topic Upgrading Management only to R80.20 and user.def.FW1 in General Topics

Upgrading Management only to R80.20 and user.def.FW1

Thomas_Allen — Fri, 09 Nov 2018 22:36:20 GMT

We recently upgraded our management server from R77.30 Take 302 to R80.20. We are planning on upgraded the gateways, but they currently are at R77.30. We have many IPSec VPN tunnels to different cloud providers and partners. For some of them, I needed to use the user.def.FW1 file to explicitly define the IP ranges to use for a particular tunnel encryption domain.

Today, I discovered that my tunnel to the Oracle cloud was not setting up SA's to all of my IP ranges. I double checked to be sure the user.def.FW1 file came through with the migrate import process. It did. A quick email to my VAR (Thanks Daniel!), and I had the answer.

I have to use the compatibility version of the user.def.FW1 file - user.def.R77CMP. Once I populated this file, and pushed policy, the gateways negotiated the proper SA's, and all is well.

Re: Upgrading Management only to R80.20 and user.def.FW1

PhoneBoy — Fri, 09 Nov 2018 23:32:30 GMT

Mind if I move this to a more general space such as General Product Topics‌?

Re: Upgrading Management only to R80.20 and user.def.FW1

Thomas_Allen — Fri, 09 Nov 2018 23:48:44 GMT

Please do.

Thanks.

Re: Upgrading Management only to R80.20 and user.def.FW1

RickHoppe — Sat, 10 Nov 2018 09:34:50 GMT

Make sure you check sk98239 before future upgrades of the Management Server.

Furthermore, you need this article too if you manage a variety of Security Gateways with different installed versions (and when they are being used for VPN).