topic Re: Migrate_server issue on Azure CP management server in Firewall and Security Management

Migrate_server issue on Azure CP management server

the_rock — Fri, 22 Sep 2023 00:56:17 GMT

Hey guys,

Apologies I dont have exact error I received when doing migrate_server verification and then export (will update tomorrow when on my corporate laptop), but I wanted to confirm something. Are there any limitations when doing this process on CP management server in Azure? I dont believe there would be, as I followed exactly what below sk outlines.

https://support.checkpoint.com/results/sk/sk135172

I downloaded R81.20 upgrade tools tgz package (though when I tried installing it on R81 Azure server, said newest package was already there) and idea is to do migrate export on R81 and import it into my R81.20 lab mgmt server.

I will upload logs and file as soon as I have access to it, but if anyone knows of any limitations doing this process on Azure side, please be free to share it in the meantime.

Its also worth mentioning I had done this many times for onprem mgmt server and never had an issue, but never on Azure, this was the first time.

Thanks a lot as always!

Andy

Re: Migrate_server issue on Azure CP management server

the_rock — Fri, 22 Sep 2023 12:32:24 GMT

Quick update. I looked over generated html file and showed below, so I used the flag mentioned to see if it works (running it now)

Pre-Export Verifications Succeeded with Warnings

To export the database, address all the warnings or run the --ignore_warnings flag

Upgrade Tools
- Upgrade Tools Build Number R81.20 997000713
Logs
- There are no upgrade logs because pre-export verifications detected configuration issues. Export cannot start until you fix these issues.
[Expert@prd9cpmgmt01:0]# grep -i fail /opt/CPsuite-R81/fw1/log/upgrade_report-2023.09.21_20.08.21.html
<h1 id="status">Failed to Load the Report</h1>
statusHeader.innerHTML = "Failed to parse the upgrade data";
(isOperationFinished(phases.import, dataAllDomains.status)) && isOperationFailed(phases.export, dataAllDomains) )
// export verification in failed
// export failed
statusHeader.innerHTML = "Database Export Failed";
let failedDomainExport = getFailedDomain(phases.export)[1];
if (failedDomainExport != "") {
openBtnsQueue.push(failedDomainExport + getPhaseWithUppercase(phases.export));
// import verification in failed
//import failed
statusHeader.innerHTML = Upgrade_or_Migration + " Failed";
// open failed domain section by default
let failedDomainImport = getFailedDomain(phases.import)[1];
if (failedDomainImport != "") {
openBtnsQueue.push(failedDomainImport + getPhaseWithUppercase(phases.import));
// upgrade failed
domainFailedName = getFailedDomain(phase)[0];
if (domainFailedName == "") {
return getDescriptionForGeneralFail(dataAllDomains.description);
return `Failed: ` + Upgrade_or_Migration + ` of "` + domainFailedName + `".<br>For more details see upgrade logs below`;
// find the domain in which upgrade had failed
function getFailedDomain(phase) {
let isFailedDomain = !isOperationSucceeded(phase, dataPerDomain) && (isOperationFinished(phase, dataPerDomain.status) ||
if (isFailedDomain) {
function getDescriptionForGeneralFail(description) {
description = description.replace(/(failed)/ig, `<span style="color:red;font-weight: bold;">$1</span>`);
progressText.innerHTML = "Canceled due to a failure in other domain";
progressText.innerHTML = "Canceled due to a failure in other domain";
if (isOperationFailed(phase, dataAllDomains)) {
} else if (dataAllDomains.importPostUpgradeStatus == "IMPORT_POST_UPGRADE_FAILED") {
// failed
} else if (dataAllDomains.exportPostUpgradeStatus == "EXPORT_POST_UPGRADE_FAILED") {
// failed
if (getFailedDomain(phase)[1] == dataPerDomain.domainId) {
function isOperationFailed(phase,dataObject) {
return phase == phases.post_upgrade || phase == phases.info || getFailedDomain(phase)[0] != domainName || ( isEmpty(dataAllDomains.description) && isEmpty(dataPerDomain.description) );
// in case this is a failed domain and has no end time, show the end time of the general upgrade
[Expert@prd9cpmgmt01:0]#

Re: Migrate_server issue on Azure CP management server

the_rock — Fri, 22 Sep 2023 12:39:11 GMT

This is the command that worked, will see if it imports into R81.20 lab

Andy

[Expert@prd9cpmgmt01:0]# $MDS_FWDIR/scripts/migrate_server export -skip_upgrade_tools_check --ignore_warnings -v R81.20 /var/log/Export_for_Upgrade_from_R81_to_R8120.tgz

Re: Migrate_server issue on Azure CP management server

G_W_Albrecht — Fri, 22 Sep 2023 13:07:24 GMT

Maybe run_cpmdoc.sh will tell you more ?

