Upgrading the CMM Firmware on N+N Chassis - CMM700

It is possible to upgrade or downgrade a CMM firmware version.

Important:

  • The procedures below apply only to CMM700.

  • Firmware packages are provided in sk161293.

  • In a Dual Chassis configuration, all CMMs must have the same firmware version.

    1. Upgrade the CMM Firmware on the Standby Chassis

    2. Fail over from the Active Chassis to the Standby Chassis

    3. Upgrade the CMM Firmware on the former Active Chassis

  • At certain points during these procedures, the CMM functionality is interrupted.

    At these times, hardware monitoring data is not collected and the chassis fans rotate at maximum speed.

Notes:

  • When the command includes the "-c" parameter, enter the Standby Chassis ID number only, not the word "chassis".

    For example: asg chassis_admin -c 1 down

  • When the command includes the "-b" parameter, enter the word "chassis" and after it enter the Standby Chassis ID number.

    For example: g_reboot -a -b chassis1

Best Practice - We recommend that you manually enter the commands below. Because of the command syntax is long, a mistake can occur if you copy and paste it. Incorrect syntax can causes an unexpected behavior.

Upgrading the CMM Firmware on CMM700 - With Physical Access to Standby Chassis

Use this procedure if there is a physical access to the chassis.

All the required steps were divided into three parts.

Part 1 - Upgrading the CMM Firmware on the Standby Chassis

In this part, you upgrade the CMM firmware on the Standby Chassis.

Step

Operation

Command

1

Connect to the command line on the Standby Chassis.

 

2

Log in to the Expert mode.

 

3

Set the state of the Standby Chassis to Admin DOWN.

asg chassis_admin -c <ID of Standby Chassis> down

4

Connect to the command line on an SGM on the Standby Chassis.

Connect over SSH or a serial console.

 

5

Get the applicable firmware version.

Usually the latest recommended firmware file is located here:

$SMODIR/conf/hw_firmware/SM_update.tar

 

6

Extract the firmware image on the SGM to the /var/log/ directory.

tar -xvf $SMODIR/conf/hw_firmware/SM700CC_update.tar -C /var/log/

7

Pull out all CMMs from the Standby Chassis.

 

8

Insert one CMM into the Standby Chassis.

 

9

Copy the firmware files from the SGM to the /tmp/ directory on the CMM.

The password is: admin

# scp /var/log/sentry.shmm700.* admin@198.51.100.33:/tmp/

10

Open a console connection to the serial port on the CMM on the Standby Chassis.

Use the default connection parameters:

  • Baud Rate: 9600
  • Data bits: 8
  • Stop bits: 1
  • Parity: None
  • Flow Control: None

 

11

Copy the CMM firmware image to the CMM.

Note - Run these commands from the console connection to the CMM.

cd /tmp

clia terminate

setenv custcnf C00013

setenv rc2 /etc/rc.0000-14

rupgrade --erase-all --base file:///tmp/sentry.shmm700. -k kernel -r rfs -a app

12

Run the firmware installation script.

Notes:

  • Run this command from the console connection to the CMM.

  • When prompted, press Enter to reboot the CMM.

  • If the screen becomes unreadable during the upgrade procedure, change the baud rate of the console connection.

install.sh

13

If the Standby Chassis ID is 2, change the Standby Chassis ID setting from "1" to "2".

sed -i 's/CHASSID="1"/CHASSID="2"/g' /etc/shmm.cfg

reboot

14

Make sure the Standby Chassis ID is correct.

Outputs of the commands listed on the right must be the same and must show the correct Standby Chassis ID.

Important - If outputs of these commands do not match, stop the entire procedure and contact Check Point Support immediately.

grep SHMM_CHASSID /etc/shmm.cfg

clia shelfaddress

15

Pull out the upgraded CMM from the Standby Chassis.

 

16

Insert the second CMM into the Standby Chassis.

 

17

Copy the firmware files from the SGM to the /tmp/ directory on the CMM.

The password is: admin

# scp /var/log/sentry.shmm700.* admin@198.51.100.33:/tmp/

18

Open a console connection to the serial port on the CMM on the Standby Chassis.

Use the default connection parameters:

  • Baud Rate: 9600
  • Data bits: 8
  • Stop bits: 1
  • Parity: None
  • Flow Control: None

 

19

Copy the CMM firmware image to the CMM.

Note - Run these commands from the console connection to the CMM.

cd /tmp

clia terminate

setenv custcnf C00013

setenv rc2 /etc/rc.0000-14

rupgrade --erase-all --base file:///tmp/sentry.shmm700. -k kernel -r rfs -a app

20

Run the firmware installation script.

