Upgrade Guide. SonicWALL Aventail E-Class SRA EX-Series v9.0.5

Transcription

1 Secure Remote Access The v9.0.5 release includes a number of resolved issues. There are relatively few other changes (since v9.0.1) in the v9.0.5 firmware. This document describes the process of obtaining your SonicWALL Aventail E-Class SRA EX- Series update file, verifying it, and installing it on an existing appliance. Updating a clustered pair of Aventail appliances is described at the end of this document. For a complete list of known issues from previous versions that are fixed in this release, see the Release Notes. Before updating your SonicWALL Aventail appliance, you must follow these steps, which are described in more detail in the Getting Started Guide: Create a MySonicWALL account, if you don't already have one. You need an account in order to register your SonicWALL Aventail SSL VPN. This registration information is not sold or shared with any other company. Register your device on MySonicWALL. Registration provides access to essential resources, such as your license file, firmware updates, documentation, and technical support information. Use your MySonicWALL account to retrieve the license file for your SonicWALL Aventail SSL VPN. Import your license file using the Aventail Management Console (AMC). Updating a clustered pair of SonicWALL Aventail appliances is described at the end of this document. For a complete list of known issues from previous versions that are fixed in this release, see the Release Notes. See the following sections for detailed upgrade information: Platform Compatibility... 1 Update Requirements... 2 Obtaining the Update File from MySonicWALL... 3 Installing the Update... 3 Verifying the Update... 4 Updating a Clustered Pair... 5 Platform Compatibility Version of the SonicWALL Aventail E-Class SRA EX-Series is supported on the following appliances: SonicWALL Aventail E-Class SRA EX7000 SonicWALL Aventail E-Class SRA EX6000 SonicWALL Aventail E-Class SRA EX-2500 SonicWALL Aventail E-Class SRA EX-1600 SonicWALL Aventail E-Class SRA EX-1500 SonicWALL Aventail E-Class SRA EX-750

2 Update Requirements The EX-Series appliance must be running the latest hotfix version before upgrading from 9.0.0, 9.0.1, or to The required hotfix for each version (9.0.x) is clt-hotfix-9_0_x-013. Appliances running versions 8.8.x or 8.9.x must be running the latest hotfixes prior to installing More information about available hotfixes for 8.8.x or 8.9.x is available on the SonicWALL Knowledge Base. To verify the current version and hotfixes: From the main navigation menu in AMC, click System Status. In addition to the version number, the System Status and Maintenance pages display a list of any hotfixes that have been applied. To install a hotfix: To apply a hotfix, run the following steps, replacing the examples with the actual file name for the hotfix: 1. Log in to your MySonicWALL account and select Support > Knowledge Portal in the left navigation pane. 2. Locate the hotfix script file, in the format clt-hotfix-9_0_x-0xx.gz, and copy it to the root folder (/) on the appliance. 3. Log in to the appliance, or to the master node of a pair, via SSH or serial connection as root. 4. Change directory to the root folder (/) with the command: cd / 5. Decompress the archive with the command: gzip -d clt-hotfix-9_0_x-0xx.gz 6. Mark the hotfix script as executable with the command: chmod a+x clt-hotfix-9_0_x-0xx 7. Execute the hotfix script:./clt-hotfix-9_0_4-002 i 8. Reboot the appliance. 9. Repeat steps 1-7 on slave node (if applicable). The hotfix script will perform certain actions such as the following: Backs up existing files. Replaces files with updated ones containing the fix. Restarts snmp and servicemgr services. To restore to the previous state: If you wish to restore the appliance to the state it was in before applying the hotfix, run the following steps, replacing the examples with the actual file name for the hotfix: 1. Log in to the appliance, or to the master node of a pair, via SSH or serial connection as root. 2. Change directory with the command: cd /var/lib/aventail/avp/rollback 3. Uncompress the rollback script with the command: gzip -d clt-hotfix-9_0_x-0xx.0.0.gz 4. Run the rollback script with the command:./clt-hotfix-9_0_x-0xx-rollback1.0.0 i 5. Reboot the appliance. 6. Repeat steps 1-5 on slave node (if applicable). A note about licensing requirements: The licensing scheme for the E-Class SRA EX-Series changed in version 9.0.x. If you are upgrading from version 8.8 or 8.9 to a later version, you must obtain a new license. 2

