Installing a Hotfix on a Single Chassis

This procedure describes the Full Connectivity installation of an Offline CPUSE package on a Single Chassis.

Important Notes

  • It is not supported to upgrade the CPUSE Deployment Agent on SGMs in a Security Group.

  • This procedure keeps the current connections in a Security GroupClosed A logical group of Security Gateway Modules that provides Active/Active cluster functionality. A Security Group can contain one or more Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway..

  • This procedure applies to Security Groups in Security Gateway mode and VSX mode.

    In VSX mode, you must run all the commands in the context of VS0.

  • If you finished a clean install on this chassis, then you can install a Jumbo Hotfix Accumulator only after you run the Gaia First Time Configuration Wizard.

  • Do not install the hotfix on all the SGMs at the same time.

    If you do so with the command below, traffic stops passing through all SGMs until the hotfix is installed:

    installer install <Number of CPUSE Package> member_ids all

  • In this procedure, you divide all SGMs in a specific Security Group into two or more logical groups.

    In the procedure below, we use two logical groups denoted below as "A" and "B".

    You install the hotfix on one logical group of the SGMs at one time.

    The other logical group(s) of the SGMs continues to handle traffic.

    Each logical group should contain the same number of SGMs - as close as possible.

    Examples:

    Environment

    Description

    Single Chassis

    • There are 8 SGMs in the Security Group.

    • The Logical Group "A" contains SGMs from 1_1 to 1_4.

    • The Logical Group "B" contains SGMs from 1_5 to 1_8.

    Single Chassis

    • There are 5 SGMs in the Security Group.

    • The Logical Group "A" contains SGMs from 1_1 to 1_3.

    • The Logical Group "B" contains SGMs from 1_4 to 1_5.

Best Practice - Perform this procedure over the serial console.

Procedure

Step

Instructions

A

Make sure you have the applicable CPUSE offline package or the exported CPUSE package.

B

Transfer the CPUSE offline or exported package to the Chassis (into some directory, for example: /home/admin/).

C

Connect to the command line on the Chassis.

D

Log in to Gaia Clish.

E

Go to the Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Gateway Modules. Commands you run in this shell apply to all Security Gateway Module in the Security Group.:

gclish

F

Import the CPUSE package from the hard disk:

installer import local /<Full Path>/<Name of the CPUSE Offline Package>

Example:

[Global] HostName-ch01-01 > installer import local /home/admin/Check_Point_R81.20_Hotfix_Bundle_FULL.tar

G

Show the imported CPUSE packages:

show installer packages imported

H

Make sure the imported CPUSE package can be installed on this Chassis:

installer verify[Press the Tab key]

installer verify <Number of CPUSE Package> member_ids all

Example:

[Global] HostName-ch01-01 > installer verify 2 member_ids all
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Installation is allowed.                                        |
|1_02         |Installation is allowed.                                        |
|1_03         |Installation is allowed.                                        |
|1_04         |Installation is allowed.                                        |
|1_05         |Installation is allowed.                                        |
|1_06         |Installation is allowed.                                        |
|1_07         |Installation is allowed.                                        |
|1_08         |Installation is allowed.                                        |
+-------------+----------------------------------------------------------------+
[Global] HostName-ch01-01 >

Note - The SMOClosed See "SMO". Image Cloning feature automatically clones all the required software packages to the SGMs during their boot. When you install or remove software packages gradually on SGMs, it is necessary to disable this feature, so that after a reboot the updated SGMs do not clone the software packages from the existing non-updated SGMs.

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is /bin/bash (Expert mode), then go to Gaia gClish:

gclish

C

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

D

Disable the SMO Image Cloning feature, if it is enabled:

set smo image auto-clone state off

E

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the SGMs in the Logical Group "A" through the console.

  • Connect to one of the SGMs in the Logical Group "B" over SSH.

B

Go to the context of one of the SGMs in the Logical Group "A":

member <Member ID>

Example:

member 1_1

C

Go to the Expert mode.

expert

D

Set the SGMs in the Logical Group "A" to the state "DOWN":

g_clusterXL_admin –b <SGM IDs in Group "A"> down

Example:

[Expert@HostName-ch0x-0x:0]# g_clusterXL_admin -b 1_1-1_4 down

E

Go to the Gaia gClish:

gclish

F

Install the CPUSE package on SGMs in the Logical Group "A":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids <SGM IDs in Group "A"

Example:

[Global] HostName-ch01-01> installer install 2 member_ids 1_1-1_4
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for installation                               |
|1_02         |Package is ready for installation                               |
|1_03         |Package is ready for installation                               |
|1_04         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y

G

Go to the Expert mode.

expert

H

Monitor the SGMs in the Logical Group "A" until they boot:

asg monitor

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the SGMs in the Logical Group "B" through the console.

  • Connect to one of the SGMs in the Logical Group "A" over SSH.

B

Go to the context of one SGMs in the Logical Group "B":

member <Member ID>

Example:

member 1_5

C

Go to Gaia gClish:

gclish

D

Upgrade the SGMs in the Logical Group "B":

installer install[Press the Tab key]

installer install <Number of CPUSE Package> member_ids <SGM IDs in Group "B">

Example:

[Global] HostName-ch01-01 > installer install 2 member_ids 1_5-1_8
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_05 (local) |Package is ready for installation                               |
|1_06         |Package is ready for installation                               |
|1_07         |Package is ready for installation                               |
|1_08         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y

E

Go to the Expert mode.

expert

F

Monitor the Security Group Members in the Logical Group "B" until they boot:

asg monitor

Step

Instructions

A

Connect to the command line on the Security Group.

B

Go to the Expert mode.

expert

C

Run:

asg diag verify