topic Re: Migration from 1590 to 1600 in Spark Firewall (SMB)

Migration from 1590 to 1600

ICSI — Tue, 27 Jun 2023 03:32:14 GMT

It is possible to migrate the configuration from a Spark 1590 to a Spark 1600?

The backup and restore option do not work and has to be typed manually, horrible! According to tech support it is not supported. is that true?

Re: Migration from 1590 to 1600

Chris_Atkinson — Wed, 28 Jun 2023 08:58:01 GMT

Locally or centrally managed?

Indeed the scenario is not covered in the applicable documentation that I can find:

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Backup-Restore-Upgrade-and-Other-System-Operatons.htm

sk170162: How to upgrade hardware from R77.20.87 to R80.20.15 or higher

Please raise the requirement with your local CP SE.

Re: Migration from 1590 to 1600

ICSI — Tue, 27 Jun 2023 17:05:05 GMT

Right? We need to solve this. Perhaps I have a client right now stuck copying their complex configuration from one appliance to the other.

I would say that we need as Check Point to solve this kind of issues, we should be able to copy and paste the configuration using the console for example, as is on most of the appliance and most of the IT guys are doing their chores when is about updating complex configurations.

Of course, the Backup n Restore its an awesome feature, but it is not supported in this case.

Wishing to have a quick fix like right now, to provide this answer to my customer.

Re: Migration from 1590 to 1600

the_rock — Tue, 27 Jun 2023 18:03:54 GMT

Personally, if you cant do restore, I would say get show configuration from 1590 and then copy bits and pieces to 1600 (just make sure that interface/ports are matching)

Hope that helps.

Andy

Re: Migration from 1590 to 1600

ICSI — Tue, 27 Jun 2023 18:09:42 GMT

As you suggested, that's what my client is doing. But as a partner, I feel sorry for this situation. I would insist to the R&D Check Point team, to create migration process for the same family of appliances. Anyways, probable nobody gives them this kind of feedback.

@PhoneBoy is this a good place to create this kind of feedback? or there is any other place that we should go?

Re: Migration from 1590 to 1600

the_rock — Tue, 27 Jun 2023 18:12:31 GMT

I understand, I was in such situation many times, but at the end of the day, if there is no better way, cant make one up : - ). If vendor comes up with something else, great, but if not, you have limited choices.

Andy

Re: Migration from 1590 to 1600

PhoneBoy — Tue, 27 Jun 2023 20:30:08 GMT

I do know that we allow for migrating older appliances to current ones: https://support.checkpoint.com/results/sk/sk170162

What is the source version the backup was taken on?
What is the target version you are attempting to restore on?
There's an internal note in the above SK that suggests backups made on R80.20 cannot be restored on R81.10.xx.
Which suggests if the backup was taken on R80.20, you will probably need to upgrade the gateway to R81.10.xx, then take the backup.

Re: Migration from 1590 to 1600

ICSI — Tue, 27 Jun 2023 21:03:22 GMT

Client response:

"What is the source version the backup was taken on? 1590 version R81.10.5
What is the target version you are attempting to restore on? 1600 Version R81.10.5
There's an internal note in the above SK that suggests backups made on R80.20 cannot be restored on R81.10.xx. – both was on the same version but only different model "

What do you think we should do now?

Re: Migration from 1590 to 1600

PhoneBoy — Tue, 27 Jun 2023 21:13:19 GMT

I suspect TAC is correct and this is not yet a supported upgrade path.
Doesn't mean it won't be supported in the future.
@Amir_Ayalon is this in the plans?

Re: Migration from 1590 to 1600

ICSI — Wed, 28 Jun 2023 22:51:41 GMT

Any response?

Believe or not my client is just about to sign for a 3-year license renewal for a 1600 with Platinum Support and he just landed his face against the "Watch Tower app" is not supported in the 1600, ON TOP of the "you can restore a backup from the 1590 into this 1600". No script no documentation about that. two major disappointments.

He does most of his work remotely and he finds this app very useful.

Re: Migration from 1590 to 1600

the_rock — Wed, 28 Jun 2023 18:13:45 GMT

Honestly, @ICSI , this is my best suggestion...we had clients in the past stuck on similar things and I always found best way to get any traction is to have SE involved. Once they know the situation and that contract is on the line because of it, TRUST ME, they WILL do something : - )

Re: Migration from 1590 to 1600

ICSI — Wed, 28 Jun 2023 22:14:22 GMT

Good idea!

Re: Migration from 1590 to 1600

Amir_Ayalon — Wed, 28 Jun 2023 22:35:58 GMT

checking

Re: Migration from 1590 to 1600

Amir_Ayalon — Wed, 28 Jun 2023 22:38:03 GMT

will check and advise

Re: Migration from 1590 to 1600

ICSI — Wed, 28 Jun 2023 22:48:09 GMT

Thank you @Amir_Ayalon! hope we can get a solution.

Re: Migration from 1590 to 1600

Ben_Dunkley — Thu, 15 Feb 2024 18:37:08 GMT

@Amir_Ayalon Did anything ever come of this?

I'm finding myself is a similar situation, wanting to migrate a customer from a 1555 to 1575 - and while it will perform a restore of the 1555 backup onto the 1575, that messes up the interfaces significantly, and a config dump/re-enter has other issues as well.

And apologies for resurrecting a 9 month old thread!

Re: Migration from 1590 to 1600

ICSI — Thu, 15 Feb 2024 19:18:13 GMT

Hi @Ben_Dunkley,

After reviewing your comment, the problem is that both devices have different interfaces, and the configurations are very specific to the hardware and because tech is changing so quick they might not have any migration tool at all. Probably if you are a CLISH expert you might copy configurations from one interface into another. I am not familiar with CLISH yet.

The only option now it is to replicate the configuration into the new device, test it and when ready then replace the old in production for the new one.

I am actually migrating a 790 into a 1575 right now.

Best!

Re: Migration from 1590 to 1600

the_rock — Fri, 16 Feb 2024 00:47:43 GMT

Thats what I always do, even for regular Gaia...just copy "bits and pieces" from existing to new machine. Its easy to correct interface names from text editor. Also, not sure if this exists on smb clish, but in regular gaia clish, you can do something like set clienv on-failure continue (I think is command) and then it tells you line you need to fix, as it will show where it stops, so that is also an option.

Best,

Andy