Uninstalling a Hotfix from Dual Chassis

This procedure describes the Full Connectivity uninstall of an Offline CPUSE package on Dual Chassis.

Important Notes

It is not supported to upgrade the CPUSE Agent on SGMs in a Security Group.
This procedure keeps the current connections in a Security Group A logical group of Security Gateway Modules that provides Active/Active cluster functionality. A Security Group can contain one or more Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway..
This procedure applies to Security Groups in Security Gateway mode and VSX mode.

In VSX mode, you must run all the commands in the context of VS0.

Do not uninstall the hotfix from all the SGMs at the same time.

If you do so with the command below, traffic stops passing through all SGMs until the hotfix is uninstalled:

installer uninstall <Number of CPUSE Package> member_ids all

In this procedure, you uninstall the hotfix from one chassis at one time.

The other chassis continues to handle traffic.
1. You uninstall the hotfix on Standby Chassis "A" from an SGM in Standby Chassis "A".
2. You fail over from Active Chassis "B" to Standby Chassis "A".
3. You uninstall the hotfix on Standby Chassis "B" from an SGM in Standby Chassis "B".
In the procedures below:
- Chassis "A" is the Standby Chassis (chassis1)
- Chassis "B" is the Active Chassis (chassis2)

Best Practice - Perform this procedure over the serial console.

Procedure

Step 1 - Disable the SMO Image Cloning feature

Note - The SMO See "SMO". Image Cloning feature automatically clones all the required software packages to the SGMs during their boot. When you install or remove software packages gradually on SGMs, it is necessary to disable this feature, so that after a reboot the updated SGMs do not clone the software packages from the existing non-updated SGMs.

Step

Instructions

Connect to the command line on the Security Group.

If your default shell is /bin/bash (Expert mode), then go to Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Gateway Modules. Commands you run in this shell apply to all Security Gateway Module in the Security Group.:

gclish

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Disable the SMO Image Cloning feature, if it is enabled:

set smo image auto-clone state off

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Step 2 - Uninstall the Hotfix from Standby Chassis "A"

Step

Instructions

Connect to the command line on the Standby Chassis (in our example, Standby Chassis A).

Set the state of the Standby Chassis "A" to "down":

asg chassis_admin -c <ID of Standby Chassis> down

Example:

[Expert@HostName-ch0x-0x:0]# asg chassis_admin -c 1 down

Go to the Gaia gClish:

gclish

Uninstall the CPUSE hotfix package on the Standby Chassis "A":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids chassis<ID of Standby Chassis>

Example:

[Global] HostName-ch01-01 > installer uninstall 2 member_ids chassis1
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for uninstallation                             |
|1_02         |Package is ready for uninstallation                             |
|1_03         |Package is ready for uninstallation                             |
|1_04         |Package is ready for uninstallation                             |
+-------------+----------------------------------------------------------------+
The machines (1_01,1_02,1_03,1_04) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y

Exit from Gaia gClish to the Expert mode:

exit

Monitor the system until SGMs on the Standby Chassis "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

Set the state of the Standby Chassis "A" to "up":

asg chassis_admin -c <ID of Standby Chassis> up

Example:

[Expert@HostName-ch0x-0x:0]# asg chassis_admin -c 1 up

Monitor the system until SGMs on the Standby Chassis "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

Make sure the Hotfix is uninstalled from all SGMs:

asg diag verify

Step 3 - Fail over from Active Chassis "B" to Standby Chassis "A"

In this step, you fail over all connections from the Active Chassis "B" (chassis2) to the Standby Chassis "A" (chassis1).

Step

Instructions

Connect to the command line on the Active Chassis (in our example, Standby Chassis B - (chassis2)).

Set the state of the Active Chassis "B" to "down":

asg chassis_admin -c <ID of Standby Chassis> down

Example:

[Expert@HostName-ch0x-0x:0]# asg chassis_admin -c 2 down

Step 4 - Uninstall the Hotfix from Standby Chassis B

In this step, you uninstall the Hotfix from the former Standby Chassis "B" (chassis2).

Step

Instructions

Go to the Gaia gClish:

gclish

Uninstall the CPUSE hotfix package on the former Active Chassis "B":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids chassis<ID of Standby Chassis>

Example:

[Global] HostName-ch01-01 > installer uninstall 2 member_ids chassis2
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|2_01 (local) |Package is ready for uninstallation                             |
|2_02         |Package is ready for uninstallation                             |
|2_03         |Package is ready for uninstallation                             |
|2_04         |Package is ready for uninstallation                             |
+-------------+----------------------------------------------------------------+
The machines (2_01,2_02,2_03,2_04) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y

Exit from Gaia gClish to the Expert mode:

exit

Monitor the system until SGMs on the former Active Chassis "B" are in the state "UP" and enforce the Security Policy again:

asg monitor

Set the state of the former Active Chassis "B" to "up":

asg chassis_admin -c <ID of Standby Chassis> up

Example:

[Expert@HostName-ch0x-0x:0]# asg chassis_admin -c 2 up

Important - If the former Active Chassis is configured as "Primary Up", an automatic fallback occurs.

Monitor the system until SGMs on the Chassis "B" are in the state "UP" and enforce the Security Policy again:

asg monitor

Make sure the Hotfix is uninstalled from all SGMs:

asg diag verify

Step 5 - (Optional) Delete the uninstalled Hotfix package from the Chassis

In this optional step, you delete the uninstalled Hotfix package from the chassis to free the disk space.

Step

Instructions

Go to the Gaia gClish:

gclish

Delete the uninstalled Hotfix package from the CPUSE repository on the chassis:

installer delete [Press the Tab key]

installer delete <Number of CPUSE Package>

Example:

[Global] HostName-ch01-01 > installer delete 2
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for delete                                     |
|1_02         |Package is ready for delete                                     |
|1_03         |Package is ready for delete                                     |
|1_04         |Package is ready for delete                                     |
|2_01         |Package is ready for delete                                     |
|2_02         |Package is ready for delete                                     |
|2_03         |Package is ready for delete                                     |
|2_04         |Package is ready for delete                                     |
+-------------+----------------------------------------------------------------+
You are about to perform
Package delete (Check_Point_R81.20_Hotfix_Bundle_FULL.tar) on blades:
1_01,1_02,1_03,1_04,2_01,2_02,2_03,2_04
*** In case the package is installed, you might not be able to uninstall and Import the package ever again ! ***
 
Are you sure? (Y - yes, any other key - no) y
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |The package was successfully removed from the machine.          |
|1_02         |The package was successfully removed from the machine.          |
|1_03         |The package was successfully removed from the machine.          |
|1_04         |The package was successfully removed from the machine.          |
|2_01         |The package was successfully removed from the machine.          |
|2_02         |The package was successfully removed from the machine.          |
|2_03         |The package was successfully removed from the machine.          |
|2_04         |The package was successfully removed from the machine.          |
+-------------+----------------------------------------------------------------+
[Global] HostName-ch01-01 >