Migration from old firewall to new firewall

[Hazard139370]

I have sms with two firewalls added in a cluster they are already expired. recently my company bought two new firewalls.
My current infrastrucuture is based on 81.10 

Please tell me step by step process to migrate

[PhoneBoy]

We need more information such as:

• Current gateway type
• New gateway type
• What is the SMS on currently?
• Is there new hardware for this also?

[Hazard139370]

gateways are  used as internet firewall and appliance modelel is 15000 and my company bought two new 9400 appliance.
i have sms on vm . both sms and old firewalls are on version 81.10

i want to keep the same sms and add new firewall cluster to it

[PhoneBoy]

The minimum software release for the 9400 is R81.20, though they are probably shipping with R82 (the current recommended release).
This and the fact R81.10 is End of Life suggests you should upgrade your SMS to R82 before doing anything else.
I agree with @the_rock that using the advanced migration process should be used.

The security policy is on the SMS.
Adding new gateways to it and pushing that same policy is relatively straightforward.
The basic Gaia configuration can be copied from one appliance to another. 

[the_rock]

Here is what I had done few times with customers and this worked well.

I would build brand new mgmt and use below process to move all the policies and config over.

https://support.checkpoint.com/results/sk/sk135172

Then, once thats done, use below to replace the cluster:

https://community.checkpoint.com/t5/Firewall-and-Security-Management/Replace-Upgrade-Cluster/td-p/69...

Now, if you want to keep same mgmt server, as long as its powerful enough to run new version (preferable at least R82), then upgrade it, so no need to run migrate server. Now, here is important part. As Heiko mentioned in replacing cluster post, its mandatory to ensure that interfaces on new firewalls are configured correctly to reflect topology in smart console cluster object. One way to make sure of that is to copy show configuration from clish off existing firewalls and the copy "bits and pieces" to new fw clish config.

Hope that helps.

[Martijn]

Hi,

Because new hardware is on a newer version, you must upgrade the SmartCenter first.
I agree @the_rock and would perform a advanced migration to a new SMS. I would then create the new cluster (if possible) in parallel on the new SMS.

When using this procedure, you can create the cluster using the new physical ports on the appliance and not worry they are different from the old hardware.

During a maintenance window, just switch over to the new cluster by switching the network cables of by disabling and enabling switch port.

Important note is you always have a roll-back option beacuse you leave the old setup untouched.

Good luck!!

Martijn

[the_rock]

That also works @Martijn . Mind you, just need to be careful about any possible IP address conflict, thats all.

[Martijn]

Another important tip.

If you decide to create two cluster objects (old and new) within the same SmartCenter, it is OK to give those clusters the same IP-addresses as long as only one cluster is connected to the network. For management (policy installs) I usally take two new IP-addresses in the management IP range (if possible) and make that interface Private instead of a Cluster interface. During migration you can disconnect old cluster and configure a VIP on the new cluster for that interface.

You can push policy to both cluster so a freeze is not needed. But...do NOT configure IPSec on both clusters. Pushing policy to two clusters with the same topology and IPSec enabled will break VPN tunnels. Perform that action during a service window.

Martijn