Migration from 1590 to 1600

[ICSI]

It is possible to migrate the configuration from a Spark 1590 to a Spark 1600? 

The backup and restore option do not work and has to be typed manually, horrible! According to tech support it is not supported. is that true? 

[Chris_Atkinson]

Locally or centrally managed?

Indeed the scenario is not covered in the applicable documentation that I can find:

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Ba... 

sk170162: How to upgrade hardware from R77.20.87 to R80.20.15 or higher 

Please raise the requirement with your local CP SE.

[ICSI]

Right? We need to solve this. Perhaps I have a client right now stuck copying their complex configuration from one appliance to the other. 

I would say that we need as Check Point to solve this kind of issues, we should be able to copy and paste the configuration using the console for example, as is on most of the appliance and most of the IT guys are doing their chores when is about updating complex configurations. 

Of course, the Backup n Restore its an awesome feature, but it is not supported in this case. 

Wishing to have a quick fix like right now, to provide this answer to my customer. 

[the_rock]

Personally, if you cant do restore, I would say get show configuration from 1590 and then copy bits and pieces to 1600 (just make sure that interface/ports are matching)

Hope that helps.

Andy

[ICSI]

As you suggested, that's what my client is doing. But as a partner, I feel sorry for this situation. I would insist to the R&D Check Point team, to create migration process for the same family of appliances. Anyways, probable nobody gives them this kind of feedback.

@PhoneBoy is this a good place to create this kind of feedback? or there is any other place that we should go? 

[the_rock]

I understand, I was in such situation many times, but at the end of the day, if there is no better way, cant make one up : - ). If vendor comes up with something else, great, but if not, you have limited choices.

Andy

[PhoneBoy]

I do know that we allow for migrating older appliances to current ones: https://support.checkpoint.com/results/sk/sk170162

What is the source version the backup was taken on?
What is the target version you are attempting to restore on?
There's an internal note in the above SK that suggests backups made on R80.20 cannot be restored on R81.10.xx.
Which suggests if the backup was taken on R80.20, you will probably need to upgrade the gateway to R81.10.xx, then take the backup.

[ICSI]

Client response: 

"What is the source version the backup was taken on? 1590 version R81.10.5
What is the target version you are attempting to restore on? 1600 Version R81.10.5
There's an internal note in the above SK that suggests backups made on R80.20 cannot be restored on R81.10.xx. – both was on the same version but only different model " 

What do you think we should do now? 

[PhoneBoy]

I suspect TAC is correct and this is not yet a supported upgrade path.
Doesn't mean it won't be supported in the future.
@Amir_Ayalon is this in the plans?

[ICSI]

Any response?

Believe or not my client is just about to sign for a 3-year license renewal for a 1600 with Platinum Support and he just landed his face against the "Watch Tower app" is not supported in the 1600, ON TOP of the "you can restore a backup from the 1590 into this 1600".  No script no documentation about that. two major disappointments. 

He does most of his work remotely and he finds this app very useful. 

[the_rock]

Honestly, @ICSI , this is my best suggestion...we had clients in the past stuck on similar things and I always found best way to get any traction is to have SE involved. Once they know the situation and that contract is on the line because of it, TRUST ME, they WILL do something : - )

[ICSI]

Good idea! 

[Amir_Ayalon]

will check and advise

[ICSI]

Thank you @Amir_Ayalon! hope we can get a solution.

[Ben_Dunkley]

@Amir_Ayalon Did anything ever come of this?

I'm finding myself is a similar situation, wanting to migrate a customer from a 1555 to 1575 - and while it will perform a restore of the 1555 backup onto the 1575, that messes up the interfaces significantly, and a config dump/re-enter has other issues as well.

And apologies for resurrecting a 9 month old thread!

[ICSI]

Hi @Ben_Dunkley, 

After reviewing your comment, the problem is that both devices have different interfaces, and the configurations are very specific to the hardware and because tech is changing so quick they might not have any migration tool at all. Probably if you are a CLISH expert you might copy configurations from one interface into another. I am not familiar with CLISH yet. 

The only option now it is to replicate the configuration into the new device, test it and when ready then replace the old in production for the new one. 

I am actually migrating a 790 into a 1575 right now. 

Best!

[the_rock]

Thats what I always do, even for regular Gaia...just copy "bits and pieces" from existing to new machine. Its easy to correct interface names from text editor. Also, not sure if this exists on smb clish, but in regular gaia clish, you can do something like set clienv on-failure continue (I think is command) and then it tells you line you need to fix, as it will show where it stops, so that is also an option.

Best,

Andy

[Amir_Ayalon]

checking