BoleTwo years ago, we wrote about how every Check Point administrator inevitably faces the question of upgrading to a new version. In this article, we discussed the upgrade from version R77.30 to R80.10. By the way, in January 2020, R77.30 became the certified version of FSTEC. However, a lot has changed in Check Point over the past 2 years. The article "" covers all the new features, of which there are many. In this article, the upgrade procedure will be described in as much detail as possible.Ā
As is known, there are 2 deployment options for Check Point: Standalone and Distributed, that is, with and without a dedicated management server. The Distributed option is highly recommended for several reasons:
minimized load on the gateway resources;
no need to plan a maintenance window to perform work on the management server;
proper functioning of SmartEvent, as it is unlikely to work in the Standalone option;
it is highly recommended to build a cluster of gateways in a Distributed configuration.
Considering all the advantages of the Distributed configuration, we will examine the upgrade of the management server and the security gateway separately.
Upgrading the Security Management Server (SMS)
There are 2 methods to upgrade SMS:
using CPUSE (via Gaia Portal)
using Migration Tools (a clean installation is required ā fresh install)
Upgrading using CPUSE is not recommended by colleagues at Check Point, as it will not update the file system version and kernel. However, this method does not require policy migration and is much faster and simpler than the second method.
A clean installation and policy migration using Migration Tools is the recommended method. In addition to new file system and OS kernel, it is often the case that the SMS database "clogs up," and a clean installation is an excellent way to enhance the server's performance.
1) The first step in any upgrade is to create backups and snapshots. If you have a physical management server, the backup should be made from the Gaia Portal web interface. Go to the tab Maintenance > System Backup > Backup. You will then specify the backup storage location. This can be an SCP, FTP, TFTP server, or locally on the device; however, you will have to later transfer this backup to the server or computer.
Figure 1. Creating a backup in Gaia Portal
2) Next, a snapshot should be taken in the tab Maintenance ā Snapshot Management ā New. The difference between backups and snapshots is that snapshots contain more information, including all installed hotfixes. Nevertheless, it's best to do both.
If your management server is installed as a virtual machine, it is recommended to back up the virtual machine using the hypervisor's built-in tools. It's simply faster and more reliable.
Figure 2. Creating a snapshot in Gaia Portal
3) Save the device configuration from Gaia Portal. You can screenshot all the settings tabs available in Gaia Portal, or enter the command from Clish save configuration. Then, retrieve the file to your PC using WinSCP or another client.
Figure 3. Saving the configuration to a text file)
Note: if WinSCP does not allow you to connect, change the user's shell to /bin/bash either in the Users tab of the web interface or by entering the command chsh ās /bin/bash.
Updating with CPUSE
4) The first three steps are mandatory for any update option. If you decide to take the simpler update path, go to the web interface and navigate to the tab Upgrades (CPUSE) > Status and Actions > Major Versions > Check Point R80.40 Gaia Fresh Install and Upgrade. Right-click on this update and select Verifier. The verification process will run for a few minutes, after which you will see a message indicating that the device can be updated. If you see errors, they need to be resolved.
Figure 4. Updating via CPUSE
5) Update to the latest version of CDT (Central Deployment Tool) ā a utility that runs on the management server and allows you to install updates, update packages, manage backups, snapshots, scripts, and much more. An outdated version of CDT can lead to problems with the update. You can download CDT from .
6) After placing the downloaded archive on SMS in any directory via WinSCP, connect to SMS via SSH and enter expert mode. Reminder: the WinSCP user must have shell /bin/bash!
7) Enter the commands:Ā
cd /somepathtoCDT/
tar -zxvf .tgz
rpm -Uhv āforce CPcdt-00-00.i386.rpm
Figure 5. Installing Central Deployment Tool (CDT)
8) The next step is installing the R80.40 image. Right-click on the update Download, then Install. Please note that the update takes about 20-30 minutes, and the management server will be unavailable for some time. Therefore, it makes sense to coordinate a maintenance window.
9) All licenses and security policies are maintained, so you should download the new .
10) Connect to the new SmartConsole SMS and set the security policies. The button Install Policy is in the upper left corner.
11) Your SMS has been updated, and you should now install the latest hotfix. In the Upgrades (CPUSE) > Status and Actions > Hotfixes right-click Verifier, then Install Update. The device will reboot automatically after the update is installed.
Figure 6. Installing the latest hotfix via CPUSE
Updating using Migration Tools
4) First, you should also update to the latest CDT version ā items 5, 6, 7 from the section āUpdating using CPUSE.ā
5) Install the Migration Tools package required for migrating policies from the management server. The Migration Tools can be found for versions: R80.20, R80.20 M1, R80.20 M2, R80.30, R80.40. You should download Migration Tools for the version you want to upgrade to, not the one you currently have! In our case, this is R80.40.
6) Next, in the SMS web interface, go to the tab Upgrades (CPUSE) > Status and Actions > Import Package > Browse > Select the downloaded file > Import.
