RSA SecurID and upgrading to R80.30 from R77.30

[jwmac]

I am planning to upgrade a our 2 gateways running ClusterXL from R77.30 from R80.30.  We currently use RSA SecurID for our VPN authentication method for our remote users who connect via the Windows Checkpoint Mobile application.

Will anything have to be done to ensure VPN continues to work for our remote users after upgrading?  Do I need to re-upload the sdconf.rec file after the upgrade?  Will anything else need to be done?

thanks

[Ryan_St__Germai]

As long as IP addresses are not changing then it should be simple. We just copied over the sdconf.rec, sdopts.rec and securid files that were located in /var/ace and only ran into one snag. On R77.30 the sdopts.rec file had CLIENT_IP=192.168.1.1 where as in R80.30 the format required a space after the "=" sign so we changed it to CLIENT_IP= 192.168.1.1

[mdjmcnally]

How are you upgrading?

If CPUSE inplace then the sdconf.rec should be in place already on the boxes.

If doing a clean rebuild to R80.x then the files would be lost and would need to re-establish the connection between the boxes and the RSA.

[Ryan_St__Germai]

Sorry, missed your upgrade path in the post. We did a fresh install on new hardware. If you are doing a CPUSE upgrade then you shouldn't have any trouble. I would leave the sdopts.rec file alone and if you do experience a problem authenticating then try adding a space after the "=" sign. I believe that change does require a cpstop/cpstart.

[jwmac]

Excellent, I will be sure to check the sdopts.rec for the space after "=" if I run into any issues.

On a side note, how was the upgrade overall for you guys?  Pretty straight forward? Any other issues?

thanks

[Ryan_St__Germai]

Upgrade wise it ended up being very straight forward all things considered. Our Management box was already on R80.30 so that helped some. We did run into two problems. The first issue was related to logs not being sent to the mgmt box from the gateways. We fixed this by going into the cluster object properties and under "Logs" we removed the management box as the logging server then re-added it and pushed policy.

Second issue is ongoing and may just be limited to our environment. We are currently experiencing a memory leak on our clustered gateways. After about a week the active gateway runs out of memory and fails over so we have an ongoing support case for that.

[jwmac]

I am planning to use the CPUSE and doing an upgrade and not a fresh install.  If the sdconf.rec is carried over then it sounds like all I should need to do is update the sdopts.rec file to include the space after the "="?