Firewall gateway migration activity

[Sam472]

We are in process of a firewall migration activity replacing 5800 gateways to 9400 . Currently 5800 is running on R81 and 9400 is out of box  R81.20 .

Want to know what will be the best approach to do this activity .

Below is my approach if any one can validate and guide will be helpful. 

1. Pre configure the gateway with interface and routes and configuration same as old gateway . 

2. In smart console from the existing cluster delete the old members gateway and add the new gateways establish SIC and get interfaces and push policy 

[Sam472 · Accepted solution]

Any one reply to this to add to this we have already created new cluster  with new gateway and tested out flow now we will add this gateway in the production cluster 

[Lloyd_Braun]

that should do it. you might inspect $FWDIR/boot/modules/fwkern.conf files to see if there are any relevant kernel parameter changes that were made in the old firewalls that you would still need in the new ones. Firewall Kernel Parameters

[Tal_Paz-Fridman]

I also suggest using Prerequisites for Upgrading and Migrating of Security Gateways and Clusters - it includes a list of important files and folders

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Gui...

[the_rock]

Just follow below. I must have done this at least 10 times, never an issue.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/m-p/69216#M5286

[Sam472]

Hii as per the guides I read if our cluster is version 81 we removed r81 gateways from cluster and added new r81.20 gateways done sic pulled network topology and when we try to install policy cluster object is not getting updated to r81.20 its still showing old r81 and policy getting failed saying mvc error

[the_rock]

Are you saying you tried that and it failed or you plan to do it that way?

Andy

[Sam472]

No I tried it and failed i was not able to install policy after adding new gateway in cluster it said mvc error it seems like r 81 not supports mvc 

[the_rock]

MVC was supported as of R80.40

[Sam472]

Ok but when we trying to install the policy cluster version was showing as r 81 it was not getting updated and was saying version error and policy getting failed in smartconsole after adding the new gateways I can see both the cluster and gateway object with r 81.20 but smartconsole it was still showing old r81 

[the_rock]

If you are allowed to do remote, Im happy to check for you. I have 45 mins now.

Andy

[_Val_]

You should be able to change the object version manually on the management side. 

[Sam472]

How to update even TAC was on call they were trying to update cluster object but not able to do and had to roll back as downtime was less 

[the_rock]

Im happy to try assist if you allow remote...Im in EST time zone, so Im sure we can figure something out, let me know.

Andy

[Sam472]

Yes that will be really helpful messaged you let us know can we connect tommorow once 

[the_rock]

Just responded.

[Sam472]

I have followed this poa and it didn't work My old cluster was in R81 we deleted the old gateway objects and added the new gateway object which is in  r81.20 and tried to install policy it failed saying cluster version miss match and cluster object was showing old r81 it was not getting updated to roll 81.20

[PhoneBoy]

The version in the gateway/cluster objects need to match the actual version installed on the gateway.
Did you install or upgrade to R81.20 on the relevant gateways?

[the_rock]

I will do remote with @Sam472 tomorrow at 9.30 pm IST to see if we can sort this out, will update afterwards.

Andy

[the_rock · Accepted solution]

-remote with Sanil
-checked the config
-both mgmt and gateways are on R81.20
-discussed below:

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/m-p/69216#M5286

-advised best way to do this is NOT create new cluster object, but rather modify existing one to new version and hardware model, copy config from show configuration if IPs will be the same
and then establish SIC, get interfaces without topology and inbstall on first backup member, then do same for new one

provided Sanil with my info in case they need help, and also advised to turn on mvc by running cphaconf mvc on command from expert

[Sam472 · Accepted solution]

Thanks everyone for the valuable inputs and special appreciation to @the_rock  for assisting with a remote session to verify the setup

We have successfully completed the firewall migration activity with only 5 minutes of downtime during the second attempt.

🔧Challenges Faced & Our Approach:

1. Configuration Differences:

The bond interface details were different between the old and new gateways.

The old gateways were on R81, while the new ones were on R81.20.

2. First Cutover Attempt:

We removed the existing gateways from the cluster and added the new R81.20 gateways.

After fetching topology and entering VIP details, we attempted to push the policy.

The cluster object (still on R81) didn’t update properly after adding the new gateways and establishing SIC.

This caused policy installation to fail, leading us to roll back the activity.

3. Second Cutover Attempt:

We opted for a new cluster approach, considering the issues faced with the old R81 cluster.

Created a new cluster, pre-configured with:

Gateway topology

Static routes

NAT rules

Policy configuration

Successfully pushed policy to the new cluster.

🚀Final Cutover Steps:

Replaced the new cluster IP with the old IP (used as the default gateway behind Check Point).

Shut down old firewall and switch ports.

Enabled the new firewall ports.

Entered VIP details in SmartConsole in new cluster

Pushed the policy — everything worked smoothly.

[the_rock]

GREAT job @Sam472