Central Deployment of Hotfixes and Version Upgrades

Introduction

Use Central Deployment in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to perform batch deployment of:

Jumbo Hotfix Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior. Accumulators and Hotfixes on Security Gateways and Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Members.
Upgrade Packages on Security Gateways and Cluster Members.

You can Deploy a Hotfix or Upgrade Package from:

The Check Point Cloud.
The Package Repository Collection of software packages that were uploaded to the Management Server. You can easily install these packages in SmartConsole on the managed Security Gateways. on the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

First, you must upload the applicable package to the Package Repository. See Adding a package to the Package Repository.

To use Central Deployment through the API, see the Check Point Management API Reference.

Best Practice - Use the Package Repository on the Management Server if the target's connectivity to the Management Server is better than the target's connectivity to the cloud, or if the target is overloaded with traffic.

Note - You can select up to 30 Security Gateways and Cluster Members, but installation can take place only on 10 targets at the same time. The Management Server places each target above the 10th in a queue. Each time an installation completes on one of the targets, the Management Server installs it on the next target in the queue.

Some Security Gateways have Recommended Hotfixes. See the Recommended Jumbo column in the Gateways & Servers view:

You can deploy a Recommended Jumbo Hotfix Accumulator Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA. or a specific Jumbo Hotfix Accumulator take.

Prerequisites

To use Central Deployment:

The administrator must have SmartUpdate Legacy Check Point GUI client used to manage licenses and contracts in a Check Point environment. write permission on the Management Server.
The latest build of the CPUSE Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS, and the Gaia OS itself. For details, see sk92449. Deployment Agent must be installed on the target Security Gateways and Cluster Members.
SIC Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server. must already be established between the Management Server and the target Security Gateways and Cluster Members.
A policy must be installed on the target Security Gateways and Cluster Members.
Only full clusters can be deployed (you cannot select and deploy one cluster member Security Gateway that is part of a cluster.).

To use Central Deployment directly from the Check Point Cloud:

The Management Server must be able to connect to the Check Point Cloud.
The target Security Gateways and Cluster Members must be able to connect to the Check Point Cloud.

To install the Recommended Jumbo Hotfix Accumulator on the target Security Gateways and Cluster Members, at least these Jumbo Hotfix Accumulator takes must be installed:

Target Version	Minimal Jumbo Hotfix Accumulator Take
R80.40 and higher	Any take.
R80.30	Take 76 or higher.
R80.20	Take 118 or higher.
R80.10	Take 245 or higher.

Limitations

Central Deployment does not support:

Connecting from SmartConsole to the Management Server through a proxy server.

In this case, use the applicable API command.
ClusterXL in High Availability mode configured as "Switch to higher priority Cluster Member" (known as "Primary Up").
ClusterXL in Load Sharing mode.
VRRP Cluster.
Standalone Configuration in which the Security Gateway and the Security Management Server products are installed and configured on the same server. server.
Scalable Chassis 40000 / 60000.
Centrally Managed Quantum Spark Appliances running Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Embedded operating system.
Standby Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server..
On Multi-Domain Servers, SmartConsole connected to the Global Domain, or the Multi-Domain Server Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. context.
Log Server Dedicated Check Point server that runs Check Point software to store and process logs..
SmartEvent Server.

Installation

Adding a package to the Package Repository

From the left navigation panel, click Manage & Settings.
From the left tree, click Package Repository.
Click New and select one of these options:
- Download from cloud - To download the package to the Package Repository from the Check Point Cloud, paste the package CPUSE Identifier and click Download.
- Upload from local - To upload the package to the Package Repository from your device, browse to the applicable package and click Open.
After the download or upload is complete, the package appears in the Package Repository window in SmartConsole > Manage & Settings view.

Note - Add packages to the repository one at a time.

Installing a Hotfix or Upgrade Package on multiple Security Gateways or Cluster Members

Best Practice - Central deployment of Hotfixes or upgrade packages on the Security Management Server relies on the status reports from the managed Gaia servers. Therefore, we recommend to wait for two minutes after the Gaia server is up and running before you install a Hotfix or upgrade package.

From the left navigation panel, click Gateways & Servers.
Select the target Security Gateways or Cluster Members for deployment.

To select multiple targets, press and hold the CTRL key.

To upgrade Cluster Members, select the cluster object.
From the toolbar menu, click Actions and select one of these options:
- Install Hotfix/Jumbo
- Version Upgrade
The Install Hotfix or Version Upgrade window opens, and shows Information about the selected targets and their corresponding recommended Hotfix or Upgrade Package.

Example:

Select one of these options:

Install Recommended Hotfix/Jumbo or

Upgrade to Recommended Major Version

Note - If there is no recommended Jumbo Hotfix Accumulator for the selected targets, this option is grayed out.

If a recommended Jumbo Hotfix Accumulator applies only to some of the selected targets, the deployment takes place only for those targets.

Install Specific Hotfix/Jumbo or

Upgrade to Specific Major Version
1. Enter the version number / Hotfix file name. You can copy the Hotfix file name from the applicable SK article to the Install Specific Hotfix text box.
  
  Example:
2. Click the search icon next to the text box:
  
  This process makes sure that the package is available for download from the Check Point servers.

Select the Package Location Source:
- Gateway - The package is downloaded from the Check Point Cloud.
- Management - The package is uploaded from the Package Repository.
- Automatic - If the package is in the Package Repository, it is downloaded from the Package Repository. If the package is not in the Package Repository, the package is downloaded from the Check Point Cloud.
Click Verify.

The Install Hotfix or Upgrade Version window is minimized, and the verification process starts. The verification process makes sure that the selected Hotfix Take or Upgrade Package can be installed on the targets. The verification process checks other installed Hotfixes are not overridden and that enough free disk space is available for the process to complete.

To see the progress of the verification process open the Tasks view in the bottom left corner of SmartConsole and click Details.

Example:
Repeat steps 1-6.
Click Install.
Central Deployment verifies that Access Control Policy is installed.
After the installation is complete, you must install the applicable Threat Prevention policy on the target Security Gateways and Clusters

Note - If different targets have different recommended Hotfixes or Upgrade Packages, each target gets its applicable recommended Hotfix or Upgrade Package.

How the Central Deployment Upgrades a Cluster

When you use the Central Deployment to install a software package on a ClusterXL in High Availability mode or VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Cluster (non-VSLS), the Central Deployment follows these steps:

Verifies that the states of the Cluster Members are valid (Active and Standby).
Prepares the Access Control Policy for the Cluster:
1. Changes the version in the Cluster object.
2. Changes the applicable configuration settings and Access Control Policy.
Upgrades the Standby Cluster Member to the new version.
Runs a Multi-Version Cluster (MVC):
1. Makes sure the upgraded Cluster Member is in the Standby or Ready state.
2. Performs cluster failover to one of the upgraded Cluster Members.
Upgrades the former Active Cluster Member.
Verifies that the states of the Cluster Members are valid (Active and Standby).