topic Re: migrate_server export versus migrate export in Firewall and Security Management

migrate_server export versus migrate export

Dale_Lobb — Fri, 13 Nov 2020 20:31:06 GMT

"migrate_server" is the new paradigm for upgrading one's management server. But, it appears as of R80.40, the migrate command still exists.

SK135172 appears to specifically decry the use of migrate_server for R80.40 to R80.40 migration, since that is not an allowed upgrade path.

So, my question is: Which command does one use if instructed by TAC to upload a management export or if one is migrating hardware platforms but staying in the same version?

Re: migrate_server export versus migrate export

PhoneBoy — Sat, 14 Nov 2020 06:51:21 GMT

I think a migrate may still be used for same-version migration (e.g. to different hardware).
It's even mentioned in the R81 docs: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/SECMG/migrate.htm?Highlight=migrate%20export
Which suggests TAC may want this (versus migrate_server output).

Re: migrate_server export versus migrate export

David_C1 — Tue, 30 Nov 2021 15:31:45 GMT

I'm getting ready to do my own lifecycle of management hardware, staying on R80.40. The Installation and Upgrade Guide R80.40 specifically says to use the migrate_server command when moving from one R80.40 management server to another R80.40 management server (in section "Migrating Database Between R80.40 Security
Management Servers"). I've always used the old "migrate export" command. Seems SK135172 contradicts the published Installation and Upgrade Guide. What command did you end up using?

Re: migrate_server export versus migrate export

Dale_Lobb — Wed, 01 Dec 2021 10:56:19 GMT

Hello David,

Sorry, at the time of this post, I was not migrating between hardware platforms, but had been instructed by TAC to "upload an export" so that they could replicate my environment. As you can see, the request was loosely stated, which prompted my query here, Eventually, TAC clarified that they wanted a migrate_server export.

Having said that, I think it indicates that "migrate_server export/import" can be used to move between hardware platforms, But as Damian said above, the R81 CLI Reference still lists "migrate export" as an option for transitioning between hardware platforms.

Best Regards,

Dale

Re: migrate_server export versus migrate export

the_rock — Tue, 30 Nov 2021 19:49:43 GMT

I will just share my experience...so yes, if you are doing migrate policies say from R80.40 to another R80.40 box, you can use migrate export and works fine. BUT...say if you are doing from R80.40 to R81.10, its recommended to use migrate_server as per below:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk135172

I tested both scenarios and got exact results I expected.

Re: migrate_server export versus migrate export

David_C1 — Tue, 30 Nov 2021 19:55:50 GMT

Thanks very much for the responses. When you tested both, any difference in speed or file size?

Dave

Re: migrate_server export versus migrate export

the_rock — Tue, 30 Nov 2021 19:59:21 GMT

No problem. Regardless of the process, speed depends on the size of the file.

Re: migrate_server export versus migrate export

G_W_Albrecht — Tue, 30 Nov 2021 20:25:05 GMT

migrate_server export/import is the current tool

migrate export/import is the legacy tool

Re: migrate_server export versus migrate export

Eran_Habad — Wed, 01 Dec 2021 08:35:03 GMT

Hi @Dale_Lobb ,

Indeed in sk135172 when looking at upgrade from R80.40 to R80.40 it shows the upgrade path is not supported, but note the focus of the SK is upgrade (i.e. advance your Management from version x to version >x), and since R80.40 to R80.40 is not considered as upgrade we declared there is no upgrade path. We consider R80.40 to R80.40 as migration (which wasn't the scope of this SK). That might be the cause of the confusion, we'll think how to make it more clear, obviously we take the blame for the confusion.

To your question:

migrate is a legacy tool that can be used today for quick migration (within same version only), if you try to use it for upgrade to newer version you'll get clear message that this tool cannot be used for upgrade and you'll see a reference to use the new tool (migrate_server).
migrate_server is the new tool for upgrade, but even if you use it for migration within the same version - behind the scenes it will automatically run the legacy migrate for you (which can also be ran manually).

Bottom line, you can't go wrong either way. Either you're blocked with clear error message, or we do the work for you behind the scenes. So no worries, you can use both for TAC.

Also I strongly recommend taking a look at sk163814 which has all the above information and more. From the SK:

=====

New upgrade command for advanced upgrade method

To upgrade your Management Server (advanced upgrade via CLI), use a new command.
The migrate_server command should be used instead of the migrate command that was used in upgrades to R80.20 or lower. For the new upgrade paths, refer to sk135172.
Make sure services are up when running the upgrade commands.

Example:
Instead of migrate export or migrate import, we will use migrate_server export or migrate_server import

======

Also from the SK:

Scenario 3: Migrate of a Security Management server within the same version

When the source and target servers are on the same major version, migrate_server uses an accelerated flow to migrate the data.

To force the full migration flow use the following flag on both export and import commands:
-force-new-upgrade

For example:

on the source server run:

./migrate_server export -v R81 -force-new-upgrade [-l | -x] /<Full Path>/<Name of Exported File>

on the target server run:

./migrate_server import -v R81 -force-new-upgrade [-l | -x] /<Full Path>/<Name of Exported File>

Re: migrate_server export versus migrate export

Dale_Lobb — Wed, 01 Dec 2021 11:03:04 GMT

Thanks, Eran!

Re: migrate_server export versus migrate export

Matlu — Sun, 17 Dec 2023 14:29:38 GMT

Hello,

One question, the "migrate_server export...." will make a backup of the logs that you have up to that moment?

Do you have to do another process to extract the logs and take them to the new version (for example if you are upgrading from R81 to R81.10)?

Cheers.

Re: migrate_server export versus migrate export

the_rock — Sun, 17 Dec 2023 19:49:56 GMT

I believe so.

Andy

Re: migrate_server export versus migrate export

PhoneBoy — Mon, 18 Dec 2023 13:47:44 GMT

By default, logs are not captured with migrate_server export.
You can include the logs (with or without indexes) with different command line switches (-l and -x).
https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SecurityManagement_AdminGuide/Topics-SECMG/CLI/migrate_server.htm
However, this isn't recommended if you have a lot of logs to move.