topic Re: How to migrate Full HA R80.40 environment to Distributed environment in Firewall and Security Management

How to migrate Full HA R80.40 environment to Distributed environment

Massi — Tue, 28 Apr 2020 17:43:32 GMT

Hi Community,

I hope you are well.

I have a request for you, because I can't find an SK that resolve my problem.

Our client currently has a Full HA environment running on two 5200 appliances with the latest version of gaia (R80.40).

He purchased an other 5200 appliance, and he want to add it to the cluster environnement, but this is not possible because full HA only works with two (02) GWs, and now he wants to migrate from full HA to the distributed environnement.

Is there any SK or recommended documentation to migrate full HA R80.40 to distributed environment ?

Thanks in advance

Re: How to migrate Full HA R80.40 environment to Distributed environment

PhoneBoy — Thu, 30 Apr 2020 20:07:10 GMT

As noted in sk44201, there is not currently a supported procedure from migrating from a FullHA configuration to distributed.
However, there is a thread here that suggests how this might be done: https://community.checkpoint.com/t5/General-Management-Topics/Moving-from-Full-HA-to-Distributed-on-R80-x/m-p/13068

Re: How to migrate Full HA R80.40 environment to Distributed environment

Massi — Thu, 07 May 2020 22:38:48 GMT

Hi PhoneBoy,

Thank you for yor replay.

I have tested it in a LAB but it is not applicable for fullha configuration, I have these errors:

[1 May 23:48:01] [Dos2UnixFile] Converting file '/opt/CPsuite-R80.40/fw1/tmp/migrate/main_db/objects_5_0.C'
[1 May 23:48:01] ...<-- Dos2UnixFile
[1 May 23:48:01] [HACompatibilityChecker::ReadRequiredFiles] Reading objects_5_0.C from '/opt/CPsuite-R80.40/fw1/tmp/migrate/main_db/objects_5_0.C'
[1 May 23:48:01] ...--> ReadFwsetFile
[1 May 23:48:01] ....--> UpgradeMacroReplacer::Instance
[1 May 23:48:01] ....<-- UpgradeMacroReplacer::Instance
[1 May 23:48:01] [ReadFwsetFile] Going to read file '/opt/CPsuite-R80.40/fw1/tmp/migrate/main_db/objects_5_0.C'
[1 May 23:48:01] HashResizeMode_verify_trigger_ratio: Illegal trigger value (1) should be 2..8
[1 May 23:48:01] [ReadFwsetFile] Succeeded to read file
[1 May 23:48:01] ...<-- ReadFwsetFile
[1 May 23:48:01] ..<-- HACompatibilityChecker::ReadRequiredFiles
[1 May 23:48:01] ..--> HACompatibilityChecker::CheckCompatibility
[1 May 23:48:01] [HACompatibilityChecker::CheckCompatibility] Checking for HA presence on source machine
[1 May 23:48:01] ...--> HACompatibilityChecker::CheckHAPresence
[1 May 23:48:01] [HACompatibilityChecker::CheckHAPresence] Found primary management
[1 May 23:48:01] [HACompatibilityChecker::CheckHAPresence] Primary is Full HA
[1 May 23:48:01] ...<-- HACompatibilityChecker::CheckHAPresence
[1 May 23:48:01] [HACompatibilityChecker::CheckCompatibility] Checking for HA presence on destination machine
[1 May 23:48:01] [HACompatibilityChecker::CheckCompatibility] ERR: Machines are Full HA incompatible
[1 May 23:48:01] ..<-- HACompatibilityChecker::CheckCompatibility
[1 May 23:48:01] .<-- HACompatibilityChecker::exec
[1 May 23:48:01] <-- ConditionalExecutor::exec
[1 May 23:48:01] [ActivitiesManager::exec] ERR: Activity 'ConditionalExecutor' failed
[1 May 23:48:01] [ActivitiesManager::exec] WRN: Activities execution finished with errors
[1 May 23:48:01] [ActivitiesManager::exec] WRN: Activities 'ConditionalExecutor' have failed
[1 May 23:48:01] [ActivitiesManager::exec] Designated exit code is 1
[1 May 23:48:01] --> CleanupManager::Instance
[1 May 23:48:01] <-- CleanupManager::Instance
[1 May 23:48:01] --> CleanupManager::DoCleanup
[1 May 23:48:01] [CleanupManager::DoCleanup] Starting to perform cleanup
[1 May 23:48:01] .--> DirCleaner::exec
[1 May 23:48:01] [DirCleaner::exec] Going to remove directory '/opt/CPsuite-R80.40/fw1/tmp/migrate/'
[1 May 23:48:01] .<-- DirCleaner::exec
[1 May 23:48:01] .--> ImportFailureMarker::exec
[1 May 23:48:01] [ImportFailureMarker::exec] Checking if cleaner is active
[1 May 23:48:01] [ImportFailureMarker::exec] Cleaner is not active, nothing to do
[1 May 23:48:01] .<-- ImportFailureMarker::exec
[1 May 23:48:01] [CleanupManager::DoCleanup] Completed the cleanup
[1 May 23:48:01] <-- CleanupManager::DoCleanup

With my collegues we have find a workaround to replace steps 8 to 11 from sk44201 with this sk154033.

Best regards

Re: How to migrate Full HA R80.40 environment to Distributed environment

PhoneBoy — Thu, 07 May 2020 23:40:35 GMT

I do remember seeing the procedure in sk154033 discussed internally a while back.
One thing to be aware of here: we didn't test it with a Full HA config.
At least that's what the internal notes on it says.
Did it actually work for you?

Re: How to migrate Full HA R80.40 environment to Distributed environment

Massi — Thu, 07 May 2020 23:55:45 GMT

We tested it twice and it worked in LAB environment with the creation of a few objects and policies.
I will get to you a feedback once the migration is done in the production environment.

I have just to check if I will not have a problem with the ICA (Users Certificats), when I promote the new secondary management server to primary, because the name and management IP will be chnaged.