topic Re: Migrate import fails in Firewall and Security Management

Migrate import fails

Jim_Fessler — Tue, 22 Mar 2016 13:14:50 GMT

I have created a migrate file for a R77.30 SmartCenter then imported it to my server running R80.. When attempting to start SmartConsole I get a "General Error". I then started SmartUpdate "SmartDistributor" which states it cannot connect. The update error log contains:

Tue Mar 22 00:58:12 2016 Following Web Service call took 52066 ms

/opt/CPsuite-R80/fw1/lib/libngm_services.so(_ZN3ngm35FwmSvcRemoteServiceSoapBindingProxy14upgradeCommandEPNS_19fwm__upgradeCommandEPNS_27fwm__upgradeCommandResponseE+0x36) [0x76b5576c]

/opt/CPsuite-R80/fw1/bin/cpdb(_ZN17CUpgCPMIInterface18RunUpgradeCommandsEv+0x419) [0x806b3d9]

/opt/CPsuite-R80/fw1/bin/cpdb(_ZN17CUpgCPMIInterface4SaveER5CCPDb+0x32e) [0x8071dde]

/opt/CPsuite-R80/fw1/bin/cpdb(_ZN11CUpgradeMgr17PerformCPMIUpdateER5CCPDbRK20CUpgradeInstructions+0x10c) [0x8075abc]

/opt/CPsuite-R80/fw1/bin/cpdb(_ZN11CUpgradeMgr14PerformUpgradeER20CUpgradeInstructions+0x3c9) [0x80771b9]

/opt/CPsuite-R80/fw1/bin/cpdb(_ZN9CCPDBMain3RunEv+0x976) [0x80800c6]

/opt/CPsuite-R80/fw1/bin/cpdb(main+0x86) [0x8082bd6]

/lib/libc.so.6(__libc_start_main+0xdc) [0x751bfdec]

/opt/CPsuite-R80/fw1/bin/cpdb [0x8053941]

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:12] [CUpgCPMIInterface::Save] ERROR: Failed to update some of the tables. The resulting DB will be corrupted.

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:12] [CUpgradeMgr::PerformCPMIUpdate] WARNING: Failed to save the DB.

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:12] CNgmProxyImpl::init: this = 0x19d48b20

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:13] CNgmProxyImpl::init: this = 0xbef66b8

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:13] CCkpRoboDBLoader::getInstance> Entering

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:13] CCkpRoboDBLoader::closeAllDB()> Entering

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:13] CCkpRoboDBLoader::getInstance> Entering

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:13] CCkpRoboDBLoader::closeAllDB()> Entering

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:14]

[CUpgradeMgr::PerformUpgrade] ERROR: Failed to perform cpmi update

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:15] [writeUpgradeResult] The path to result file is: '/opt/CPsuite-R80/fw1/log/upgrade_result'

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:15] [writeUpgradeResult] Wrote the following to the result file: '80004005'

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:15] [CCPDBMain::Run] cpdb ended with result '0x80004005' (Unspecified error).

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:15] [CCPDBMain::Run] Setting upgrade phase in CPM Server

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:15] [CCPDBMain::setNgmUpgradeStatus] Setting upgrade phase for domain 41e821a0-3720-11e3-aa6e-0800200c9fde to post_objects

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:19] [CCPDBMain::Run] Setting upgrade phase in CPM Server

[ 5694 1944315600]@S4ITR80[22 Mar 0:58:20] [CCPDBMain::setNgmUpgradeStatus] Setting upgrade phase for domain 41e821a0-3720-11e3-aa6e-0800200c9fde to finalize_domain

[ 5694 1944315600]@S4ITR80[22 Mar 1:05:38] [main] FATAL ERROR: Operation failed.

[ 5694 1944315600]@S4ITR80[22 Mar 1:05:38] [UpgradeToRenaissanceInfra::shutdownJavaUpgradeServer] Sending shutdown request to java upgrade server

The complete file is not posted as it is very big and contains information about a customers configuration.

The file upgrade_results contains 80004005

Server is a Pentiem 4 core 4gb memory.

What would be the next steps to take to find the problem.

Re: Migrate import fails

Timothy_Hall — Tue, 22 Mar 2016 13:23:41 GMT

Did you use the migrate binary from the target version (R80) on the R77.30 SMS to take the migrate export? Using the migrate binary built into R77.30 for import into R80 will not work. The latest migrate binary for R80 (dated 3/18/2016) that you'll need to use is here:

http://downloads.checkpoint.com/dc/filedetails.htm?ID=46651&product=R80&version=R80&os=GAiA&appID=CPEA-EVAL-R80-MGMT

Also if doing this in VMWare with a relatively small disk allocated, you'll almost certainly need to reallocate some disk space from the backup/upgrade partition into the Logs partition at Gaia load time to ensure you don't run out of disk space when attempting the import.

My book "Max Power: Check Point Firewall Performance Optimization"

now available via http://maxpowerfirewalls.com.

Re: Migrate import fails

Jim_Fessler — Tue, 22 Mar 2016 13:30:24 GMT

I used the upgrade tools for R80 dated 2/23/16.

