VPN-1 Power VSX NGX R65 Upgrade Guide

Size: px

Start display at page:

Download "VPN-1 Power VSX NGX R65 Upgrade Guide"

Ethan Ferguson
5 years ago
Views:

1 VPN-1 Power VSX NGX R65 Upgrade Guide March In This Document Upgrade Overview page 2 Upgrading the Management Server to R65 page 4 Installing the GUI Clients page 6 Activating the VSX Plug-in in Provider-1 page 8 Upgrading VSX Gateways and Clusters page 10 Documentation Feedback page 12 Copyright 3/3/08 Check Point Software Technologies, Ltd. All rights reserved 1

2 Upgrade Overview Upgrade Overview This guide describes the upgrade path to VPN-1 Power VSX NGX R65 for both SmartCenter server and Provider-1 environments. The upgrade process consists of several procedures which must be performed in sequence: 1. Upgrading the management server (SmartCenter or Provider-1) to R65 2. Installing the GUI Clients 3. Activating the management plugin in Provider-1 4. Upgrading the VSX gateway and/or cluster Each procedure is described in its own section. Before you begin, make sure that you have the latest version of this document by checking in the User Center at: Obtaining Software Installation Packages VSX and Provider-1 software installation packages for Solaris, Windows, Linux and SecurePlatform may be found on the product CD. Resolving Upgrade Issues If you encounter unforeseen obstacles during the upgrade process, contact your Reseller or our SecureKnowledge support center at: Terminology ClusterXL: A software-based load sharing and high availability solution for Check Point gateway deployments. It distributes traffic between clusters of redundant gateways so that the computing capacity of multiple machines may be combined to increase total throughput. In the event that any individual gateway becomes unreachable, all connections are re-directed to a designated backup without interruption. Tight integration with Check Point's SmartCenter management and enforcement point solutions ensures that ClusterXL deployment is a simple task for VPN-1 administrators. Gateway or Check Point Gateway: A gateway is the VPN-1 engine which actively enforces the Security Policy of the organization. In Place Upgrade: In Place upgrades are upgrades performed locally. Security Policy: A Security Policy is created by the system administrator in order to regulate the incoming and outgoing flow of communication. SmartCenter Server: The SmartCenter server is used by the system administrator to manage the Security Policy. The databases and policies of the organization are stored on the SmartCenter server, and are downloaded from time to time to the gateways. SmartConsole Clients: The SmartConsole Clients are the GUI applications that are used to manage different aspects of the Security Policy. For example, SmartView Tracker is a GUI client used to view logs. SmartDashboard: A GUI client that is used to create Security Policies. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 2

3 Terminology SmartUpdate: A tool that enables you to centrally upgrade and manage Check Point software and licenses. Standalone Deployment: A standalone deployment is performed when the Check Point components that are responsible for the management of the Security Policy (the SmartCenter server and the gateway) are installed on the same machine. Virtual Routers: Independent routing domains within a VSX Gateway that function like physical routers. Virtual System: A routing and security domain featuring firewall and VPN capabilities supported by a standard Check Point Gateway. Multiple Virtual Systems can run concurrently on a single VSX Gateway, isolated from one another by their use of separate system resources and data storage. VSX Clustering: The connection of two or more VSX Gateways in such a way that if one fails, another immediately takes its place. A single VSX Gateway contains multiple Virtual Routers and Virtual Systems. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 3

4 Upgrading the Management Server to R65 Upgrading the Management Server to R65 This section presents procedures for upgrading your SmartCenter servers to version VSX NGX R65. Before Upgrading Backup your existing management server (SmartCenter server or Provider-1 MDS) before upgrading. This will allow you to restore your servers to their pre-installation state in the event you encounter problems. Upgrading to SmartCenter NGX R65 The procedures for for upgrading to SmartCenter or Provider-1 version NGX R65 are specific for your platform and your version. To upgrade you current SmartCenter server version to NGX R65, please refer to the chapter and section in the Check Point NGX R65 Upgrade Guide appropriate for your version. Upgrading to Provider-1 NGX R65 The procedures for for upgrading the Provider-1 and other components to version NGX R65 are specific for your platform and your version. To upgrade you current management server version to NGX R65, please refer to the Provider-1 chapter in the Check Point NGX R65 Upgrade Guide. Installing the Management Update This section assumes that you have already installed or upgraded your management server (Provider-1 MDS or SmartCenter server) to NGX R65. At this point, it is necessary to install the VPN-1 Power VSX management update for SmartCenter/Provider-1, which consists of the following components: VSX NGX R65 management hotfix VSX NGX R65 compatibility package VSX NGX R65 management plug-in To install the VPN-1 Power VSX management update for SmartCenter/Provider-1 to your NGX R65 Provider-1 MDS or SmartCenter server, perform the steps as described for your platform. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 4

