topic Re: Migrating R75 Management Server to New Release in Firewall and Security Management

Migrating R75 Management Server to New Release

Prince_Osei_Wia — Wed, 10 Jan 2018 09:01:02 GMT

Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server running on R77. Any help please?

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Kaspars_Zibarts — Wed, 10 Jan 2018 11:20:08 GMT

Easy option - get Checkpoint professional services

Otherwise read R77 installation and upgrade guide, Advanced upgrade section. It's a fairly straight forward job - you run export tool in old R75 Mgmt server and then important it in freshly built R77.

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Prince_Osei_Wia — Wed, 10 Jan 2018 11:25:43 GMT

Do you have some SK's I can refer to especially the how to run the export tool?

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

AlekseiShelepov — Wed, 10 Jan 2018 11:42:58 GMT

Well, usually people get paid for that kind of help... I believe you should contact your Check Point partner or Check Point itself.

For now this information is not enough. There are several options to get this done depending on your current OS and software versions, enabled blades, hardware platform, and desired software version (I believe it should be Gaia R77.30). There could be some minor issues in the policy which should be fixed before the migration.

You will need these things for sure:

Upgrade Wizard

Check Point Upgrade Map

R77.30 Release Notes

Gaia R77 Installation and Upgrade Guide PDF | Gaia R77 Installation and Upgrade Guide WEB

R77.30 Migration tools

After a quick look I think that general steps should be:

Upgrade current device to R75.40
Install clean Gaia R77.30 on the new device
Use R77.30 migration tools to migrate policies (think about logs too)
Install the latest CPUSE and Jumbo Hotfix Accumulator on the new server

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Kaspars_Zibarts — Wed, 10 Jan 2018 13:25:54 GMT

It's in the R77 documentation package: "Installation and Upgrade Guide" > section "Advanced Upgrade and Database Migration". It's a step by step guide covering

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Prince_Osei_Wia — Wed, 10 Jan 2018 15:54:21 GMT

This was the error I received when I followed the process in the document "Installation and Upgrade Guide" > section "Advanced Upgrade and Database Migration" using CLI.

[Expert@cpmgt1]# ./migrate export scremy.tgz

Migrating from the current management version is not supported.
For information on what platforms are supported for upgrade
please refer to the release notes.

Execution finished with errors. See log file '/opt/CPshrd-R75/log/migrate-Wed_Jan_10_15-52-53_2018.log' for further details

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Kaspars_Zibarts — Wed, 10 Jan 2018 16:45:07 GMT

Which version of R75 are you running? SPLAT or GAIA?

This appendix shows upgrade path CP_R77.30_Appendix_ReleaseNotes.pdf

If you are running version prior to R75.40 you will need to upgrade to R77 first, but read the release notes

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Kaspars_Zibarts — Wed, 10 Jan 2018 16:46:34 GMT

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Prince_Osei_Wia — Wed, 10 Jan 2018 17:02:12 GMT

I am running SPLAT on the old management server. DOes that mean that I will be required to upgrade the old server to GAIA R77 before I can export the configuration files and import into the new management server?

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

PhoneBoy — Wed, 10 Jan 2018 17:20:51 GMT

If you're running R75 GA, then you will need to upgrade to an intermediary release first.

Plug your exact situation into the Upgrade Wizard in SupportCenter.

You'll get something like the following with appropriate download links.

Note upgrading to an intermediary release from your existing SPLAT management can be done in-place, whereas going to Gaia and R80.10 must be done with migrate export/import.

I also echo the sentiment that you should involve Professional Services (either from your partner or Check Point) to ensure your upgrade is smooth.

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Kaspars_Zibarts — Wed, 10 Jan 2018 17:25:03 GMT

No, you start new server as R77, do export from old using R77 tools and then upgrade new server from R77 to R77.30

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

PhoneBoy — Wed, 10 Jan 2018 18:15:31 GMT

Also a valid approach.

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

AlekseiShelepov — Wed, 10 Jan 2018 21:10:59 GMT

Personally I would go with a clean R77.30 install from the beginning, which includes "support for SHA-256 based certificates for all blades / features". Maybe some more good fixes included from the beginning, should be easier. Just another option.

Prince Osei Wiafe, and remember about snapshot, if decide to upgrade the old server as a middle step.

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Michael_Lawrenc — Wed, 10 Jan 2018 23:35:09 GMT

I've helped customers go from R70 to R77.30 and R75 to R77.30. In both cases, I had to do a couple of "hops". (R70->R75->R77->R77.30) I used upgrade_import/upgrade_import for both and used clean hop systems. (i.e. I would NOT try this as an upgrade in place. If it goes south, you have no fallback.) We also had to go from SPLAT to Gaia. As Phoneboy mentions, you'll need migrate_import for the R80 step, but it's pretty much the same. But, this is the step that I would be most worried about since so many things have changed between R77 and R80. I would definitely prototype that with your production database to make sure it works. And, have that fallback - very important. It's a delicate process although simple in concept. If possible, I would do one hop at a time and test before moving on to the next. (If possible - it's not a showstopper if you can't)

And, at the risk of breaking rules here on the boards (Let me know if I'm out of line here Dameon), I am a Check Point partner who can do this for you or provide a "second pair of eyes" and guidance.

