Installing a Hotfix on Dual Chassis

This procedure describes the Full Connectivity installation of an Offline CPUSE package on Dual Chassis.

Important Notes

  • It is not supported to upgrade the CPUSE Agent on SGMs in a Security Group.

  • This procedure applies to Security Groups in Security Gateway mode and VSX mode.

    In VSX mode, you must run all the commands in the context of VS0.

  • This procedure keeps the current connections.

  • If you finished a clean install on this chassis, then you can install a Jumbo Hotfix Accumulator only after you run the Gaia First Time Configuration Wizard.

  • Do not install the hotfix on all the SGMs at the same time.

    If you do so with the command below, traffic stops passing through all SGMs until the hotfix is installed:

    installer install <Number of CPUSE Package> member_ids all

  • With this procedure, you install the hotfix on one chassis at one time.

    The other chassis continues to handle traffic.

    1. You install the hotfix on "Standby Chassis A" from an SGM in "Standby Chassis A".

    2. You failover all connections from "Standby Chassis B" to "Standby Chassis A".

    3. You install the hotfix on "Standby Chassis B" from an SGM in "Standby Chassis B".

    In the procedures below:

    • "Standby Chassis A" is the Standby Chassis (chassis1)

    • "Standby Chassis B" is the Active Chassis (chassis2)

Best Practice - Perform this procedure over the serial console.

Part 1 - Preliminary Steps

In this part, you import the CPUSE package and make sure it can be installed.

Step

Instructions

1

Make sure you have the applicable CPUSE offline package (TGZ file) or the exported CPUSE package (TAR file).

2

Transfer the CPUSE offline or exported package to the Chassis (into some directory, for example: /home/admin/).

3

Connect to the command line on each chassis.

4

Log in to Gaia Clish.

5

Go to the Gaia gClish:

gclish

6

Import the CPUSE package from the hard disk:

installer import local /<Full Path>/<Name of the CPUSE Offline Package>

Example:

[Global] MyChassis-ch01-01 > installer import local /home/admin/Check_Point_R80_20SP_T26_HF_006_Bundle_T16_FULL.tgz

7

Show the imported CPUSE packages:

show installer packages imported

8

Make sure the imported CPUSE package can be installed on this Chassis:

installer verify[Press the Tab key]

installer verify <Number of CPUSE Package> member_ids all

Example:

[Global] MyChassis-ch01-01 > installer verify 2 member_ids all
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Installation is allowed.                                        |
|1_02         |Installation is allowed.                                        |
|1_03         |Installation is allowed.                                        |
|1_04         |Installation is allowed.                                        |
|2_01         |Installation is allowed.                                        |
|2_02         |Installation is allowed.                                        |
|2_03         |Installation is allowed.                                        |
|2_04         |Installation is allowed.                                        |
+-------------+----------------------------------------------------------------+
[Global] MyChassis-ch01-01 >

Part 2 - Installing the Hotfix on Standby Chassis A

In this part, you install the Hotfix on all SGMs on the Standby "Standby Chassis A" (chassis1).

Step

Instructions

9

Connect to the command line on the Standby Chassis (in our example, Standby Chassis A).
10

Log in to the Expert mode.
11

Set the state of the Standby Chassis to "down":

asg chassis_admin -c <Standby Chassis ID> down

Example:

[Expert@MyChassis-ch0x-0x:0]# asg chassis_admin -c 1 down

12

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

13

Go to the Gaia gClish:

gclish
14

Install the CPUSE hotfix package on the Standby Chassis:

installer install[Press the Tab key]

installer install <Number of CPUSE Package> member_ids chassis<Standby Chassis ID>

Example:

[Global] MyChassis-ch01-01 > installer install 2 member_ids chassis1
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for installation                               |
|1_02         |Package is ready for installation                               |
|1_03         |Package is ready for installation                               |
|1_04         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (1_01,1_02,1_03,1_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y
15

Exit from Gaia gClish to the Expert mode:

exit

16

Monitor the system until SGMs on the Standby Chassis are in the UP state and enforce the Security Policy again:

asg monitor

17

Set the state of the Standby Chassis to "up":

asg chassis_admin -c <Standby Chassis ID> up

Example:

[Expert@MyChassis-ch0x-0x:0]# asg chassis_admin -c 1 up

18

Monitor the system until SGMs on the Standby Chassis are in the UP state and enforce the Security Policy again:

asg monitor

Part 3 - Failing Over from Standby Chassis B to Standby Chassis A

In this part, you fail over all connections from the Active "Standby Chassis B" to the Standby "Standby Chassis A".

Step

Instructions

19

Connect to the command line on the Active Chassis (in our example, Standby Chassis B).

20

Log in to the Expert mode.

21

Set the state of the Active Chassis to "down":

asg chassis_admin -c <Standby Chassis ID> down

Example:

[Expert@MyChassis-ch0x-0x:0]# asg chassis_admin -c 2 down

Part 4 - Installing the Hotfix on Standby Chassis B

In this part, you install the Hotfix on all SGMs on the former Active "Standby Chassis B" (chassis2).

Step

Instructions

22

Connect to one of the Security Group Members in the Logical Group "B":

member <Member ID>

23

Go to the Gaia gClish:

gclish
24

Install the CPUSE hotfix package on the former Active Chassis (in our example, Standby Chassis B):

installer install[Press the Tab key]

installer install <Number of CPUSE Package> member_ids chassis<Standby Chassis ID>

Example:

[Global] MyChassis-ch01-01 > installer install 2 member_ids chassis2
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|2_01 (local) |Package is ready for installation                               |
|2_02         |Package is ready for installation                               |
|2_03         |Package is ready for installation                               |
|2_04         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (2_01,2_02,2_03,2_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y
25

Exit from Gaia Clish to the Expert mode:

exit

26

Monitor the system until SGMs on the former Active Chassis are in the UP state and enforce the Security Policy again:

asg monitor

27

Set the state of the former Active Chassis to "up":

asg chassis_admin -c <Standby Chassis ID> up

Example:

[Expert@MyChassis-ch0x-0x:0]# asg chassis_admin -c 2 up

Important - If the former Active Chassis is configured as "Primary Up", an automatic fallback occurs.

28

Monitor the system until SGMs on the former Active Chassis are in the UP state and enforce the Security Policy again:

asg monitor