5 Installing the Management Update SecurePlatform, Linux, Solaris 1. Insert the VPN-1 Power VSX management update for SmartCenter/Provider-1 CD ROM into the drive. 2. Execute the following commands on the management server (SmartCenter of Provider-1 MDS): a. mount /mnt/cdrom b. cd /mnt/cdrom c../unixinstallscript 3. When you receive confirmation that the process has finished, reboot the machine. Windows Platforms (SmartCenter Only) 1. Insert the VPN-1 Power VSX management update for SmartCenter/Provider-1 CD ROM into the drive. 2. Run setup.bat and follow the instructions on the screen. Nokia IPSO (SmartCenter Only) 1. Download the VPN-1 Power VSX management update for SmartCenter/Provider-1 package from the Check Point Download Center. 2. Create a temporary directory as a sub-directory of the /var directory. 3. Copy the VPN-1 Power VSX management update for SmartCenter/Provider-1 package to your temporary directory. 4. Execute the following command from your temporary directory: tar xzvf <package file name>. 5. Execute./UnixInstallScript and follow the instructions on the screen. 6. Reboot the machine. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 5

6 Installing the GUI Clients Installing the GUI Clients This sections describe how to install the NGX R65 SmartDashboard and Provider-1 MDG, as well as how to install the VSX NGX R65 enhanced SmartConsole. Installing NGX R65 SmartConsole To install the SmartConsole on Windows platforms: 1. Navigate to the windows/smartconsole directory on the Provider-1 product CD. 2. Copy the SmartConsole executable to a temporary directory. 3. Start the installation by double-clicking the SmartConsole executable. 4. When the installation has completed, run SmartConsole applications from the Windows Start > Programs > Check Point SmartConsole R65 > SmartDashboard menu option. Installing the VSX Enhanced MDG for Provider-1 To install the MDG package on a Windows platform: 1. Uninstall the existing MDG using the Windows uninstall client (Start > Control Panel > Add or Remove programs). 2. Insert the VPN-1 Power VSX management update for SmartCenter/Provider-1 CD and navigate to the ExternalFiles directory. 3. Copy Prov1Gui.zip to a temporary directory and extract the installation files. 4. Run setup.exe and follow the instructions on the screen. 5. When the installation has completed, run the MDG from the Windows Start > Programs > Check Point SmartConsole R65 > Provider-1 menu option. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 6

7 Installing VSX NGX R65 Enhanced SmartConsole Installing VSX NGX R65 Enhanced SmartConsole VSX NGX R65 uses an enhanced version of the SmartConsole applications that supports VSX functionality. In a SmartCenter server deployment, VSX NGX R65 automatically installs the enhanced SmartConsole when you log on to SmartDashboard for the first time. In a Provider-1 deployment, the VSX enhanced SmartConsole automatically installs the firs time that you connect to a CMA with the plug-in activated. You must, however, already have installed the NGX R65 MDG already installed on your client computer for this to occur. You can also manually install the VSX enhanced SmartConsole for Provider-1 by performing the following tasks: 1. Uninstall the standard NGX R65 MDG, if installed. 2. Insert the VSX Management Add-on CD ROM into the drive. 3. Copy the Prov1Gui.zip file from the VSX Management Add-on CD to your management client machine. This file is located in the /ExternalFiles directory. 4. Extract and run the executable setup file. 5. Follow the instructions on the screen. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 7

Activating the VSX Plug-in in Provider-1 Activating the VSX Plug-in in Provider-1 VSX NGX R65 employs Check Point plug-in technology to implement VSX functionality in Provider-1.

Prior to activating the VSX plug-in, you must install the VPN-1 Power VSX management update for SmartCenter/Provider-1, as described in Installing the Management Update on page 4.

8 Activating the VSX Plug-in in Provider-1 Activating the VSX Plug-in in Provider-1 VSX NGX R65 employs Check Point plug-in technology to implement VSX functionality in Provider-1. You must activate the VSX plug-in for each CMA that manages VSX NGX R65 gateways or Virtual Devices. Prior to activating the VSX plug-in, you must install the VPN-1 Power VSX management update for SmartCenter/Provider-1, as described in Installing the Management Update on page 4. We recommend that you stop all active CMAs before activating the plug-in, as this action speeds up the process of activating the plug-in. The process of activating the plug-in for a CMA automatically restarts it. In addition, we recommend that you close all instances of SmartDashboard before activating the plug-in. To activate the VSX Plug-in, perform the following steps: 1. From the MDG Selection Bar, select Management Plug-ins. 2. Click the Plug-in Details icon. The Management Plug-ins Details page appears. 3. Right-click anywhere on the page and select Activate Plug-in on Customers. The Plugin Activation wizard opens. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 8

9 Activating the VSX Plug-in in Provider-1 4. Click to select the VSX plug-in (Plvsx) and then click Next. The Customer Selection page appears. 5. Select the customers for which the VSX plug-in is to be activated. Click Next to continue. 6. Click Finish on the Plug-in Operation Completion page. Note - Alternatively, you can use the vsx_util activate_plugin command to activate the VSX plug-in for individual CMAs. When using this command, do not stop the Main CMA. You can, however, stop any other CMAs. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 9

