You have a production implementation of Management High Availability, at version VPN-1 NG with Application Intelligence R55. You must upgrade your two SmartCenter Servers to VPN-1 NGX.
What is the correct procedure?
A.
1. Synchronize the two SmartCenter Servers.
2. Upgrade the secondary SmartCenter Server.
3. Upgrade the primary SmartCenter Server.
4. Configure both SmartCenter Server host objects version to VPN-1 NGX.
5. Synchronize the Servers again.
B.
1. Synchronize the two SmartCenter Servers.
2. Perform an advanced upgrade on the primary SmartCenter Server.
3. Upgrade the secondary SmartCenter Server.
4. Configure both SmartCenter Server host objects to version VPN-1 NGX.
5. Synchronize the Servers again.
C.
1. Perform an advanced upgrade on the primary SmartCenter Server.
2. Configure the primary SmartCenter Server host object to version VPN-1 NGX.
3. Synchronize the primary with the secondary SmartCenter Server.
4. Upgrade the secondary SmartCenter Server.
5. Configure the secondary SmartCenter Server host object to version VPN-1 NGX.
6. Synchronize the Servers again.
D.
1. Synchronize the two SmartCenter Servers.
2. Perform an advanced upgrade on the primary SmartCenter Server.
3. Configure the primary SmartCenter Server host object to version VPN-1 NGX.
4. Synchronize the two Servers again.
5. Upgrade the secondary SmartCenter Server.
6. Configure the secondary SmartCenter Server host object to version VPN-1 NGX.
7. Synchronize the Servers again.
The answer is A.
There is no need to do an Advnaced Upgrade – this is only required if we are migrating to a new server – it does not specify this in the question. Also, in HA you should upgrade the backup server first.
Upgrading a SmartCenter High AvailabilityDeployment
To upgrade a SmartCenter server high availability deployment:
1. Before you perform the Upgrade process, synchronize all the SmartCenter servers (select Policy > Management High Availability).
2. Perform the Upgrade process on both SmartCenter servers (refer to the relevant upgrade process).
3. Using the SmartDashboard GUI client, connect to one of the SmartCenter servers.
4. In the General page of each of the SmartCenter server’s Gateway Properties window, set the correct Check Point Products Version. This can also be done by clicking the Get Version button in the specific objects’ properties page.
5. Once again, synchronize all the SmartCenter servers (select Policy > Management High Availability).
6. Repeat steps 3 and 4 for each additional SmartCenter server.
No, the right answer is “B” because CheckPoint always recommend to export configuration before upgrade and SMS is not contain the whole configuration of Primary Management Server.
By definition, an “Advanced Upgrade” requires another machine: you build a new system on that new machine, copy the config over from the old machine, the turn off the old machine. Nowhere in “B” does it mention using another machine, it says to “Perform an advanced upgrade on the primary SmartCenter Server” which is a complete contradiction.
For that reason, I’d have to reject answers B, C and D, and go with “A”