Any easy way to roll back to R77.30 from R80.10

[Jack_Prenderga1]

Our Smart 1-50 appliances are not running fantastic on R80.10, due to it only have 4GB of RAM.

Since Check Point dont provide RAM for the Smart 1-50's anymore, despite them still being in support, we need to roll back to R77.30.

I have a backup from before we upgraded to R80.10, however running a clean install and restoring from this will lose 2 months of work.

We need to roll back and have our current policies and configuration as they are on R80.10.

Im aware there is no easy way to  do via migrate export.

Back up will not work..

I believe there isn't a proper option. 

Anyone else with any advice? Failing  that - anyone know how to get hold of RAM for our Smart 1-50's, that isnt going to invalidate support and warranty of course.

[Daniel_Taney]

Not to sound insulting, but it looks like the Engineering Support ended on the Smart 1-50 at the end of September 2017. Did you have any plans on replacing this box in the near future regardless?

IMO, it would be easier to consider migrating your management to a Physical OpenServer or a VM. If you did that, you'd have complete control over the RAM / Disk specs that best would suit your environment. Doing one more migrate export from R80.10 to another R80.10 box sounds a lot less painful than trying to find a way to engineer a reverse path.

I realize that's probably not the answer you were looking for... but if I was in your situation, it is probably what I would do. 

[Jack_Prenderga1]

Brilliant! Thank you for your advice.

in terms of support, we have plans to replace our management servers in 2019. We didn’t appreciate how much the end of engineering support would detriment the actual support level.

Regards to VM, we were actually planning on doing this.

do you know anything about licensing? How easy is it to transfer your current licenses to VM built security manager?

do you have to buy extra VM licenses or can you get your certificate key changed to the new MAC and voila?

[Vladimir]

Completely agree with Daniel.

If performance is the only impediment of you using R80.10, go with VM SMS.

[Jack_Prenderga1]

Brilliant! Thank you for your advice.

we were actually planning on doing this.

do you know anything about licensing? How easy is it to transfer your current licenses to VM built security manager?

do you have to buy extra VM licenses or can you get your certificate key changed to the new MAC and voila?

[Vladimir]

For management, to the best of my knowledge, all you have to do is re-issue the license to a different platform.

I do not believe that in case of open servers or VMs it is tied to MACs.

Just make sure to allocate proper space, vCPUs and RAM to VM prior to installation from ISO. 

[Timothy_Hall]

> Just make sure to allocate proper space, vCPUs and RAM to VM prior to installation from ISO. 

To further elaborate on the needed specs for a SMS VM, 8 physical cores (not hyperthreaded) seems to be the sweet spot.  Not that allocating more cores than that won't help at all, but from what I've seen 9+ cores on an SMS is past the point of diminishing returns.  16GB RAM is recommended, 32GB would be even better.  Very important though, make sure the thick-provisioned disk for the SMS VM is as blazing fast as you can get, and is NOT shared with a bunch of database-oriented VMs or other types of VMs that constantly pound the disk I/O channel.

--
My Book "Max Power: Check Point Firewall Performance Optimization"
Second Edition Coming Soon

[Daniel_Taney]

I agree, nothing should be tied to the MAC address. When you do the install, I would recommend you pay attention to the "default" disk partitioning. In my experience, the out-of-the-box config makes the root partition way too small and the backup/recovery partition way too big. I've been making my root partitions at least 50gb to leave space for the possibility of multiple cpinfo's and other temporary data collection. 

[Danny]

Talk to your local Check Point representative. They might be able to offer a solution. This can either be a performance optimization session, appliance replacement quotation, RAM upgrade options of other alternatives. I've been in such situations before and always got help from Check Point that helped me solving the issue while keeping everyone happy.

[Eyal_Rashelbach]

Hi Jack,

My name is Eyal and i run the R80 Desk in Check Point.

I would like to help you and already started internal process for the same.

will you please contact me directly eyalra@checkpoint.com and share your Account details, HW details and your sales contact.

Best regards

Eyal Rashelbach

R80 Desk Manager | Solution Center | Check Point Software Technologies

[Eyal_Rashelbach]

Hi Jack,

I hope that following our help you to succeed with your migrating to R80.10
I appreciate if you share your experience with us in our R80.10 Survey 

if needed I will be happy to assist you with personal attention.

Eyal Rashelbach

R80 Desk Manager, Solution Center | Check Point Software Technologies