10 Upgrading VSX Gateways and Clusters Upgrading VSX Gateways and Clusters The process for upgrading VSX gateways and clusters to VSX NGX R65 involves two primary processes: 1. Creating a fresh installation of VSX NGX R65 SecurePlatform on each VSX gateway and/or cluster member machine. 2. Upgrading the VSX object definitions, configuration settings and security policies and then transferring them from the management database to the VSX gateway and/or cluster members. The vsx_util upgrade command upgrades the VSX object definitions, configuration settings and security policies to VSX NGX R65. The vsx_util reconfigure command transfers these settings from the management database (SmartCenter server or Provider-1 MDS) to the newly created objects. Before Upgrading Before upgrading the VSX cluster, perform the following: 1. Make sure that you have successfully upgraded you management server to VSX NGX R65, using the VSX NGX R65 Management update. 2. Upgrade your licenses from previous VSX versions as required. 3. If you intend to use a different machine for the upgraded gateway: a. Make sure the new machine meets the minimum hardware requirements as defined in the VPN-1 VSX NGX Getting Started Guide. b. Make sure the new machine contains at least the same number of interfaces as the old machine, and that the VSX gateway is accessible from the management server. 4. If you intend to use the same machine, backup the current gateway, and save the configuration file to a safe location. For detailed information on backing up a VSX gateway, see the backup and restore section of the SecurePlatform VPN-1 VSX NGX Guide. 5. Perform a fresh install of VSX NGX R65 on each gateway or cluster member and perform the initial configuration steps as described in the VSX NGX R65 Getting Started Guide. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 10

11 Performing the Upgrade Performing the Upgrade This section describes the procedures for upgrading clusters from an earlier VSX version to the current version. You perform the upgrade process using the vsx_util upgrade command. Afterwards, you use the vsx_util reconfigure command to apply settings stored in the management database to the newly upgraded member. Upgrading to VSX NGX R65 Warning - Make sure that no other administrators are connected to the management server before proceeding. The vsx_util command cannot modify the management database if the database is locked. Performing the following steps to upgrade the cluster and its members: 1. Close SmartDashboard. 2. Execute the vsx_util upgrade command from the management server command line. Enter the following information as prompted: a. SmartCenter server or main CMA IP address b. Administrator name and password c. Cluster name This action upgrades the existing VSX objects, configuration settings and policy. 3. When prompted, select the version to which you wish to upgrade. 4. Wait until the Finished upgrading/database saved successfully message appears, indicating that the database has been updated and saved. 5. Open SmartDashboard and verify that an object representing the new gateway or cluster now appears in the specified cluster. Close SmartDashboard when you are finished. Note - In a Provider-1 environment, the operation will skip any CMAs locked by an administrator. If this should occur, execute the vsx_util upgrade command again, using the same parameters, once the CMAs become available. 6. Execute the vsx_util reconfigure command from the management server command line for each member. Enter the following information when prompted: a. Management server or main CMA IP address b. Administrator name and password c. SIC activation key for the upgraded gateway or member This action transfers the upgraded objects, security policy and configuration to the newly upgraded gateways or members. 7. Wait until the Finished upgrading/database saved successfully message appears. Note - In a Provider-1 environment, the operation will skip any CMAs locked by an administrator. If this should occur, execute the vsx_util reconfigure command again, using the same parameters, once the CMAs become available. 8. Reboot the machine. 9. Repeat steps 6 through 8 for each gateway or member. VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 11

12 Documentation Feedback Resume Operation If the vsx_util upgrade or vsx_util reconfigure operation fails to complete, you can resume the process from the point at which if failed. If the operation fails for some CMAs, simply rerun the appropriate command and the operation and select the resume option. Notes to the Upgrade Process You only need to run the vsx_util upgrade command once for each VSX cluster. You must, however, run the vsx_util reconfigure command for each cluster member. For example, for a deployment with two clusters, each cluster having three members, run vsx_util upgrade twice, once for each cluster object, and the vsx_util reconfigure six times, once for each cluster member. To ensure the stability of the VSX deployment, it is recommended that you upgrade one cluster object and all of its members before attempting to upgrade another cluster. Execute vsx_util upgrade for one cluster object and then immediately execute vsx_util reconfigure for its members. Verify that each upgraded member is fully operational before upgrading the remaining members. All operations performed using vsx_util are logged to: vsx_util.log. This file is created in the same directory from which you ran the vsx_util command. Documentation Feedback Check Point is engaged in a continuous effort to improve its documentation. Please help us by sending your comments to: cp_techpub_feedback@checkpoint.com VPN-1 Power VSX NGX Upgrade Guide March 3, :29 am 12

SecurePlatform 2.6 for NGX R65 Release Notes

SecurePlatform 2.6 for NGX R65 Release Notes Revised: March 26, 2008 This Release Notes document provides essential operating requirements and describes known issues for SecurePlatform 2.6 for NGX R65.