Uninstalling a Hotfix from Dual Chassis

This procedure describes the Full Connectivity uninstall of an Offline CPUSE package on Dual Chassis.

Important Notes

  • This procedure keeps the current connections in a Security Group.

  • This procedure applies to Security Groups in Security Gateway mode and VSX mode.

    In VSX mode, you must run all the commands in the context of VS0.

  • Do not uninstall the hotfix from all the SGMs at the same time.

    If you do so with the command below, traffic stops passing through all SGMs until the hotfix is uninstalled:

    installer uninstall <Number of CPUSE Package> member_ids all

  • In this procedure, you uninstall the hotfix from one chassis at one time.

    The other chassis continues to handle traffic.

    1. You uninstall the hotfix on Standby Chassis "A" from an SGM in Standby Chassis "A".

    2. You fail over from Active Chassis "B" to Standby Chassis "A".

    3. You uninstall the hotfix on Standby Chassis "B" from an SGM in Standby Chassis "B".

    In the procedures below:

    • Chassis "A" is the Standby Chassis (chassis1)

    • Chassis "B" is the Active Chassis (chassis2)

Best Practice - Perform this procedure over the serial console.

Procedure

Note - The SMO Image Cloning feature automatically clones all the required software packages to the Security Group Members during their boot. When you install or remove software packages gradually on Security Group Members, it is necessary to disable this feature, so that after a reboot the updated Security Group Members do not clone the software packages from the existing non-updated Security Group Members.

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Examine the state of the SMO Image Cloning feature:

show cluster configuration image auto-clone state

D

Disable the SMO Image Cloning feature, if it is enabled:

set cluster configuration image auto-clone state off

E

Examine the state of the SMO Image Cloning feature again:

show cluster configuration image auto-clone state

Step

Instructions

A

Connect to the command line on the Standby Chassis (in our example, Standby Chassis A).

B

Log in to the Expert mode.

C

Set the state of the Standby Chassis "A" to "down":

cluster_site_admin -c <ID of Standby Chassis> down

Example:

cluster_site_admin -c 1 down

D

Go to the Gaia gClish:

gclish

E

Uninstall the CPUSE hotfix package on the Standby Chassis "A":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids chassis<ID of Standby Chassis>

Example:

[Global] SG-s01-01 > installer uninstall 2 member_ids chassis1
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for uninstallation                             |
|1_02         |Package is ready for uninstallation                             |
|1_03         |Package is ready for uninstallation                             |
|1_04         |Package is ready for uninstallation                             |
+-------------+----------------------------------------------------------------+
The machines (1_01,1_02,1_03,1_04) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y

F

Exit from Gaia gClish to the Expert mode:

exit

G

Monitor the system until SGMs on the Standby Chassis "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

H

Set the state of the Standby Chassis "A" to "up":

cluster_site_admin -c <ID of Standby Chassis> up

Example:

cluster_site_admin -c 1 up

I

Monitor the system until SGMs on the Standby Chassis "A" are in the state "UP" and enforce the Security Policy again:

asg monitor

J

Make sure the Hotfix is uninstalled from all SGMs.

Use one of these tools:

  • The "insights" tool (see insights):

    insights

  • The HCP tool (see hcp):

    hcp --help

In this step, you fail over all connections from the Active Chassis "B" (chassis2) to the Standby Chassis "A" (chassis1).

Step

Instructions

A

Connect to the command line on the Active Chassis (in our example, Standby Chassis B - (chassis2)).

B

Log in to the Expert mode.

C

Set the state of the Active Chassis "B" to "down":

cluster_site_admin -c <ID of Standby Chassis> down

Example:

cluster_site_admin -c 2 down

In this step, you uninstall the Hotfix from the former Standby Chassis "B" (chassis2).

Step

Instructions

A

Go to the Gaia gClish:

gclish

B

Uninstall the CPUSE hotfix package on the former Active Chassis "B":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids chassis<ID of Standby Chassis>

Example:

[Global] SG-s01-01 > installer uninstall 2 member_ids chassis2
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|2_01 (local) |Package is ready for uninstallation                             |
|2_02         |Package is ready for uninstallation                             |
|2_03         |Package is ready for uninstallation                             |
|2_04         |Package is ready for uninstallation                             |
+-------------+----------------------------------------------------------------+
The machines (2_01,2_02,2_03,2_04) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y

C

Exit from Gaia gClish to the Expert mode:

exit

D

Monitor the system until SGMs on the former Active Chassis "B" are in the state "UP" and enforce the Security Policy again:

asg monitor

E

Set the state of the former Active Chassis "B" to "up":

cluster_site_admin -c <ID of Standby Chassis> up

Example:

cluster_site_admin -c 2 up

Important - If the former Active Chassis is configured as "Primary Up", an automatic fallback occurs.

F

Monitor the system until SGMs on the Chassis "B" are in the state "UP" and enforce the Security Policy again:

asg monitor

G

Make sure the Hotfix is uninstalled from all SGMs.

Use one of these tools:

  • The "insights" tool (see insights):

    insights

  • The HCP tool (see hcp):

    hcp --help

In this optional step, you delete the uninstalled Hotfix package from the chassis to free the disk space.

Step

Instructions

A

Go to the Gaia gClish:

gclish

B

Delete the uninstalled Hotfix package from the CPUSE repository on the chassis:

installer delete [Press the Tab key]

installer delete <Number of CPUSE Package>

Example:

[Global] SG-s01-01 > installer delete 2
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for delete                                     |
|1_02         |Package is ready for delete                                     |
|1_03         |Package is ready for delete                                     |
|1_04         |Package is ready for delete                                     |
|2_01         |Package is ready for delete                                     |
|2_02         |Package is ready for delete                                     |
|2_03         |Package is ready for delete                                     |
|2_04         |Package is ready for delete                                     |
+-------------+----------------------------------------------------------------+
You are about to perform
Package delete (Check_Point_R82_Hotfix_Bundle_FULL.tar) on blades:
1_01,1_02,1_03,1_04,2_01,2_02,2_03,2_04
*** In case the package is installed, you might not be able to uninstall and Import the package ever again ! ***
 
Are you sure? (Y - yes, any other key - no) y
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |The package was successfully removed from the machine.          |
|1_02         |The package was successfully removed from the machine.          |
|1_03         |The package was successfully removed from the machine.          |
|1_04         |The package was successfully removed from the machine.          |
|2_01         |The package was successfully removed from the machine.          |
|2_02         |The package was successfully removed from the machine.          |
|2_03         |The package was successfully removed from the machine.          |
|2_04         |The package was successfully removed from the machine.          |
+-------------+----------------------------------------------------------------+
[Global] SG-s01-01 >