Upgrading Maestro Environment from R82 to R82.10 - VSNext mode

Important:

• See these rollback procedures:

  • Rolling Back a Failed Upgrade of a Security Group from R82.10

  • Rolling Back a Failed Upgrade of a Maestro Orchestrator from R82.10

Important Notes for Maestro Orchestrators:

• We recommend to schedule a maintenance window for all Orchestrators on all sites.

• The major software version on the Orchestrators must be equal to or higher than the major software version on the managed Security Group (PMTR-86785).

• To prevent traffic outage in an environment with two Orchestrators on a Single Site, make sure each Uplink interface and each Management interface are configured as a Bond interface.

  Example:

  • Bond interface magg1 with the subordinate interfaces eth1-Mgmt1 on Orch1_1 and eth2-Mgmt1 on Orch1_2.

  • Bond interface bond2 with subordinate interfaces eth1-05 on Orch1_1 and eth2-05 on Orch1_2.

• This procedure keeps the current configuration on the Orchestrators.

• Upgrade all Orchestrators and only then upgrade the Security Groups.

• Upgrade one Orchestrator at a time.

• In a Maestro Dual Site environment:

  Procedure

  1. Upgrade the Orchestrators on the Standby Site (for example, Site 2).

  2. Initiate a fail-over in each Security Group from the non-upgraded Active Site (Site 1) to the upgraded Standby Site (Site 2):

     1. Connect to the command line on each Security Group that is configured on these Orchestrators.

     2. Initiate a fail-over of all Security Group Members:

        • Syntax for R82 and higher (in Gaia gClish):

          set cluster site-id <ID of non-upgraded Active Site> admin-state down

          set cluster site-id <ID of non-upgraded former Active Site> admin-state up

        • Syntax for R81.20 and lower (in the Expert mode):

          chassis_admin -c <ID of non-upgraded Active Site> down

          chassis_admin -c <ID of non-upgraded former Active Site> up

  3. Upgrade the Orchestrators on the new Standby Site (Site 1).

Important Notes for Security Groups:

• Before you upgrade the Security Groups, you must upgrade the Management Server that manages the Security Groups.

  See the R82.10 Installation and Upgrade Guide.

• This procedure applies to Security Groups in the Gateway mode and the VSNext / Traditional VSX mode.

  In the VSNext / Traditional VSX mode, you must run all the commands in the context of VS0:

  • To change the context in Gaia gClish, run: set virtual-system 0

  • To change the context in the Expert mode, run: vsenv 0

• During the upgrade process, it is:

  • Forbidden to change the configuration of the Security Group and its Security Group Members.

• To prevent down time, do not upgrade all the Security Group Members in a specific Security Group at the same time.

• In this upgrade procedure, you divide all Security Group Members in a specific Security Group into two or more logical groups.

  In the procedure below, we use two logical groups denoted below as "A" and "B".

  You upgrade one logical group of the Security Group Members at one time.

  The other logical group(s) of the Security Group Members continues to handle traffic.

  Each logical group should contain the same number of Security Group Members - as close as possible.

  Examples

  Environment	Description
  Single Site	There are 8 Security Group Members in the Security Group. The Logical Group "A" contains Security Group Members from 1_1 to 1_4. The Logical Group "B" contains Security Group Members from 1_5 to 1_8.
  Single Site	There are 5 Security Group Members in the Security Group. The Logical Group "A" contains Security Group Members from 1_1 to 1_3. The Logical Group "B" contains Security Group Members from 1_4 to 1_5.
  Dual Site	There are 4 Security Group Members in the Security Group (on each Site). The Logical Group "A" contains Security Group Members on Site 1 from 1_1 to 1_4. The Logical Group "B" contains Security Group Members on Site 2 from 2_1 to 2_4.

• In a Dual Site environment:

  • We recommend to upgrade all Security Group Members in each Security Group on one Site and then upgrade all Security Group Members in the same Security Group on the next Site.

    Do this on one Security Group at a time.

  • To prevent a fail-over between Sites during the upgrade, we recommend these steps for each Security Group:

    Procedure

    1. Connect to the command line on the Security Group.

    2. If your default shell is the Expert mode (/bin/bash), then go to Gaia gClish:

       gclish

    3. Get the current Active/Standby mode and write it down (you need it at the end of the procedure):

       • Syntax for R82 and higher:

         show cluster configuration high-availability mode

       • Syntax for R81.20 and lower:

         show chassis high-availability mode

       Available Modes:

       Mode ID	Mode Title	Mode Description
       0	Active/Standby - Active Up	No primary Site. The currently Active Site stays Active until one of these changes: The currently Active Site changes its state to "DOWN". If the formerly Active Site changes its state to "UP" again, it becomes the Standby Site. The quality grade of the currently Standby Site becomes greater than the quality grade of the currently Active Site.
       1	Active/Standby - Primary Up	The Active Site always stays Active until one of these changes: The currently Active Site changes its state to "DOWN". If the formerly Active Site changes its state to "UP" again, it becomes the Active Site again. The quality grade of the currently Standby Site becomes greater than the quality grade of the currently Active Site.
       2	Not available	Not supported. This mode is reserved.
       3	Standby Chassis VSLS Mode	In the Traditional VSX mode, provides Virtual System Load Sharing.

    4. Decide which of the Site should be Active for this procedure.

    5. Change the Active/Standby mode to "Active/Standby - Primary Up" (value "1"):

       • Syntax for R82 and higher:

         set cluster configuration high-availability mode 1

       • Syntax for R81.20 and lower:

         set chassis high-availability mode 1

    6. Change the Site Priority - enter the number of the currently Active Site:

       • Syntax for R82 and higher:

         set cluster configuration high-availability vs site_priority {1 | 2}

       • Syntax for R81.20 and lower:

         set chassis high-availability vs chassis_priority {1 | 2}

    7. Upgrade all Security Group Members on the Standby Site.

    8. On the upgraded Standby Site, change the Active/Standby mode to "Active/Standby - Primary Up" (value "1"):

       set cluster configuration high-availability mode 1

    9. On the upgraded Site change the Site Priority - enter the number of the currently Active Site:

       set cluster configuration high-availability vs site_priority {1 | 2}

    10. Upgrade all Security Group Members on the new Standby Site (former Active Site).

    11. Change the Active/Standby mode to the previous mode:

        set cluster configuration high-availability mode <Mode ID>