Notes:

  • Run this command from the console connection to the CMM.

  • When prompted, press Enter to reboot the CMM.

  • If the screen becomes unreadable during the upgrade procedure, change the baud rate of the console connection.

install.sh

21

If the Standby Chassis ID is 2, change the Standby Chassis ID setting from "1" to "2".

sed -i 's/CHASSID="1"/CHASSID="2"/g' /etc/shmm.cfg

reboot

22

Make sure the Standby Chassis ID is correct.

Outputs of the commands listed on the right must be the same and must show the correct Standby Chassis ID.

Important - If outputs of these commands do not match, stop the entire procedure and contact Check Point Support immediately.

grep SHMM_CHASSID /etc/shmm.cfg

clia shelfaddress

23

Insert the first CMM into the Standby Chassis.

 

24

Go to Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Gateway Modules. Commands you run in this shell apply to all Security Gateway Module in the Security Group.: enter gclish and press Enter.

 

25

Make sure the Active and Standby CMMs have the same firmware version.

asg_version -i

26

Set the state of the Standby Chassis to Admin UP.

asg chassis_admin -c <ID of Standby Chassis> up

Part 2 - Failing Over from Active Chassis to Standby Chassis

In this part, you fail over all connections from the Active Chassis to the Standby Chassis.

Step

Instructions

27

Connect to the command line on the Active Chassis.

28

Log in to the Expert mode.

29

Set the state of the Active Chassis to "down":

asg chassis_admin -c <ID of Standby Chassis> down

Example:

asg chassis_admin -c 2 down

Part 3 - Upgrading the CMM Firmware on the former Active Chassis

In this part, you upgrade the CMM firmware on the former Active Chassis.

Step

Operation

Command

30

Connect to the command line on the former Active Chassis.

 

31

Log in to the Expert mode.

 

32

Set the state of the former Active Chassis to Admin DOWN.

asg chassis_admin -c <ID of Standby Chassis> down

33

Connect to the command line on an SGM on the former Active Chassis.

Connect over SSH or a serial console.

 

34

Get the applicable firmware version.

Usually the latest recommended firmware file is located here:

$SMODIR/conf/hw_firmware/SM_update.tar

 

35

Extract the firmware image on the SGM to the /var/log/ directory.

tar -xvf $SMODIR/conf/hw_firmware/SM700CC_update.tar -C /var/log/

36

Pull out all CMMs from the former Active Chassis.

 

37

Insert one CMM into the former Active Chassis.

 

38

Copy the firmware files from the SGM to the /tmp/ directory on the CMM.

The password is: admin

# scp /var/log/sentry.shmm700.* admin@198.51.100.33:/tmp/

39

Open a console connection to the serial port on the CMM on the former Active Chassis.

Use the default connection parameters:

  • Baud Rate: 9600
  • Data bits: 8
  • Stop bits: 1
  • Parity: None
  • Flow Control: None

 

40

Copy the CMM firmware image to the CMM.

Note - Run these commands from the console connection to the CMM.

cd /tmp

clia terminate

setenv custcnf C00013

setenv rc2 /etc/rc.0000-14

rupgrade --erase-all --base file:///tmp/sentry.shmm700. -k kernel -r rfs -a app

41

Run the firmware installation script.

Notes:

  • Run this command from the console connection to the CMM.

  • When prompted, press Enter to reboot the CMM.

  • If the screen becomes unreadable during the upgrade procedure, change the baud rate of the console connection.

install.sh

42

If the Standby Chassis ID is 2, change the Standby Chassis ID setting from "1" to "2".

sed -i 's/CHASSID="1"/CHASSID="2"/g' /etc/shmm.cfg

reboot

43

Make sure the Standby Chassis ID is correct.

Outputs of the commands listed on the right must be the same and must show the correct Standby Chassis ID.

Important - If outputs of these commands do not match, stop the entire procedure and contact Check Point Support immediately.

grep SHMM_CHASSID /etc/shmm.cfg

clia shelfaddress

44

Pull out the upgraded CMM from the former Active Chassis.

 

45

Insert the second CMM into the former Active Chassis.

 

46

Copy the firmware files from the SGM to the /tmp/ directory on the CMM.

The password is: admin

# scp /var/log/sentry.shmm700.* admin@198.51.100.33:/tmp/

47

Open a console connection to the serial port on the CMM on the former Active Chassis.

