topic Re: CMA migrate to R80.10 fails in Firewall and Security Management

CMA migrate to R80.10 fails

Sriram_Somayaju — Wed, 16 May 2018 05:27:28 GMT

Hi All,

I am trying to migrate a CMA from R77.10 multi-domain manager to R80.10 but getting the following errors.

I managed to migrate 10 other CMAs from the same R77.10 box to R80.10 without any issue but there seems to be something wrong with this particular one.

The migrate logs shows the below, cannot find what the error code 4 refers to and if there is anything wrong with the database imported. I have raised it with CP TAC but it has been 2 days and they are yet to respond to me. Any help here would be much appreciated.

[16 May 3:13:31] [CanonicalizePath] Canonicalizing path '/opt/CPmds-R80/customers/domain1/CPsuite-R80/fw1/bin/upgrade_phase -d 6596f369-849c-4dc0-b783-533e88fcb781 -c migrate_cma -s started'
[16 May 3:13:31] [CanonicalizePath] Resulting path: '/opt/CPmds-R80/customers/domain1/CPsuite-R80/fw1/bin/upgrade_phase -d 6596f369-849c-4dc0-b783-533e88fcb781 -c migrate_cma -s started'
[16 May 3:13:31] ..<-- CanonicalizePath
[16 May 3:13:31] ..--> ExecCommandGetOutput
[16 May 3:13:31] [ExecCommandGetOutput] Going to execute command: '/opt/CPmds-R80/customers/domain1/CPsuite-R80/fw1/bin/upgrade_phase -d 6596f369-849c-4dc0-b783-533e88fcb781 -c migrate_cma -s started'
[16 May 3:13:39] [ExecCommandGetOutput] ERR: Command completed with error code 4
[16 May 3:13:39] ..<-- ExecCommandGetOutput
[16 May 3:13:39] [CommandRunner::exec] Command's output:
-------------------------------------
Failed to upgrade phase
-------------------------------------
[16 May 3:13:39] [CommandRunner::exec] ERR: Command execution had failed
[16 May 3:13:39] .<-- CommandRunner::exec
[16 May 3:13:39] <-- ConditionalExecutor::exec
[16 May 3:13:39] [ActivitiesManager::exec] ERR: Activity 'ConditionalExecutor' failed
[16 May 3:13:39] [ProgressUpdater::UpdateProgressToGaia] Progress Updated to '56.4103
[16 May 3:13:39] [ActivitiesManager::exec] WRN: Activities execution finished with errors
[16 May 3:13:39] [ActivitiesManager::exec] WRN: Activities 'ConditionalExecutor' have failed
[16 May 3:13:39] [ActivitiesManager::exec] Designated exit code is 1
[16 May 3:13:39] --> CleanupManager::Instance
[16 May 3:13:39] .--> CleanupManager::CleanupManager
[16 May 3:13:39] .<-- CleanupManager::CleanupManager
[16 May 3:13:39] <-- CleanupManager::Instance
[16 May 3:13:39] --> CleanupManager::DoCleanup
[16 May 3:13:39] [CleanupManager::DoCleanup] Starting to perform cleanup
[16 May 3:13:39] [CleanupManager::DoCleanup] Completed the cleanup
[16 May 3:13:39] <-- CleanupManager::DoCleanup

Re: CMA migrate to R80.10 fails

Demith_Samaraw2 — Wed, 16 May 2018 05:45:24 GMT

Did you use the correct migration tools from R80.10, get the latest migration tools copied and try the following commands

# mdsenv <domainServer_name>

Before you export the database, make sure that you remove the Global Policy from the source Domain Server.

# <full path to migrate command> migrate export [-l] <output file>

The optional –l flag includes closed log files and SmartLog data from the source Domain Server in the output archive

Also if the MDS/CMA has any VSX/VSs configured it will not be able to import so you have to do the following hack on the new R80.10 MDS

Create a file named AllowVsxMigration in the root directory of your MDS machine as follows:
touch /AllowVsxMigration

On the R80 Multi-Domain Server, run these API commands to create a new Domain and a new Domain Server (without starting it):
# mgmt_cli login <user_name> <password>

# mgmt_cli add domain name <my_domain_name> servers.ip-address <my_IP_address> servers.name <my_domain_server_name> servers.multi-domain-server <R80_multi-domain-server_Name> servers.skip-start-domain-server true

Copy the TGZ file from the R77.xx Domain Server to the R80 Multi-Domain Server.
When the new Domain is ready, import the exported database:
# cma_migrate <source_server> <new_server>/<FWDIR_path>

For example: # cma_migrate /tmp/myR77-30.tgz /opt/CPmds-r80/domains/my_dms/CPsuite-R80/fw1

Re: CMA migrate to R80.10 fails

Sriram_Somayaju — Wed, 16 May 2018 05:51:47 GMT

Hi Demith,

This is exactly what I have done. As I mentioned, other CMA from same R77 box to R80.10 works without any issue.

Re: CMA migrate to R80.10 fails

Marco_Valenti — Wed, 16 May 2018 08:45:27 GMT

sound something for the tac I'm afraid

Re: CMA migrate to R80.10 fails

Eyal_Rashelbach — Wed, 16 May 2018 12:08:51 GMT

Hi Sriram,

My name is Eyal and i run the R80 customer success in Checkpoint.

Will you please share the SR number in order tohelp us monitor your case ?

Best regards

Eyal Rashelbach

R80 Desk Manager | Solution Center | Check Point Software Technologies

Re: CMA migrate to R80.10 fails

Sriram_Somayaju — Thu, 17 May 2018 04:48:06 GMT

Hi Eyal,

SR 3-0191044271

Re: CMA migrate to R80.10 fails

Marco_Valenti — Thu, 17 May 2018 15:48:14 GMT

are you interessed in following another similar case? I can send you the sr if you agree with that