sk135172 - Upgrade Tools package

Upgrade Tools package

Product

Multi-Domain Security Management

Version

R81 (EOS), R81.10 (EOS), R81.20, R82, R82.10

OS

Gaia

Last Modified

2026-03-28

Solution

Introduction

For versions R80.20 and higher, Check Point introduced a new upgrade mechanism for the Security Management Server, Multi-Domain Security Management Server, and Standalone Server.

The new upgrade mechanism provides several benefits:

Includes updatable code that allows faster release of upgrade-related features and fixes.
Management Servers with online access to the Check Point cloud will be able to fetch the latest available upgrade packages automatically, eliminating the need for an administrator to download and import upgrade packages manually.
New dynamic upgrade report (in HTML format) that shows the current status while the upgrade is in progress and the final report once the upgrade is done.

Upgrade Paths Using the New Upgrade Mechanism

Below is the matrix of source versions, from which you can upgrade (appear in the left-most column) and target versions, to which you can upgrade (appear in other columns) using the new upgrade mechanism. In addition, refer to sk113113.


	← Target Version →
Source Version ↓	R82.10	R82	R81.20	R81.10	R81
R82	Yes	No	No	No	No
R81.20	Yes	Yes	No	No	No
R81.10	Yes	Yes	Yes	No	No
R81	Yes	Yes	Yes	Yes	No

Legend:


Yes	This upgrade path is supported.
No	This upgrade path is not supported (the source version is higher than or equal to the target version).
	This upgrade path is not handled by the "new upgrade", but by another mechanism.

In some cases, updating the Upgrade Tools manually to the latest is required to perform the upgrade. The cases are:

Poor Internet connectivity between the Management Server and Check Point Download Center.
The Management Server is not connected to the Internet.
The setting to perform an automatic update of the CPUSE Agent is disabled.

(see the CPUSE Administration Guide).

To install the latest version of the Check Point Upgrade Tools Package manually:

Make sure your Deployment Agent is up-to-date.

See the CPUSE Administration Guide.

Download the applicable Check Point Upgrade Tools Package from the table below:


Target Version (to which you upgrade)	Download Link
R82.10	(TGZ)
R82	(TGZ)
R81.20	(TGZ)
R81.10	(TGZ)
R81	(TGZ)

IMPORTANT NOTES:

Do NOT manually uninstall the current RPM package.

The installation of the newer package automatically removes the current package.
Do NOT open the downloaded TGZ file and do NOT manually install the newer RPM package.

You must install the newer TGZ package only with CPUSE.
If CPUSE fails to install this package, contact Check Point Support for assistance.

Make sure the hash checksum of the downloaded package is the same as appears on its download page in the fields MD5, SHA1, or SHA256.


Hash	Expert Mode Command on Gaia OS	PowerShell Command on Windows OS
MD5	`md5sum <Name of TGZ File>`	`Get-FileHash <Path>\<Name of TGZ File> -Algorithm MD5`
SHA1	`sha1sum <Name of TGZ File>`	`Get-FileHash <Path>\<Name of TGZ File> -Algorithm SHA1`
SHA256	`sha256sum <Name of TGZ File>`	`Get-FileHash <Path>\<Name of TGZ File> -Algorithm SHA256`

Import, Verify, and Install the Check Point Upgrade Tools Package on the Management Server - in Gaia Portal or in Gaia Clish.

See the CPUSE Administration Guide.

Make sure the package is installed on the Management Server.

Option 1:

Run in Expert mode:

$MDS_FWDIR/scripts/migrate_server print_installed_tools -v <Version>

<Version> is the target version to which you plan to upgrade. One of these:

R82.10, R82, R81.20, R81.10

Example:

[Expert@MyMgmt]# $MDS_FWDIR/scripts/migrate_server print_installed_tools -v R82.10 The build number of the Upgrade Tools package for version R82.10 is: 999001080.

The output must show the same build number you see in the name of the downloaded TGZ package.

Option 2:

Run in Expert mode:

cpprod_util CPPROD_GetValue CPupgrade-tools-<Version> BuildNumber 1

<Version> is the target version to which you plan to upgrade. One of these:

R82.10, R82, R81.20, R81.10

Example:

[Expert@MyMgmt]# cpprod_util CPPROD_GetValue CPupgrade-tools-R81.20 BuildNumber 1 997000570 [Expert@MyMgmt]#

The output must show the same build number you see in the name of the downloaded TGZ package.

Important - Output of the "cpinfo -y all" command does not show the Upgrade Tools Package because it is not an update / hotfix package.

Note for the Advanced Upgrade

If you encountered one of the "Symptoms" of sk164932, use the "-skip_upgrade_tools_check" flag during any migration operation, after you update the Upgrade Tools package to the latest version:


Command	Syntax / Example
Verify	Syntax	`$MDS_FWDIR/scripts/migrate_server verify -skip_upgrade_tools_check -v <Target Version>` `<Target Version>` is the target version, to which you upgrade. One of these target versions: R81.20, R81.10, R81, R80.40, R80.30, R80.20.M2, R80.20
Example	`[Expert@MyMgmt:0]# $MDS_FWDIR/scripts/migrate_server verify -skip_upgrade_tools_check -v R81.20`
Note	The "`migrate_server verify`" command does not affect the current operation of the Management Server. This command does not stop any processes. This command runs Java code that consumes some CPU for several minutes, depending on the number of configured Domains and the size of their databases.
Export	Syntax	`$MDS_FWDIR/scripts/migrate_server export -skip_upgrade_tools_check -v <Target Version> <Path and Name of the Export TGZ file>`
Example	`[Expert@MyMgmt:0]# $MDS_FWDIR/scripts/migrate_server export -skip_upgrade_tools_check -v R81.20 /var/log/Export_for_Upgrade_from_R8020_to_R8120.tgz`
Note	The "`migrate_server export`" command requires closing all SmartConsole clients and stopping all Check Point services on the Management Server (`cpstop`).
Import	Syntax	`$MDS_FWDIR/scripts/migrate_server import -skip_upgrade_tools_check -v <Target Version> <Path and Name of the Exported TGZ file>`
Example	`[Expert@HostName:0]# $MDS_FWDIR/scripts/migrate_server import -skip_upgrade_tools_check -v R81.20 /var/log/Export_for_Upgrade_from_R8020_to_R8120.tgz`
Note	The "`migrate_server import`" command requires closing all SmartConsole clients and stopping all Check Point services on the Management Server (`cpstop`).

Notes:

Refer to sk163814 - Security Management Upgrade troubleshooting (new upgrade process).
Schedule a maintenance window. The "migrate_server" command may restart all Check Point services on your Management Server.
On a Multi-Domain Security Management Server, the "migrate_server" command covers all Domains, as opposed to the previous "migrate" script that only collected the local Domain to which you were currently logged in.