SMS Upgrade from R81 to R82 : Migrate export Warnings, S2S VPN

[dceko]

Hello community,

We are trying to upgrade CheckPoint Secure Management Seerver from R81 (and R81.20)  to R82.

When we run migrate export, Upgrade report shows warning about verifying the Site to Site VPN Encrytion Domain per Community (screenshot attached). Upgrade report shows same warning with R81, and with R81.20. We have folowed solution with Jumbo Hotfix Accumulator, with no luck.

We have multiple clients with multiple Site to Site VPN tunnels, and as in sk170857 we do not prefer to change as suggested in immediate workaround (VPN Community : According to gateway).

We have tried migrate export with skip warnings in lab environment, it executes with success, and import is succesfull.

I am wondering if anyone have faced this or similar issues or how to resolve it.

Any help appreciated,

Regards,

[_Val_]

The warning does not indicate that you would face any immediate issues after the upgrade. First, you need to check if you are even using EDCP in the first place. If yes, proceed with extra care.

But if you are already running one of the mentioned versions:

• Jumbo Hotfix Accumulator for R81.20 starting from Take 43
• Jumbo Hotfix Accumulator for R81.10 starting from Take 131
• Jumbo Hotfix Accumulator for R81 starting from Take 99
• Jumbo Hotfix Accumulator for R80.40 starting from Take 211

you should not expect any issue at all.

[_Val_]

To be on the safe side,

1. Keep your MGMT backup or snapshot for rollback
2. upgrade yout MGMT
3. set a service window
4. select the least important VPN tunnel and push policy on the relevant GWs
5. observe the results and make corrective actions if required
6. proceed with the rest of the tunnels one by one

[dceko]

Actually, what we did is we used Jumbo Hotfix Accumulator for R81 Take 107. We will try to use Take 99, and check upgrade report again. For R81.20 we have to check which Take was used.

[Alex-]

We did upgrade an R81.20 SMS to R82 today with advanced upgrade (migrate_server) and don't see adverse impacts on VPN, they all use custom encryption domains.

Probably a general warning in the verifier.

[dceko]

Hi Alex, 

Just for info, when you did upgrade from R81.20 SMS, did you have to run migrate export with --ignore_warnings flag, or it completed succesfully without it?

Regards

[Alex-]

Yes, using the flag was necessary.

[_Val_]

In this case, it is already included in the higher Take version

[Alex-]

Note the SK states that the fix is actually if you're not in the versions where the behaviour is addressed.

[CaseyB]

We had the same warning, I believe it is meant to be more of a "BTW" notice. Every single one of my IPsec VPNs use granular encryption domains and we had zero issues with IPsec VPNs after the upgrade.