Installing a Hotfix on a Single Chassis

This procedure describes the Full Connectivity installation of an Offline CPUSE package on a Single Chassis.

Important Notes

  • It is not supported to upgrade the CPUSE Agent on SGMs in a Security Group.

  • This procedure applies to Security Groups in Security Gateway mode and VSX mode.

    In VSX mode, you must run all the commands in the context of VS0.

  • This procedure keeps the current connections.

  • If you finished a clean install on this chassis, then you can install a Jumbo Hotfix Accumulator only after you run the Gaia First Time Configuration Wizard.

  • Do not install the hotfix on all the SGMs at the same time.

    If you do so with the command below, traffic stops passing through all SGMs until the hotfix is installed:

    installer install <Number of CPUSE Package> member_ids all

  • With this procedure, you install the hotfix on half of the SGMs in a Security Group at one time.

    The other half of the SGMs continues to handle traffic.

    1. You install the hotfix on SGMs in a Logical Group "A" from an SGM that belongs to the Logical Group "A".

    2. You install the hotfix on SGMs in a Logical Group "B" from an SGM that belongs to the Logical Group "B".

    Example:

    • There are 8 SGMs in the chassis.

    • A Logical Group "A" comprises SGMs from 1_1 to 1_4.

    • A Logical Group "B" comprises SGMs from 1_5 to 1_8.

Best Practice - Perform this procedure over the serial console.

Part 1 - Preliminary Steps

In this part, you import the CPUSE package and make sure it can be installed.

Step

Instructions

1

Make sure you have the applicable CPUSE offline package (TGZ file) or the exported CPUSE package (TAR file).

2

Transfer the CPUSE offline or exported package to the Chassis (into some directory, for example: /home/admin/).

3

Connect to the command line on the Chassis.

4

Log in to Gaia Clish.

5

Go to the Gaia gClish:

gclish

6

Import the CPUSE package from the hard disk:

installer import local /<Full Path>/<Name of the CPUSE Offline Package>

Example:

[Global] MyChassis-ch01-01 > installer import local /home/admin/Check_Point_R80_20SP_T26_HF_006_Bundle_T16_FULL.tgz

7

Show the imported CPUSE packages:

show installer packages imported

8

Make sure the imported CPUSE package can be installed on this Chassis:

installer verify[Press the Tab key]

installer verify <Number of CPUSE Package> member_ids all

Example:

[Global] MyChassis-ch01-01 > installer verify 2 member_ids all
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Installation is allowed.                                        |
|1_02         |Installation is allowed.                                        |
|1_03         |Installation is allowed.                                        |
|1_04         |Installation is allowed.                                        |
|1_05         |Installation is allowed.                                        |
|1_06         |Installation is allowed.                                        |
|1_07         |Installation is allowed.                                        |
|1_08         |Installation is allowed.                                        |
+-------------+----------------------------------------------------------------+
[Global] MyChassis-ch01-01 >

Part 2 - Installing the Hotfix on SGMs in Group A

In this part, you install the hotfix on SGMs in a Logical Group "A" from an SGM that belongs to the Logical Group "A".

Step

Instructions

9

Log in to the Expert mode.

10

Set SGMs in the Logical Group "A" to the "down" state:

g_clusterXL_admin -b <List of SGM IDs in Group A> down

Example:

[Expert@MyChassis-ch0x-0x:0]# g_clusterXL_admin -b 1_1-1_4 down

11

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

12

Go to the Gaia gClish:

gclish

13

Install the CPUSE package on SGMs in the Logical Group "A":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids <List of SGM IDs in Group A>

Example:

[Global] MyChassis-ch01-01> installer install 2 member_ids 1_1-1_4
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for installation                               |
|1_02         |Package is ready for installation                               |
|1_03         |Package is ready for installation                               |
|1_04         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y

14

Monitor the system until SGMs in the Logical Group "A" are in the UP state and enforce the Security Policy again:

  1. Open another shell window.

  2. Log in to the Expert mode.

  3. Run:

    asg monitor

Part 3 - Installing the Hotfix on SGMs in Group B

In this part, you install the hotfix on SGMs in a Logical Group "B" from an SGM that belongs to the Logical Group "B".

Step

Instructions

15

Log in to the Expert mode.
16

Set SGMs in the Logical Group "B" to the "down" state:

g_clusterXL_admin -b <List of SGM IDs in Group B> down

Example:

[Expert@MyChassis-ch0x-0x:0]# g_clusterXL_admin -b 1_5-1_8 down

17

Connect to one of the Security Group Members in the Logical Group "B":

member <Member ID>

18

Go to the Gaia gClish:

gclish
19

Install the CPUSE package on SGMs in the Logical Group "B":

installer install[Press the Tab key]

installer install <Number of CPUSE Package> member_ids <List of SGM IDs in Group B>

Example:

[Global] MyChassis-ch01-01 > installer install 2 member_ids 1_5-1_8
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_05 (local) |Package is ready for installation                               |
|1_06         |Package is ready for installation                               |
|1_07         |Package is ready for installation                               |
|1_08         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y
20

Monitor the system until SGMs in the Logical Group "B" are in the UP state and enforce the Security Policy again:

  1. Open another shell window.

  2. Log in to the Expert mode.

  3. Run:

    asg monitor