3 Obtaining the Update File from MySonicWALL The next step is to obtain the update file and copy it to the file system of your local computer: 1. In your Web browser, go to and log in with your username and password. 2. In the Downloads area, select your EX-Series software type from the drop-down list. 3. In the Available Software list, select the firmware item that corresponds to your appliance. You ll be prompted to download a file named <part number>_upgrade-<n>_<n>_<n>_<three-digit build number>.bin file to your local computer. Verifying the Downloaded Update File To make sure that the update was successfully transferred to your local computer, compare its checksum against the MD5 checksum information displayed on MySonicWALL. To verify the MD5 checksum of the upgrade file on a PC, use a Windows- or Java-based utility. Microsoft, for example, offers an unsupported command-line utility on their site named File Checksum Integrity Verifier (FCIV). Follow these steps to compare checksums using this utility: 1. At the DOS command prompt, type the following, which returns a checksum for the downloaded file: fciv <upgrade_filename>.bin 2. Compare the result against the MD5 checksum displayed on MySonicWALL. If they match, you can safely continue with your update. If they differ, try the download again and compare the resulting checksums. If they still don t match, contact Technical Support. To verify the MD5 checksum directly on your SonicWALL Aventail appliance, type the following command to see the checksum for the downloaded file: md5sum <upgrade_filename>.bin Installing the Update This section outlines the process of updating your system. Backing Up Your Current Configuration Before updating, you can back up the current configuration data from your appliance using the export feature in AMC. This step is optional, but recommended. 1. From the main AMC navigation menu, click Maintenance. 2. In the System configuration area, click Import/Export. 3. Click the Export button. A File Download dialog box prompts you to open the.aea file or save it to your hard drive. Note: On Windows operating systems, Internet Explorer may block the download of the.aea file. To work around this, click the information bar that appears beneath the Internet Explorer Address box, and then click Download File. 4. Click Save, browse to the correct directory on your hard drive, and then save the.aea file. 5. Click OK on the Export Configuration page to return to the Import/Export page. 3

4 Installing the Update File Next, install the update through AMC. 2. In the System software updates area, click Update. 3. If you have not already downloaded the update file (as described above in Obtaining the Update File from mysonicwall.com ), click the mysonicwall.com link and log in to download the appropriate update file to your local file system. 4. Type the path of the update file or click Browse to locate it. 5. Click Install Update. This step may take several minutes, depending on the network connection speed. After the file upload process is complete, the update is automatically installed on the appliance. You cannot cancel this installation process. The appliance automatically restarts when the installation process is complete. Restoring a Configuration If the installation of the update file is interrupted or fails, restore a saved configuration (creating a backup, as described above in Backing Up Your Current Configuration, is highly recommended). To restore a configuration: 2. In the System configuration area, click Import/Export. 3. In the File name box, type the path of the appropriate file (<appliance_name>-<date>-<nnn>.aea), or click Browse to locate it. 4. Click Import. To activate the imported configuration, you must apply changes. Rolling Back to a Previous Version From AMC, you can undo the most recent update installed on the system. If you experience problems after completing an update, you may want to use this feature to roll back to a known state. Each time you roll back the software image, it removes the most recent system update and restores the version that existed just prior to the update. CAUTION: If you have made any configuration changes since updating the system, rolling back the software image will erase these changes. 2. In the System configuration area, click Rollback. 3. To roll back to the version displayed on the Rollback page, click OK. After the rollback process is complete, the appliance automatically restarts and applies the changes. 4. After the appliance restarts, verify the new version number in the bottom-left corner of the AMC home page. Note: To roll back the version on a cluster, you must follow the steps above on both nodes, beginning with the master node. Verifying the Update After installing the update, verify the current version number in AMC. To verify the current version number: 5. Log in to AMC. 6. From the main navigation menu, click System Status and make sure that the update succeeded by verifying that the Version number is: <n>.<n>.<n>-<three-digit build number> For more information on managing a cluster, see the Installation and Administration Guide. 4

5 Updating a Clustered Pair To update the Aventail software in a cluster environment, you must install the update file and import the license file on each node of the cluster. The order in which you update the nodes in the cluster is very important: begin the process with the master node, and then proceed to the slave node. There may be some disruption to service when performing the update, so you should schedule it during a maintenance window. Be sure to match the serial number to the authentication code on mysonicwall.com for each appliance; you can check the serial number of the appliance in the lower-left corner of any AMC page. For more information on managing a cluster, see the Installation and Administration Guide. To update a cluster: 1. Log in to AMC and verify which node is the master. For more information, see Monitoring a Cluster in the Installation and Administration Guide. 2. Log in to AMC on the master node and then, from the main navigation menu in AMC, click Maintenance. 3. In the System Configuration area, click Update. 4. If you have not already downloaded the update file (as described above in Obtaining the Update File from mysonicwall.com ), click the mysonicwall.com link and log in to download the appropriate update file to your local file system. 5. Type the path of the update file or click Browse to locate it. 6. On the second node click Maintenance in the main navigation menu in AMC. 7. In the System software updates area, click Update. 8. Type the path of the update file or click Browse to locate it. 9. Click Install Update. A file upload status indicator appears. If necessary, you can stop the upload process by clicking Cancel. While the master node is updating, the slave node continues servicing requests. When the update to the master node completes and the master comes back online, it notices that the slave node s version differs from its own. It then stops the services on the slave node and services all incoming requests itself. 10. Log in to AMC on the slave node and then, on the AMC Home page, click Update. 11. Type the path of the update file or click Browse to locate it. 12. Click Install Update. A file upload status indicator appears. If necessary, you can stop the upload process by clicking Cancel. When the update to the slave node completes and the slave node comes back online, it rejoins the cluster and is synchronized with the master node. The load balancer is then aware that both nodes are available to service requests. 13. Make sure that the update succeeded by verifying in AMC on both nodes that the Version number is <n>.<n>.<n>-<three-digit build number>. Last updated: 10/5/2009 5