Use the default connection parameters:

  • Baud Rate: 9600
  • Data bits: 8
  • Stop bits: 1
  • Parity: None
  • Flow Control: None

 

48

Copy the CMM firmware image to the CMM.

Note - Run these commands from the console connection to the CMM.

cd /tmp

clia terminate

setenv custcnf C00013

setenv rc2 /etc/rc.0000-14

rupgrade --erase-all --base file:///tmp/sentry.shmm700. -k kernel -r rfs -a app

49

Run the firmware installation script.

Notes:

  • Run this command from the console connection to the CMM.

  • When prompted, press Enter to reboot the CMM.

  • If the screen becomes unreadable during the upgrade procedure, change the baud rate of the console connection.

install.sh

50

If the Standby Chassis ID is 2, change the Standby Chassis ID setting from "1" to "2".

sed -i 's/CHASSID="1"/CHASSID="2"/g' /etc/shmm.cfg

reboot

51

Make sure the Standby Chassis ID is correct.

Outputs of the commands listed on the right must be the same and must show the correct Standby Chassis ID.

Important - If outputs of these commands do not match, stop the entire procedure and contact Check Point Support immediately.

grep SHMM_CHASSID /etc/shmm.cfg

clia shelfaddress

52

Insert the first CMM into the former Active Chassis.

 

53

Go to GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. gClish: enter gclish and press Enter.

 

54

Make sure the Active and Standby CMMs have the same firmware version.

asg_version -i

55

Set the state of the former Active Chassis to Admin UP.

Important - If the former Active Chassis is configured as "Primary Up", an automatic fallback occurs.

asg chassis_admin -c <ID of Standby Chassis> up

Upgrading the CMM Firmware on CMM700 - No Physical Access to Standby Chassis

Use this procedure if there is no physical access to the chassis.

This procedure requires a console connection to each CMM.

All the required steps were divided into three parts.

Part 1 - Upgrading the CMM Firmware on the Standby Chassis

In this part, you upgrade the CMM firmware on the Standby Chassis.

Step

Operation

Command

1

Connect to the command line on the Standby Chassis.

 

2

Log in to the Expert mode.

 

3

Set the state of the Standby Chassis to Admin DOWN.

asg chassis_admin -c <ID of Standby Chassis> down

4

Open a console connection to the serial port on the Active CMM and on the Standby CMM on the Standby Chassis.

Use the default connection parameters:

  • Baud Rate: 9600
  • Data bits: 8
  • Stop bits: 1
  • Parity: None
  • Flow Control: None

 

5

Connect to the command line on an SGM on the Standby Chassis.

Connect over SSH or a serial console.

 

6

Get the applicable firmware version.

Usually the latest recommended firmware file is located here:

$SMODIR/conf/hw_firmware/SM_update.tar

 

7

Extract the firmware image on the SGM to the /var/log/ directory.

tar -xvf $SMODIR/conf/hw_firmware/SM700CC_update.tar -C /var/log/

8

Terminate the Standby CMM on the Standby Chassis.

  1. Identify the Standby CMM:

    clia shmstatus

  2. From the console connection to the Standby CMM, terminate the CMM:

    clia terminate

9

Copy the firmware files from the SGM to the /tmp/ directory on the CMM.

The password is: admin

# scp /var/log/sentry.shmm700.* admin@198.51.100.33:/tmp/

10

Copy the CMM firmware image to the Active CMM.

Notes:

  • Run these commands from the console connection to the Active CMM.

  • After the CMM reboot, these lines appear.

    Press Enter to get the login prompt:

    <INFO> Write confirmed: 1 -> 0 [ALLOW]

    <INFO> Write upgrade_state: "in progress" (2) -> "confirmed" (4) [ALLOW]

    <INFO> Write upgrade watchdog: 1 -> 0 [ALLOW]

cd /tmp

clia terminate

setenv custcnf C00013

setenv rc2 /etc/rc.0000-14

rupgrade --erase-all --base file:///tmp/sentry.shmm700. -k kernel -r rfs -a app

11

Run the firmware installation script.

Notes:

  • Run this command from the console connection to the Active CMM.

  • When prompted, press Enter to reboot the CMM.

  • If the screen becomes unreadable during the upgrade procedure, change the baud rate of the console connection.

install.sh

12

If the Standby Chassis ID is 2, change the Standby Chassis ID setting from "1" to "2".

sed -i 's/CHASSID="1"/CHASSID="2"/g' /etc/shmm.cfg

reboot

13

Make sure the Standby Chassis ID is correct.

Outputs of the commands listed on the right must be the same and must show the correct Standby Chassis ID.

