Best way to Upgrade MDM & VSX Cluster from R77.30 to R80.10

[Atanu_Bandhu]

Hi All,

I am looking for the best possible way to Upgrade MDM & VSX Cluster from R77.30 to R80.10.

I have done some basic home lab to upgrade MDM and VSX Cluster to R80 but every time I am the fashing issue, can anyone please let me know which process I need to go for the upgrade is cline install or import process.

Can someone help please.

[PhoneBoy]

It would be helpful if you could explain in detail the issues you are running into and the exact process you are following.

[Atanu_Bandhu]

Hi Dameon,

I have try MDM upgrade via CPUSE but we are not gating any output error also I have check MDM logs not find any error logs.

[Kaspars_Zibarts]

With MDS we did export > clean install > import. 

With VSX we have done both (successfully) - CPUSE upgrade and clean install + vsx_util reconfigure.

We followed standard upgrade documents

[Atanu_Bandhu]

Thanks, Kaspars.

Kaspars can you please tell me after upgrade have face any issue like performance or any other issue?

MDM we are hare VM setup and VSX we are using 12600 model.

Can you please suggest me for the upgrade we need to go upgrade right now or wait for R80.20?

[Kaspars_Zibarts · Accepted solution]

It all depends on your expectations. R80.10 with current jumbo HFAs is very stable as far as we are concerned. R80.20 will be whole new kettle of fish so I won't comment on that.

I have written these to someone who wanted a reference regarding our experience with R80.10:

• VSX is now running 64bit kernel on each VS lifting RAM limitation of 4GB (= limit of concurrent connections per VS)
• Domain object usage. They do not stop acceleration and don’t rely on reverse lookups permitting only one IP. Really useful for us as we use proxy normally for users and opening direct connections to internet was always a challenge. Had to raise a case yesterday though when it stopped working – there is existing SK and hotfix
• Concurrent read-write admins – absolute saver for us having many admins around the world
• MDS Backups have increased 1GB per month in size. SO we have gone from 4 to 14GB backup in 10 months
• MDS restore takes much longer now: one due to the backup size and two due to the DB usage in R80
• We have had issues with SmartLog becoming nearly unusable when we had a lot of administrators performing complex long searches, case still ongoing. Apparently fixed in R80.20 with the new file system
• Management API has saved us few times now – ability to script rules and objects is irreplaceable
• SmartConsole in general – much more friendly
• SmartConsole performance is not great for users with high latency
• R80 mgmt is much more resource hungry (CPU and RAM) so be prepared to beef up your systems – we quadrupled VM power for mgmt servers.

[Atanu_Bandhu]

Thanks Kaspars for sharing your wonderful explanation.  

[Marco_Valenti]

Hey all , I'm starting to approach the same type of task but we choose to not export entire mds but single cma , the part about vsx gateway is the one that worried me less at the moment but since we have 5 vs in 5 different cma  I would like to know if they can be migrated in any way or there are something more detailed about how to do it , if you try to import a tgz created from the migration tool the error message is  "VSX Migration With Provider-1 WhitePaper " that point to a 2012 document in support center. I'm in contact with country support to see what are they response.

thanks

[Kaspars_Zibarts]

I'm not entirely sure if I follow you Marco. What exactly you are upgrading?

[Marco_Valenti]

we have a vsx r77.30 in an mdm env r77.30 with 5 vs that have their own cma plus cma mangement for the vsx itself , now the task is to move to r80.10

[Kaspars_Zibarts]

Just follow the R80.10 upgrade document. First upgrade MDS (whole of course, you cannot upgrade one CMA if that's what you meant), then you upgrade whole VSX (again all VSes at once). Fairly straight forward

[Marco_Valenti]

That's the point we are not supposed to upgrade whole mds due to customer different needs more than fifty cma is not even thinkable so I would like to know if there are different way to do that at the moment.

[Kaspars_Zibarts]

I don't think so - code itself runs on the "box", not per CMA.  So you cannot have some CMAs on R77 and others on R80

If that's too high risk then you should consider having multiple management platforms

[Marco_Valenti]

No doubt on that , just want to know if there are some step for migrating the entire vsx management cma and relative vs if it is not supported at all we 'll have to live with that

[Maarten_Sjouw]

The problem with the VSX migration is that you will need to migrtae all 6 VSX related CMA's at the time, I did this a while back from different R77.30 MDS servers into 1 setup with about 30 VS contaning CMA's per setup and about4 CMA's with the VSX Gateways in them. Was quite a job but there is a check to mke sure you know what you are doing.

Most important part in this case would be to make sure the CMA Names and IP's remain the same. Next (on R77.30 you need to create a empty file at a specific place with a specific name. I don't expect that this was changed. As long as you know what you are doing that is the correct method.

I was looking for the filename and location but was unable to find it yet.

[Maarten_Sjouw]

Found the command to allow VSX import:

touch /AllowVsxMigration

[Kaspars_Zibarts]

https://community.checkpoint.com/people/m.val738897f1-5ecc-4b02-8e8b-1999b12e857a Ok then I'm bit confused. Are you simply upgrading from R77.30 to R80.10? Since you are saying you are "migrating" to R80.10.. what exactly do you mean by migration?

[Marco_Valenti]

Sorry man you are right , i'm updating to r80.10 from r77.10 just an italian way to say it was lost in translation