topic Re: How to migrate Checpoint appliance R80.30 to R81.10 in Firewall and Security Management

How to migrate Checpoint appliance R80.30 to R81.10

TSOL — Wed, 21 Sep 2022 09:00:34 GMT

Hello

We need to migrate Checkpoint appliances 5600(R80.30) to 6000 series(R81.10).

We will plan to add new settings when we switch to new equipment (6000 series).
So I'm thinking of using the migrate_server command on the 5600 to extract the configuration.

When I checked migrate_server command,
I got information that when the "migrate_server" command is executed, "cpstop" occurs and the process stops. Is this information correct?
If the information is correct. we need to get the administers permission because company network will be affected.

The Checkpoint 5600 appluance is 1HA(ClusterXL), Standalone(no another management server ).

Re: How to migrate Checpoint appliance R80.30 to R81.10

PhoneBoy — Wed, 21 Sep 2022 11:16:25 GMT

migrate_server requires a cpstop, yes.

Re: How to migrate Checpoint appliance R80.30 to R81.10

G_W_Albrecht — Wed, 21 Sep 2022 14:10:01 GMT

The Management on the FW Cluster is not a good deployment - i would think about a deployment with SMS in VM !

Re: How to migrate Checpoint appliance R80.30 to R81.10

Oliver_Fink — Wed, 21 Sep 2022 15:34:14 GMT

I agree completely, Full HA Cluster is pain in the a… But keep in mind that a deployment with SMS in VM adds license costs.

Re: How to migrate Checpoint appliance R80.30 to R81.10

Oliver_Fink — Wed, 21 Sep 2022 15:33:19 GMT

I think you should do it during a maintenance window.

I somehow sure that you cannot use Multi-Version Cluster (MVC) during update because SMS is running on the gateways (Full HA Cluster).

The upgrade process in R81.10 Installation And Upgrade Guide follows "Upgrading Security Management Servers in Management High Availability from R80.20 and higher" on page 215 (redirected from page 423).

Such, I would expect a downtime during upgrade.