Installing and Uninstalling a Hotfix on Security Group Members

This section describes the Full Connectivity installation and uninstall of an Offline CPUSE package.

Important Notes

This procedure is supported only on these:

  • Maestro Security Group

  • ElasticXL Cluster

Notes:

  • The procedure term "Site" applies to Maestro Security Group and to ElasticXL Cluster.

  • The procedure term "Security Group" applies to Maestro Security Group and to ElasticXL Cluster.

  • The procedure term "Security Group Member" applies to a Maestro Security Group Member and to an ElasticXL Cluster Member.

  • The procedure term "Security Group Members" applies to Maestro Security Group Members and to ElasticXL Cluster Members.

  • ElasticXL Cluster supports a maximum of:

    • 3 ElasticXL Cluster Members on each ElasticXL Site.

    • 6 ElasticXL Cluster Members in total.

  • CPUSE examples below are provided for a Maestro Security Group.

Notes:

Installing a Hotfix Package on Security Group Members

Important:

  • This procedure keeps the current connections in a Security Group.

  • In Maestro: This procedure applies to Security Groups in the Security Gateway, VSNext, and Traditional VSX modes.

    In the VSNext mode, you must run all the commands in the context of the Virtual Gateway 0.

    In the Traditional VSX mode, you must run all the commands in the context of VS0.

  • In ElasticXL: This procedure applies to Security Groups in the Security Gateway and in the VSNext modes.

    In the VSNext mode, you must run all the commands in the context of the Virtual Gateway 0.

  • Do not install the hotfix on all the Security Group Members in a Security Group at the same time.

  • In this procedure, you divide all Security Group Members in a Security Group into two or more logical groups.

    In the procedure below, we use two logical groups denoted below as "A" and "B".

    You install the hotfix on one logical group of the Security Group Members at one time.

    The other logical group(s) of the Security Group Members continues to handle traffic.

    Each logical group should contain the same number of Security Group Members - as close as possible.

    1. You fail over from the Logical Group "A" to the Logical Group "B".

    2. You install the hotfix on the Logical Group "A" while the Logical Group "B" continues to handle traffic.

    3. You fail over from the Logical Group "B" to the Logical Group "A".

    4. You install the hotfix on the Logical Group "B" while the Logical Group "A" continues to handle traffic.

    Environment

    Description

    Maestro

    Single Site

    • There are 8 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_4.

    • The Logical Group "B" contains Security Group Members from 1_5 to 1_8.

    Maestro

    Single Site

    • There are 5 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_3.

    • The Logical Group "B" contains Security Group Members from 1_4 to 1_5.

    Maestro

    Dual Site

    • There are 4 Security Group Members in the Security Group (on each Site).

    • The Logical Group "A" contains Security Group Members on Site 1 from 1_1 to 1_4.

    • The Logical Group "B" contains Security Group Members on Site 2 from 2_1 to 2_4.

    ElasticXL

    Single Site

    • There are 3 ElasticXL Cluster Members in the ElasticXL Cluster.

    • The Logical Group "A" contains ElasticXL Cluster Members from 1_1 to 1_2.

    • The Logical Group "B" contains the ElasticXL Cluster Member 1_3.

    ElasticXL

    Dual Site

    • There are 6 ElasticXL Cluster Members in the ElasticXL Cluster (3 on each Site).

    • The Logical Group "A" contains ElasticXL Cluster Members on Site 1 from 1_1 to 1_3.

    • The Logical Group "B" contains ElasticXL Cluster Members on Site 2 from 2_1 to 2_3.

Installation Procedure

Step

Instructions

A

Make sure you have the applicable CPUSE Offline package.

B

Transfer the CPUSE Offline package to the Security Group (into some directory, for example /var/log/).

C

Connect to the command line on the Security Group.

D

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

E

Import the CPUSE Offline package from the hard disk:

installer import local /<Full Path>/<Name of the CPUSE Offline Package>

Example:

[Global] SG-s01-01 > installer import local /var/log/Check_Point_R82_Hotfix_Bundle_FULL.tgz

F

Show the imported CPUSE packages:

show installer packages imported

G

Make sure the imported CPUSE package can be installed on this Security Group:

installer verify [Press the Tab key]

installer verify <Number of CPUSE Package> member_ids all

Example:

[Global] SG-s01-01 > installer verify 2 member_ids all
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_01 (local) |Installation is allowed.                     |
|1_02         |Installation is allowed.                     |
|1_03         |Installation is allowed.                     |
|1_04         |Installation is allowed.                     |
|1_05         |Installation is allowed.                     |
|1_06         |Installation is allowed.                     |
|1_07         |Installation is allowed.                     |
|1_08         |Installation is allowed.                     |
+-----------------------------------------------------------+
[Global] SG-s01-01 >

Note - The SMO Image Cloning feature automatically clones all the required software packages to the Security Group Members during their boot. When you install or remove software packages gradually on Security Group Members, it is necessary to disable this feature, so that after a reboot the updated Security Group Members do not clone the software packages from the existing non-updated Security Group Members.

