Installing and Uninstalling a Hotfix on Security Group Members

This section describes the Full Connectivity installation and uninstall of an Offline CPUSE Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS, and the Gaia OS itself. For details, see sk92449. package.

Installing a Hotfix Package

Important:

It is not supported to upgrade the CPUSE Agent on Security Group Members.
This procedure keeps the current connections in a Security Group A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected..
This procedure applies to Security Groups in both Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. and VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. mode.

In VSX mode, you must run all the commands in the context of VS0.
Do not install the hotfix on all the Security Group Members in a specific Security Group at the same time.

In this procedure, you divide all Security Group Members in a specific Security Group into two or more logical groups.

In the procedure below, we use two logical groups denoted below as "A" and "B".

You install the hotfix Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior. on one logical group of the Security Group Members at one time.

The other logical group(s) of the Security Group Members continues to handle traffic.

Each logical group should contain the same number of Security Group Members - as close as possible.

Examples

Environment	Description
Single Site	There are 8 Security Group Members in the Security Group. The Logical Group "A" contains Security Group Members from 1_1 to 1_4. The Logical Group "B" contains Security Group Members from 1_5 to 1_8.
Single Site	There are 5 Security Group Members in the Security Group. The Logical Group "A" contains Security Group Members from 1_1 to 1_3. The Logical Group "B" contains Security Group Members from 1_4 to 1_5.
Dual Site	There are 4 Security Group Members in the Security Group (on each Site). The Logical Group "A" contains Security Group Members on Site 1 from 1_1 to 1_4. The Logical Group "B" contains Security Group Members on Site 2 from 2_1 to 2_4.

Installation Procedure

Step 1 - Perform the preliminary steps

For Offline CPUSE packages

Follow these steps if Security Group Members are not connected to the Internet or cannot reach Check Point Cloud.

Step

Instructions

Make sure you have the applicable CPUSE Offline package (TGZ file) / exported package (TAR file).

Transfer the CPUSE Offline package to the Security Group (into some directory, for example /var/log/).

Connect to the command line on the Security Group.

Go to the Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group.:

gclish

Import the CPUSE Offline package from the hard disk:

installer import local /<Full Path>/<Name of the CPUSE Offline Package>

Example:

[Global] MyChassis-ch01-01 > installer import local /var/log/Check_Point_R81_Hotfix_Bundle_FULL.tgz

Show the imported CPUSE packages:

show installer packages imported

Make sure the imported CPUSE package can be installed on this Security Group:

installer verify[Press Tab]

installer verify <Number of CPUSE Package> member_ids all

Example:

[Global] MyChassis-ch01-01 > installer verify 2 member_ids all
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_01 (local) |Installation is allowed.                     |
|1_02         |Installation is allowed.                     |
|1_03         |Installation is allowed.                     |
|1_04         |Installation is allowed.                     |
|1_05         |Installation is allowed.                     |
|1_06         |Installation is allowed.                     |
|1_07         |Installation is allowed.                     |
|1_08         |Installation is allowed.                     |
+-----------------------------------------------------------+
[Global] MyChassis-ch01-01 >

Step 2 - On the Security Group, make sure to disable the SMO Image Cloning feature

Note - The SMO Image Cloning feature automatically clones all the required software packages to the Security Group Members during their boot. When you install or remove software packages gradually on Security Group Members, it is necessary to disable this feature, so that after a reboot the updated Security Group Members do not clone the software packages from the existing non-updated Security Group Members.

Step

Instructions

Connect to the command line on the Security Group.

If your default shell is /bin/bash (Expert mode), then go to Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. gClish:

gclish

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Disable the SMO Image Cloning feature, if it is enabled:

set smo image auto-clone state off

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Step 3 - Install the Hotfix on the Security Group Members in the Logical Group "A"

Note - You are still connected to the command line on the Security Group.

Step

Instructions

Go to the Expert mode.

