Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
ICSI
Collaborator

Migration from 1590 to 1600

 

It is possible to migrate the configuration from a Spark 1590 to a Spark 1600? 

 

The backup and restore option do not work and has to be typed manually, horrible! According to tech support it is not supported. is that true? 

 

 

Regards,

Oscar Catana
https://ipthub.com

Cyber Sec Passionate!
0 Kudos
17 Replies
Chris_Atkinson
Employee Employee
Employee

Locally or centrally managed?

Indeed the scenario is not covered in the applicable documentation that I can find:

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Ba... 

sk170162: How to upgrade hardware from R77.20.87 to R80.20.15 or higher 

 

Please raise the requirement with your local CP SE.

CCSM R77/R80/ELITE
ICSI
Collaborator

Right? We need to solve this. Perhaps I have a client right now stuck copying their complex configuration from one appliance to the other. 

I would say that we need as Check Point to solve this kind of issues, we should be able to copy and paste the configuration using the console for example, as is on most of the appliance and most of the IT guys are doing their chores when is about updating complex configurations. 

Of course, the Backup n Restore its an awesome feature, but it is not supported in this case. 

Wishing to have a quick fix like right now, to provide this answer to my customer. 

Regards,

Oscar Catana
https://ipthub.com

Cyber Sec Passionate!
0 Kudos
the_rock
Legend
Legend

Personally, if you cant do restore, I would say get show configuration from 1590 and then copy bits and pieces to 1600 (just make sure that interface/ports are matching)

Hope that helps.

Andy

ICSI
Collaborator

As you suggested, that's what my client is doing. But as a partner, I feel sorry for this situation. I would insist to the R&D Check Point team, to create migration process for the same family of appliances. Anyways, probable nobody gives them this kind of feedback.

 

@PhoneBoy is this a good place to create this kind of feedback? or there is any other place that we should go? 

Regards,

Oscar Catana
https://ipthub.com

Cyber Sec Passionate!
0 Kudos
the_rock
Legend
Legend

I understand, I was in such situation many times, but at the end of the day, if there is no better way, cant make one up : - ). If vendor comes up with something else, great, but if not, you have limited choices.

Andy

0 Kudos
PhoneBoy
Admin
Admin

I do know that we allow for migrating older appliances to current ones: https://support.checkpoint.com/results/sk/sk170162

What is the source version the backup was taken on?
What is the target version you are attempting to restore on?
There's an internal note in the above SK that suggests backups made on R80.20 cannot be restored on R81.10.xx.
Which suggests if the backup was taken on R80.20, you will probably need to upgrade the gateway to R81.10.xx, then take the backup.

0 Kudos
ICSI
Collaborator

Client response: 

"What is the source version the backup was taken on? 1590 version R81.10.5
What is the target version you are attempting to restore on? 1600 Version R81.10.5
There's an internal note in the above SK that suggests backups made on R80.20 cannot be restored on R81.10.xx. – both was on the same version but only different model " 

What do you think we should do now? 

Regards,

Oscar Catana
https://ipthub.com

Cyber Sec Passionate!
0 Kudos
PhoneBoy
Admin
Admin

I suspect TAC is correct and this is not yet a supported upgrade path.
Doesn't mean it won't be supported in the future.
@Amir_Ayalon is this in the plans?

0 Kudos
ICSI
Collaborator

Any response?

Believe or not my client is just about to sign for a 3-year license renewal for a 1600 with Platinum Support and he just landed his face against the "Watch Tower app" is not supported in the 1600, ON TOP of the "you can restore a backup from the 1590 into this 1600".  No script no documentation about that. two major disappointments. 

He does most of his work remotely and he finds this app very useful. 

 

Regards,

Oscar Catana
https://ipthub.com

Cyber Sec Passionate!
0 Kudos
the_rock
Legend
Legend

Honestly, @ICSI , this is my best suggestion...we had clients in the past stuck on similar things and I always found best way to get any traction is to have SE involved. Once they know the situation and that contract is on the line because of it, TRUST ME, they WILL do something : - )

0 Kudos
(1)
ICSI
Collaborator

Good idea! 

Regards,

Oscar Catana
https://ipthub.com

Cyber Sec Passionate!
Amir_Ayalon
Employee
Employee

will check and advise

0 Kudos
ICSI
Collaborator

Thank you @Amir_Ayalon! hope we can get a solution.

Regards,

Oscar Catana
https://ipthub.com

Cyber Sec Passionate!
Ben_Dunkley
Contributor

@Amir_Ayalon Did anything ever come of this?

I'm finding myself is a similar situation, wanting to migrate a customer from a 1555 to 1575 - and while it will perform a restore of the 1555 backup onto the 1575, that messes up the interfaces significantly, and a config dump/re-enter has other issues as well.

And apologies for resurrecting a 9 month old thread!

0 Kudos
ICSI
Collaborator

Hi @Ben_Dunkley

 

After reviewing your comment, the problem is that both devices have different interfaces, and the configurations are very specific to the hardware and because tech is changing so quick they might not have any migration tool at all. Probably if you are a CLISH expert you might copy configurations from one interface into another. I am not familiar with CLISH yet. 

 

The only option now it is to replicate the configuration into the new device, test it and when ready then replace the old in production for the new one. 

I am actually migrating a 790 into a 1575 right now. 

 

Best!

Regards,

Oscar Catana
https://ipthub.com

Cyber Sec Passionate!
0 Kudos
the_rock
Legend
Legend

Thats what I always do, even for regular Gaia...just copy "bits and pieces" from existing to new machine. Its easy to correct interface names from text editor. Also, not sure if this exists on smb clish, but in regular gaia clish, you can do something like set clienv on-failure continue (I think is command) and then it tells you line you need to fix, as it will show where it stops, so that is also an option.

Best,

Andy

(1)
Amir_Ayalon
Employee
Employee

checking

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events