Upgrading Nokia cluster setup which comes first Master or Member?

[mc_rockz]

Hi,

I would like to know if there is a difference if i upgrade first the cluster member instead the cluster master? Bcoz im upgrading my Nokia IP530 fromm R55 to R62 in 3 weeks time.


Mc_rockz

[lammbo]

First, is your config distributed or standalone? (is your SCS a separate server or is it on one of your gateways?)

A good place for you to start would be reading this:

CheckPoint_R65_UpgradeGuide.pdf

[mc_rockz]

Yes it is distributed. and there is a seperate smartcenter management server.

[lammbo]

All the better! This is a very stripped down version of the procedure, but using this and reading the guide should get you where you need to be.

I always upgrade my HA (standby) node first per the zero-downtime upgrade procedure.

Disconnect SYNC cable (since STATE won't sync between different versions anyway)

Once the standby gateway is upgraded (IPSO - then CP), go into SCS and change the Version to R65 (or version du jour that you installed). Then push policy.

Policy will only push to the upgraded host because of the version change. If all is well, you should be able to set VRRP (assumption for Nokia box) to a higher priority on the upgraded node so it takes over permanently and then reboot your primary node. It has been my experience that during this process, rebooting the primary or disconnecting the interfaces are the only things that make it fail over because of the loss of state sync.

When the untouched node is rebooting, you can stop the boot and enter command line to do the IPSO upgrade on that node. Complete this node, reboot, connect sync cable, push policy and finally, change VRRP back so the designated primary takes over again.

During this last VRRP change, STATE sync should be back to normal and you should be done.

[mc_rockz]

Hi lammbo,

tnx for your guide, im running an Active/active mode load sharing.

so im planning to upgrade individually the firewalls. and dont let each other see when one is running an old version and new version.

is this right?


regards,
Mc_rockz

[lammbo]

I can't be 100% certain as I've never built or worked with Active/Active clusters.

I can only guess that in your case, this same procedure should work.

Can anyone else provide confirmation on this?