topic Re: R77.30 to R80.10 upgrade/migration to new Smart-1? in Firewall and Security Management

R77.30 to R80.10 upgrade/migration to new Smart-1?

Saul_Schwartz — Mon, 01 Oct 2018 14:20:08 GMT

My current environment is a Smart1 225 (HA) management station with about 8 gateways, all running R77.30. We purchased new Smart1 5050 appliances.

What are my options? Do I need to upgrade the Smart1-225 first, then export the DB to the new appliance? I'd prefer not to upgrade the Smart1-225's if at all possible and just cleanly move over to the 5050, and move SIC from each gateway to the new management station.

Re: R77.30 to R80.10 upgrade/migration to new Smart-1?

Ofir_Shikolski — Mon, 01 Oct 2018 16:20:04 GMT

Yes, you can export the database

Install the new Smart1 Gen5 machine with the same IP as the original MGMT(smart-1 225)

Add a license

Follow Upgrading a Security Management Server, Endpoint Security Management Server, or vSEC Controller

You can follow Upgrading a Security Management Server with Advanced Upgrade

Shutdown the Smart-1 225

Re: R77.30 to R80.10 upgrade/migration to new Smart-1?

JozkoMrkvicka — Mon, 01 Oct 2018 17:18:44 GMT

A few days ago I have asked the same question. In my case migration from R77.30 to R80.20:

MDS migration from R77.30 to R80.20

To sum it up:

Transfer R80.10 ISO to the R77.30 MDS
Mount R80.10 ISO
Run "<MOUNT_POINT>/linux/p1_install/mds_setup" script
Follow on-screen wizard to create report (what are errors or warnings) and/or export itself
Transfer export from R77.30 MDS to the R80.10 MDS
Run command "$MDSDIR/scripts/mds_import.sh /var/log/exported_mds.<DATE>.tgz" on R80.10 MDS
Wait ... Wait ... Wait ...

The script "mds_setup" will check all created CMAs for possible errors and warning, including Global Policy.

I am not sure about licenses. Once migrated, the original lics are also migrated, which means there will be wrong CK key (MAC of Mgmt interface)...

Re: R77.30 to R80.10 upgrade/migration to new Smart-1?

Maarten_Sjouw — Mon, 01 Oct 2018 21:12:48 GMT

When done just replace the license of the 225 with the license of the 5050.

Re: R77.30 to R80.10 upgrade/migration to new Smart-1?

_Val_ — Tue, 02 Oct 2018 10:14:59 GMT

Advanced upgrade is always the best option. Keep older Smart-1 as is, move DB as part of advanced upgrade to the new boxes in the lab. Once they are up, replace the older SMSs. No SIC should be moved, it will work as before, unless you also want to change IPs of the management servers (not really needed)

Re: R77.30 to R80.10 upgrade/migration to new Smart-1?

Maarten_Sjouw — Tue, 02 Oct 2018 14:56:24 GMT

Even if you change the IP's (only remember to allow the new IP full access to the Gateway before migration) you don't need to reset the SIC, it is moved along. Only other problem you have is the licenses, in central license scheme you will need to issue the licenses on the new CMA IP's and apply them after migration.

Done about 160 CMA's in the last year and a half.....

Re: R77.30 to R80.10 upgrade/migration to new Smart-1?

_Val_ — Tue, 02 Oct 2018 15:18:06 GMT

Not only licenses. You need to adjust your policy BEFORE moving to new IP addresses, as the implied rules only cover pre-existing management objects with their old IP addresses. GW will refuse SIC requests from new MGMT IP addresses, unless you take care of that before migration.

That said, without changing IP addresses on the management side it is much easier

Re: R77.30 to R80.10 upgrade/migration to new Smart-1?

Maarten_Sjouw — Tue, 02 Oct 2018 17:51:37 GMT

I think that is exactly what I said: (only remember to allow the new IP full access to the Gateway before migration)