Re: Migrate_server issue on Azure CP management server

the_rock — Fri, 22 Sep 2023 13:29:16 GMT

Was able to import fine into R81.20 lab, just did --ignore_warnings flag again. Thanks guys!

Andy

Re: Migrate_server issue on Azure CP management server

Sanjay_S — Mon, 01 Jul 2024 13:15:34 GMT

Hi All,

Can we use the new IP for the domain as my Lab doesn't have the VLAN extended. Also need to test this first before completely migrate it from MDS to the new SMS.

> Can we use different IP to the domain we import in the new SMS?

For example if we have the CMA IP: 10.10.1.100 in the existing one. Do we need to use the same IP or can we setup the new one in new SMS.

> Can we rename the CMA name while we import to the new SMS?

Please suggest.

Re: Migrate_server issue on Azure CP management server

khumbokaunda — Fri, 07 Nov 2025 08:25:39 GMT

Did your R81.20 security management server continue to work properly even after you issued the --ignore_warnings flag? I'm just trying to ensure it won't cause any issues in my environment if I issue it too

Re: Migrate_server issue on Azure CP management server

the_rock — Sat, 08 Nov 2025 01:04:44 GMT

Yes, it worked just fine, no issues.

Re: Migrate_server issue on Azure CP management server

the_rock — Sat, 08 Nov 2025 13:28:57 GMT

Also, here is one thing you can do. If you navigate to $FWDIR/scripts dir, you can run ./migrate_server -h command and it will show you all the possible flags.

Re: Migrate_server issue on Azure CP management server

the_rock — Sat, 08 Nov 2025 13:31:49 GMT

Like below:

[Expert@CP-MANAGEMENT:0]# cd $FWDIR/scripts
[Expert@CP-MANAGEMENT:0]# ./migrate_server -h

Use the migrate utility to: 1. Verify, export and import the Check Point
Security Management Server database.
2. Migrate_import_domain

1. Verify, export and import

Usage: migrate_server <ACTION> <PARAMETERS> [OPTIONS] <FILE>

ACTION (required parameter):

export - Exports the database of the Management Server or Multi-Domain Server.
import - Imports the database of the Management Server or Multi-Domain Server.
verify - Verifies the database of the Management Server or Multi-Domain Server.
print_installed_tools - returns the upgrade tools installed for a given version.

Parameters (required parameter):

'-v <target version>' Import version.

Options (optional parameters):

'-h' Show this message.
'-skip_upgrade_tools_check' Does not check for updated upgrade tools.
'-force-upgrade-flow' When the source and target servers are on the same major version,
migrate_server uses an accelerated flow to migrate the data.
This flag forces the full migration flow.
Note: if this flag is used, it is mandatory to use it both on export and import.
'-npb, --no_progress_bar' Disable the progress bar.
'-ivw, --ignore_warnings' Perform Export/Import although the pre-verification process raised warnings.
Note: option is valid for import, export and migrate_import_domain modes only.
'-l <N>' Export N last days of logs without log indexes.
'-l' Export/import all logs without log indexes.
'-x <N>' Export N last days of logs with log indexes.
'-x' Export/import all logs with log indexes.
'-n' Run non-interactively.
'--exclude-uepm-postgres-db' skip the backup/restore of PostgreSQL.
'--include-uepm-msi-files' Export/import the uepm msi files.
'--exclude-licenses' skip the restore of licenses.
'-mask' Hide sensitive information in exported DB.
Note: Applicable only when exporting.
'--verify_all_servers' Runs the verification process on all Management Servers and Log Servers.
Notes:
1) This flag is valid only for the 'verify' and 'export' operations.
2) This flag is supported on the versions R81 and higher.
3) List of servers, on which you can run the 'migrate_server verify' / 'migrate_server export'
command with the flag '--verify_all_servers':
- All Security Management Servers
- Multi-Domain Security Management Servers
- Multi-Domain Log Servers
4) List of remote servers, to which the 'migrate_server verify' / 'migrate_server export' command can connect:
- Security Management Servers
- Multi-Domain Security Management Servers
- Multi-Domain Log Servers
- Dedicated Log Servers
- Dedicated SmartEvent Servers
- Security Management Servers configured as a Backup of a Domain Management Server
Note:
Servers that are configured on a specific Domain on a Multi-Domain Security Management Server will be verified
only if there is a Domain Server of that Domain on the current Multi-Domain Security Management Server.
5) The default behavior:
- Only on Primary Management Servers, the 'migrate_server verify' command runs with the '--verify_all_servers' flag.
- On all servers except Primary Management Servers, the 'migrate_server verify' command runs with the '--verify_local_only' flag.
- On all servers without exception, the 'migrate_server export' command runs with the '--verify_local_only' flag.
'--verify_local_only' Runs the verification process locally, only on the current server.
Notes:
1) This flag is valid only for the 'verify' and 'export' operations.
2) The default behavior:
- On all servers except Primary Management Servers, the 'migrate_server verify' command runs with the '--verify_local_only' flag.
- On all servers without exception, the 'migrate_server export' command runs with the '--verify_local_only' flag.
'-skip_tools_check_on_remote' Specifies not to check for updated Upgrade Tools when running the verification process on remote Management Servers (not the current Management Server).
Notes:
1) This flag is valid only for the 'verify' and 'export' operations.
2) This flag is valid only when running the verification process on all Management Servers (not only on current server).

