topic Re: R80.20 Standalone cluster migration to a Distributed environment in Firewall and Security Management

R80.20 Standalone cluster migration to a Distributed environment

George_Georgio1 — Mon, 13 Feb 2023 15:49:07 GMT

Dear All,

We have being trying to do an R80.20 Standalone cluster migration to a Distributed environment without success. We have followed the below SK without any success

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk179444&partition=Advanced&product=Quantum#MigrationProcedure1

Also, is there a script/way to migrate the rules, objects and NATs since the above does not work.

Any help will be appreciated. Thank you.

George

Re: R80.20 Standalone cluster migration to a Distributed environment

_Val_ — Mon, 13 Feb 2023 15:55:43 GMT

Where did you fail? It is hard to help you without knowing more details.

Re: R80.20 Standalone cluster migration to a Distributed environment

PhoneBoy — Mon, 13 Feb 2023 17:54:34 GMT

If by Standalone Cluster, you mean Full HA (where management is on both cluster members), the procedure in sk179444 is not supported.
This is noted in the Limitations section.

Your only option is something like the following: https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-package-or-parts-of/m-p/41100#M2829
You can run this tool against the primary system to export much of the Access Policy and Threat Prevention configuration and import it into a newly installed management server.
You will have to create several objects manually, but it’s far easier than recreating the entire configuration from scratch.

Re: R80.20 Standalone cluster migration to a Distributed environment

George_Georgio1 — Tue, 14 Feb 2023 07:18:33 GMT

Hi Val and PhoneBoy,

Thank you both for the replies. Yes, it's a Full HA and we saw the limitation on SK. So, the only way is to try the python script. We will do so and hopefully we will be able to export most of the access policy. Thank you again.

Re: R80.20 Standalone cluster migration to a Distributed environment

G_W_Albrecht — Tue, 14 Feb 2023 08:49:25 GMT

See here for a working solution Migrate R80.40 Full HA to distributed Management

Re: R80.20 Standalone cluster migration to a Distributed environment

George_Georgio1 — Tue, 14 Feb 2023 09:11:01 GMT

Hi and thank you for the reply. Will this work on a Full HA R80.20 also?

Re: R80.20 Standalone cluster migration to a Distributed environment

G_W_Albrecht — Tue, 14 Feb 2023 09:17:39 GMT

That may well be - but i would try to upgrade to R80.40 first, R80.20 is unsupported since last September...

Re: R80.20 Standalone cluster migration to a Distributed environment

George_Georgio1 — Tue, 14 Feb 2023 10:01:13 GMT

Thank you, we will try that.

Re: R80.20 Standalone cluster migration to a Distributed environment

George_Georgio1 — Thu, 16 Feb 2023 09:06:51 GMT

Hi again,

We followed the procedure with both R80.40 and R81.10 with the same issue, we can not promote the Management

[Expert@CPMGT:0]# $FWDIR/bin/promote_util
Binding to localhost...Done
Opening database...Done
Promote failed.
Please make sure all clients are disconnected

Any ideas are welcomed. Thank you.

Re: R80.20 Standalone cluster migration to a Distributed environment

G_W_Albrecht — Thu, 16 Feb 2023 09:20:02 GMT

Maybe TAC can help with this step. It is from sk114933 - so this step is supported.

Re: R80.20 Standalone cluster migration to a Distributed environment

George_Georgio1 — Thu, 16 Feb 2023 09:21:32 GMT

Hi again,

We have a case with the TAC since day one, unfortunately not much help there. Thank you anyway.