Snapshot to upgrade 3000 series HW (3600 to 3800)?

[Scottc98]

Is there any use case where you can use a snapshot of a current cluster and use it to move to another set of hardware?   I totally understand when you are moving up to different hardware with different cards and such.

I was more looking at a situation where you would move from a 3600 to a 3800 series.   The physically nics and hardware is basically the same; it would really be about increasing the CPU and RAM on such conversions.    If one was low on RAM on a 5000/6000 series, you would just pop in some RAM; where on the 3000 series, you have to replace the hardware.  

I might have some situations with some 3600s and just trying to think in advance on how I can easily replace them in the field with some 3800s I have; limiting the staging and downtime for a remote site (i.e. Keep it simple for hand on staff and remote engineers ;))

[_Val_]

Not a good idea, always use backup and not snapshot when between different HW.

[Scottc98]

I figured as much 🙂   

@_Val_ 

Can I use a system backup here to move from 3600 to 3800?    Reading SK91400, it lists this limitation:

"Restore is only allowed using the same appliance model on the source and target computers."

There is also this one I am curious about:

"Once restore is done, you must reboot the machine and install policy in order to apply the new configuration."

   - Upon the restore, is the current policy that was on the backup file properly working or is this a case where you have to do a 'fw unloadlocal' and then push policy?     This was one of my initial concerns that I understood a snapshot would not have.    If the backup file has the current policy upon load but just needs a push post replace to 'sync' back up, that isn't as bad.

@the_rock 

In the use case of 3600 => 3800, I really don't think there is a real difference within the 'show configuration' portion here on these boxes.   I would think I would be ok with a complete copy of gaia config as you mentioned would copy over like for like but then there is the extra .conf file edits one would have to manually make that a backup shouldn't require.

[the_rock]

Totally up to you, but I did this with customers before and even TAC told us that doing restore, specially when models are different is not a good idea, which I agree with 100%.

All I did is exactly what I mentioned. Saved the file, then simply copy it over to new fw, made sure to make necessary changed, did below and then loaded the file

Andy

[Expert@QUANTUM-MANAGEMENT:0]# clish
QUANTUM-MANAGEMENT> set clienv on-fai
QUANTUM-MANAGEMENT> set clienv on-failure cont
QUANTUM-MANAGEMENT> set clienv on-failure continue
QUANTUM-MANAGEMENT> save config
QUANTUM-MANAGEMENT> load config
QUANTUM-MANAGEMENT> load configuration

Just be careful if you run set clienv command to continue on failure, UNLESS you are POSITIVE config is fine. Personally, I always copy bits and pieces, so it can tell me if something is wrong.

Now, if you load the config file, it will NOT tell you if something is wrong, will simply continue, so you would need to figure it out yourself.

Btw, backup wont restore any jumbo hotfixes, something to keep in mind.

Cheers,

Andy

[Scottc98]

Thanks @the_rock 

I think I'll have to take the manual approach here first just to be safe.   It just will add to a lot more steps here staging before shipping and on site work to get it online.   I might be able to use a new management IP on a few sites and that may allow for me to rebuild with a new cluster Name/IP & install policy before cutting over.  

I'll have to put some more thoughts on this one 😉

[the_rock]

As I said, everyone has their own approach, but I always found show configuration is the safest.

Just my honest feedback/suggestion.

Andy

[the_rock]

Also, for whatever this is worth, if you look at below sk, it states that backup CAN be restored on different firewall running the same OS and hotfixes, but in the words on Dallas TAC escalation guy few years ago, key word is can be, but will usually never work properly...and thats 100% accurate statement actually.

https://support.checkpoint.com/results/sk/sk108902

Anyway, something to think about...again, Im just giving you my HONEST feedback/opinion. I would never force anyone to do anything, its a free world after all : - )

Andy

[_Val_]

show config, then copy/paste. Also, make sure the interface names are the same, or edit the captured config before pasting 

[the_rock]

I agree with that 100% Val. I find that method always works without any issues.

Andy

[the_rock]

Personally, I would not use either if I were you. Interfaces might be different, along with few other things...

 I always do show configuration, save it into a file and then copy bits and pieces. You also need to confirm interface names, as config related to it would not work, since names might be different.

from expert -> clish -c "show configuration" > /var/log/currentconfig.txt

Andy