topic Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN in General Topics

SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

dceko — Wed, 13 Aug 2025 07:17:48 GMT

Hello community,

We are trying to upgrade CheckPoint Secure Management Seerver from R81 (and R81.20) to R82.

When we run migrate export, Upgrade report shows warning about verifying the Site to Site VPN Encrytion Domain per Community (screenshot attached). Upgrade report shows same warning with R81, and with R81.20. We have folowed solution with Jumbo Hotfix Accumulator, with no luck.

We have multiple clients with multiple Site to Site VPN tunnels, and as in sk170857 we do not prefer to change as suggested in immediate workaround (VPN Community : According to gateway).

We have tried migrate export with skip warnings in lab environment, it executes with success, and import is succesfull.

I am wondering if anyone have faced this or similar issues or how to resolve it.

Any help appreciated,

Regards,

Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

_Val_ — Wed, 13 Aug 2025 07:27:12 GMT

The warning does not indicate that you would face any immediate issues after the upgrade. First, you need to check if you are even using EDCP in the first place. If yes, proceed with extra care.

But if you are already running one of the mentioned versions:

Jumbo Hotfix Accumulator for R81.20 starting from Take 43
Jumbo Hotfix Accumulator for R81.10 starting from Take 131
Jumbo Hotfix Accumulator for R81 starting from Take 99
Jumbo Hotfix Accumulator for R80.40 starting from Take 211

you should not expect any issue at all.

Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

_Val_ — Wed, 13 Aug 2025 07:29:37 GMT

To be on the safe side,

Keep your MGMT backup or snapshot for rollback
upgrade yout MGMT
set a service window
select the least important VPN tunnel and push policy on the relevant GWs
observe the results and make corrective actions if required
proceed with the rest of the tunnels one by one

Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

Alex- — Wed, 13 Aug 2025 07:29:57 GMT

Note the SK states that the fix is actually if you're not in the versions where the behaviour is addressed.

Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

dceko — Wed, 13 Aug 2025 07:51:10 GMT

Actually, what we did is we used Jumbo Hotfix Accumulator for R81 Take 107. We will try to use Take 99, and check upgrade report again. For R81.20 we have to check which Take was used.

Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

Alex- — Wed, 13 Aug 2025 10:03:25 GMT

We did upgrade an R81.20 SMS to R82 today with advanced upgrade (migrate_server) and don't see adverse impacts on VPN, they all use custom encryption domains.

Probably a general warning in the verifier.

Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

_Val_ — Wed, 13 Aug 2025 10:12:48 GMT

In this case, it is already included in the higher Take version

Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

CaseyB — Wed, 13 Aug 2025 13:02:13 GMT

We had the same warning, I believe it is meant to be more of a "BTW" notice. Every single one of my IPsec VPNs use granular encryption domains and we had zero issues with IPsec VPNs after the upgrade.

Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

dceko — Thu, 14 Aug 2025 11:10:15 GMT

Hi Alex,

Just for info, when you did upgrade from R81.20 SMS, did you have to run migrate export with --ignore_warnings flag, or it completed succesfully without it?

Regards

Re: SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

Alex- — Thu, 14 Aug 2025 11:14:43 GMT

Yes, using the flag was necessary.