Important - If outputs of these commands do not match, stop the entire procedure and contact Check Point Support immediately.

grep SHMM_CHASSID /etc/shmm.cfg

clia shelfaddress

14

Terminate the Active CMM on the Standby Chassis.

Run these commands from the console connection to Active CMM.

  1. Terminate the CMM:

    clia terminate

  2. Set the state of the eth0 interface to down:

    ifconfig eth0 down

  3. Set the state of the eth1 interface to down:

    ifconfig eth1 down

15

Reboot the Standby CMM.

Notes:

  • Run this command from the console connection to the Standby CMM:

  • This CMM becomes the new Active CMM.

reboot

16

Terminate the Standby CMM (former Active CMM) on the Standby Chassis.

  1. Identify the Standby CMM:

    clia shmstatus

  2. From the console connection to the Standby CMM (former Active CMM), terminate the CMM:

    clia terminate

17

Copy the firmware files from the SGM to the /tmp/ directory on the new Active CMM (former Standby CMM).

The password is: admin

# scp /var/log/sentry.shmm500.* admin@198.51.100.33:/tmp/

18

Copy the CMM firmware image to the new Active CMM.

Notes:

  • Run these commands from the console connection to the new Active CMM.

  • After the CMM reboot, these lines appear.

    Press Enter to get the login prompt:

    <INFO> Write confirmed: 1 -> 0 [ALLOW]

    <INFO> Write upgrade_state: "in progress" (2) -> "confirmed" (4) [ALLOW]

    <INFO> Write upgrade watchdog: 1 -> 0 [ALLOW]

cd /tmp

setenv rc2 /etc/rc.asis

clia terminate

rupgrade_tool -s -v --r=sentry.shmm500.rfs --k=sentry.shmm500.kernel --u=sentry.shmm500.u-boot --hook=erase

19

Run the firmware installation script.

Notes:

  • Run this command from the console connection to the new Active CMM.

  • When prompted, press Enter to reboot the CMM.

  • If the screen becomes unreadable during the upgrade procedure, change the baud rate of the console connection.

install.sh

20

If the Standby Chassis ID is 2, change the Standby Chassis ID setting from "1" to "2".

sed -i 's/CHASSID="1"/CHASSID="2"/g' /etc/shmm.cfg

reboot

21

Make sure the Standby Chassis ID is correct.

Outputs of the commands listed on the right must be the same and must show the correct Standby Chassis ID.

Important - If outputs of these commands do not match, stop the entire procedure and contact Check Point Support immediately.

grep SHMM_CHASSID /etc/shmm.cfg

clia shelfaddress

22

Reboot the Standby CMM.

Run this command from the console connection to the Standby CMM:

reboot

23

Go to Gaia gClish: enter gclish and press Enter.

 

24

Make sure the Active and Standby CMMs have the same firmware version.

asg_version -i

25

Set the state of the Standby Chassis to Admin UP.

asg chassis_admin -c <ID of Standby Chassis> up

Part 2 - Failing Over from Active Chassis to Standby Chassis

In this part, you fail over all connections from the Active Chassis to the Standby Chassis.

Step

Instructions

26

Connect to the command line on the Active Chassis.

27

Log in to the Expert mode.

28

Set the state of the Active Chassis to "down":

asg chassis_admin -c <ID of Standby Chassis> down

Example:

asg chassis_admin -c 2 down

Part 3 - Upgrading the CMM Firmware on the former Active Chassis

In this part, you upgrade the CMM firmware on the former Active Chassis.

Step

Operation

Command

29

Connect to the command line on the former Active Chassis.

 

30

Log in to the Expert mode.

 

31

Set the state of the former Active Chassis to Admin DOWN.

asg chassis_admin -c <ID of Standby Chassis> down

32

Open a console connection to the serial port on the Active CMM and on the Standby CMM on the former Active Chassis.

Use the default connection parameters:

  • Baud Rate: 9600
  • Data bits: 8
  • Stop bits: 1
  • Parity: None
  • Flow Control: None

 

33

Connect to the command line on an SGM on the former Active Chassis.

Connect over SSH or a serial console.

 

34

Get the applicable firmware version.

Usually the latest recommended firmware file is located here:

$SMODIR/conf/hw_firmware/SM_update.tar

 

35

Extract the firmware image on the SGM to the /var/log/ directory.

tar -xvf $SMODIR/conf/hw_firmware/SM700CC_update.tar -C /var/log/

36

Terminate the Standby CMM on the former Active Chassis.

