Uninstalling a Hotfix from a Single Chassis

This procedure describes the Full Connectivity uninstall of an Offline CPUSE package from a Single Chassis.

Important Notes

  • This procedure keeps the current connections in a Security Group.

  • This procedure applies to Security Groups in Security Gateway mode and VSX mode.

    In VSX mode, you must run all the commands in the context of VS0.

  • Do not uninstall the hotfix from all the SGMs at the same time.

    If you do so with the command below, traffic stops passing through all SGMs until the hotfix is uninstalled:

    installer uninstall <Number of CPUSE Package> member_ids all

  • In this procedure, you divide all SGMs in a specific Security Group into two or more logical groups.

    In the procedure below, we use two logical groups denoted below as "A" and "B".

    You uninstall the hotfix from one logical group of the SGMs at one time.

    The other logical group(s) of the SGMs continues to handle traffic.

    Each logical group should contain the same number of SGMs - as close as possible.

    Examples:

    Environment

    Description

    Single Chassis

    • There are 8 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_4.

    • The Logical Group "B" contains Security Group Members from 1_5 to 1_8.

    Single Chassis

    • There are 5 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_3.

    • The Logical Group "B" contains Security Group Members from 1_4 to 1_5.

Best Practice - Perform this procedure over the serial console.

Procedure

Note - The SMO Image Cloning feature automatically clones all the required software packages to the Security Group Members during their boot. When you install or remove software packages gradually on Security Group Members, it is necessary to disable this feature, so that after a reboot the updated Security Group Members do not clone the software packages from the existing non-updated Security Group Members.

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Examine the state of the SMO Image Cloning feature:

show cluster configuration image auto-clone state

D

Disable the SMO Image Cloning feature, if it is enabled:

set cluster configuration image auto-clone state off

E

Examine the state of the SMO Image Cloning feature again:

show cluster configuration image auto-clone state

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the SGMs in the Logical Group "A" through the console.

  • Connect to one of the SGMs in the Logical Group "B" over SSH.

B

Go to the context of one of the SGMs in the Logical Group "A":

member <Member ID>

Example:

member 1_1

C

Go to the Expert mode.

expert

D

Set the SGMs in the Logical Group "A" to the state "DOWN":

cluster-cli set members-admin-state ids <SGM IDs in Group "A"> down

Example:

cluster-cli set members-admin-state ids 1_1-1_4> down

E

Go to the Gaia gClish:

gclish

F

Uninstall the CPUSE package from SGMs in the Logical Group "A":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <SGM IDs in Group "A"

Example:

[Global] SG-s01-01 > installer uninstall 2 member_ids 1_1-1_4
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for uninstallation                             |
|1_02         |Package is ready for uninstallation                             |
|1_03         |Package is ready for uninstallation                             |
|1_04         |Package is ready for uninstallation                             |
+-------------+----------------------------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y

G

Go to the Expert mode.

expert

H

Monitor the SGMs in the Logical Group "A" until they boot:

asg monitor

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the SGMs in the Logical Group "B" through the console.

  • Connect to one of the SGMs in the Logical Group "A" over SSH.

B

Go to the context of one of the SGMs in the Logical Group "B":

member <Member ID>

Example:

member 1_5

C

Go to the Expert mode.

expert

D

Set the SGMs in the Logical Group "B" to the state "DOWN":

cluster-cli set members-admin-state ids <SGM IDs in Group "B"> down

Example:

cluster-cli set members-admin-state ids 1_5-1_8 down

E

Go to the Gaia gClish:

gclish

F

Uninstall the CPUSE package from SGMs in the Logical Group "B":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <SGM IDs in Group "B"

Example:

[Global] SG-s01-01 > installer uninstall 2 member_ids 1_5-1_8
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_05 (local) |Package is ready for uninstallation                             |
|1_06         |Package is ready for uninstallation                             |
|1_07         |Package is ready for uninstallation                             |
|1_08         |Package is ready for uninstallation                             |
+-------------+----------------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y

G

Go to the Expert mode.

expert

H

Monitor the SGMs in the Logical Group "B" until they boot:

asg monitor

Step

Instructions

A

Connect to the command line on the Security Group.

B

Go to the Expert mode.

expert

C

Use one of these tools:

  • The "insights" tool (see insights):

    insights

  • The HCP tool (see hcp):

    hcp --help

In this optional step, you delete the uninstalled Hotfix package from the chassis to free the disk space.

Step

Instructions

A

Go to the Gaia gClish:

gclish

B

Delete the uninstalled Hotfix package from the CPUSE repository on the chassis:

installer delete [Press the Tab key]

installer delete <Number of CPUSE Package>

Example:

[Global] SG-s01-01 > installer delete 2
... ...
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |Package is ready for delete                                     |
|1_02         |Package is ready for delete                                     |
|1_03         |Package is ready for delete                                     |
|1_04         |Package is ready for delete                                     |
|1_05         |Package is ready for delete                                     |
|1_06         |Package is ready for delete                                     |
|1_07         |Package is ready for delete                                     |
|1_08         |Package is ready for delete                                     |
+-------------+----------------------------------------------------------------+
You are about to perform
Package delete (Check_Point_R82_Hotfix_Bundle_FULL.tar) on blades:
1_01,1_02,1_03,1_04,1_05,1_06,1_07,1_08
*** In case the package is installed, you might not be able to uninstall and Import the package ever again ! ***

Are you sure? (Y - yes, any other key - no) y
Update Service Engine
+------------------------------------------------------------------------------+
|Member ID    |Status                                                          |
+-------------+----------------------------------------------------------------+
|1_01 (local) |The package was successfully removed from the machine.          |
|1_02         |The package was successfully removed from the machine.          |
|1_03         |The package was successfully removed from the machine.          |
|1_04         |The package was successfully removed from the machine.          |
|1_05         |The package was successfully removed from the machine.          |
|1_06         |The package was successfully removed from the machine.          |
|1_07         |The package was successfully removed from the machine.          |
|1_08         |The package was successfully removed from the machine.          |
+-------------+----------------------------------------------------------------+
[Global] SG-s01-01 >