Upgrading a Security Management Server or Log Server from R80.20 and higher with CPUSE

In a CPUSE Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS, and the Gaia OS itself. upgrade scenario, you perform the upgrade procedure on the same Check Point server.

Notes: This procedure is supported only for servers that run R80.20.M1, R80.20, R80.20.M2, R80.30, or higher versions. These instructions equally apply to: Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. CloudGuard Controller Dedicated Log Server Dedicated Check Point server that runs Check Point software to store and process logs. Dedicated SmartEvent Server For additional information related to this upgrade, see sk163814.

Important - Before you upgrade a Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. or Log Server: Step Instructions 1 Back up your current configuration (see Backing Up and Restoring). 2 See the Upgrade Options and Prerequisites. 3 Only the latest published database revision is upgraded. If there are pending changes, we recommend to Publish the session. 4 You must close all GUI clients (SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. applications) connected to the source Security Management Server. 5 Install the latest version of the CPUSE from sk92449. Note - This is to make sure the CPUSE is able to support the required Upgrade Tools package. 6 Run the Pre-Upgrade Verifier on all source servers and fix all detected issues before you start the upgrade. 7 In Management High Availability, make sure the Primary Security Management Server is upgraded and runs, before you start the upgrade on other servers.

Procedure:

1. Get the required Upgrade Tools on the server

   Important - See Upgrade Tools to understand if your server can download and install the latest version of the Upgrade Tools automatically.

   Step	Instructions
   1	Download the R81 Upgrade Tools from the sk135172. (See Upgrade Tools.) Note - This is a CPUSE Offline package.
   2	Install the R81 Upgrade Tools with CPUSE. See Installing Software Packages on Gaia and follow the applicable action plan for the Local - Offline installation.
   3	Make sure the package is installed. Run this command in the Expert mode: cpprod_util CPPROD_GetValue CPupgrade-tools-R81 BuildNumber 1 The output must show the same build number you see in the name of the downloaded TGZ package. Example Name of the downloaded package: ngm_upgrade_wrapper_993000222_1.tgz [Expert@HostName:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R81 BuildNumber 1 993000222 [Expert@HostName:0]#

   Note - The command "migrate_server" from these Upgrade Tools always tries to connect to Check Point Cloud over the Internet. This is to make sure you always have the latest version of these Upgrade Tools installed. If the connection to Check Point Cloud fails, this message appears: Timeout. Failed to retrieve Upgrade Tools package. To download the package manually, refer to sk135172.

2. Upgrade the Security Management Server with CPUSE

   See Installing Software Packages on Gaia and follow the applicable action plan.

3. Install the R81 SmartConsole

   See Installing SmartConsole.

4. Upgrade the dedicated Log Servers and dedicated SmartEvent Servers

   This step is part of the upgrade procedure of a Management Server. If you upgrade a dedicated Log Servers or SmartEvent Servers, then skip this step.

   Important - If your Security Management Server manages dedicated Log Servers or SmartEvent Servers, you must upgrade these dedicated servers to the same version as the Security Management Server.

   Follow the applicable procedure in Upgrading a Security Management Server or Log Server from R80.20 and higher.

5. Update the object version of the dedicated Log Servers and SmartEvent Servers

   Important - If your Security Management Server manages dedicated Log Servers or SmartEvent Servers, you must update the version of the corresponding objects in SmartConsole.

   Step	Instructions
   1	Connect with SmartConsole to the R81 Security Management Server that manages the dedicated Log Server or SmartEvent Server.
   2	From the left navigation panel, click Gateways & Servers.
   3	Open the object of the dedicated Log Server or SmartEvent Server.
   4	From the left tree, click General Properties.
   5	In the Platform section > in the Version field, select R81.
   6	Click OK.

6. Install the management database

   Step	Instructions
   1	Connect with SmartConsole to the R81 Security Management Server.
   2	In the top left corner, click Menu > Install database.
   3	Select all objects.
   4	Click Install.
   5	Click OK.

7. Install the Event Policy

   Important - This step applies only if the SmartEvent Correlation Unit Software Blade Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities. is enabled on the R81 Security Management Server.

   Step	Instructions
   1	Connect with the SmartConsole to the R81 Security Management Server.
   2	In the SmartConsole, from the left navigation panel, click Logs & Monitor.
   3	At the top, click + to open a new tab.
   4	In the bottom left corner, in the External Apps section, click SmartEvent Settings & Policy. The Legacy SmartEvent client opens.
   5	In the top left corner, click Menu > Actions > Install Event Policy.
   6	Confirm.
   7	Wait for these messages to appear: SmartEvent Policy Installer installation complete SmartEvent Policy Installer installation succeeded
   8	Click Close.
   9	Close the Legacy SmartEvent client.

8. Reconfigure the Log Exporter

   Step	Instructions
   1	Connect to the command line on the server.
   2	Log in to the Expert mode.
   3	Restore the Log Exporter configuration as described in sk127653.
   4	Reconfigure the Log Exporter: cp_log_export reconf
   5	Restart the Log Exporter: cp_log_export restart

   For more information, see the R81 Logging and Monitoring Administration Guide > Chapter Log Exporter.

9. In SmartConsole, install policy on all SmartLSM Security Profiles

   Important - This step applies only if you enabled the SmartProvisioning Check Point Software Blade on a Management Server (the actual name is "Provisioning") that manages large-scale deployments of Check Point Security Gateways using configuration profiles. Synonyms: Large-Scale Management, SmartLSM, LSM. Software Blade on this Management Server.

   Step	Instructions
   1	Install the Access Control Policy: Click Install Policy. In the Policy field, select the applicable Access Control Policy. Select the applicable SmartLSM Security Profile objects. Click Install. The Access Control Policy must install successfully.
   2	Install the Threat Prevention Policy: Click Install Policy. In the Policy field, select the applicable Threat Prevention Policy. Select the applicable SmartLSM Security Profile objects. Click Install. The Threat Prevention Policy must install successfully.

   For more information, see the R81 SmartProvisioning Administration Guide.

10. Test the functionality

    Step	Instructions
    1	Connect with SmartConsole to the R81 Security Management Server.
    2	Make sure the management database and configuration were upgraded correctly.