topic migrate_server utility feedback in Firewall and Security Management

migrate_server utility feedback

Josh28 — Mon, 29 Apr 2024 08:21:56 GMT

Dear community,

I’m planning an upgrade of our MDS deployment (2 VM, active and standby, running around 30 CMA, 2To of logs currently) from R81.10 to R81.20 using the migrate_server utility.

Following the documentation https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Guide/Content/Topics-IUG/Upgrading-one-MDS-from-R80_20-and-higher-with-Migration.htm , I’ve configured two new VMs in R81.20 using the same IP addresses, hostname etc… (First-Time wizard and initial configuration in the smartConsole completed) and ran the the migrate_server verify on the R81.10 VM and fixed the issues mentioned in the report.

I’ll do the export/import in a few weeks but I’m looking for some feedback about the utility, mainly about the following:

I guess I should do the import/export on both active and standby MDS ?
Regarding the logs, our /var/log is currently at 2To so I’m worried that the export might take some time (or fail?) if I export the logs too. How did you handle the logs while migrating the configuration ?
Is there any specific configuration file not mentioned in the migrate_server report that I should check, like fwkern.conf etc…
Any other tips related to a MDS upgrade

Thank you for your help.

Re: migrate_server utility feedback

PhoneBoy — Mon, 29 Apr 2024 21:13:42 GMT

For any serious volume of logs, you generally copy them via other means (sftp or similar) to the target system and initiate log reindexing after the migration is complete.

Re: migrate_server utility feedback

the_rock — Mon, 29 Apr 2024 22:47:45 GMT

I see what Phoneboy is saying, that works the same way for regular SMS as well.

Andy

Re: migrate_server utility feedback

Josh28 — Thu, 02 May 2024 07:57:40 GMT

Thanks for your feedback, I'll do that, after looking at the amount of logs I have, even if I only keep on the MDS the strict necessary logs, it will be too much to handle with the migration tool I think.

Should I only backup the logs in /var/log/mds_logs to save the trafic logs of the CMAs ?

Re: migrate_server utility feedback

PhoneBoy — Fri, 03 May 2024 01:31:51 GMT

There's a reason that capturing logs is not the default in migrate_server 🙂
For the exact location of logs, please refer to: https://support.checkpoint.com/results/sk/sk130992
It may be that /var/log/mds_logs encompasses all of the above, but I don't have an MDS handy to confirm this. 🙂

Re: migrate_server utility feedback

the_rock — Fri, 03 May 2024 14:39:38 GMT

I built mds lab to confirm and thats the location 🙂