Central Deployment of Hotfixes and Version Upgrades

Introduction

Use Central Deployment in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to perform batch deployment of:

• Jumbo Hotfix Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior. Accumulators and Hotfixes on Security Gateways and Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Members.

• Upgrade Packages on Security Gateways and Cluster Members.

You can Deploy a Hotfix or Upgrade Package from:

• The Check Point Cloud.

• The Package Repository Collection of software packages that were uploaded to the Management Server. You can easily install these packages in SmartConsole on the managed Security Gateways. on the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

  First, you must upload the applicable package to the Package Repository. See Adding a package to the Package Repository.

To use Central Deployment through the API, see the Check Point Management API Reference.

Best Practice - Use the Package Repository on the Management Server if the target's connectivity to the Management Server is better than the target's connectivity to the cloud, or if the target is overloaded with traffic.

Note - You can select up to 30 Security Gateways and Cluster Members, but installation can take place only on 10 targets at the same time. The Management Server places each target above the 10th in a queue. Each time an installation completes on one of the targets, the Management Server installs it on the next target in the queue.

You can deploy a Recommended Jumbo Hotfix Accumulator Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA. or a specific Jumbo Hotfix Accumulator take.

Prerequisites

To use Central Deployment:

• The administrator must have SmartUpdate Legacy Check Point GUI client used to manage licenses and contracts in a Check Point environment. write permission on the Management Server.

• The latest build of the CPUSE Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS, and the Gaia OS itself. Deployment Agent must be installed on the target Security Gateways and Cluster Members.

• SIC Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server. must already be established between the Management Server and the target Security Gateways and Cluster Members.

• A policy must be installed on the target Security Gateways and Cluster Members.

• Only full clusters can be deployed (you cannot select and deploy one cluster member Security Gateway that is part of a cluster.).

To use Central Deployment directly from the Check Point Cloud:

1. The Management Server must be able to connect to the Check Point Cloud.

2. The target Security Gateways and Cluster Members must be able to connect to the Check Point Cloud.

To install the Recommended Jumbo Hotfix Accumulator on the target Security Gateways and Cluster Members, at least these Jumbo Hotfix Accumulator takes must be installed:

Target Version	Minimal Jumbo Hotfix Accumulator Take
R80.40 and higher	Any take.
R80.30	Take 76 or higher.
R80.20	Take 118 or higher.
R80.10	Take 245 or higher.

Limitations

• Upgrade from the R80.30, R80.20, and R80.10 versions (to upgrade from these versions to a higher version, use the CPUSE in-place upgrade).

• Central Deployment does not support:

  • Connecting from SmartConsole to the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. through a proxy server.
    In this case, use the applicable API command.

  • ClusterXL in High Availability mode configured as "Switch to higher priority Cluster Member" (known as "Primary Up").

  • ClusterXL in Load Sharing mode.

  • VRRP Cluster.

  • Standalone Configuration in which the Security Gateway and the Security Management Server products are installed and configured on the same server. server.

  • Scalable Chassis 40000 / 60000.

  • For Centrally Managed Quantum Spark Appliances running Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Embedded operating system:

    • Cluster of Quantum Spark Appliances.

      Note - This feature is supported starting from R81.20 Jumbo Hotfix Accumulator, Take 8.

    • Downloading the package from the Check Point Cloud. You must manually add the required package to the Package Repository on the Security Management Server.

    • When using SmartConsole Central Deployment to install a firmware package of the same version, but of a lower build number than is already installed on a Quantum Spark appliance, the "Verify" action does not compare the firmware build numbers. Therefore, SmartConsole shows that "The package is valid for installation", while in fact, the installation will fail by design.

  • Standby Security Management Server.

  • On Multi-Domain Servers, SmartConsole connected to the Global Domain, or the Multi-Domain Server Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. context.

  • Log Server Dedicated Check Point server that runs Check Point software to store and process logs..

  • SmartEvent Server.

Installation

Notes: If different targets have different recommended Hotfixes or Upgrade Packages, each target gets its applicable recommended Hotfix or Upgrade Package. Before you install a firmware on a Quantum Spark appliance that runs Gaia Embedded operating system, you must disconnect an external storage from the USB port (at minimum, make sure it does not contain firmware images for Quantum Spark appliances).

How the Central Deployment Upgrades a Cluster

When you use the Central Deployment to install a software package on all members of a ClusterXL in High Availability mode or VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Cluster (non-VSLS), the Central Deployment follows these steps:

1. Verifies that the states of the Cluster Members are valid (Active and Standby).

2. Prepares the Access Control Policy for the Cluster:

   1. Changes the version in the Cluster object.

   2. Changes the applicable configuration settings and Access Control Policy.

3. Upgrades the Standby Cluster Member to the new version.

4. Runs a Multi-Version Cluster (MVC):

   1. Makes sure the upgraded Cluster Member is in the Standby or Ready state.

   2. Performs cluster failover to one of the upgraded Cluster Members.

5. Upgrades the former Active Cluster Member.

6. Verifies that the states of the Cluster Members are valid (Active and Standby).