Upgrading an Endpoint Security Management Server or Endpoint Policy Server from R80.20 and higher with CPUSE

In a CPUSE upgrade scenario, you perform the upgrade procedure on the same Check Point server.

Notes:

  • This procedure is supported only for servers that run R80.20.M1, R80.20, R80.20.M2, or R80.30 versions.

  • These instructions equally apply to:

    • Endpoint Security Management Server

    • Endpoint Policy Server

  • For additional information related to this upgrade, see sk163814.

Important - Before you upgrade an Endpoint Security Management Server or Endpoint Policy Server:

Step

Instructions

1

Back up your current configuration (see Backing Up and Restoring).

2

See the Upgrade Options and Prerequisites.

3

Only the latest published database revision is upgraded.

If there are pending changes, we recommend to Publish the session.

4

You must close all GUI clients (SmartConsole applications) connected to the source Endpoint Security Management Server or Endpoint Policy Server.

5

Install the latest version of the CPUSE from sk92449.

Note - This is to make sure the CPUSE is able to support the required Upgrade Tools package.

6

Run the Pre-Upgrade Verifier on all source servers and fix all detected issues before you start the upgrade.

7

In Management High Availability, make sure the Primary Endpoint Security Management Server is upgraded and runs, before you start the upgrade on other servers.

Procedure:

  		1.

    Important - See Management Server Migration Tool and Upgrade Tools to understand if your server can download and install the latest version of the Upgrade Tools automatically.

    Step

    Instructions

    1

    Download the R80.40 Upgrade Tools from the sk135172.

    (See Management Server Migration Tool and Upgrade Tools.)

    Note - This is a CPUSE Offline package.

    2

    Install the R80.40 Upgrade Tools with CPUSE.

    See Installing Software Packages on Gaia and follow the applicable action plan for the Local - Offline installation.

    3

    Make sure the package is installed.

    Run this command in the Expert mode:

    cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1

    The output must show the same build number you see in the name of the downloaded TGZ package.

    Name of the downloaded package: ngm_upgrade_wrapper_993000222_1.tgz

    [Expert@HostName:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1

    993000222

    [Expert@HostName:0]#

    Note - The command "migrate_server" from these Upgrade Tools always tries to connect to Check Point Cloud over the Internet.

    This is to make sure you always have the latest version of these Upgrade Tools installed.

    If the connection to Check Point Cloud fails, this message appears:

    Timeout. Failed to retrieve Upgrade Tools package. To download the package manually, refer to sk135172.

  2. See Installing Software Packages on Gaia and follow the applicable action plan.

  3. See Installing SmartConsole.

  4. This step is part of the upgrade procedure of a Endpoint Security Management Server server. If you upgrade a dedicated Endpoint Policy Server, then skip this step.

    Important - If your Endpoint Security Management Server manages dedicated Endpoint Policy Servers, you must upgrade these dedicated servers to the same version as the Endpoint Security Management Server.

    Select the applicable upgrade option from these:

  		5.

    Important - If your Endpoint Security Management Server manages dedicated Endpoint Policy Servers, you must update the version of the corresponding objects in SmartConsole.

    Step

    Instructions

    1

    Connect with SmartConsole to the R80.40 Security Management Server that manages the Endpoint Policy Server.

    2

    From the left navigation panel, click Gateways & Servers.

    3

    Open the object of the Endpoint Policy Server.

    4

    From the left tree, click General Properties.

    5

    In the Platform section > in the Version field, select R80.40.

    6

    Click OK.

  6. Step

    Instructions

    1

    Connect with SmartConsole to the R80.40 Endpoint Security Management Server.

    2

    In the top left corner, click Menu > Install database.

    3

    Select all objects.

    4

    Click Install.

    5

    Click OK.

  7. Important - This step applies only if the SmartEvent Correlation Unit Software Blade is enabled on the R80.40 Endpoint Server.

    Step

    Instructions

    1

    Connect with the SmartConsole to the R80.40 Endpoint Server.

    2

    In the SmartConsole, from the left navigation panel, click Logs & Monitor.

    3

    At the top, click + to open a new tab.

    4

    In the bottom left corner, in the External Apps section, click SmartEvent Settings & Policy.

    The Legacy SmartEvent client opens.

    5

    In the top left corner, click Menu > Actions > Install Event Policy.

    6

    Confirm.

    7

    Wait for these messages to appear:

    SmartEvent Policy Installer installation complete

    SmartEvent Policy Installer installation succeeded

    8

    Click Close.

    9

    Close the Legacy SmartEvent client.

  8. Step

    Instructions

    1

    Connect to the command line on the server.

    2

    Log in to the Expert mode.

    3

    Restore the Log Exporter configuration as described in sk127653.

    4

    Reconfigure the Log Exporter:

    cp_log_export reconf

    5

    Restart the Log Exporter:

    cp_log_export restart

    For more information, see the R80.40 Logging and Monitoring Administration Guide > Chapter Log Exporter.

  9. Step

    Instructions

    1

    Connect with SmartConsole to the R80.40 Endpoint Security Management Server.

    Make sure the management database and configuration were upgraded correctly.

    2

    Connect with SmartConsole to the R80.40 Endpoint Policy Server.

    Make sure the everything works correctly.