Figure 7. Importing Migration Tools
7) From expert mode on the SMS, check that the Migration Tools package is installed using the command (the output of the command should match the number in the name of the Migration Tools archive):
cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1
Figure 8. Checking the installation of Migration Tools
8) Navigate to the $FWDIR/scripts folder on the management server:
cd $FWDIR/scripts
9) Run the pre-upgrade verifier (verification script) using the command (if there are errors, fix them before proceeding):
./migrate_server verify -v R80.40
Note: if you see the error āFailed to retrieve Upgrade Tools packageā, but you confirmed that the archive was successfully imported (see item 4), use the command:
./migrate_server verify -v R80.40 -skip_upgrade_tools_check
Figure 9. Running the verification script
10) Export the security policies using the command:
./migrate_server export -v R80.40 //.tgz
Figure 10. Exporting security policies
Note: if you see the error āFailed to retrieve Upgrade Tools packageā, but you confirmed that the archive was successfully imported (item 7), use the command:
./migrate_server export -skip_upgrade_tools_check -v R80.40 //.tgz
11) Calculate the MD5 hash checksum and save the output of the command:
md5sum //.tgz
Figure 11. Calculating the MD5 hash checksum
12) Use WinSCP to transfer this file to your computer.
13) Enter the command df -h and keep the percentage ratio of directories based on the space occupied.
Figure 12. Percentage ratio of directories on SMS
14.1) In case you have a real SMS
14.1.1) Using a bootable USB flash drive with an image is created .Ā
14.1.2) I recommend preparing at least 2 bootable flash drives, since sometimes the flash drive may not be readable.Ā
14.1.3) As an administrator on the computer, run ISOmorphic.exe. In point 1, select the downloaded Gaia R80.40 image, and in point 4, select the flash drive. Points 2 and 3 should not be changed at all.!
Figure 13. Creating a bootable flash drive
14.1.4) Select the option āInstall automatically without confirmationā and it is important to specify your management server model. For SMS, you should select line 3 or 4.
Figure 14. Selecting the device model for creating a bootable flash drive
14.1.5) Next, turn off the appliance, insert the flash drive into the USB port, connect via serial cable through the COM port to the device, and turn on SMS. The installation process will occur automatically. The default IP address is 192.168.1.1/24, and the login data is admin / admin.
14.1.6) The next step is to connect to the web interface on Gaia Portal (default address ), where you will go through the device initialization. During initialization, you mainly click Next, as almost all settings can be changed in the future. However, you may change the IP address, DNS settings, and hostname right away.
14.2) In case you have a virtual SMS
14.2.1) Under no circumstances should you delete the old SMS, create a new virtual machine with the same resources (CPU, RAM, HDD) with the same IP address. By the way, you can add RAM and HDD since R80.40 is somewhat more demanding. To avoid IP address conflicts, turn off the old SMS and start the installation of the new one.
14.2.2) During the installation of Gaia, configure the current IP address and allocate appropriate space for the directory. /root The percentage ratio of directories should approximately be preserved,use the output df -h.
15) At the stage of selecting the installation type āInstallation Typeā choose the first option, as you are most likely not using MDS (Multi-Domain Server). If you are using MDS, it means you managed many domains from different entities of SMS at the same time. In this case, you should choose the second option.
Figure 15. Selecting the installation type of Gaia
16) The most important point, which cannot be changed without a reinstallation ā is the selection of the entity. You must choose Security Management and click Next. Next, leave everything at default.
Figure 16. Selecting the entity type during Gaia installation
17) Once the device reboots, connect to the web interface at or another IP address if you changed it.
18) Transfer the settings from the screenshots into all tabs of the Gaia Portal where any configuration was made, or execute the command from clish load configuration .txt. This config file should be uploaded to the SMS in advance.
Note: Since the OS is new, WinSCP will not allow admin access; change the user's shell to /bin/bash either in the Users tab in the web interface or by entering the command chsh ās /bin/bash or create a new user.
19) Upload the file with exported policies from the old management server into any directory. Then enter the console in expert mode and verify that the MD5 hash matches the previous one. If not, you need to export again:
md5sum /<Full Path>/<Name of Exported File>.tgz
20) Repeat step 6 and install Upgrade Tools on the new SMS in Gaia Portal under the Upgrades (CPUSE) > Status and Actions.
21) Enter the command in expert mode:
./migrate_server import -v R80.40 -skip_upgrade_tools_check //.tgz
Figure 17. Importing the security policy to the new SMS
22) Start the services with the command cpstart.
23) Download the new and connect to the management server. Go to Menu > Manage Licenses and Packages (SmartUpdate) and check that your license is still valid.
Figure 18. Checking installed licenses
24) Apply the security policy to the gateway or cluster ā Install Policy.
