Installing a Hotfix on Dual Chassis

This procedure describes the Full Connectivity installation of an Offline CPUSE Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS, and the Gaia OS itself. For details, see sk92449. package on Dual Chassis.

Important Notes

It is not supported to upgrade the CPUSE Agent on SGMs in a Security Group.
This procedure keeps the current connections in a Security Group A logical group of Security Gateway Modules that provides Active/Active cluster functionality. A Security Group can contain one or more Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway..
This procedure applies to Security Groups in Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. mode and VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. mode.

In VSX mode, you must run all the commands in the context of VS0.
If you finished a clean install on this chassis, then you can install a Jumbo Hotfix Accumulator Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA. only after you run the Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. First Time Configuration Wizard.

Do not install the hotfix on all the SGMs at the same time.

If you do so with the command below, traffic stops passing through all SGMs until the hotfix Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior. is installed:

installer install <Number of CPUSE Package> member_ids all

In this procedure, you install the hotfix on one chassis at one time.

The other chassis continues to handle traffic.
1. You install the hotfix on Standby Chassis "A" from an SGM in Standby Chassis "A".
2. You fail over all connections from Active Chassis "B" to Standby Chassis "A".
3. You install the hotfix on Standby Chassis "B" from an SGM in Standby Chassis "B".
In the procedures below:
- Chassis "A" is the Standby Chassis (chassis1)
- Chassis "B" is the Active Chassis (chassis2)

Best Practice - Perform this procedure over the serial console.

Procedure

Step 1 - Perform the preliminary steps

Step

Instructions

Make sure you have the applicable CPUSE offline package or the exported CPUSE package.

Transfer the CPUSE offline or exported package to the Chassis (into some directory, for example: /home/admin/).

Connect to the command line on each chassis.

Log in to Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

Go to the Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Gateway Modules. Commands you run in this shell apply to all Security Gateway Module in the Security Group.:

gclish

Import the CPUSE package from the hard disk:

installer import local /<Full Path>/<Name of the CPUSE Offline Package>

Example:

[Global] HostName-ch01-01 > installer import local /home/admin/Check_Point_R81.10_Hotfix_Bundle_FULL.tar

Show the imported CPUSE packages:

show installer packages imported

Make sure the imported CPUSE package can be installed on this Chassis:

installer verify [Press the Tab key]

installer verify <Number of CPUSE Package> member_ids all

Example:

[Global] HostName-ch01-01 > installer verify 2 member_ids all
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Installation is allowed.                                        |
|1_02         |Installation is allowed.                                        |
|1_03         |Installation is allowed.                                        |
|1_04         |Installation is allowed.                                        |
|2_01         |Installation is allowed.                                        |
|2_02         |Installation is allowed.                                        |
|2_03         |Installation is allowed.                                        |
|2_04         |Installation is allowed.                                        |
+-------------+----------------------------------------------------------------+
[Global] HostName-ch01-01 >

Step 2 - Disable the SMO Image Cloning feature

Note - The SMO See "SMO". Image Cloning feature automatically clones all the required software packages to the SGMs during their boot. When you install or remove software packages gradually on SGMs, it is necessary to disable this feature, so that after a reboot the updated SGMs do not clone the software packages from the existing non-updated SGMs.

Step

Instructions

Connect to the command line on the Security Group.

If your default shell is /bin/bash (Expert mode), then go to Gaia gClish:

gclish

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Disable the SMO Image Cloning feature, if it is enabled:

set smo image auto-clone state off

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Step 3 - Install the Hotfix on Standby Chassis "A"

Step

Instructions

Connect to the command line on the Standby Chassis (in our example, Chassis "A" - chassis1).

Set the state of the Standby Chassis "A" to "down":

asg chassis_admin -c <ID of Standby Chassis> down

Example:

[Expert@HostName-ch0x-0x:0]# asg chassis_admin -c 1 down

Connect to one of the SGMs in the Standby Chassis "A":

member <Member ID>

Go to the Gaia gClish:

gclish

Install the CPUSE hotfix package on the Standby Chassis "A":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids chassis<ID of Standby Chassis>

Example:

[Global] HostName-ch01-01 > installer install 2 member_ids chassis1
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for installation                               |
|1_02         |Package is ready for installation                               |
|1_03         |Package is ready for installation                               |
|1_04         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (1_01,1_02,1_03,1_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y

Exit from Gaia gClish to the Expert mode:

exit

Monitor the system until SGMs on the Standby Chassis "A" are in the state "UP" and enforce the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. again:

asg monitor

Set the state of the Standby Chassis "A" to "up":

asg chassis_admin -c <ID of Standby Chassis> up

Example:

[Expert@HostName-ch0x-0x:0]# asg chassis_admin -c 1 up

Monitor the system until SGMs on the Chassis "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

Make sure the Hotfix is installed on all SGMs:

asg diag verify

Step 4 - Fail over from Active Chassis "B" to Standby Chassis "A"

In this step, you fail over all connections from the Active Chassis "B" (chassis2) to the Standby Chassis "A" (chassis1).

Step

Instructions

Connect to the command line on the Active Chassis (in our example, Chassis "B" - chassis2).

Set the state of the Active Chassis "B" to "down":

asg chassis_admin -c <ID of Active Chassis> down

Example:

[Expert@HostName-ch0x-0x:0]# asg chassis_admin -c 2 down

Step 5 - Install the Hotfix on Standby Chassis "B"

In this step, you install the Hotfix on all SGMs on the former Active Chassis "B" (chassis2).

Step

Instructions

Connect to the command line on the Standby Chassis (in our example, Standby Chassis "B" - chassis2).

Set the state of the Standby Chassis "B" to "down":

asg chassis_admin -c <ID of Standby Chassis> down

Example:

[Expert@HostName-ch0x-0x:0]# asg chassis_admin -c 2 down

Connect to one of the SGMs in the Standby Chassis "B":

member <Member ID>

Go to the Gaia gClish:

gclish

Install the CPUSE hotfix package on the Standby Chassis "B":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids chassis<ID of Standby Chassis>

Example:

[Global] HostName-ch02-01 > installer install 2 member_ids chassis2
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|2_01 (local) |Package is ready for installation                               |
|2_02         |Package is ready for installation                               |
|2_03         |Package is ready for installation                               |
|2_04         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (2_01,2_02,2_03,2_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y

Exit from Gaia gClish to the Expert mode:

exit

Monitor the system until SGMs on the Standby Chassis "B" are in the state "UP" and enforce the Security Policy again:

asg monitor

Set the state of the Standby Chassis "B" to "up":

asg chassis_admin -c <ID of Standby Chassis> up

Example:

[Expert@HostName-ch0x-0x:0]# asg chassis_admin -c 2 up

Important - If the former Active Chassis is configured as "Primary Up", an automatic fallback occurs.

Monitor the system until SGMs on the Chassis "B" are in the state "UP" and enforce the Security Policy again:

asg monitor

Make sure the Hotfix is installed on all SGMs:

asg diag verify