<FILE> (required parameter only for import):

Path to the archived file to export/import the database to/from.
Path to archive should exist.

2. Migrate_import_domain

Usage: migrate_server <ACTION> [OPTIONS] -o <FILE>

ACTION (required parameter):

migrate_import_domain - Imports the database of the Domain Management Server
from a Multi-Domain Server.

Parameters (required parameter):

'-o <FILE>' Path to the archived file to import the database from.

Options (optional parameters):

'-h' Show this message.
'-skip_upgrade_tools_check' Does not check for updated upgrade tools.
'-sn <Domain Server name>' Name of the Domain Management Server.
'-dsi <Domain Server IP address>' IP address of the Management Server.
Default is local machine.
'-skip_logs' Skip import logs (without log indexes).
'-npb, --no_progress_bar' Disable the progress bar.
'-ivw, --ignore_warnings' Perform Export/Import although the pre-verification process raised warnings.
Note: option is valid for import, export and migrate_import_domain modes only.

Note:
Run the utility either from the current directory or use
an absolute path.
[Expert@CP-MANAGEMENT:0]#

Re: Migrate_server issue on Azure CP management server

khumbokaunda — Sun, 09 Nov 2025 19:03:40 GMT

Wow, thank you very much for this reply. It will help me as I proceed with this migration. I'll make sure to bookmark this so I can revisit it

Re: Migrate_server issue on Azure CP management server

the_rock — Sun, 09 Nov 2025 19:11:56 GMT

No problem mate. Just remember -h or --help, its basic, yet powerful :). Anywho, message me any time if you need more clarification.

Re: Migrate_server issue on Azure CP management server

PhoneBoy — Tue, 11 Nov 2025 01:29:03 GMT

It's also in the official documentation.

Re: Migrate_server issue on Azure CP management server

the_rock — Tue, 11 Nov 2025 01:50:05 GMT

Definitely good reference 👍

Re: Migrate_server issue on Azure CP management server

khumbokaunda — Tue, 11 Nov 2025 11:41:44 GMT

Thanks for the link. The one I was using beforehand did not mention anything about the --ignore_warnings flag which left me confused at first.

Re: Migrate_server issue on Azure CP management server

the_rock — Tue, 11 Nov 2025 11:43:11 GMT

Thats cause the original link would not have that option, hence -h or --help 😉

Re: Migrate_server issue on Azure CP management server

the_rock — Tue, 11 Nov 2025 14:30:34 GMT

This is the link you were referring to, I assume?

https://support.checkpoint.com/results/sk/sk135172

Re: Migrate_server issue on Azure CP management server

khumbokaunda — Wed, 12 Nov 2025 06:20:20 GMT

Yes, there was that, and there were also other links including this one Migrate_Server_R80.40. As you can see, it did not explain the --ignore_warnings flag so that was why I wanted reassurance from you.
I'm fairly new to this Check Point world and seem to have been reviewing outdated information since the version I was migrating from was R81.10 to R82.
Once again, thank you very much for pointing me in the right direction and reminding me how helpful the -h/--help flag can be.

Best regards,
Khumbo.

topic Re: Migrate_server issue on Azure CP management server in Firewall and Security Management

Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Pre-Export Verifications Succeeded with Warnings

To export the database, address all the warnings or run the --ignore_warnings flag

Upgrade Tools

Logs

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server

Re: Migrate_server issue on Azure CP management server