topic Replace and migrate in Firewall and Security Management

Replace and migrate

Ginoogle — Sun, 07 Feb 2021 12:55:41 GMT

Hi ,

I have a little question.

I need to replace clusterxl with 2 5600 running on r77,30 in new 6600 with r80.40.

The problem is that is not possible to stop the firewall service.

The management run on vmware.

Which is the more easy procedure with minor impact on the gateway so that in case the rollback i need only an restart of old environment?

The interface ip is not possible to change

Thank a lot

Re: Replace and migrate

PhoneBoy — Sun, 07 Feb 2021 18:03:50 GMT

There’s really not a way to do this without some sort of minimal outage.
On the policy side, you can (temporarily) disable the “Drop out of state” properties to minimize some of the impact.
You can generally swap in/out the hardware (with the accompanying restart) easily enough.

Where I see some possible complexity is in either defining a new cluster (with duplicate IPs to the previous) or updating the existing cluster object configuration to match the new hardware.
I’d recommend searching the community as I know others have had to perform similar types of upgrades.

Re: Replace and migrate

MartinTzvetanov — Mon, 08 Feb 2021 12:59:50 GMT

I do it the following path:

1) replace the standby 5600 with a new 6600

2) initiate SIC to 6600 and change the version of the cluster to R80.40

3) Install a policy and remove the tick on install on all members - 6600 will become a part of the cluster but will be in ready, 5600 will proceed to be the active one

4) in the most unstressed time do a cpstop of the 5600. 6600 will start processing traffic

5) replace 5600 with the new 6600, initiate SIC and push the policy and mark on install on all members