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Examine the state of the SMO Image Cloning feature:

show cluster configuration image auto-clone state

D

Disable the SMO Image Cloning feature, if it is enabled:

set cluster configuration image auto-clone state off

E

Examine the state of the SMO Image Cloning feature again:

show cluster configuration image auto-clone state

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the Security Group Members in the Logical Group "A" through the console.

  • Connect to one of the Security Group Members in the Logical Group "B" over SSH.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Set the Security Group Members in the Logical Group "A" to the state "DOWN":

set cluster members-admin-state ids <SGM IDs in Group "A"> down

Example:

set cluster members-admin-state ids ids 1_1-1_4 down

D

Connect to one of the Security Group Members in the Logical Group "A":

member <Member ID>

Example:

member 1_1

E

Go from the Expert mode to Gaia gClish:

  • If your default shell is the Expert mode, then run:

    gclish

  • If your default shell is Gaia Clish (/etc/cli.sh), then run:

    exit

F

Install the CPUSE hotfix package on the Security Group Members in the Logical Group "A":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids <SGM IDs in Group "A">

Example:

[Global] SG-s01-01 > installer install 2 member_ids 1_1-1_4
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_01 (local) |Package is ready for installation            |
|1_02         |Package is ready for installation            |
|1_03         |Package is ready for installation            |
|1_04         |Package is ready for installation            |
+-----------------------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y
[Global] SG-s01-01 >

G

Monitor the system until the Security Group Members in the Logical Group "A" are in the state "UP" and enforce the Security Policy again:

show cluster info overview live

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the Security Group Members in the Logical Group "B" through the console.

  • Connect to one of the Security Group Members in the Logical Group "A" over SSH.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Set the Security Group Members in the Logical Group "B" to the state "DOWN":

set cluster members-admin-state ids <SGM IDs in Group "B"> down

Example:

set cluster members-admin-state ids 1_5-1_8 down

D

Connect to one of the Security Group Members in the Logical Group "B":

member <Member ID>

Example:

member 1_5

E

Go from the Expert mode to Gaia gClish:

  • If your default shell is the Expert mode, then run:

    gclish

  • If your default shell is Gaia Clish (/etc/cli.sh), then run:

    exit

F

Install the CPUSE hotfix package on the Security Group Members in the Logical Group "B":

installer install [Press the Tab key]

installer install <Number of CPUSE Package> member_ids <SGM IDs in Group "B">

Example:

[Global] SG-s01-01 > installer install 2 member_ids 1_5-1_8
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_05 (local) |Package is ready for installation            |
|1_06         |Package is ready for installation            |
|1_07         |Package is ready for installation            |
|1_08         |Package is ready for installation            |
+-----------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after install.
Do you want to continue? ([y]es / [n]o) y
[Global] SG-s01-01 >

G

Monitor the system until the Security Group Members in the Logical Group "B" are in the state "UP" and enforce the security policy again:

show cluster info overview live

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Use one of these tools:

  • The "insights" tool (see insights):

    insights

  • The HCP tool (see hcp):

    hcp --help

Uninstalling a Hotfix Package on Security Group Members

Important:

  • This procedure keeps the current connections in a Security Group.

  • In Maestro: This procedure applies to Security Groups in the Security Gateway, VSNext, and Traditional VSX modes.

    In the VSNext mode, you must run all the commands in the context of the Virtual Gateway 0.

    In the Traditional VSX mode, you must run all the commands in the context of VS0.

  • In ElasticXL: This procedure applies to Security Groups in the Security Gateway and in the VSNext modes.

    In the VSNext mode, you must run all the commands in the context of the Virtual Gateway 0.

  • Do not uninstall the hotfix from all the Security Group Members in a Security Group at the same time.

  • In this procedure, you divide all Security Group Members in a Security Group into two or more logical groups.

    In the procedure below, we use two logical groups denoted below as "A" and "B".

    You uninstall the hotfix from one logical group of the Security Group Members at one time.

    The other logical group of the Security Group Members continues to handle traffic.

    Each logical group should contain the same number of Security Group Members - as close as possible.

    1. You fail over from the Logical Group "A" to the Logical Group "B".

    2. You uninstall the hotfix from the Logical Group "A" while the Logical Group "B" continues to handle traffic.

    3. You fail over from the Logical Group "B" to the Logical Group "A".

    4. You uninstall the hotfix from the Logical Group "B" while the Logical Group "A" continues to handle traffic.

    Environment

    Description

    Maestro

    Single Site

    • There are 8 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_4.

    • The Logical Group "B" contains Security Group Members from 1_5 to 1_8.

