topic Re: R80.10 to R80.30 Management Server Upgrade in Firewall and Security Management

R80.10 to R80.30 Management Server Upgrade

Kevin_Orrison — Tue, 17 Sep 2019 18:04:51 GMT

I'm going to be upgrading my management server from R80.10 to R80.30 soon. I know an advanced upgrade to a new server is recommended for the new kernel and file system. I guess I'm just curious how many people are upgrading to R80.30 like that. I've heard from a few other Check Point admins that are just doing in place upgrades. I guess my question is, is it worth the effort to migrate to a new VM in my case?

Re: R80.10 to R80.30 Management Server Upgrade

Dima_M — Tue, 17 Sep 2019 18:46:40 GMT

Hi Kevin,

We've upgraded the OS kernel to 3.10 in R80.20, while kernel upgrade will happen during inplace upgrade file system will change from ext3 to XFS only on new installation, hence we recommend to go with advanced upgrade in your case to enjoy the benefits (Enlarged system storage, I/O performance, better compression).

But in general, moving "inplace" between minor versions is the recommended way, we're working to make these upgrades even better and you'll feel it in your next upgrade..

Re: R80.10 to R80.30 Management Server Upgrade

FedericoMeiners — Tue, 17 Sep 2019 19:13:07 GMT

If you are working on a virtualized enviroment I would recommend export + fresh install, the process is really quick and easy.

Re: R80.10 to R80.30 Management Server Upgrade

Kevin_Orrison — Tue, 17 Sep 2019 21:21:38 GMT

Thanks for the replies!

Re: R80.10 to R80.30 Management Server Upgrade

Maarten_Sjouw — Tue, 17 Sep 2019 21:25:02 GMT

I finished a MDS R80.10 to R80.30 migration a couple of months ago and last weekend in a second attempt I migrated a 3 set of MDS servers from R77.30 to R80.30 exactly with that method:
Build a new server with R80.30, give it a temp IP
When you are ready to go this is what you do:
stop the CP services (mdsstop/cpstop)
start the migration export (use the upgrade guide)
once done change the IP of your original management server(s)
change the IP of the new machine to the original IP of the management server
start the FTW and finish it
move the export file from the old to the new server
use the commands from the manual to import the exportfile
start the cp services (cpstart/mdsstart).
run your check ups to make sure everything looks ok
install database (on every domain)
install policy(ies)
check logging.

Re: R80.10 to R80.30 Management Server Upgrade

Kevin_Orrison — Tue, 17 Sep 2019 21:27:44 GMT

I appreciate the response!

Re: R80.10 to R80.30 Management Server Upgrade

Kevin_Orrison — Tue, 17 Sep 2019 21:30:05 GMT

Did you export logs from the old server using "migrate export -l"?

If so, did you re-index the logs?

Re: R80.10 to R80.30 Management Server Upgrade

Maarten_Sjouw — Tue, 17 Sep 2019 21:36:26 GMT

In my case it was an MDS and I used mds_setup however I did not copy the logs nor the indexes.
There was about 2,5TB in logs for the 80.10 MDS and copying that into a tgz file would take even more space that is not avalable.
If I would have moved all files over to the new server it would start indexing by itself, however there is a default setting for the number of days it will index, IIRC that is around 14.

Re: R80.10 to R80.30 Management Server Upgrade

Kevin_Orrison — Tue, 17 Sep 2019 21:36:55 GMT

I am going to use the same IP as the existing SMS like you did too. This being the case, did you have to do anything with licensing on the new server once it had the original IP?

Re: R80.10 to R80.30 Management Server Upgrade

Maarten_Sjouw — Tue, 17 Sep 2019 21:39:30 GMT

Nope, licensing and everything else is preserved.

Re: R80.10 to R80.30 Management Server Upgrade

Kevin_Orrison — Tue, 17 Sep 2019 21:40:43 GMT

good to know.