Rolling Back a Failed Upgrade of a Security Group to R81.20 - After Partial Upgrade

This section describes the steps for rolling back a failed upgrade of a Security GroupClosed A logical group of Security Gateway Modules that provides Active/Active cluster functionality. A Security Group can contain one or more Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. to R81.20.

This procedure supports only these downgrade paths for Security Groups:

  • from R81.20 to R81

  • from R81.20 to R81.10

  • from R81.20 to R80.20SP

Important - Use this rollback procedure if you upgraded only some (not all) Security Group Members in the Security Group.

Step

Instructions

1

Connect to the command line on the Security Group.

2

If your default shell is /bin/bash (Expert mode), then go to the Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Gateway Modules. Commands you run in this shell apply to all Security Gateway Module in the Security Group.:

gclish

3

Disable the SMOClosed See "SMO". Image Cloning feature:

Note - The SMO Image Cloning feature automatically clones all the required software packages to the SGMs during their boot. When you install or remove software packages gradually on SGMs, it is necessary to disable this feature, so that after a reboot the updated SGMs do not clone the software packages from the existing non-updated SGMs.

  1. Examine the state of the SMO Image Cloning feature:

    show smo image auto-clone state

  2. Disable the SMO Image Cloning feature, if it is enabled:

    set smo image auto-clone state off

  3. Examine the state of the SMO Image Cloning feature:

    show smo image auto-clone state

4

Go to the Expert mode:

  • If your default shell is /bin/bash (Expert mode):

    exit

  • If your default shell is /etc/gclish (Gaia gClish):

    expert

5

Go to the context of one of the Security Group Members that were upgraded to R81.20:

member <Member ID>

Example:

member 1_1

6

Run the upgrade script with the "revert" parameter and follow the instructions on the screen:

sp_upgrade --revert

7

On each Security Group Member that was upgraded to R81.20, restore the Gaia automatic snapshot:

  1. Go to the context of each Security Group Member:

    member <Member ID>

    Example:

    member 1_2

  2. Go to Gaia Clish (do not use the Gaia gClish):

    clish

  3. Restore the Gaia automatic snapshot that was saved automatically before the upgrade.

    set snapshot revert AutoSnapShot_<Original-Version>_<Take>

    Example:

    set snapshot revert AutoSnapShot_AutoSnapShot_R81_47

  4. Wait for the Security Group Member to complete the reboot.

  5. Repeat Steps a-d for the next Security Group Member that was upgraded.

8

Connect to the command line on the Security Group.

9

If your default shell is /etc/gclish (Gaia gClish), then go to the Expert mode:

expert

10

Run the upgrade script with the "revert" parameter again and follow the instructions on the screen:

sp_upgrade --revert

11

Make sure the downgrade was successful:

asg diag verify