Installing and Uninstalling a Hotfix on Security Group Members

This section describes the Full Connectivity installation and uninstall of an Offline CPUSE package.

Installing a Hotfix Package on Security Group Members

Important:

  • It is not supported to upgrade the CPUSE Agent on Security Group Members.

  • This procedure keeps the current connections in a Security Group.

  • This procedure applies to Security Groups in both Security Gateway and VSX mode.

    In VSX mode, you must run all the commands in the context of VS0.

  • Do not install the hotfix on all the Security Group Members in a specific Security Group at the same time.

  • In this procedure, you divide all Security Group Members in a specific Security Group into two or more logical groups.

    In the procedure below, we use two logical groups denoted below as "A" and "B".

    You install the hotfix on one logical group of the Security Group Members at one time.

    The other logical group(s) of the Security Group Members continues to handle traffic.

    Each logical group should contain the same number of Security Group Members - as close as possible.

    Environment

    Description

    Single Site

    • There are 8 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_4.

    • The Logical Group "B" contains Security Group Members from 1_5 to 1_8.

    Single Site

    • There are 5 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_3.

    • The Logical Group "B" contains Security Group Members from 1_4 to 1_5.

    Dual Site

    • There are 4 Security Group Members in the Security Group (on each Site).

    • The Logical Group "A" contains Security Group Members on Site 1 from 1_1 to 1_4.

    • The Logical Group "B" contains Security Group Members on Site 2 from 2_1 to 2_4.

Installation Procedure

Step

Instructions

A

Make sure you have the applicable CPUSE Offline package.

B

Transfer the CPUSE Offline package to the Security Group (into some directory, for example /var/log/).

C

Connect to the command line on the Security Group.

D

If your default shell is /bin/bash (the Expert mode), then go to Gaia gClish:

gclish

E

Import the CPUSE Offline package from the hard disk:

installer import local /<Full Path>/<Name of the CPUSE Offline Package>

Example:

[Global] HostName-ch01-01 > installer import local /var/log/Check_Point_R81.20_Hotfix_Bundle_FULL.tgz

F

Show the imported CPUSE packages:

show installer packages imported

G

Make sure the imported CPUSE package can be installed on this Security Group:

installer verify [Press the Tab key]

installer verify <Number of CPUSE Package> member_ids all

Example:

[Global] HostName-ch01-01 > installer verify 2 member_ids all
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_01 (local) |Installation is allowed.                     |
|1_02         |Installation is allowed.                     |
|1_03         |Installation is allowed.                     |
|1_04         |Installation is allowed.                     |
|1_05         |Installation is allowed.                     |
|1_06         |Installation is allowed.                     |
|1_07         |Installation is allowed.                     |
|1_08         |Installation is allowed.                     |
+-----------------------------------------------------------+
[Global] HostName-ch01-01 >

Note - The SMO Image Cloning feature automatically clones all the required software packages to the Security Group Members during their boot. When you install or remove software packages gradually on Security Group Members, it is necessary to disable this feature, so that after a reboot the updated Security Group Members do not clone the software packages from the existing non-updated Security Group Members.

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is /bin/bash (Expert mode), then go to Gaia gClish:

gclish

C

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

D

Disable the SMO Image Cloning feature, if it is enabled:

set smo image auto-clone state off

E

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the Security Group Members in the Logical Group "A" through the console.

  • Connect to one of the Security Group Members in the Logical Group "B" over SSH.

B

If your default shell is /etc/cli.sh (Gaia Clish), then go to the Expert mode:

expert

C

Set the Security Group Members in the Logical Group "A" to the state "DOWN":

g_clusterXL_admin –b <SGM IDs in Group "A"> down

Example:

[Expert@HostName-ch0x-0x:0]# g_clusterXL_admin -b 1_1-1_4 down

D

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

Example:

member 1_1

E

Go from the Expert mode to Gaia gClish:

  • If your default shell is /bin/bash (the Expert mode), then run:

    gclish

  • If your default shell is /etc/cli.sh (Gaia Clish), then run:

    exit

F

Install the CPUSE hotfix package on the Security Group Members in the Logical Group "A":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids <SGM IDs in Group "A">

Example:

[Global] HostName-ch01-01 > installer install 2 member_ids 1_1-1_4
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_01 (local) |Package is ready for installation            |
|1_02         |Package is ready for installation            |
|1_03         |Package is ready for installation            |
|1_04         |Package is ready for installation            |
+-----------------------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y
[Global] HostName-ch01-01 >

G

Go from Gaia gClish to the Expert mode:

  • If your default shell is /bin/bash (the Expert mode), then run:

    exit

  • If your default shell is /etc/cli.sh (Gaia Clish), then run:

    expert

H

Monitor the system until the Security Group Members in the Logical Group "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the Security Group Members in the Logical Group "B" through the console.

  • Connect to one of the Security Group Members in the Logical Group "A" over SSH.

