Upgrade to R80.20

[Ravindra_Katrag]

Hi

I have to upgrade my Production MDS from R 77.30 to R 80.20. So I am running a Test Upgrade in a Lab Environment so that I can replicate it to my Production Environment.

I took a Back-Up from my R77.30 Production MDS and restored it in an R77.30 VM in my Lab. I Changed the MDS IP, CMA IP, and Lead Interface. I attached an Eval License, then I logged in to the R77.30 (VM) Smart Dashboard, disabled the automatic IPS updates and installed the database. I copied the R80.20 Security Management Clean Install ISO File into the R77.30 VM and ran the Pre Upgrade Verifier.

The Pre Upgrade gave me the below three warnings but it said I can upgrade it.

1. Legacy DHCP Relay Services - Change in Behavior in R80 and Higher

2. Deactivate IPS Protections by type (Client/Server)

3. OPSEC was modified in R80

Since the verification report said I can upgrade it, I took the export from my LAB MDS and copied that file to another R80.20 VM. When I try to import this to my LAB R80.20 VM, the MDS Database upgrade is Succesful but the CMA Database upgrade failed. I see the below error in the log file and the FWM Process of the CMA in the R80.20 VM doesn't come up. I am stuck here.

Anyhelp here would be much appreciated.

[23 May 12:02:44] [DbUpgrader::ExecuteCpdb] Executing cpdb using the following arguments: "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/bin/cpdb" up --no-ngm-db-drop --no-ngm-stop --src_version 6.0.4.0 --src_hfa_level 30 --src_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/tmp/migrate/main_db/" --db_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/conf/" --default_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/conf/defaultDatabase" --db_type cma --db-migration

[23 May 12:02:44] [runShellCommand] Executing command: '"/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/bin/cpdb" up --no-ngm-db-drop --no-ngm-stop --src_version 6.0.4.0 --src_hfa_level 30 --src_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/tmp/migrate/main_db/" --db_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/conf/" --default_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/conf/defaultDatabase" --db_type cma --db-migration'

[23 May 12:25:44] [runShellCommand] Execution result: 1, exit code: -1

[23 May 12:25:44] [DbUpgrader::ExecuteCpdb] ERR: cpdb completed with error code '-1'

[23 May 12:25:44] ...<-- DbUpgrader::ExecuteCpdb

[23 May 12:25:44] ..<-- DbUpgrader::UpgradeMainDatabase

[23 May 12:25:44] [DbUpgrader::exec] ERR: Failed to upgrade main database

[23 May 12:25:44] .<-- DbUpgrader::exec

[23 May 12:25:44] <-- ConditionalExecutor::exec

[23 May 12:25:44] [ActivitiesManager::exec] ERR: Activity 'ConditionalExecutor' failed

[23 May 12:25:44] [ProgressUpdater::UpdateProgressToGaia] Progress Updated to '70.2128

[23 May 12:25:44] [ActivitiesManager::exec] WRN: Activities execution finished with errors

[23 May 12:25:44] [ActivitiesManager::exec] WRN: Activities 'ConditionalExecutor' have failed

[23 May 12:25:44] [ActivitiesManager::exec] Designated exit code is 1

[23 May 12:25:44] --> CleanupManager::Instance

[23 May 12:25:44] <-- CleanupManager::Instance

[23 May 12:25:44] --> CleanupManager::DoCleanup

[23 May 12:25:44] [CleanupManager::DoCleanup] Starting to perform cleanup

[Daniel_Taney]

I would open a TAC case for this one. They can collect a CPinfo from you and should be able to recreate the issue to determine the root cause. Whatever is causing the issue, it is probably very specific to an object or configuration in your database.

[Ravindra_Katrag]

Hi

I did open a case with Checkpoint TAC. 

In my first attempt of the Upgrade, I got this error then TAC suggested me to disable the automatic IPS updates and try again. I did that and I got the same error again.

The case is still open, but I opened a post here hoping to get some help regarding the problem that I am having

[Daniel_Taney]

Really dumb question, but I'm assuming free disk space is not an issue?

[Ravindra_Katrag]

The VM has 950 GB disk assigned to it

[Expert@R8020vamgmt01:0]# df -h
Filesystem	Size	Used	Avail	Use%	Mounted on
/dev/mapper/vg_splat-lv_current	150G	9.2G	141G	7%	/
/dev/sda1	291M	25M	251M	9%	/boot
tmpfs	7.8G	4.0K	7.8G	1%	/dev/shm
/dev/mapper/vg_splat-lv_log	150G	3.6G	147G	3%	/var/log

[Daniel_Taney]

Have you seen this sk?

[Ravindra_Katrag]

Hi

Do you know the Path to those files?

I couldn't find that in my VM.

[Daniel_Taney]

Did you look in either $FWDIR/log or $CPDIR/log?

[Ravindra_Katrag]

checked the files and SK

The error is different.

[JozkoMrkvicka]

Do you have Global Policies on R77.30 ? If yes, firstly you need to import GP on R80.20 using "import_global_policies" command and after that do import itself.

And have a look here for similar issues:

Installation & Upgrade problems from R77.x to R80.x

[Ravindra_Katrag]

Hi

I do not have global policies. I just have one TACACS+ global object for authentication. other than that I do not have any global policies.

[Tal_Paz-Fridman]

Hi

Let me see if I can help you as well.

1) Did TAC help you with this issue?

2) Can you share the SR number so that I can also followup internally?

3) I will involve R&D see if we have a quick solution to the problem.

Best wishes

Tal

[Tal_Paz-Fridman]

Hi Ravindra,

Also if you prefer you can contact me directly at tfridman@checkpoint.com

Best wishes

Tal

[Ravindra_Katrag]

Hi

I Opened a case with TAC. I send the export files and back up files whenever asked but no success so far.

Case N.O: 6-0001567206

I would really appreciate any help.