topic Re: Management Upgrade R77.30 --> R80.20 and Configuration in Firewall and Security Management

Management Upgrade R77.30 --> R80.20 and Configuration

David_C1 — Thu, 11 Oct 2018 20:34:09 GMT

I am planning my upgrade of our HA Management from R77.30 to R80.20. As in past upgrades, I will do a clean install of the OS on the same machine (after of course doing backups, exporting database, etc.).

To simplify the build after the clean install, my plan was to save the configuration of the management server before starting ("save configuration /path_to/name_of_saved_config_file") and then importing the configuration once the clean install of R80.20 is complete ("load configuration /path_to/name_of_saved_config_file"). However, I see that his is only supported using the same version of Gaia. Has anyone else attempted this, or does anyone have other suggestions to streamline this process?

Thanks,

Dave

Re: Management Upgrade R77.30 --> R80.20 and Configuration

Ofir_Shikolski — Fri, 12 Oct 2018 06:31:08 GMT

Something like this one?

cat <<EOF > ./clish.txt
aaa
aggregate
allowed-client
arp
as
backup-scheduled
bgp
bonding
bootp
bridging
clienv
cluster
command
core-dump
cron
dhcp-client
dhcp-server
dns
domainname
expert-password
format
group
host
hostname
igmp
inbound-route-filter
installer
interface
interface-name
ip-reachability-detection
iphelper
ipv6
ipv6-state
kernel-routes
mail-notification
management
max-path-splits
mcvr
message
neighbor
net-access
netflow
ntp
ospf
password-controls
pbr
pbrroute
pim
ping
pppoe
prefix-list
prefix-tree
protocol-rank
proxy
rba
rdisc
rip
route-redistribution
routedsyslog
routemap
routemaps
router-id
router-options
snmp
static-mroute
static-route
syslog
timezone
trace
tracefile
user
vpnt
vrrp
web
EOF

for line in $(cat ./clish.txt| sed -e 's/^[ \t]*//'|sed 's/^[ \t]*//;s/[ \t]*$//')
do
zz=$(clish -c "show configuration $line")
echo "$line"
echo "$zz"
echo " "
done

rm -v ./clish.txt

Re: Management Upgrade R77.30 --> R80.20 and Configuration

G_W_Albrecht — Fri, 12 Oct 2018 09:48:32 GMT

What kind of HA Management are you using ? For primary Management Server, usually migrate export / import is the best way to upgrade. The save configuration command writes only GAiA OS setting into a file and is used when a GW is replaced by a fresh install and a complicated configuration has to be preserved.

Re: Management Upgrade R77.30 --> R80.20 and Configuration

David_C1 — Sat, 13 Oct 2018 18:15:48 GMT

I have the normal primary and secondary management servers running on Check Point appliances. I did plan on doing the migrate/export and import for the database, but my understanding is that this does not include the OS level settings (IPs, routes, administrators, etc.) and was going to "save configuration filename" in clish and then after the clean install of R80.20, use "load configuration filename" for the OS settings, and migrate import for the database. My OS configuration is not terribly complicated, but if this saves me some time and mistakes I'd like to use it. So to sum, my plan:

1. Save configuration of the primary management

2. Export the database of the primary management

3. Perform clean install of R80.20, complete FTCW

4. Load the saved configuration

5. Import the database

I found a note, however, that save configuration/load configuration can only be used across the same versions of GAiA. I was wondering if anyone had experience with this.

Dave

Re: Management Upgrade R77.30 --> R80.20 and Configuration

G_W_Albrecht — Mon, 15 Oct 2018 09:04:18 GMT

I would assume that the average primary SMS (not Management HA with GW on same appliance !) will not need save configuration/load configuration as all OS settings (IP, GAiA admin) will be set during FTW, and everything defined in SMS Database will be imported using migrate import. So usually you will not need step 4 as there is no further configuration necessary.

Re: Management Upgrade R77.30 --> R80.20 and Configuration

Ian_Cresswell — Tue, 08 Jan 2019 10:10:34 GMT

If you are not changing hardware would a simple backup and then upgrade through CPUSE not be the simplest option?

Using CPUSE creates a new partition with a clean install and then migrates existing config to it and boots if successful, so you can always reboot into the old partition if something goes wrong.