Set Security Group Members in the Logical Group "A" to the "down" state:

g_clusterXL_admin –b <SGM IDs in Group "A"> down

Example:

[Expert@MyChassis-ch0x-0x:0]# g_clusterXL_admin -b 1_1-1_4 down

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

Go to the Gaia gClish:

gclish

Install the CPUSE hotfix package on the Security Group Members in the Logical Group "A":

installer install[Press Tab]

installer install <Number of CPUSE Package> member_ids <SGM IDs in Group "A">

Example:

[Global] MyChassis-ch01-01 > installer install 2 member_ids 1_1-1_4
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_01 (local) |Package is ready for installation            |
|1_02         |Package is ready for installation            |
|1_03         |Package is ready for installation            |
|1_04         |Package is ready for installation            |
+-----------------------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y
[Global] MyChassis-ch01-01 >

Go to the Expert mode.

Monitor the system until the Security Group Members in the Logical Group "A" are in the UP state and enforce the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. again:

asg monitor

Step 4 - Install the Hotfix on the Security Group Members in the Logical Group "B"

Note - You are still connected to the command line on the Security Group.

Step

Instructions

Go to the Expert mode.

Set Security Group Members in the Logical Group "B" to the "down" state:

g_clusterXL_admin –b <SGM IDs in Group "B"> down

Example:

[Expert@MyChassis-ch0x-0x:0]# g_clusterXL_admin -b 1_5-1_8 down

Connect to one of the Security Group Members in the Logical Group "B":

member <Member ID>

Go to the Gaia gClish:

gclish

Install the CPUSE hotfix package on the Security Group Members in the Logical Group "B":

installer install[Press Tab]

installer install <Number of CPUSE Package> member_ids <SGM IDs in Group "B">

Example:

[Global] MyChassis-ch01-01 > installer install 2 member_ids 1_5-1_8
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_05 (local) |Package is ready for installation            |
|1_06         |Package is ready for installation            |
|1_07         |Package is ready for installation            |
|1_08         |Package is ready for installation            |
+-----------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y
[Global] MyChassis-ch01-01 >

Go to the Expert mode.

Monitor the system until the Security Group Members in the Logical Group "A" are in the UP state and enforce the security policy again:

asg monitor

Step 5 - Make sure the Hotfix is installed on all Security Group Members

Step

Instructions

Connect to the command line on the Security Group.

If your default shell is /etc/cli.sh (Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell).), then go to the Expert mode:

expert

Run:

asg diag verify

Uninstalling a Hotfix Package on Security Group Members

Important:

It is not supported to upgrade the CPUSE Agent on Security Group Members.
This procedure keeps the current connections in a Security Group.
This procedure applies to Security Groups in both Security Gateway and VSX mode.

In VSX mode, you must run all the commands in the context of VS0.
Do not uninstall the hotfix from all the Security Group Members in a specific Security Group at the same time.

You uninstall the hotfix from one logical group of the Security Group Members at one time.

The other logical group of the Security Group Members continues to handle traffic.

You divide all Security Group Members in a specific Security Group into two logical groups - denoted below as "A" and "B".

You uninstall the hotfix from the Security Group Members in the Logical Group "A"
You uninstall the hotfix from the Security Group Members in the Logical Group "B"

Each logical group should contain the same number of Security Group Members - as close as possible.

Examples

Environment	Description
Single Site	There are 8 Security Group Members in the Security Group. The Logical Group "A" contains Security Group Members from 1_1 to 1_4. The Logical Group "B" contains Security Group Members from 1_5 to 1_8.
Single Site	There are 5 Security Group Members in the Security Group. The Logical Group "A" contains Security Group Members from 1_1 to 1_3. The Logical Group "B" contains Security Group Members from 1_4 to 1_5.
Dual Site	There are 4 Security Group Members in the Security Group (on each Site). The Logical Group "A" contains Security Group Members on Site 1 from 1_1 to 1_4. The Logical Group "B" contains Security Group Members on Site 2 from 2_1 to 2_4.

