topic Re: Full HA R77.30 to R80.40 Distributed architevture with VM Open server in Firewall and Security Management

Full HA R77.30 to R80.40 Distributed architevture with VM Open server

Cesar_Santos — Sat, 20 Feb 2021 11:33:29 GMT

Hi Checkmates,

I would like to have your thougs on a migration from a deployment of a Full HA of two 5100 in R77.30 to a Distributed deployment in R80.40. On the new deployment I'll have a VM on Hyper-V dedicated as the management station.

So far I've installed the VM with the R77.30 software and with the same Jumbo version of my Full HA deployment on the production environment.

I've read some quite of the documentation available on this in the security knowledge base and here in Checkmates, but I'm still not comfartable with the whole process.

I know that first I need to go with the conversion to the Distributed architecture. But how can I proceed safely? Should I migrate export on the HA cluster first and migrate import on the VM and then disable the management role on my 5100? Or should I go the other way around?

What should be my approach on this? It is possible to avoid any downtime on this? If it was just an upgrade I know it is possible to have different versions on the cluster members, avoiding downtime. But with conversion I don't know if it is possible to achieve that.

Thanks in advance.

Re: Full HA R77.30 to R80.40 Distributed architevture with VM Open server

PhoneBoy — Sat, 20 Feb 2021 18:07:04 GMT

I would suggest making the change to distributed prior to upgrading to R80.40.
The procedure on R77.30 is: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk44201&partition=Advanced&product=ClusterXL,
There is no “zero downtime” option for this sort of conversion.

Re: Full HA R77.30 to R80.40 Distributed architevture with VM Open server

Cesar_Santos — Mon, 22 Feb 2021 08:58:38 GMT

Hi PhoneBoy,

Thanks for your reply. I've already checked the sk44201 and my question here is not about the steps, but about the process. Can I do it remotely in one member at a time? Or should I do it on site? What is the expected time window to do this? Please be aware this is a customer on the public healthcare system.

Regards,

César Santos

Re: Full HA R77.30 to R80.40 Distributed architevture with VM Open server

G_W_Albrecht — Mon, 22 Feb 2021 11:55:58 GMT

I would not suggest to do this remotely ! The important step is to get the SMS database from the primary Management node and install it in a VM.

Re: Full HA R77.30 to R80.40 Distributed architevture with VM Open server

Cesar_Santos — Mon, 22 Feb 2021 12:47:52 GMT

Hi G_W_Albrecht,

Thanks for your input. I'll schedule a maintenance window to run the procedure on site.

About the important step, should I import the SMS database on the VM right now? Or only after the "Convert to host..." step of the procedure.

Regards

Re: Full HA R77.30 to R80.40 Distributed architevture with VM Open server

G_W_Albrecht — Mon, 22 Feb 2021 12:58:42 GMT

According to sk44201, you will perform migrate export only after cp_conf fullha disable, Convert to Host... and Install Database... 8)

Re: Full HA R77.30 to R80.40 Distributed architevture with VM Open server

Cesar_Santos — Mon, 22 Feb 2021 14:24:41 GMT

In between those moments, the cp_conf gullah disable and the import Database on the VM, will I've downtime? In that case, how can I reduce that?

Re: Full HA R77.30 to R80.40 Distributed architevture with VM Open server

G_W_Albrecht — Mon, 22 Feb 2021 14:30:39 GMT

Not if you follow the steps. The Secondary Full HA cluster member will run as the Active member in the cluster to continue passing traffic.