Installing a Hotfix on a Single Chassis

This procedure describes the Full Connectivity installation of an Offline CPUSE Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS, and the Gaia OS itself. For details, see sk92449. package on a Single Chassis.

Important Notes

• It is not supported to upgrade the CPUSE Deployment Agent on SGMs in a Security Group.

• This procedure keeps the current connections in a Security Group A logical group of Security Gateway Modules that provides Active/Active cluster functionality. A Security Group can contain one or more Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway..

• This procedure applies to Security Groups in Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. mode and VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. mode.

  In VSX mode, you must run all the commands in the context of VS0.

• If you finished a clean install on this chassis, then you can install a Jumbo Hotfix Accumulator Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA. only after you run the Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. First Time Configuration Wizard.

• Do not install the hotfix on all the SGMs at the same time.

  If you do so with the command below, traffic stops passing through all SGMs until the hotfix Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior. is installed:

  installer install <Number of CPUSE Package> member_ids all

• In this procedure, you divide all SGMs in a specific Security Group into two or more logical groups.

  In the procedure below, we use two logical groups denoted below as "A" and "B".

  You install the hotfix on one logical group of the SGMs at one time.

  The other logical group(s) of the SGMs continues to handle traffic.

  Each logical group should contain the same number of SGMs - as close as possible.

  Examples:

  Environment	Description
  Single Chassis	There are 8 SGMs in the Security Group. The Logical Group "A" contains SGMs from 1_1 to 1_4. The Logical Group "B" contains SGMs from 1_5 to 1_8.
  Single Chassis	There are 5 SGMs in the Security Group. The Logical Group "A" contains SGMs from 1_1 to 1_3. The Logical Group "B" contains SGMs from 1_4 to 1_5.

Best Practice - Perform this procedure over the serial console.

Procedure