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Prince_Osei_Wia — Thu, 11 Jan 2018 09:23:07 GMT

Hi Dameon, from your approach, does that mean that the old appliance which will be decommissioned be upgraded first to R77.30 using the steps before the migration can be done onto the new appliance?

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Prince_Osei_Wia — Thu, 11 Jan 2018 09:24:00 GMT

Thanks Michael. I will share the problems I encounter then you can advise on them.

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Kaspars_Zibarts — Thu, 11 Jan 2018 11:02:57 GMT

If you upgrade on old appliance you lose ability for quick rollback - make sure that you make the snapshot before you start.

I would do export from old R75 to new appliance R77 and the upgrade new appliance to R77.30. But in this case you won't have "clean" R77.30 on the new box, but very quick rollback possibility

You can do R75 to R77 upgrade on the old appliance, then do export and upgrade new to R77.30 (slow rollback!) So you don't need to upgrade old to R77.30 to answer your question. Just the intermediate part - R77.

If you are familiar with VMWare Player/Workstation, you can spin up R77 VM on your laptop and perform intermediate upgrade there: export R75 to VM R77, then export VM R77 to new R77.30 appliance. This way rollback is fast and you have "clean" new R77.30

Clear as a mud!

But it sounds like you would be better off with professional help

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Prince_Osei_Wia — Thu, 11 Jan 2018 11:33:10 GMT

Thanks Kaspars, this approach will help. The good thing is that I will quickly setup the the VM and try what you proposed above.

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Prince_Osei_Wia — Thu, 11 Jan 2018 15:26:06 GMT

Kaspars, so i tried with the first option following the instructions in the guide as instructed.

I also downloaded migration tools for r77 as sugeested.

The following errors were encountered.

[11 Jan 15:17:48] [ExecCommandGetOutput] Going to execute command: '"/opt/Check_Point_migration_tools_R77/pre_upgrade_verifier" -p "/opt/CPsuite-R75/fw1" -c 6.0.2.0 -t
6.0.4.0'
[11 Jan 15:17:48] [ExecCommandGetOutput] ERR: Command completed with error code -1
[11 Jan 15:17:48] .<-- ExecCommandGetOutput
[11 Jan 15:17:48] [PreupgradeVerifierRunner::exec] ERR: Preupgrade verifier had failed
[11 Jan 15:17:48] [PreupgradeVerifierRunner::exec] Preupgrade verifier's output:
-------------------------------------
"/opt/Check_Point_migration_tools_R77/pre_upgrade_verifier" -p "/opt/CPsuite-R75/fw1" -c 6.0.2.0 -t 6.0.4.0: Permission denied

-------------------------------------
[11 Jan 15:17:48] <-- PreupgradeVerifierRunner::exec
[11 Jan 15:17:48] [ActivitiesManager::exec] ERR: Activity 'PreupgradeVerifierRunner' failed
[11 Jan 15:17:48] [ActivitiesManager::exec] WRN: Activities execution finished with errors
[11 Jan 15:17:48] [ActivitiesManager::exec] WRN: Activities 'PreupgradeVerifierRunner' have failed
[11 Jan 15:17:48] [ActivitiesManager::exec] Designated exit code is 1
[11 Jan 15:17:48] --> CleanupManager::Instance
[11 Jan 15:17:48] <-- CleanupManager::Instance
[11 Jan 15:17:48] --> CleanupManager::DoCleanup
[11 Jan 15:17:48] [CleanupManager::DoCleanup] Starting to perform cleanup
[11 Jan 15:17:48] .--> DirCleaner::exec
[11 Jan 15:17:48] [DirCleaner::exec] Going to remove directory '/opt/CPsuite-R75/fw1/tmp/migrate/'
[11 Jan 15:17:48] .<-- DirCleaner::exec
[11 Jan 15:17:48] [CleanupManager::DoCleanup] Completed the cleanup
[11 Jan 15:17:48] <-- CleanupManager::DoCleanup

[Expert@cpmgt1]# /opt/Check_Point_migration_tools_R77/migrate export /scremy.tgz
Execution finished with errors. See log file '/opt/CPshrd-R75/log/migrate-Thu_Jan_11_15-25-37_2018.log' for further details
[Expert@cpmgt1]#

Is this normal?

Re: Hello everyone, I have an old management server running on R75 which will be end of life soon. I have purchased a new management server and I need assistance to migrate all the rules, policies, objects and everything to the new management server runni

Prince_Osei_Wia — Thu, 11 Jan 2018 16:02:19 GMT

Think I made a head way... Database migration was successful on the source machine

[Expert@cpmgt1]#
[Expert@cpmgt1]#
[Expert@cpmgt1]# ./upgrade_export /scremy.tgz

You are required to close all clients to Security Management Server
or execute 'cpstop' before the Export operation begins.

Do you want to continue? (y/n) [n]? y

Copying required files...
Compressing files...

The operation completed successfully.

Location of archive with exported database: /scremy.tgz