Upgrading Security Gateway (SG)
The security gateway can be updated through CPUSE, just like the management server, or installed anew ā fresh install. From my experience, 99% of cases involve reinstalling the Security Gateway since it takes almost as much time as upgrading through CPUSE, but you get a clean, updated OS without bugs.
Similarly to the SMS, a backup and snapshot need to be created and the settings from the Gaia Portal saved. Refer to steps 1, 2, and 3 in the section āUpgrading Security Management Serverā.
Updating with CPUSE
Upgrading the Security Gateway through CPUSE is exactly the same process as upgrading the Security Management Server, so please refer to the beginning of the article.
Important point: upgrading the SG requires a reboot! Therefore, perform the update during a maintenance window. If you have a cluster, update the passive node first, then switch roles and update the other node. In the case of a cluster, maintenance windows can be avoided.
Installing a new OS version on Security Gateway
1.1) If you have a physical SG
1.1.1) Using a bootable USB flash drive with an image is created . The image is the same as on SMS, but the procedure for creating a bootable flash drive looks slightly different.
1.1.2) I recommend preparing at least 2 bootable flash drives, as sometimes a drive may not be read properly.Ā
1.1.3) Run ISOmorphic.exe. In point 1, select the downloaded Gaia R80.40 image, and in point 4, select the flash drive. Points 2 and 3 should not be changed at all.!
Figure 19. Creating a bootable flash drive
1.1.4) Select the option āInstall automatically without confirmation,ā and it is important to specify the model of your Security Gateway ā line 2 or 3. If it is a physical sandbox (SandBlast Appliance), then choose line 5.
Figure 20. Choosing the device model for creating a bootable flash drive
1.1.5) Next, you power off the appliance, insert the flash drive into the USB port, connect via a console cable through the COM port to the device, and power on the gateway. The installation process occurs automatically. The default IP address is 192.168.1.1/24, and the login data is admin / admin. First, you should update the passive node, then set a policy for it, switch roles, and then update the other node. Most likely, a maintenance window will be needed.
1.1.6) The next step is to connect to the web interface on Gaia Portal, where you go through the initial setup of the device. During initialization, you mainly click Next, as almost all settings can be changed in the future. However, you may change the IP address, DNS settings, and hostname right away.
1.2) If you have a virtual SG
1.2.1) Create a new virtual machine with the same or more resources (CPU, RAM, HDD), as version R80.40 is slightly more demanding. To avoid IP address conflicts, power off the old gateway and start the installation of the new one with the same IP address. The old SG can be safely removed, as nothing of value is on it; all the important information ā security policy ā is stored on the management server.
1.2.2) During the OS installation, configure the current IP address and allocate an adequate amount of space for the directory. /root 3) Connect via HTTPS port to the gateway and start the initialization process. At the installation type selection stage
select the first option ā Security Gateway and/or Security Management. āInstallation Typeā Figure 21. Selecting the Gaia installation type
4) A crucial point is the selection of the entity (Products). You should choose
4) The most important point is the choice of entity (Products). You should select Security Gateway And if you have a cluster, check the box "Unit is a part of a cluster, type: ClusterXL". If you have a VRRP cluster, choose that type, but this is unlikely.
Figure 22. Choosing the entity type during the Gaia installation
5) In the next step, set a one-time SIC password to establish trust with the management server. This password generates a certificate, and the management server will communicate with the gateway over an encrypted channel. Check the box "Connect to your Management as a Service" if the management server is in the cloud. We recently wrote about this and how convenient and easy cloud management is.
Figure 23. Creating SIC
6) Start the initialization process on the next tab. Once the device reboots, connect to the web interface and transfer the settings from the screenshots to all tabs in the Gaia Portal where something was configured, or execute the command load configuration .txt. This config file should first be uploaded to the security gateway.
Note: Since the OS is new, WinSCP will not allow admin access; change the user's shell to /bin/bash either in the Users tab in the web interface or by entering the command chsh ās /bin/bash or create a new user with that shell.
7) Open and access the security gateway object that you just reinstalled. Open the tab General Properties > Communication > Reset SIC and enter the password set in step 5.
Figure 24. Establishing trust with the new security gateway
8) The Gaia version of the object should change; if it doesn't, change it manually. Then set the policy on the gateway.
9) In Gaia Portal, go to the tab Upgrades (CPUSE) > Status and Actions > Hotfixes and install the latest hotfix. The device will go into reboot during the installation!
10) In the case of a cluster, switch the node roles and perform the same steps for the other node.
Conclusion
I tried to create a clear and comprehensive guide for upgrading from version R80.20/R80.30 to the current R80.40, as much has changed. The version is already available in demo mode, however, the upgrade procedure remains largely the same. Following the official from Check Point, you will be able to navigate all the nuances yourself.
For any questions, you can contact us. We would be happy to assist with the most complex upgrades and cases within our technical support . Also, on our there is an option to order an audit of the Check Point settings or leave a free on a technical case.
. Stay tuned for updates (, , , , ).
Source: habr.com
