Uninstalling a Hotfix from a Single Chassis

This procedure describes the Full Connectivity uninstall of an Offline CPUSE package from a Single Chassis.

Important Notes

  • It is not supported to upgrade the CPUSE Agent on SGMs in a Security Group.

  • This procedure applies to Security Groups in Security Gateway mode and VSX mode.

    In VSX mode, you must run all the commands in the context of VS0.

  • This procedure keeps the current connections.

  • If you finished a clean install on this chassis, then you can install a Jumbo Hotfix Accumulator only after you run the Gaia First Time Configuration Wizard.

  • Do not uninstall the hotfix from all the SGMs at the same time.

    If you do so with the command below, traffic stops passing through all SGMs until the hotfix is uninstalled:

    installer uninstall <Number of CPUSE Package> member_ids all

  • With this procedure, you uninstall the hotfix on half of the SGMs in a Security Group at one time.

    The other half of the SGMs continues to handle traffic.

    1. You uninstall the hotfix on SGMs in a Logical Group "A" from an SGM that belongs to the Logical Group "A".

    2. You uninstall the hotfix on SGMs in a logical Group B from an SGM that belongs to the logical Group B.

    Example:

    • There are 8 SGMs in the chassis.

    • A Logical Group "A" comprises SGMs from 1_1 to 1_4.

    • A logical Group B comprises SGMs from 1_5 to 1_8.

Best Practice - Perform this procedure over the serial console.

Part 1 - Uninstalling a Hotfix from SGMs in Group A

In this part, you uninstall the hotfix from SGMs in a Logical Group "A" from an SGM that belongs to the Logical Group "A".

Step

Instructions

1

Connect to the command line on the Chassis.

2

Log in to the Expert mode.
3

Set SGMs in the Logical Group "A" to the "down" state:

g_clusterXL_admin -b <List of SGM IDs in Group A> down

Example:

[Expert@MyChassis-ch0x-0x:0]# g_clusterXL_admin -b 1_1-1_4 down

4

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

5

Go to the Gaia gClish:

gclish
6

Install the CPUSE package on SGMs in the Logical Group "A":

installer uninstall[Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <List of SGM IDs in Group A>

Example:

[Global] MyChassis-ch01-01 > installer uninstall 2 member_ids 1_1-1_4
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for uninstallation                             |
|1_02         |Package is ready for uninstallation                             |
|1_03         |Package is ready for uninstallation                             |
|1_04         |Package is ready for uninstallation                             |
+-------------+----------------------------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y
7

Monitor the system until SGMs in the Logical Group "A" are in the UP state and enforce the Security Policy again:

  1. Open another shell window.

  2. Log in to the Expert mode.

  3. Run:

    asg monitor

Part 2 - Uninstalling a Hotfix from SGMs in Group B

In this part, you uninstall the hotfix from SGMs in a logical Group B from an SGM that belongs to the logical Group B.

Step

Instructions
8

Log in to the Expert mode.
9

Set SGMs in the logical Group B to the "down" state:

g_clusterXL_admin -b <List of SGM IDs in Group B> down

Example:

[Expert@MyChassis-ch0x-0x:0]# g_clusterXL_admin -b 1_5-1_8 down

10

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

11

Go to the Gaia gClish:

gclish
12

Install the CPUSE package on SGMs in the Logical Group "A":

installer uninstall[Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <List of SGM IDs in Group B>

Example:

[Global] MyChassis-ch01-01 > installer uninstall 2 member_ids 1_5-1_8
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_05 (local) |Package is ready for uninstallation                             |
|1_06         |Package is ready for uninstallation                             |
|1_07         |Package is ready for uninstallation                             |
|1_08         |Package is ready for uninstallation                             |
+-------------+----------------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y
13

Monitor the system until SGMs in the logical Group B are in the UP state and enforce the Security Policy again:

  1. Open another shell window.

  2. Log in to the Expert mode.

  3. Run:

    asg monitor

Part 3 - Deleting the Uninstalled Hotfix Package from the Chassis

In this optional part, you delete the uninstalled Hotfix package from the chassis.

Step

Instructions
12

Go to the Gaia gClish:

gclish
13

Delete the uninstalled Hotfix package from the CPUSE repository on the chassis:

installer delete[Press the Tab key]

installer delete <Number of CPUSE Package>

Example:

[Global] MyChassis-ch01-01 > installer delete 2
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for delete                                     |
|1_02         |Package is ready for delete                                     |
|1_03         |Package is ready for delete                                     |
|1_04         |Package is ready for delete                                     |
|1_05         |Package is ready for delete                                     |
|1_06         |Package is ready for delete                                     |
|1_07         |Package is ready for delete                                     |
|1_08         |Package is ready for delete                                     |
+-------------+----------------------------------------------------------------+
You are about to perform
Package delete (Check_Point_R80_20SP_JHF_TEST_002_MAIN_Bundle_T2_FULL.tgz) on blades:
1_01,1_02,1_03,1_04,1_05,1_06,1_07,1_08
*** In case the package is installed, you might not be able to uninstall and Import the package ever again ! ***

Are you sure? (Y - yes, any other key - no) y
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |The package was successfully removed from the machine.          |
|1_02         |The package was successfully removed from the machine.          |
|1_03         |The package was successfully removed from the machine.          |
|1_04         |The package was successfully removed from the machine.          |
|1_05         |The package was successfully removed from the machine.          |
|1_06         |The package was successfully removed from the machine.          |
|1_07         |The package was successfully removed from the machine.          |
|1_08         |The package was successfully removed from the machine.          |
+-------------+----------------------------------------------------------------+
[Global] MyChassis-ch01-01 >