  1. Identify the Standby CMM:

    clia shmstatus

  2. From the console connection to the Standby CMM, terminate the CMM:

    clia terminate

37

Copy the firmware files from the SGM to the /tmp/ directory on the CMM.

The password is: admin

# scp /var/log/sentry.shmm700.* admin@198.51.100.33:/tmp/

38

Copy the CMM firmware image to the Active CMM.

Notes:

  • Run these commands from the console connection to the Active CMM.

  • After the CMM reboot, these lines appear.

    Press Enter to get the login prompt:

    <INFO> Write confirmed: 1 -> 0 [ALLOW]

    <INFO> Write upgrade_state: "in progress" (2) -> "confirmed" (4) [ALLOW]

    <INFO> Write upgrade watchdog: 1 -> 0 [ALLOW]

cd /tmp

clia terminate

setenv custcnf C00013

setenv rc2 /etc/rc.0000-14

rupgrade --erase-all --base file:///tmp/sentry.shmm700. -k kernel -r rfs -a app

39

Run the firmware installation script.

Notes:

  • Run this command from the console connection to the Active CMM.

  • When prompted, press Enter to reboot the CMM.

  • If the screen becomes unreadable during the upgrade procedure, change the baud rate of the console connection.

install.sh

40

If the Standby Chassis ID is 2, change the Standby Chassis ID setting from "1" to "2".

sed -i 's/CHASSID="1"/CHASSID="2"/g' /etc/shmm.cfg

reboot

41

Make sure the Standby Chassis ID is correct.

Outputs of the commands listed on the right must be the same and must show the correct Standby Chassis ID.

Important - If outputs of these commands do not match, stop the entire procedure and contact Check Point Support immediately.

grep SHMM_CHASSID /etc/shmm.cfg

clia shelfaddress

42

Terminate the Active CMM on the former Active Chassis.

Run these commands from the console connection to Active CMM.

  1. Terminate the CMM:

    clia terminate

  2. Set the state of the eth0 interface to down:

    ifconfig eth0 down

  3. Set the state of the eth1 interface to down:

    ifconfig eth1 down

43

Reboot the Standby CMM.

Notes:

  • Run this command from the console connection to the Standby CMM:

  • This CMM becomes the new Active CMM.

reboot

44

Terminate the Standby CMM (former Active CMM) on the former Active Chassis.

  1. Identify the Standby CMM:

    clia shmstatus

  2. From the console connection to the Standby CMM (former Active CMM), terminate the CMM:

    clia terminate

45

Copy the firmware files from the SGM to the /tmp/ directory on the new Active CMM (former Standby CMM).

The password is: admin

# scp /var/log/sentry.shmm500.* admin@198.51.100.33:/tmp/

46

Copy the CMM firmware image to the new Active CMM.

Notes:

  • Run these commands from the console connection to the new Active CMM.

  • After the CMM reboot, these lines appear.

    Press Enter to get the login prompt:

    <INFO> Write confirmed: 1 -> 0 [ALLOW]

    <INFO> Write upgrade_state: "in progress" (2) -> "confirmed" (4) [ALLOW]

    <INFO> Write upgrade watchdog: 1 -> 0 [ALLOW]

cd /tmp

setenv rc2 /etc/rc.asis

clia terminate

rupgrade_tool -s -v --r=sentry.shmm500.rfs --k=sentry.shmm500.kernel --u=sentry.shmm500.u-boot --hook=erase

47

Run the firmware installation script.

Notes:

  • Run this command from the console connection to the new Active CMM.

  • When prompted, press Enter to reboot the CMM.

  • If the screen becomes unreadable during the upgrade procedure, change the baud rate of the console connection.

install.sh

48

If the Standby Chassis ID is 2, change the Standby Chassis ID setting from "1" to "2".

sed -i 's/CHASSID="1"/CHASSID="2"/g' /etc/shmm.cfg

reboot

49

Make sure the Standby Chassis ID is correct.

Outputs of the commands listed on the right must be the same and must show the correct Standby Chassis ID.

Important - If outputs of these commands do not match, stop the entire procedure and contact Check Point Support immediately.

grep SHMM_CHASSID /etc/shmm.cfg

clia shelfaddress

50

Reboot the Standby CMM.

Run this command from the console connection to the Standby CMM:

reboot

51

Go to Gaia gClish: enter gclish and press Enter.

 

52

Make sure the Active and Standby CMMs have the same firmware version.

asg_version -i

53

Set the state of the former Active Chassis to Admin UP.

Important - If the former Active Chassis is configured as "Primary Up", an automatic fallback occurs.

asg chassis_admin -c <ID of Standby Chassis> up