Upgrade_Import got failed

[Andhra_Bank]

Hello Everyone,

We are in the middle of Migration from Windows MGMT R77.10 to Gaia R80.10. We have exported the configuration by using R80.10 Migration export tool and it was successfully exported when we tried to Import the file in to new Gaia R80.10 MGMT server getting error as follows " Execution finished with error. The Log details has been shared over here. Could you please help me on this.

Thanks,

Mohamed

[PhoneBoy]

This looks very similar to: Importing CMA from R77.30 to R80.10 using cma_migrate fails 

In this case, the SK suggests the export is somehow corrupt.

Make sure you are using the correct version of the migration tools here: R80.10 Management Server Migration Tools for Windows 

If you're still having issues, I recommend getting the TAC involved: Contact Support | Check Point Software 

Also, did you utilize the R80.x Upgrade Verification Service beforehand?

See: R80.10 Upgrade Verification and Environment Simulation service 

[Andhra_Bank]

Thanks Dameon. I raised a case with TAC however it's not complex setup just using firewall blade. Can we export firewall policy from existing Windows security manager(R77.10) and Import in to new Gaia R80.10. Also guide me if there is a way to export objects as well. Thanks in advance.

[PhoneBoy]

The migration tools should get the policy and all the objects.

That's what those tools are for.

Even if Firewall only, did you run through the upgrade verifier as suggested earlier?

What was the result of this?

My first thought when I saw the output you provided was: have you recently updated the IPS signatures?

Even if you're not using IPS, this is taken as part of the migration export.

Might not hurt to update the IPS signatures on the management also to ensure that data isn't corrupt.

[Robert_Mueller]

Hi - We have the same issue but on a GAiA based Mgmt and raised a TAC but one question.. how long does it take to get response from the "special team" which is responsible for the pre-upgrade verfier service??? 

[PhoneBoy]

Not sure what the SLA is for this.

Please send the SR privately, I can investigate.

[Andhra_Bank]

The migration tools should get the policy and all the objects.

That's what those tools are for.

Oh Ok.

Even if Firewall only, did you run through the upgrade verifier as suggested earlier?

What was the result of this?

since it's running on windows server could you please verify the command which is given in the below.

pre_upgrade_verifier.exe -p c:\windows\FW1\R77\fw1\ -c R77.10 -t R80.10 –f c:\desktop\CPMGM001 w

My first thought when I saw the output you provided was: have you recently updated the IPS signatures?

No. IPS not used

Might not hurt to update the IPS signatures on the management also to ensure that data isn't corrupt.

How to verify that? Please guide me. Thanks in advance.

[PhoneBoy]

You should run the Pre Upgrade Verifier regardless of what blades are active.

Your command line looks correct to the best of my knowledge.

To update IPS signatures, go here in SmartDashboard:

[Tomer_Sole]

are you guys familiar with R80.10 Upgrade Verification and Environment Simulation service  ?

[PhoneBoy]

I mentioned that earlier.

It doesn't support Windows, which is relevant here.

[Hugo_vd_Kooij]

In the objects I noticed a lot of backward compatiblility stuff:

:installed_products ("IDA,CPFC,FW1,SecurePlatform,CPinfo,DIAG,SmartPortal,Reporting Module,CPuepm,VSEC,SmartLog,R7520CMP,R7540CMP,R7540VSCMP,R76CMP,SFWR77CMP,R77CMP,R75CMP,NGXCMP,EdgeCmp,SFWCMP,FLICMP,SFWR75CMP,MGMTAPI,rtm")

You might want to strip off those features, as much as possible, first before you run another export.

[Ofer_Barzvi]

Please upload also $CPDIR/log/ips* , $FWDIR/log/cpm* files

It's also recommended to install latest available Jumbo mentioned in sk116380 before running the import.

[avisheen_shetty]

Make sure the export file when transferred from management server to ftp/sftp server is bin and not ASCII. I faced similar problem. Also update the Add on package if any applicable for R80.10

[Ruan_Kotze]

I have come across similar issues, and while this may not solve your problem, it might put you on the correct path.  Have had two instances where the Endpoint Policy Management Blade was not properly de-activated (we traced the issue to EPM by analyzing the log files).  We resolved it by like so:

On the R77.30 SMS -

1. Active EPM Blade - Save - Install Database

2. Reboot SMS

3 De-active EPM blade - Save - Install database

4 Execute the following from the CLI "cpprod_util CPPROD_SetValue CPuepm ProdActive 1 0 1"

We then ran the migrate export / import with the --exclude-uepm-postgres-db switch.

As I said, chances are 99% that this is not your exact issue, but by taking a close look at the logs you should be able to see why the import fails and then take it from there.