topic Re: Firewall gateway migration activity in Firewall and Security Management

Firewall gateway migration activity

Sam472 — Thu, 29 May 2025 19:33:16 GMT

We are in process of a firewall migration activity replacing 5800 gateways to 9400 . Currently 5800 is running on R81 and 9400 is out of box R81.20 .

Want to know what will be the best approach to do this activity .

Below is my approach if any one can validate and guide will be helpful.

1. Pre configure the gateway with interface and routes and configuration same as old gateway .

2. In smart console from the existing cluster delete the old members gateway and add the new gateways establish SIC and get interfaces and push policy

Re: Firewall gateway migration activity

Sam472 — Fri, 30 May 2025 14:51:24 GMT

Any one reply to this to add to this we have already created new cluster with new gateway and tested out flow now we will add this gateway in the production cluster

Re: Firewall gateway migration activity

Lloyd_Braun — Fri, 30 May 2025 16:00:02 GMT

that should do it. you might inspect $FWDIR/boot/modules/fwkern.conf files to see if there are any relevant kernel parameter changes that were made in the old firewalls that you would still need in the new ones. Firewall Kernel Parameters

Re: Firewall gateway migration activity

Tal_Paz-Fridman — Fri, 30 May 2025 16:27:57 GMT

I also suggest using Prerequisites for Upgrading and Migrating of Security Gateways and Clusters - it includes a list of important files and folders

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Guide/Content/Topics-IUG/Prerequisites-for-Upgrading-and-Migrating-of-Security-Gateways-and-Clusters.htm

Re: Firewall gateway migration activity

the_rock — Fri, 30 May 2025 17:48:46 GMT

Just follow below. I must have done this at least 10 times, never an issue.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/m-p/69216#M5286

Re: Firewall gateway migration activity

Sam472 — Sun, 01 Jun 2025 03:37:22 GMT

I have followed this poa and it didn't work My old cluster was in R81 we deleted the old gateway objects and added the new gateway object which is in r81.20 and tried to install policy it failed saying cluster version miss match and cluster object was showing old r81 it was not getting updated to roll 81.20

Re: Firewall gateway migration activity

Sam472 — Sun, 01 Jun 2025 06:12:05 GMT

Hii as per the guides I read if our cluster is version 81 we removed r81 gateways from cluster and added new r81.20 gateways done sic pulled network topology and when we try to install policy cluster object is not getting updated to r81.20 its still showing old r81 and policy getting failed saying mvc error

Re: Firewall gateway migration activity

the_rock — Sun, 01 Jun 2025 11:56:19 GMT

Are you saying you tried that and it failed or you plan to do it that way?

Andy

Re: Firewall gateway migration activity

Sam472 — Sun, 01 Jun 2025 15:38:40 GMT

No I tried it and failed i was not able to install policy after adding new gateway in cluster it said mvc error it seems like r 81 not supports mvc

Re: Firewall gateway migration activity

_Val_ — Mon, 02 Jun 2025 10:17:27 GMT

You should be able to change the object version manually on the management side.

Re: Firewall gateway migration activity

the_rock — Mon, 02 Jun 2025 10:20:21 GMT

MVC was supported as of R80.40

Re: Firewall gateway migration activity

Sam472 — Mon, 02 Jun 2025 12:41:34 GMT

How to update even TAC was on call they were trying to update cluster object but not able to do and had to roll back as downtime was less

Re: Firewall gateway migration activity

the_rock — Mon, 02 Jun 2025 12:42:58 GMT

Im happy to try assist if you allow remote...Im in EST time zone, so Im sure we can figure something out, let me know.

Andy

Re: Firewall gateway migration activity

Sam472 — Mon, 02 Jun 2025 12:44:45 GMT

Ok but when we trying to install the policy cluster version was showing as r 81 it was not getting updated and was saying version error and policy getting failed in smartconsole after adding the new gateways I can see both the cluster and gateway object with r 81.20 but smartconsole it was still showing old r81

Re: Firewall gateway migration activity

the_rock — Mon, 02 Jun 2025 12:49:20 GMT

If you are allowed to do remote, Im happy to check for you. I have 45 mins now.

Andy

Re: Firewall gateway migration activity

Sam472 — Mon, 02 Jun 2025 13:36:21 GMT

Yes that will be really helpful messaged you let us know can we connect tommorow once

Re: Firewall gateway migration activity

the_rock — Mon, 02 Jun 2025 13:37:10 GMT

Just responded.

Re: Firewall gateway migration activity

PhoneBoy — Mon, 02 Jun 2025 20:22:00 GMT

The version in the gateway/cluster objects need to match the actual version installed on the gateway.
Did you install or upgrade to R81.20 on the relevant gateways?

Re: Firewall gateway migration activity

the_rock — Mon, 02 Jun 2025 20:54:08 GMT

I will do remote with @Sam472 tomorrow at 9.30 pm IST to see if we can sort this out, will update afterwards.

Andy

Re: Firewall gateway migration activity

the_rock — Tue, 03 Jun 2025 16:33:13 GMT

-remote with Sanil
-checked the config
-both mgmt and gateways are on R81.20
-discussed below:

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/m-p/69216#M5286

-advised best way to do this is NOT create new cluster object, but rather modify existing one to new version and hardware model, copy config from show configuration if IPs will be the same
and then establish SIC, get interfaces without topology and inbstall on first backup member, then do same for new one

provided Sanil with my info in case they need help, and also advised to turn on mvc by running cphaconf mvc on command from expert