> Source: [sk181606](https://support.checkpoint.com/results/sk/sk181606)

# sk181606 - Cloud Firewall Clusters  upgrade using Central Deployment Tool

| Property | Value |
|----------|-------|
| Solution ID | sk181606 |
| Date Created | 2023-11-02 |
| Last Modified | 2026-04-29 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |
| Platform | AWS, Azure, GCP |

## Solution

Overview
--------

The Central Deployment Tool (CDT) runs on Security Management Servers and Multi-Domain Security Management Servers running Gaia OS.  

The CDT integration with Cloud Firewall enables upgrading the Cluster members' connectivity without downtime. To avoid downtime, it is required to make sure that all cloud operations, depending on the platform, as part of the failover process are done (for example, update route table and set Cluster IP).

Prerequisites
-------------

1. CDT (Central Deployment Tool), version 1.9.8 and higher, is installed on the Security Management or Multi-Domain Security Management Server.
2. For Hotfix/Jumbo Hotfix package installation, image build 1475 and above is required.  
   To check the image build, run on each cluster member:  
   `cat /etc/cloud-version.json`  
   For example:  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk181606/build202312170922091.jpg)
3. Public Cloud Cluster members are configured correctly in SmartConsole and are in stable mode - **ACTIVE / STANBY** .  

#### Note: for more information regarding CDT refer to [Central Deployment Tool (CDT) Administration Guide](https://sc1.checkpoint.com/documents/CDT/Unified/Topics/Introduction-to-CDT.htm).

<br />

### Connectivity Upgrade procedure for Hotfix installation on Cloud Firewall Cluster solutions

1. Move the Hotfix/Jumbo Hotfix package for the required Cluster members version to the Security Management Server or the Multi-Domain Management Server (MDS).
2. Create a deployment plan for the Hotfix installation with these operations:
   1. Import the Hotfix package.
   2. Install the Hotfix package.
   3. Use \<connectivityupgrade value="true" /\> under the plan settings.  

      For example:  
      `<?xml version="1.0" encoding="UTF-8"?>`  
      `<CDT_Deployment_Plan>`  
      ` <plan_settings>`  
      ` <name value="jumbo installation plan" />`  
      ` <description value="jumbo installation on cloud cluster"/>`  
      ` <update_cpuse value="true" />`  
      ` <connectivityupgrade value="true" />`  
      ` <Logging FileLevel="DEBUG" ScreenLevel="NORMAL" SyslogLevel="NONE" Colors="false"/>`  
      ` </plan_settings>`  

      ` <import_package path="/home/admin/pkgs/Check_Point_R81_10_JUMBO_HF_MAIN_Bundle_T110_FULL.tar"/>`  
      ` <install_package path="/home/admin/pkgs/Check_Point_R81_10_JUMBO_HF_MAIN_Bundle_T110_FULL.tar" />`  
      ` <log level="NORMAL" value="Done." />`  

      `</CDT_Deployment_Plan>`  

      **Important:** Make sure the path in the deployment plan matches the location on the machine.  

3. For Multi-Domain Management Server, run: `mdsenv <CMA_IP>` to change to the CMA level.
4. Create candidates list:  
   `/opt/CPcdt/CentralDeploymentTool -generate -candidates=<path to candidates file> -deploymentplan=<path to deployment plan>`  
   (For Multi-Domain Management Server add: `-server=<CMA_IP>`)
5. Execute the deployment plan:  
   `/opt/CPcdt/CentralDeploymentTool -execute -candidates=<path to candidates file> -deploymentplan=<path to deployment plan>`  
   (For Multi-Domain Management Server add: `-server=<CMA_IP>`)

### Connectivity Upgrade procedure for Cloud Firewall Cluster solutions version upgrade

1. Move the upgrade package you want to install to the Security Management Server or the Multi-Domain Management Server.  
   See [In-Place Upgrade packages for Cloud Firewall](https://support.checkpoint.com/results/sk/sk177714) for upgrade packages.
2. Create a deployment plan for the upgrade with these operations:
   1. Import the upgrade package.
   2. Verify the upgrade package.
   3. Install the upgrade package.
   4. Use \<connectivityupgrade value="true" /\> under the plan settings.  

      For example:  
      `<?xml version="1.0" encoding="UTF-8"?>`  
      `<CDT_Deployment_Plan>`  
      ` <plan_settings>`  
      ` <name value="upgrade version plan" />`  
      ` <description value="upgrade version for cloud cluster"/>`  
      ` <update_cpuse value="true" />`  
      ` <connectivityupgrade value="true" />`  
      ` <Logging FileLevel="DEBUG" ScreenLevel="NORMAL" SyslogLevel="NONE" Colors="false"/>`  
      ` </plan_settings>`  

      ` <import_package path="/home/admin/pkgs/aio_Check_Point_ignis_main_T335_R81.10_Gaia_3_10_Install_and_Upgrade.tar"/>`  
      ` <verify_package path="/home/admin/pkgs/aio_Check_Point_ignis_main_T335_R81.10_Gaia_3_10_Install_and_Upgrade.tar" />`  
      ` <install_package path="/home/admin/pkgs/aio_Check_Point_ignis_main_T335_R81.10_Gaia_3_10_Install_and_Upgrade.tar" />`  
      ` <log level="NORMAL" value="Done." />`  

      `</CDT_Deployment_Plan>`  

      **Important:** Make sure the path in the deployment plan matches the location on the machine.  

3. For Multi-Domain Management Server, run: `mdsenv <CMA_IP>` to change to CMA level.
4. Create candidates list:  
   `/opt/CPcdt/CentralDeploymentTool -generate -candidates=<path to candidates file> -deploymentplan=<path to deployment plan>`  
   (For Multi-Domain Server add: `-server=<CMA_IP>`)  

5. Execute the deployment plan:  
   `/opt/CPcdt/CentralDeploymentTool -execute -candidates=<path to candidates file> -deploymentplan=<path to deployment plan>`  
   (For Multi-Domain Management Server add: `-server=<CMA_IP>`)

Limitations
-----------

1. See Central Deployment Tool (CDT) limitations in [sk111158](https://support.checkpoint.com/results/sk/sk111158).
2. Make sure the cluster members are stable before CDT starts the upgrade to avoid a failover.
3. Cluster upgrade is not supported for the AWS Geo cluster in Active/Active mode. See [sk180306](https://support.checkpoint.com/results/sk/sk180306) for the migration process to R81.20 Cross AZ Cluster.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content