Uninstall Procedure

Step 1 - On the Security Group, make sure to disable the SMO Image Cloning feature

Step

Instructions

Connect to the command line on the Security Group.

If your default shell is /bin/bash (Expert mode), then go to Gaia gClish:

gclish

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Disable the SMO Image Cloning feature, if it is enabled:

set smo image auto-clone state off

Examine the state of the SMO Image Cloning feature:

show smo image auto-clone state

Step 2 - Uninstall the Hotfix from the Security Group Members in the Logical Group "A"

Step

Instructions

Connect in one of these ways:

Connect to one of the Security Group Members in the Logical Group "A" through the console.
Connect to one of the Security Group Members in the Logical Group "B" over SSH.

Go to the Expert mode.

Set Security Group Members in the Logical Group "A" to the state "DOWN":

g_clusterXL_admin –b <SGM IDs in Group "A"> down

Example:

[Expert@HostName-ch0x-0x:0]# g_clusterXL_admin -b 1_1-1_4 down

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

Go from the Expert mode to Gaia gClish:

If your default shell is /bin/bash (the Expert mode), then run:

gclish

If your default shell is /etc/cli.sh (Gaia Clish), then run:

exit

Uninstall the CPUSE hotfix package on the Security Group Members in the Logical Group "A":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <SGM IDs in Group "A">

Example:

[Global] HostName-ch01-01 > installer uninstall 2 member_ids 1_1-1_4
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-------------+---------------------------------------------+
|1_01 (local) |Package is ready for uninstallation          |
|1_02         |Package is ready for uninstallation          |
|1_03         |Package is ready for uninstallation          |
|1_04         |Package is ready for uninstallation          |
+-------------+---------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y
[Global] HostName-ch01-01 >

Go from Gaia gClish to the Expert mode:

If your default shell is /bin/bash (the Expert mode), then run:

exit

If your default shell is /etc/cli.sh (Gaia Clish), then run:

expert

Monitor the system until the Security Group Members in the Logical Group "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

Step 3 - Uninstall the Hotfix from the Security Group Members in the Logical Group "B"

Step

Instructions

Connect in one of these ways:

Connect to one of the Security Group Members in the Logical Group "B" through the console.
Connect to one of the Security Group Members in the Logical Group "A" over SSH.

Go to the Expert mode:

expert

Set Security Group Members in the Logical Group "B" to the state "DOWN":

g_clusterXL_admin –b <SGM IDs in Group "B"> down

Example:

[Expert@HostName-ch0x-0x:0]# g_clusterXL_admin -b 1_5-1_8 down

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

Go from the Expert mode to Gaia gClish:

If your default shell is /bin/bash (the Expert mode), then run:

gclish

If your default shell is /etc/cli.sh (Gaia Clish), then run:

exit

Uninstall the CPUSE hotfix package on the Security Group Members in the Logical Group "B":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <SGM IDs in Group "B">

Example:

[Global] HostName-ch01-01 > installer uninstall 2 member_ids 1_5-1_8
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_05 (local) |Package is ready for uninstallation          |
|1_06         |Package is ready for uninstallation          |
|1_07         |Package is ready for uninstallation          |
|1_08         |Package is ready for uninstallation          |
+-----------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y
[Global] HostName-ch01-01 >

Go from Gaia gClish to the Expert mode:

If your default shell is /bin/bash (the Expert mode), then run:

exit

If your default shell is /etc/cli.sh (Gaia Clish), then run:

expert

Monitor the system until the Security Group Members in the Logical Group "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

Step 4 - Make sure the Hotfix is uninstalled from all Security Group Members

Step

Instructions

Connect to the command line on the Security Group.

If your default shell is /etc/cli.sh (Gaia Clish), then go to the Expert mode:

expert

Run:

asg diag verify