topic Re: Issue during migrate old cluster to new on in Firewall and Security Management

Issue during migrate old cluster to new on

Kriminal73 — Wed, 24 Jan 2024 21:13:01 GMT

Hi to all,
I would like to replace my two Check Point 5100 with the 6200P I just purchased.
I installed the first 6200P, configured the network interfaces, connected the network cables of the standby node to the right interfaces, performed the SIC with management, modifying the cluster hardware from 5000 to 6000 (same R.81.20) and installed the policies.
Install policies works only without check mark "If installation fail do not install on that cluster" otherwise the installation fail.
The error refers some problem on the network interfaces that I can't identify, seem well configured.
I noticed that the "Sync" network interface ("Sync" on the 6200 and "eth1.7" on the 5100) is not marked as a trust interface on the 6200.
Could it be due to this? If so, how do I make it become a "trust"?
Thank you.
Regards

Re: Issue during migrate old cluster to new on

the_rock — Wed, 24 Jan 2024 22:57:01 GMT

Great process to follow.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/td-p/69216

Re: Issue during migrate old cluster to new on

Oliver_Fink — Thu, 25 Jan 2024 14:24:46 GMT

Did you change the topology in the cluster object (and install policy after that)? You have to do this if interface names change (e.g. "Sync" vs "eth1.7").

Re: Issue during migrate old cluster to new on

Kriminal73 — Thu, 25 Jan 2024 14:42:33 GMT

Yes, the topology was changed and the policies were installed without the "if fails" flag.

I'll have to try power off the working 5100 as suggested by the previous post, but I don't want to do it remotely.

I'll try it as soon as I get back to the office.

Thank you.

Re: Issue during migrate old cluster to new on

the_rock — Thu, 25 Jan 2024 15:01:17 GMT

I see what @Oliver_Fink is saying, topology has to match, make sure to do "get interfaces WITHOUT topology".

Andy

Re: Issue during migrate old cluster to new on

Kriminal73 — Thu, 25 Jan 2024 15:45:22 GMT

Done.

Smart console tells me that all ports except the sync port have been changed (pencil icon).

I checked them one by one and didn't notice any changes.

After that I installed the policies with the flag "if fails.." with same results, if I remove the flag "if fails.." the policies are installed.

Re: Issue during migrate old cluster to new on

the_rock — Thu, 25 Jan 2024 18:15:16 GMT

Can you verify interfaces do match for new cluster?

Andy

Re: Issue during migrate old cluster to new on

CheckPointerXL — Thu, 08 Feb 2024 21:40:17 GMT

Is the eth1.7 the lowest vlan on that trunk?

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ClusterXL_AdminGuide/Topics-CXLG/Synchronization-Network.htm?TocPath=Synchronizing%20Connections%20in%20the%20Cluster%7C_____1

Re: Issue during migrate old cluster to new on

Kriminal73 — Fri, 09 Feb 2024 07:33:40 GMT

After powered off the 5100 the 6200P works like a charm without downtime.

No issue after the configuration of second 6200P, sync port it's now trusted and cluster xl working.

Thank you.