Not a fan of VM - dedicated machine running GAIA

Re: Migrate import fails

Timothy_Hall — Tue, 22 Mar 2016 13:32:38 GMT

May want to give the latest version of EA code (3/18/2016) a try on both your new server and the migrate utility. This is EA after all...

My book "Max Power: Check Point Firewall Performance Optimization"

now available via http://maxpowerfirewalls.com.

Re: Migrate import fails

Eyal_Balla — Tue, 22 Mar 2016 16:21:29 GMT

Jim,

was this take given to you by EA?

Re: Migrate import fails

Timothy_Hall — Tue, 22 Mar 2016 16:29:17 GMT

It is available from the Early Availability R80 download section in the User Center, I don't remember seeing an email notification for this latest update. Log in to the User Center then try to go here, you'll need to have been previously enrolled in the R80 EA to successfully download:

http://downloads.checkpoint.com/dc/filedetails.htm?ID=46650&product=R80&version=R80&os=GAiA&appID=CPEA-EVAL-R80-MGMT

My book "Max Power: Check Point Firewall Performance Optimization"

now available via http://maxpowerfirewalls.com.

Re: Migrate import fails

Jim_Fessler — Tue, 22 Mar 2016 20:50:58 GMT

The software was downloaded from the EA site.

Re: Migrate import fails

Gil_Amar — Wed, 23 Mar 2016 12:11:24 GMT

Hi Jim,

I'm Gilad from the EA group in Check Point.

Can you please contact me at gila@checkpoint.com in order to solve this issue?

Thanks,

Gilad

Re: Migrate import fails

Cyrill_Kaspar — Wed, 25 May 2016 07:50:32 GMT

Hi all

Just spent the last week trying to import the R77.30 exported database into freshly set-up R80 installation without success though pre_upgrade_verifier and of course the Check Point R80 upgrade simulation service stated that an upgrade should be possible...

On R77.30 I used all available migration tools (installed, pre-r80 and r80) to generate the export files.

On R80 I also used all three versions of migration tools with each of the three export files.

Now, after many more grey hairs I opend an SR and was told to ask our CCSP to solve the problem.

I thought Check Point would be more interested to help in such a case as they seem eager to push R80.

Regards

Cyrill

Re: Migrate import fails

Wed, 25 May 2016 08:53:50 GMT

Hi Cyrill,

I'm Matan from Checkpoint support,

Please contact me at matanb@checkpoint.com and I will assist you.

Thanks,

Matan

Re: Migrate import fails

Jim_Fessler — Tue, 07 Jun 2016 19:10:39 GMT

The migrate import is finally done. Support found some strange error I won't even attempt to explain. They then informed me they used my uploaded migrate file and it worked. So I performed a clean install as instructed and did the migrate import - FAILS.

I then did another clean install T109 both times. Once the install was complete and rebooted I logged in and ran TOP - All 4 CPU were at 95+%. and were still at 95% after four hours so I waited until the next day. In the morning the usage was <10% so I ran migrate import. Success, however the import ran 4+ hours.

Lab machine Dell Inspiron 3252 4 core 4gb.

It appears patience is now required - which I have little of.

I could not have done it without Check Point support - Thanks guys.

Re: Migrate import fails

Yonathan_Kazans — Thu, 09 Jun 2016 18:02:19 GMT

If you got a lab machine - why not to try clean install + migrate db exactly after the migration failed first time.

Anywhere I'm happy that it a successful one

Re: Migrate import fails

Rafael_Apolinar — Tue, 28 Jun 2016 18:55:36 GMT

Same problem here, used the R80 migration tool on my R77.30 Management server, exported the backup, imported on the R80 Server, tried to import, waited 20 minutes and got an error

Re: Migrate import fails

Cyrill_Kaspar — Thu, 14 Jul 2016 14:34:14 GMT

Hi all

Just like to thank CP support for their effort to solve my problem.

They even imported our R77.30 export files to their VM environment and tried the same steps I executed but surprisingly R80 migrate import worked in their environment...

The suspect was Unicode characters in the DB.

I had already tried the SK for encoding problems (Check_Point_R80_Encoding_Detection_sk109795) with the command "export CHECKPOINT_DB_ENCODING=CP1026" before but with no success.

I found three host objects in SmartDashboard (searching the "Object List" tab) which had a character like "ä", "ö" or "ü" in their comment.

But when I wanted to edit the objects, the comment field showed empty!

So I went though the database with GuiDBedit eliminating the characters in the comment string of the host object.

And guess what: migrate export from R77.30 and migrate import to new R80 server was successful!

Since then administrators have a lot of fun working with R80 at the same time...

One thing you should possibly be aware of: CP changed some service/protocol definitions in R80 and in some of our rules the obsolete service definitions were not correctly replaced and were missing after we pushed the policies to the gateways. ldap_tcp, winframe, web_proxy, tcp_high_ports or snmp_trap were some of them. Fortunately we had little trouble solving the situation. Very helpful was CPs "Web Visualization Tool" we used before migration...

Have fun

Cyrill