    Maestro

    Single Site

    • There are 5 Security Group Members in the Security Group.

    • The Logical Group "A" contains Security Group Members from 1_1 to 1_3.

    • The Logical Group "B" contains Security Group Members from 1_4 to 1_5.

    Maestro

    Dual Site

    • There are 4 Security Group Members in the Security Group (on each Site).

    • The Logical Group "A" contains Security Group Members on Site 1 from 1_1 to 1_4.

    • The Logical Group "B" contains Security Group Members on Site 2 from 2_1 to 2_4.

    ElasticXL

    Single Site

    • There are 3 ElasticXL Cluster Members in the ElasticXL Cluster.

    • The Logical Group "A" contains ElasticXL Cluster Members from 1_1 to 1_2.

    • The Logical Group "B" contains the ElasticXL Cluster Member 1_3.

    ElasticXL

    Dual Site

    • There are 6 ElasticXL Cluster Members in the ElasticXL Cluster (3 on each Site).

    • The Logical Group "A" contains ElasticXL Cluster Members on Site 1 from 1_1 to 1_3.

    • The Logical Group "B" contains ElasticXL Cluster Members on Site 2 from 2_1 to 2_3.

Uninstall Procedure

Note - The SMO Image Cloning feature automatically clones all the required software packages to the Security Group Members during their boot. When you install or remove software packages gradually on Security Group Members, it is necessary to disable this feature, so that after a reboot the updated Security Group Members do not clone the software packages from the existing non-updated Security Group Members.

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Examine the state of the SMO Image Cloning feature:

show cluster configuration image auto-clone state

D

Disable the SMO Image Cloning feature, if it is enabled:

set cluster configuration image auto-clone state off

E

Examine the state of the SMO Image Cloning feature again:

show cluster configuration image auto-clone state

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the Security Group Members in the Logical Group "A" through the console.

  • Connect to one of the Security Group Members in the Logical Group "B" over SSH.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Set Security Group Members in the Logical Group "A" to the state "DOWN":

set cluster members-admin-state ids <SGM IDs in Group "A"> down

Example:

set cluster members-admin-state ids 1_1-1_4 down

D

Connect to one of the ElasticXL Cluster Members in the Logical Group "A":

member <ID of Site>_<Member ID>

Example:

member 1_1

E

Uninstall the CPUSE hotfix package on the Security Group Members in the Logical Group "A":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <SGM IDs in Group "A">

Example:

[Global] SG-s01-01 > installer uninstall 2 member_ids 1_1-1_4
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-------------+---------------------------------------------+
|1_01 (local) |Package is ready for uninstallation          |
|1_02         |Package is ready for uninstallation          |
|1_03         |Package is ready for uninstallation          |
|1_04         |Package is ready for uninstallation          |
+-------------+---------------------------------------------+
The machines (1_02,1_02,1_03,1_04) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y
[Global] SG-s01-01 >

F

Monitor the system until the Security Group Members in the Logical Group "A" are in the state "UP" and enforce the Security Policy again:

show cluster info overview live

Step

Instructions

A

Connect in one of these ways:

  • Connect to one of the Security Group Members in the Logical Group "B" through the console.

  • Connect to one of the Security Group Members in the Logical Group "A" over SSH.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Set Security Group Members in the Logical Group "B" to the state "DOWN":

set cluster members-admin-state ids <SGM IDs in Group "B"> down

Example:

set cluster members-admin-state ids 1_5-1_8 down

D

Connect to one of the ElasticXL Cluster Members in the Logical Group "B":

member <ID of Site>_<Member ID>

Example:

member 1_5

E

Uninstall the CPUSE hotfix package on the Security Group Members in the Logical Group "B":

installer uninstall [Press the Tab key]

installer uninstall <Number of CPUSE Package> member_ids <SGM IDs in Group "B">

Example:

[Global] SG-s01-05 > installer uninstall 2 member_ids 1_5-1_8
... ...
Update Service Engine
+-----------------------------------------------------------+
|Member ID    |Status                                       |
+-----------------------------------------------------------+
|1_05 (local) |Package is ready for uninstallation          |
|1_06         |Package is ready for uninstallation          |
|1_07         |Package is ready for uninstallation          |
|1_08         |Package is ready for uninstallation          |
+-----------------------------------------------------------+
The machines (1_05,1_06,1_07,1_08) will automatically reboot after uninstall.
Do you want to continue? ([y]es / [n]o) y
[Global] SG-s01-05 >

F

Monitor the system until the Security Group Members in the Logical Group "B" are in the state "UP" and enforce the Security Policy again:

show cluster info overview live

Step

Instructions

A

Connect to the command line on the Security Group.

B

If your default shell is the Expert mode, then go to Gaia gClish:

gclish

C

Get the list of the installed packages:

show installer packages installed