down.

3

Make sure the Active upgraded member handles the traffic:

cphacu stat

1

Connect with SmartConsole to the R80.20 Security Management Server or Domain Management Server that manages this cluster.

2

From the left navigation panel, click Gateways & Servers.

3

Click Install Policy.

4

In the Install Policy window:

1. In the Policy field, select the applicable Access Control Policy
2. In the Install Mode section, select these two options:
   • Install on each selected gateway independently
   • For gateway clusters, if installation on a cluster member fails, do not install on that cluster
3. Click Install.

5

The Access Control Policy successfully installs on all the cluster members.

1

Connect to the command line on each cluster member.

2

Examine the cluster state:

• In Gaia Clish, run:

  show cluster state

• In Expert mode, run:

  cphaprob state

Note - Cluster states of the members are: one is Active, others are Standby.

1

Connect to the command line on each cluster member.

2

Change the CCP mode:

• In Gaia Clish, run:

  set cluster member ccp auto

  save config

• In Expert mode, run:

  cphaconf set_ccp auto

Notes:

• This change does not require a reboot.
• This change applies immediately and survives reboot.

3

Make sure the CCP mode is set to Auto:

• In Gaia Clish, run:

  show cluster members interfaces all

• In Expert mode, run:

  cphaprob -a if

1

Connect with SmartConsole to the R80.20 Security Management Server or Domain Management Server that manages this cluster.

2

From the left navigation panel, click Gateways & Servers.

3

Click Install Policy.

4

In the Policy field, select the applicable Threat Prevention Policy

5

Click Install.

1

Connect with SmartConsole to the R80.20 Security Management Server or Domain Management Server that manages this cluster.

2

From the left navigation panel, click Logs & Monitor > Logs.

3

Examine the logs from this Cluster to make sure it inspects the traffic as expected.