Migrating R81.20 Cluster XL to new 9100 appliances

[Joe_Kanaszka]

Good Afternoon!

I have a project to complete the migration of a two node cluster running on a pair of 5100 appliances to (2) new 9100 appliances.

I have a month but I'd like to get this done sooner than later.

Both new servers are fresh out of the box and racked next to their cluster members they will be replacing. (so old_GW1 is racked next to new_GW1, etc...

I'd rather not change too much at one time, so for now I plan on staying on R81.20 with the latest patches.

My old cluster is not up to date with the latest patches - but still on R81.20.

I have a general idea how this migration will work.

I'm referring to this post:

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/m-p/69251#M5294

Where I'm getting tripped up is with the "initial configuration" phase.  Do I use the "First Time Wizard" on the new appliances?  I'm keeping the same IPs as the old gateways, so I obviously cannot configure the interfaces on the new appliance and have it online at the same time.  I installed LOM cards in the new 9100s so I can work offline.

So that's my first question...how do I get these new appliances to the point that I can perform the actual swapping out, re-cabling, SICing, and pushing policy?

One area that is really confusing me are the interface re-mappings to my new gateways.  I know this can be done from the "advanced tab" but not sure how this actually works.

My new 9100s have 8 interfaces plus a management interface.

Here is what my interfaces look like on my old gateways:

Mgmt is actually an External Standby ISP connection (we ran out of interfaces) - We use ISP redundancy on the Cluster.

eth1 - External - Primary ISP

eth2 - External - No longer used - Decommissioned ISP link - replaced by the link on "Mgmt"

eth 3 & eth4 - internal LAN

eth5 - sync

My new appliance has 8 interfaces plus a Management.  What I would like to do on new appliance:

eth1 - External - Primary ISP

eth2 - External - Standby ISP - (move this interface from Mgmt)

eth 3 & 4 - Internal LANs 

eth5 - sync

Is this possible?  Thank you again!!!

[the_rock]

Hey brother,

Here is what I ALWAYS do in this case (must had done it more than 20 times) and never had the issue:

1) Do initial wizard on new appliances, connect them to Internet for time being, so you can install recommended jumbo on version that came with it and enable any needed interfaces

2) follow the same with other appliance

3) install eval licenses for the time being

4 ) generate corresponding show configuration from existing firewalls and copy bits and pieces to corresponding new firewalls, just make sure not to override any IP until cutover and enable whatever interfaces have to be enabled

5) compare the config, make sure all is good, if it is...

6) last step is follow the link you references and NO NEED to delete anything from smart console

7) once done,you can be proud of great job you did 👌👍🙌

[Joe_Kanaszka]

Thanks Andy!  

generate corresponding show configuration from existing firewalls and copy bits and pieces to corresponding new firewalls, just make sure not to override any IP until cutover and enable whatever interfaces have to be enabled

So just use Clish to copy the config over (bits and pieces)...What are the necessary pieces of the config that I need from the old gateways?  IPs and interfaces...What about routes?  We have ISP redundancy so my default route will change depending on which ISP link is active.   Would it be easier to use the migrate export and import commands?

And...Sorry Andy - but this part trips me up..

What about my existing interfaces - in particular my standby ISP link that is currently on the MGMT interface?  Can I use the advanced settings in SmartConsole to change the interface on the new device so that link is now on ETH2 - not MGMT?

Thanks again Andy!!!

[the_rock]

No problem. Yes, for existing interfaces, thats tricky part, make sure you decide beforehand the CORRESPONDING ones on new firewalls, so then clish config for those can be copied, just make sure name matches name on new firewalls. Also, routes can be copied, but again, as long as new device is NOT on the network, same routes/IPs can be copied, not an issue.

[the_rock]

@Joe_Kanaszka 

FWIW brother, I followed that exact same method for every customer I did this for. Last time, it was large hospital...well, truth be told, its NOTHING as bag as say West China Medical centre or Geneva University Hospital, but its hospital that serves city of about 200,000 people, so definitely important and my client there followed exact steps I mentioned, all went so smooth, no issues when we did cutover.

If you need anything else, let me know, I can put together some notes I took about it.

[Joe_Kanaszka]

Thanks Brother!

So just to clarify re: the interfaces:

If my old 5100 has the Mgmt interface as ISP2 - I can change this to ETH2 on the new device?

So old 5100:

Eth1 - ISP1 (Active ISP in ISP Redundancy)

Eth2 - ISP2 (Decommissioned & not used)

Mgmt - ISP2 (Standby ISP in ISP Redundancy)

I can change this on the new 9100 to :

Eth1 -ISP1 (Active ISP in ISP Redundancy) - no change

Eth2 - ISP2 (Standby ISP in ISP Redundancy) - changed from Mgmt interface on 5100

Mgmt - new management IP (Changed from decommissioned & unused ISP2 on 5100)

These interface changes can all be made in CLISH on the new 9100 correct?  No need to mess with the Advanced interface settings in Smart Console?

Thanks again Andy!

[the_rock]

You got it!

[the_rock · Accepted solution]

Here is something I always do:

on current fw, run this from expert:

clish -c "show configuration" > /var/log/config_hostname_date.txt 

then, get the file off the fw, make sure scp is on (chsh -s /bib/bash admin is the command to enable it, or whatever admin name is)

once you got the file, copy bits and pieces to NW fw as we discussed, then when ready, do the same thing on new fw, compare configs, it will give great idea if things look right

Mesage me any time, we can even have a call if needed.

[Joe_Kanaszka]

Thank you again Andy!  What do you mean by NW fw?  Just curious...

[the_rock]

You can tell English is not my first language haha...I meant NEW fw 😂

[Joe_Kanaszka]

No worries brother!  I envy you for speaking a second language in the first place!

[the_rock]

I always found that to be the biggest sign of respect anywhere in the world you go, and I been to more than 99% of it lol. If you put an effort to learn even few words of the local language, people TRULY APPRECIATE it.

[Joe_Kanaszka]

I absolutely agree with you!

[the_rock]

2 IMPORTANT things, though kind of goes without saying 🙂

1) make sure default gateway is right on new firewalls

2) DNS servers are correct

[the_rock]

I attached basic steps I put together, just ingnore first 2, since we did migrate server last time, as they built new mgmt server.

[Joe_Kanaszka]

Thank you sooo much Andy!  I really appreciate this!  

[the_rock]

Glad we can help you my friend.