Installing a Hotfix on Dual Chassis

This procedure describes the Full Connectivity installation of an Offline CPUSE package on Dual Chassis.

Important Notes

  • This procedure keeps the current connections in a Security Group.

  • This procedure applies to Security Groups in Security Gateway mode and VSX mode.

    In VSX mode, you must run all the commands in the context of VS0.

  • If you finished a clean install on this chassis, then you can install a Jumbo Hotfix Accumulator only after you run the Gaia First Time Configuration Wizard.

  • Do not install the hotfix on all the SGMs at the same time.

    If you do so with the command below, traffic stops passing through all SGMs until the hotfix is installed:

    installer install <Number of CPUSE Package> member_ids all

  • In this procedure, you install the hotfix on one chassis at one time.

    The other chassis continues to handle traffic.

    1. You install the hotfix on Standby Chassis "A" from an SGM in Standby Chassis "A".

    2. You fail over all connections from Active Chassis "B" to Standby Chassis "A".

    3. You install the hotfix on Standby Chassis "B" from an SGM in Standby Chassis "B".

    In the procedures below:

    • Chassis "A" is the Standby Chassis (chassis1)

    • Chassis "B" is the Active Chassis (chassis2)

Best Practice - Perform this procedure over the serial console.

Procedure

Step

Instructions

A

Make sure you have the applicable CPUSE offline package or the exported CPUSE package.

B

Transfer the CPUSE offline or exported package to the Chassis (into some directory, for example: /home/admin/).

C

Connect to the command line on each chassis.

D

Log in to Gaia Clish.

E

Go to the Gaia gClish:

gclish

F

Import the CPUSE package from the hard disk:

installer import local /<Full Path>/<Name of the CPUSE Offline Package>

Example:

[Global] SG-s01-01 > installer import local /home/admin/Check_Point_R82_Hotfix_Bundle_FULL.tar

G

Show the imported CPUSE packages:

show installer packages imported

H

Make sure the imported CPUSE package can be installed on this Chassis:

installer verify [Press the Tab key]

installer verify <Number of CPUSE Package> member_ids all

Example:

[Global] SG-s01-01 > installer verify 2 member_ids all
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Installation is allowed.                                        |
|1_02         |Installation is allowed.                                        |
|1_03         |Installation is allowed.                                        |
|1_04         |Installation is allowed.                                        |
|2_01         |Installation is allowed.                                        |
|2_02         |Installation is allowed.                                        |
|2_03         |Installation is allowed.                                        |
|2_04         |Installation is allowed.                                        |
+-------------+----------------------------------------------------------------+
[Global] SG-s01-01 >

Note - The SMO Image Cloning feature automatically clones all the required software packages to the Security Group Members during their boot. When you install or remove software packages gradually on Security Group Members, it is necessary to disable this feature, so that after a reboot the updated Security Group Members do not clone the software packages from the existing non-updated Security Group Members.

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Examine the state of the SMO Image Cloning feature:

show cluster configuration image auto-clone state

D

Disable the SMO Image Cloning feature, if it is enabled:

set cluster configuration image auto-clone state off

E

Examine the state of the SMO Image Cloning feature again:

show cluster configuration image auto-clone state

Step

Instructions

A

Connect to the command line on the Standby Chassis (in our example, Chassis "A" - chassis1).

B

Log in to the Expert mode.

C

Set the state of the Standby Chassis "A" to "down":

cluster_site_admin -c <ID of Standby Chassis> down

Example:

cluster_site_admin -c 1 down

D

Connect to one of the SGMs in the Standby Chassis "A":

member <Member ID>

E

Go to the Gaia gClish:

gclish

F

Install the CPUSE hotfix package on the Standby Chassis "A":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids chassis<ID of Standby Chassis>

Example:

[Global] SG-s01-01 > installer install 2 member_ids chassis1
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for installation                               |
|1_02         |Package is ready for installation                               |
|1_03         |Package is ready for installation                               |
|1_04         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (1_01,1_02,1_03,1_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y

G

Exit from Gaia gClish to the Expert mode:

exit

H

Monitor the system until SGMs on the Standby Chassis "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

I

Set the state of the Standby Chassis "A" to "up":

cluster_site_admin -c <ID of Standby Chassis> up

Example:

cluster_site_admin -c 1 up

J

Monitor the system until SGMs on the Chassis "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

K

Make sure the Hotfix is installed on all SGMs.

Use one of these tools:

  • The "insights" tool (see insights):

    insights

  • The HCP tool (see hcp):

    hcp --help

In this step, you fail over all connections from the Active Chassis "B" (chassis2) to the Standby Chassis "A" (chassis1).

Step

Instructions

A

Connect to the command line on the Active Chassis (in our example, Chassis "B" - chassis2).

B

Log in to the Expert mode.

C

Set the state of the Active Chassis "B" to "down":

cluster_site_admin -c <ID of Active Chassis> down

Example:

cluster_site_admin -c 2 down

In this step, you install the Hotfix on all SGMs on the former Active Chassis "B" (chassis2).

Step

Instructions

A

Connect to the command line on the Standby Chassis (in our example, Standby Chassis "B" - chassis2).

B

Log in to the Expert mode.

C

Set the state of the Standby Chassis "B" to "down":

cluster_site_admin -c <ID of Standby Chassis> down

Example:

cluster_site_admin -c 2 down

D

Connect to one of the SGMs in the Standby Chassis "B":

member <Member ID>

E

Go to the Gaia gClish:

gclish

F

Install the CPUSE hotfix package on the Standby Chassis "B":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids chassis<ID of Standby Chassis>

Example:

[Global] SG-s02-01 > installer install 2 member_ids chassis2
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|2_01 (local) |Package is ready for installation                               |
|2_02         |Package is ready for installation                               |
|2_03         |Package is ready for installation                               |
|2_04         |Package is ready for installation                               |
+-------------+----------------------------------------------------------------+
The machines (2_01,2_02,2_03,2_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y

G

Exit from Gaia gClish to the Expert mode:

exit

H

Monitor the system until SGMs on the Standby Chassis "B" are in the state "UP" and enforce the Security Policy again:

asg monitor

I

Set the state of the Standby Chassis "B" to "up":

cluster_site_admin -c <ID of Standby Chassis> up

Example:

cluster_site_admin -c 2 up

Important - If the former Active Chassis is configured as "Primary Up", an automatic fallback occurs.

J

Monitor the system until SGMs on the Chassis "B" are in the state "UP" and enforce the Security Policy again:

asg monitor

K

Make sure the Hotfix is installed on all SGMs.

Use one of these tools:

  • The "insights" tool (see insights):

    insights

  • The HCP tool (see hcp):

    hcp --help