R70 Splat NGX to R77.30 migration

ashish_verma — Fri, 22 May 2020 20:00:50 GMT

Hello Team,

Need your help in one issue. We are having 2 SMS:

1) R70 Splat which manage only one gateway

2) R77.30 which manage all the other site GWs

The requirement is to shut R70 SMS and merge its policy package with R77.30 and start managing all GWs with R77.30. Later on will migrate R77.30 to R80.30.

Since cp_merge requires both the source and destination SMS should be of same version we have planned to first upgrade R70 SMS to R77.30 and then using cp_merge to merge the policy package of R70 to R77.30

As per the upgrade path first we have to upgrade R70 to R75

R70 >>> R75 >>> R77 >>> R80.30

The issue I am facing is with this upgrade in which when running R75 pre_upgrade_verifier I am getting following error:

[Expert@R70-management]# ./pre_upgrade_verifier -p $FWDIR -c R70 -t R75
Warning: Can't find ::CPSB-COMP-150 in cp.macro. License version might be not compatible
Warning: Can't find ::CPSB-SSLVPN-MOBMAIL in cp.macro. License version might be not compatible
Warning: Can't find ::CPSB-ADNC-M in cp.macro. License version might be not compatible
Warning: Can't find ::CPSB-SWB in cp.macro. License version might be not compatible
Warning: Can't find ::CPSB-WKFL-100 in cp.macro. License version might be not compatible
GetLicFromFile: Failed to open file: /opt/CPshrd-R70/conf/cp.pnp

==============================================================
Action items after the upgrade, before the first installation:
==============================================================

Warnings: It is recommended to resolve the following problems.
==============================================================

Title: Software Blade licenses required
-----
* Description: Check Point software version R75 and above requires Software Blade licenses.
Please deploy a valid Software Blade license instead of your NGX license.
For more details go to http://www.checkpoint.com/products/promo/software-blades/upgrade/index.html or contact Account Services.

Your current NGX license will not be valid.

I generated blade license and attached with the SMS but still I am getting the same error. So my question is:

1) Is it possible to merge policy package directly from R70 Splat to R77.30?

2) If above option is not possible, how can I generate blade license from NGX license as the aforementioned error showing?

3) Is there any other better option to merge the policy package?

Thanks in advance 🙂

Re: R70 Splat NGX to R77.30 migration

PhoneBoy — Mon, 25 May 2020 20:06:38 GMT

The "can't find whatever in cp.macro" errors can be ignored.
It just means your license has features that the version you're running doesn't know about.

Can you provide the output of cplic print (mask sensitive data)?
Worst case, you can generate a 30-day Eval license: https://community.checkpoint.com/t5/General-Topics/How-to-Request-an-Evaluation-License-for-Security-Gateways-and/m-p/40391#M8499

Re: R70 Splat NGX to R77.30 migration

Maarten_Sjouw — Mon, 25 May 2020 21:12:40 GMT

You are stuck with the migration from R70 to R75 from R75 you should be able to import directly into R77
Watch out this is really R77, not R77.30, so you need 2 steps before you can migrate to R77.30!!

topic Re: R70 Splat NGX to R77.30 migration in General Topics

R70 Splat NGX to R77.30 migration

Re: R70 Splat NGX to R77.30 migration

Re: R70 Splat NGX to R77.30 migration