- CheckMates
- :
- Products
- :
- General Topics
- :
- Re: R80.10 to R81 migration and licences
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
R80.10 to R81 migration and licences
Hello,
I have a SMS version R80.10 running on a Smart-1 410 appliance (and a pair of R80.10 gateways running on 5600 appliances). I want to do an advanced upgrade with migration and I will do it for my SMS first. Since this is quite complex two steps process, doing first R80.10 - -> R80.40 with old ./migrate export tools and R80.40 - -> R81 with new ./migrate_server tools as a second step, I want to do it offline, to migrate my database to R81 virtual machine, assure that I can load my existing policy in R81 version before deploying it in my production network. So, in other words, my plan is to do all the migration offline, check if my policy is loading in R81 version and prepare ./migrate_server export from R81. If everything runs OK, I will reinstall Smart-1 410 from the scratch with R81 ISOMorphic tool and do ./migrate_server import owith already prepared database.
R80.10 - - > R80.40 went fine, but when I try export R80.40 - -> R81 I run into some troubles with licences. After the ./migrate_server import on a brand new R81 virtual machine, I do not see my licences, even trial 15-day licences are not valid any more. It seems that old migrate export tool always contains the license of the time of the DB export from SMS, but it is not the case for the new ./migrate_server tool. I tried it several times, and each time I got this message trying to connect with SmartConsole (see attached picture).
Is there some possibility to also transfer the licences with the new ./migrate_server tools as it was the case with old ./migrate tools?
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you’re doing this in a VM based on what’s coming from a physical Check Point appliance, the license is only valid for that specific appliance, not in a VM.
You can confirm the licenses came over by doing a cplic print from the CLI.
If no licenses came over (I.e. cplic print is empty), that’s a bug and the TAC should be engaged.
You can apply an All-In-One Eval license to your VM after you perform the migration to confirm the rest of the configuration came over correctly.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you’re doing this in a VM based on what’s coming from a physical Check Point appliance, the license is only valid for that specific appliance, not in a VM.
You can confirm the licenses came over by doing a cplic print from the CLI.
If no licenses came over (I.e. cplic print is empty), that’s a bug and the TAC should be engaged.
You can apply an All-In-One Eval license to your VM after you perform the migration to confirm the rest of the configuration came over correctly.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @PhoneBoy for you explanation, you are right, I took the migrate export from the physical CheckPoint appliance and tried ./migrate_server import into a VM. I now understand the reason why it does not work. I have checked cplic print, it only shows trial license, so real licences are not valid here. Thanks for your help, I will try to do an upgrade with the All-In-One Eval license.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wait a second...if you did ./migrate export and import, that always imports the licenses from original server. I had done it many times and that was always the result. Are you saying it did NOT move over original licenses to a new server?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As stated above by PhoneBoy: the export from an appliance can not include licenses valid for VMs, only licenses for an appliance with the same MAC address.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, I see what you are saying...never really paid attention to that before, but I guess it makes sense : )
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Technically, no. MAC is an ID of your appliance licenses, but they are enforced by IP address. Running appliance license or an open server/VM is still a violation of your service agreement though.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FYI, you don’t apply the eval license after the migrate_server import.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @PhoneBoy I will apply the eval license first.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually, I had that incorrect: you do it after. 😬
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I got it, thanks @PhoneBoy
