156-315.76 · Question #618
You want to upgrade a cluster with two members to R76. The Security Management Server and both members are version NGX R65, with the latest Hotfix Accumulator. What is the correct upgrade procedure?…
The correct answer is D. 2, 3, 1, 4. See the full explanation below for the reasoning.
Question
Options
- A3, 2, 1, 4
- B2, 4, 3, 1
- C1, 3, 2, 4
- D2, 3, 1, 4
How the community answered
(30 responses)- A3% (1)
- B17% (5)
- C7% (2)
- D73% (22)
Community Discussion
5
Nina C.Feb 13, 2026The answer is D, which means the order is: upgrade the Security Management Server first and reboot, then do the rolling cluster member upgrades one at a time, then update the version in the cluster object's General Properties, and finally reinstall the Security Policy. The management server has to go first because Check Point requires the SMS to be at the same version or higher than the gateways it manages, so you cannot push a valid policy to R76 gateways from an R65 SMS. Upgrading the members one at a time with cpstop keeps the cluster functional during the upgrade window, which is the whole point of having two members. You update the General Properties after the hardware is upgraded because that change tells SmartDashboard what feature set to expose, and reinstalling the policy last locks everything in and syncs the new version's rule compilation to the gateways. What tripped me up at first was thinking you had to update the cluster object before touching the gateways, but the object change is just a management-side setting, so it only makes sense after the actual gateways are already running the new version.
Samuel O.Feb 15, 2026That order is exactly right, and the only thing I would add from the field is that before you ever touch the SMS you want to snapshot your current policy package and export the database, because if the SMS upgrade rolls back for any reason you are in a nasty state where your backup gateways may still be running but you cannot push any policy changes until the management side is restored.
Samuel O.Feb 8, 2026Saw this exact sequence question on my attempt and almost talked myself into B because I kept thinking you need to push policy right after the management upgrade, but the logic clicked when I remembered the members are still running R65 at that point and the policy reinstall has to come last after you have updated the cluster object properties. The order in D is the one that actually maps to how these rolling upgrades work in production, management first then members one at a time with the cluster object change sandwiched before the final policy push.
Nina C.Feb 10, 2026The part that locked it in for me was realizing the cluster object update is what signals to the management server that the members finished upgrading, so if you push policy before that step you are essentially pushing to a cluster the management still thinks is on the old version.
Anjali D.Jan 27, 2026Okay so I initially went with A because my instinct was to get the cluster members sorted first before touching management, but then our group walked through it step by step and that falls apart fast. You have to upgrade the Security Management Server first (step 2) because a newer gateway version being managed by an older SMS is asking for trouble, and Check Point is pretty clear that management leads the upgrade order. Then you do the rolling member upgrade (step 3) with cpstop so the cluster stays functional during the process, then you update the version in the gateway-cluster object properties (step 1) to reflect reality in SmartDashboard, and finally you reinstall the policy (step 4) to make sure everything is consistent end to end. The reason A trips people up is that it flips steps 3 and 2, which would mean you are upgrading a member while the SMS is still on R65, and that mismatch is exactly the kind of thing that causes weird policy push failures. Does anyone in the group have lab notes from actually running this sequence, because I would love to see what the cpstop output looks like mid-upgrade?