topic Re: R77.30 standalone to full ha in Firewall and Security Management

R77.30 standalone to full ha

Fung_To_Puk — Mon, 14 Sep 2020 01:18:55 GMT

I am trying to migrate a standalone R77.30 to full ha R77.30 in vmware then go to R80.40 on 2x6200, but it seems R77.30 cannot convert from standalone to full ha, even I followed the procedure on sk104699.

I also tested with a fresh installed R77.30 with jhf take351, on 1 policy that allow all traffic, its still does not work.

Had anybody had successfully convert a R77.30 standalone to Full HA before? any suggestion?

edit: I just found R80.40 known limitation (sk160753) they list

02414257,
02403960,
PMTR-47457

It is not possible to convert a Standalone deployment (Security Gateway and Security Management on one computer) to a cluster member of a Full HA deployment - or vice versa.

R7x

So, sk104699 claim R77.30 can use the procedure to convert from standalone to part of full ha primary member, but sk160753 claim all R7x cannot do this, which sk is the correct one?

Re: R77.30 standalone to full ha

PhoneBoy — Mon, 14 Sep 2020 02:19:05 GMT

I would strongly suggest not doing a Full HA config and instead consider using Smart-1 Cloud or buy an external management license/appliance.

Also, Full HA is only supported on physical Check Point appliances.
That said you didn’t provide any details about what “not working” means (ie exact errors/behaviors observed).

Re: R77.30 standalone to full ha

Fung_To_Puk — Mon, 14 Sep 2020 03:34:14 GMT

Thanks PhoneBoy, I totally forgot Full HA only run on Appliances. But I only had 2x6200, so could I just make it import to vmware then using r80.40 migrate export to get the full ha config, then import on the 6200? or there are other way to upgrade a standalone 4600 to 2x6200 Full HA?

Re: R77.30 standalone to full ha

PhoneBoy — Sun, 20 Sep 2020 05:00:05 GMT

You have to do a fresh install on the 6200s and configure Full HA as part of the initial installation.
To copy the configuration from 4600, you’ll need to upgrade it to R80.x (can be done in VMware) and use the following tool: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Python-tool-for-exporting-importing-a-policy-package-or-parts-of/m-p/41100
This will require some manual work.

Re: R77.30 standalone to full ha

Fung_To_Puk — Sun, 08 Nov 2020 03:30:07 GMT

Thanks for the reminder, I tried on physical appliance, the full HA worked. thanks.

Is it possible to change the name of primary member object in in R80.40 of full ha?

Re: R77.30 standalone to full ha

PhoneBoy — Mon, 09 Nov 2020 05:26:29 GMT

Does the UI not allow that?

Re: R77.30 standalone to full ha

Fung_To_Puk — Mon, 09 Nov 2020 05:34:39 GMT

No, the smartconsole of R80.40 does not allow change of full HA primary member object name, only the cluster and secondary object name can be changed.