B

If your default shell is /etc/cli.sh (Gaia Clish), then go to the Expert mode:

expert

C

Set the Security Group Members in the Logical Group "B" to the state "DOWN":

g_clusterXL_admin –b <SGM IDs in Group "B"> down

Example:

[Expert@HostName-ch0x-0x:0]# g_clusterXL_admin -b 1_5-1_8 down

D

Connect to one of the Security Group Members in the Logical Group "B":

member <Member ID>

Example:

member 1_5

E

Go from the Expert mode to Gaia gClish:

  • If your default shell is /bin/bash (the Expert mode), then run:

    gclish

  • If your default shell is /etc/cli.sh (Gaia Clish), then run:

    exit

F

Install the CPUSE hotfix package on the Security Group Members in the Logical Group "B":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids <SGM IDs in Group "B">

Example:

[Global] HostName-ch01-01 > installer install 2 member_ids 1_5-1_8
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_05 (local) |Package is ready for installation            |
|1_06         |Package is ready for installation            |
|1_07         |Package is ready for installation            |
|1_08         |Package is ready for installation            |
+-----------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y
[Global] HostName-ch01-01 >

G

Go from Gaia gClish to the Expert mode:

  • If your default shell is /bin/bash (the Expert mode), then run:

    exit

  • If your default shell is /etc/cli.sh (Gaia Clish), then run:

    expert

H

Monitor the system until the Security Group Members in the Logical Group "B" are in the state "UP" and enforce the security policy again:

asg monitor

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is /etc/cli.sh (Gaia Clish), then go to the Expert mode:

expert

C

Run:

asg diag verify

Uninstalling a Hotfix Package on Security Group Members

Important:

  • It is not supported to upgrade the CPUSE Agent on Security Group Members.

  • This procedure keeps the current connections in a Security Group.

  • This procedure applies to Security Groups in both Security Gateway and VSX mode.

    In VSX mode, you must run all the commands in the context of VS0.

  • Do not uninstall the hotfix from all the Security Group Members in a specific Security Group at the same time.

  • You uninstall the hotfix from one logical group of the Security Group Members at one time.

    The other logical group of the Security Group Members continues to handle traffic.

    You divide all Security Group Members in a specific Security Group into two logical groups - denoted below as "A" and "B".

    1. You uninstall the hotfix from the Security Group Members in the Logical Group "A"

    2. You uninstall the hotfix from the Security Group Members in the Logical Group "B"

    Each logical group should contain the same number of Security Group Members - as close as possible.

    Environment

    Description

    Single Site

    • There are 8 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_4.

    • The Logical Group "B" contains Security Group Members from 1_5 to 1_8.

    Single Site

    • There are 5 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_3.

    • The Logical Group "B" contains Security Group Members from 1_4 to 1_5.

    Dual Site

    • There are 4 Security Group Members in the Security Group (on each Site).

    • The Logical Group "A" contains Security Group Members on Site 1 from 1_1 to 1_4.

    • The Logical Group "B" contains Security Group Members on Site 2 from 2_1 to 2_4.

Uninstall Procedure

Note - The SMO Image Cloning feature automatically clones all the required software packages to the Security Group Members during their boot. When you install or remove software packages gradually on Security Group Members, it is necessary to disable this feature, so that after a reboot the updated Security Group Members do not clone the software packages from the existing non-updated Security Group Members.

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is /bin/bash (Expert mode), then go to Gaia gClish:

gclish

C

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

D

Disable the SMO Image Cloning feature, if it is enabled:

set smo image auto-clone state off

E

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the Security Group Members in the Logical Group "A" through the console.

  • Connect to one of the Security Group Members in the Logical Group "B" over SSH.

B

Go to the Expert mode.

C

Set Security Group Members in the Logical Group "A" to the state "DOWN":

g_clusterXL_admin –b <SGM IDs in Group "A"> down

Example:

[Expert@HostName-ch0x-0x:0]# g_clusterXL_admin -b 1_1-1_4 down

D

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

E

Go from the Expert mode to Gaia gClish:

  • If your default shell is /bin/bash (the Expert mode), then run:

    gclish

  • If your default shell is /etc/cli.sh (Gaia Clish), then run:

    exit

F

Uninstall the CPUSE hotfix package on the Security Group Members in the Logical Group "A":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <SGM IDs in Group "A">

Example:

[Global] HostName-ch01-01 > installer uninstall 2 member_ids 1_1-1_4
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-------------+---------------------------------------------+
|1_01 (local) |Package is ready for uninstallation          |
|1_02         |Package is ready for uninstallation          |
|1_03         |Package is ready for uninstallation          |
|1_04         |Package is ready for uninstallation          |
+-------------+---------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y
[Global] HostName-ch01-01 >

G

Go from Gaia gClish to the Expert mode:

  • If your default shell is /bin/bash (the Expert mode), then run:

    exit

  • If your default shell is /etc/cli.sh (Gaia Clish), then run:

    expert

H

Monitor the system until the Security Group Members in the Logical Group "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the Security Group Members in the Logical Group "B" through the console.

  • Connect to one of the Security Group Members in the Logical Group "A" over SSH.

B

Go to the Expert mode:

expert

C

Set Security Group Members in the Logical Group "B" to the state "DOWN":

g_clusterXL_admin –b <SGM IDs in Group "B"> down

Example:

[Expert@HostName-ch0x-0x:0]# g_clusterXL_admin -b 1_5-1_8 down

D

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

E

Go from the Expert mode to Gaia gClish:

  • If your default shell is /bin/bash (the Expert mode), then run:

    gclish

  • If your default shell is /etc/cli.sh (Gaia Clish), then run:

    exit

F

Uninstall the CPUSE hotfix package on the Security Group Members in the Logical Group "B":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <SGM IDs in Group "B">

Example:

[Global] HostName-ch01-01 > installer uninstall 2 member_ids 1_5-1_8
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_05 (local) |Package is ready for uninstallation          |
|1_06         |Package is ready for uninstallation          |
|1_07         |Package is ready for uninstallation          |
|1_08         |Package is ready for uninstallation          |
+-----------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y
[Global] HostName-ch01-01 >

G

Go from Gaia gClish to the Expert mode:

  • If your default shell is /bin/bash (the Expert mode), then run:

    exit

  • If your default shell is /etc/cli.sh (Gaia Clish), then run:

    expert

H

Monitor the system until the Security Group Members in the Logical Group "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is /etc/cli.sh (Gaia Clish), then go to the Expert mode:

expert

C

Run:

asg diag verify