topic Re: Replacing R81.20 cluster with new R82 cluster in Firewall and Security Management

Replacing R81.20 cluster with new R82 cluster

Si_Dunford — Tue, 30 Sep 2025 11:09:20 GMT

Hi,

I have a pair of 5800 gateway appliance running R81.20 in HA mode. These devices go end of hardware support today (30 Sep 25) and I have a pair of new 9400 appliances due to be delivered in the next few days.

I anticipated that the new devices will come with R82 and so I have pre-upgraded our management from R81.20 to R82 already.

I know that R82 and R81.20 appliances cannot sit in the same cluster and obviously cannot have the same HA or IP addresses as the existing devices, but what I cannot find is any documentation showing the best way to replace them.

This is how I am planning to approach this:

1. Build / Install the R82 gateways with a new management address (and adding them to firewall rules).

2. Configure interfaces and IP addresses the same as R81.20 counterparts, leaving them disabled.

3. Add routing tables and Proxy ARP the same as R81.20 counterparts.

4. Failover 81.20 to the Secondary

5. Shut down the R81.20 Primary

6. Reset SIC on the Primary host in the cluster object

7. Enable interfaces on R82 Primary.

8. Upgrade cluster object to R82 and rest/initialise SIC for Primary host.

9. Push policy to individual gateways (Should work on R82 and Fail on R81.20)

10. Failover to R82 Primary

11. Repeat steps 5, 6, 7 for Secondary appliance

12. Push policy to gateways

I don't know what will happen in step 7-9 when I bring the R82 primary online. Will there be two devices trying to become ACTIVE?

In step 10 will I have to shut down R81.20 Secondary to get the failover to work properly?

I would like to hear your comments and advice on this.
(Thanks in advance)

Re: Replacing R81.20 cluster with new R82 cluster

the_rock — Tue, 30 Sep 2025 12:51:14 GMT

I would just follow below process, had done it many times, never had an issue.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/td-p/69216

Re: Replacing R81.20 cluster with new R82 cluster

vobryan — Tue, 30 Sep 2025 13:00:04 GMT

What a timely post! I am doing the exact same thing with the same old and new hardware as you in about a month.

I had to change some interface names because we are using more 10 gig interfaces and the old fw we used none.

Good luck to us both!

Re: Replacing R81.20 cluster with new R82 cluster

the_rock — Tue, 30 Sep 2025 13:14:30 GMT

I found same process I linked worked well even for R82.

Andy

Re: Replacing R81.20 cluster with new R82 cluster

Si_Dunford — Tue, 30 Sep 2025 14:16:51 GMT

Thanks, this is fairly similar to the approach I was planning... will report back when completed.

Re: Replacing R81.20 cluster with new R82 cluster

the_rock — Tue, 30 Sep 2025 14:19:28 GMT

Exactly! The best part is you dont need to worry about MVC feature, since its automatically enabled since R80.40

Andy

Re: Replacing R81.20 cluster with new R82 cluster

Si_Dunford — Tue, 30 Sep 2025 14:35:50 GMT

I don't have a delivery date for our replacement yet, but hope yours goes well...
We are moving up to 10G interfaces from 1G too, but in our case we bond them and add VLAN subinterfaces so the bond and the subinterface names will remain the same; only the bond members will be changing.

Re: Replacing R81.20 cluster with new R82 cluster

the_rock — Tue, 30 Sep 2025 14:39:39 GMT

Just make sure if say sync interface would be different link/speed, something to keep in mind, as thats important.

Andy