1

Back up your current configuration.

Important - Back up both the Management Server and the VSX Cluster Members. Follow sk100395: How to backup and restore VSX gateway.

2

See the Upgrade Options and Prerequisites.

3

See the Planning a Cluster Upgrade.

4

Upgrade the Management Server and Log Servers to R80.20 version.

5

Schedule a full maintenance window to make sure you can make all the desired custom configurations again after the upgrade.

1

Connect to the command line on the Security Management Server or Multi-Domain Server that manages this VSX Cluster.

2

Log in to the Expert mode.

3

On a Multi-Domain Server, go to the context of the Main Domain Management Server that manages this VSX Cluster:

mdsenv <IP Address or Name of Main Domain Management Server>

4

Upgrade the configuration of the VSX Cluster object to R80.20:

4A

Run:

vsx_util upgrade

This command is interactive.

4B

Enter these details to log in to the management database:

• IP address of the Security Management Server or Main Domain Management Server that manages this VSX Cluster
• Management Server administrator's username
• Management Server administrator's password

4C

Select your VSX Cluster.

4D

Select R80.20.

4E

For auditing purposes, save the vsx_util log file:

• On a Security Management Server:

  /opt/CPsuite-R80.20/fw1/log/vsx_util_YYYYMMDD_HH_MM.log

• On a Multi-Domain Server:

  /opt/CPmds-R80.20/customers/<Name_of_Domain>/CPsuite-R80.20/fw1/log/vsx_util_YYYYMMDD_HH_MM.log

5

Connect with SmartConsole to the R80.20 Security Management Server or Main Domain Management Server that manages this VSX Cluster.

6

From the left navigation panel, click Gateways & Servers.

7

Open the VSX Cluster object.

8

From the left navigation tree, click the General Properties page.

9

Make sure in the Platform section, the Version field shows R80.20.

10

Click Cancel (do not click OK).

Note - If you click OK, the Management Server pushes the VSX configuration to the VSX Cluster Members. Because the VSX Cluster Members are not upgraded yet, this operation would fail.

Upgrade to R80.20 with CPUSE

See Installing Software Packages on Gaia.

Follow the applicable action plan for the local or central installation.

Select the R80.20 package and perform Upgrade.

Clean Install of R80.20 with CPUSE

See Installing Software Packages on Gaia.

Follow the applicable action plan for the local or central installation.

Select the R80.20 package and perform Clean Install.

Clean Install of R80.20 from scratch

See Installing a VSX Cluster.

1. In the Gaia First Time Configuration Wizard, for the Management Connection IP address, you must use the same IP address as was used by the previous VSX Cluster Member (prior to the upgrade).
2. After you complete the Gaia First Time Configuration Wizard and reboot, run the vsx_util reconfigure command on the Management Server to push the VSX configuration to the VSX Cluster Member. You must enter the same Activation Key you entered during the First Time Configuration Wizard of the VSX Cluster Member.

1

Connect with SmartConsole to the R80.20 Security Management Server or Main Domain Management Server that manages this VSX Cluster.

2

From the left navigation panel, click Gateways & Servers.

3

Install the default policy on the VSX Cluster object:

1. Click Install Policy.
2. In the Policy field, select the default policy for this VSX Cluster object.

   This policy is called:

   <Name_of_VSX_Cluster_object>_VSX

3. In the Install Mode section, select these two options:
   • Install on each selected gateway independently
   • For gateway clusters, if installation on a cluster member fails, do not install on that cluster
4. Click Install.

4

Install the Threat Prevention Policy on the VSX Cluster object:

1. Click Install Policy.
2. In the Policy field, select the applicable Threat Prevention Policy for this VSX Cluster object.
3. Click Install.

1

Connect to the command line on each VSX Cluster Member.

2

Log in to the Expert mode.

3

Examine the VSX state:

vsenv 0

vsx stat -v

Notes:

• Make sure all the configured Virtual Devices are loaded.
• Make sure all Virtual Systems and Virtual Routers have policy and SIC.

1

Connect to the command line on each VSX Cluster Member.

2

Examine the cluster state:

• In Gaia Clish, run:

  set virtual-system 0

  show cluster state

• In Expert mode, run:

  vsenv 0

  cphaprob state

Note - Cluster states of the Cluster Members are: one is Active, others are Standby.

1

Connect with SmartConsole to the R80.20 Security Management Server or Main Domain Management Server that manages the Virtual Systems on this VSX Cluster.

2

From the left navigation panel, click Logs & Monitor > Logs.

3

Examine the logs from Virtual Systems on this VSX Cluster to make sure they inspect the traffic as expected.