- Products
- Learn
- Local User Groups
- Partners
- More
What's New in R82.10?
10 December @ 5pm CET / 11am ET
Improve Your Security Posture with
Threat Prevention and Policy Insights
Overlap in Security Validation
Help us to understand your needs better
CheckMates Go:
Maestro Madness
Just wanted your heads on for a migration scenario from existing cluster using ClusterXL to new cluster using ElasticXL as-is.
I am aware that we need to perform a fresh install on the new gateways and enable elasticXL, use a new management IP and add the second cluster via Gaia (global), use dedicated sync interface.
I am wondering how to migrate the existing SMS policy to the new ElasticXL cluster;
-I would assume that all ClusterXL virtual IP should be configured on the global Gaia portal as it would only have a single IP for each interface/vlan.
-migrate all other gaia configuration to the new ElasticXL (excluding network interfaces), like NTP, DNS, RADIUS, admins.
-what about the network topology on the SMS policy of the existing ClusterXL, should we duplicate the policy and basically rebuilt the network topology to match the ElasticXL topology (which i assume to be with those internal links like Maestro)
With above we should be able to install the policy on the new ElasticXL cluster, someone here any advise to make this migration as smooth as possible? Any tips and tricks please share.
Im positive @HeikoAnkenbrand or @emmap would know. I know there is a tool for it that was discussed recently, but since its not public yet, no idea if it would actually include policy migration.
Last I heard it was on the road map, but its not there yet... If you have a HA pair then it may be cleaner to just rebuild..better still if your migrating to new cluster build that as ElasticXL.
You should be able to use Proxmox / VMWare to go through the scenrios in a controlled way first.
I was told that Proxmox is now formally supported
Hi @dehaasm,
You can find more on this topic in this article:
Converting Tool - ClusterXL to ElasticXL
Its not publicly available yet, is it @HeikoAnkenbrand ?
There is no tool yet and it sounds like in this case we're moving to new hardware as well, so the tool would not apply as it is for migrating an existing cluster between cluster models.
In this case @dehaasm you have it about right, you need to build a new gateway object to represent your new EXL cluster in your mgmt server. What used to be VIPs on your CXL will now be IPs on EXL interfaces. If you can do a new mgmt IP then you can host them side by side in the management server - it's ok that all the other interface IPs will overlap as long as the mgmt IP and the name are different. You can install the same policy to both clusters, just make sure you add the new one to anywhere in the rulebase it needs to go.
Yes indeed and i was thinking to temporarily use separate IP addresses for each bond vlan interface to be able to validate the new connectivity/cabling to the new elasticXL cluster. I believe the ElasticXL only works with bond interfaces as well as the standard SYNC and MGMT interface. Then later when policy is installed put the correct IP addresses and swap over from old to new hardware.
EXL works with solo interfaces or bonds, there's no specific requirement there. Bonds can be nice to set up in case you want to expand the link capacity in future but there's no hard requirement to use them. Temporary IPs for testing is a good idea.
Note SecureXL isn't a clustering mechanism and is still relevant regardless of ClusterXL vs ElasticXL.
Thats really good to know, Chris.
i meant clusterXL i corrected
The new CCSE R82 class features a final lab exercise that involves converting from a ClusterXL HA cluster to a new ElasticXL cluster. It is a manual process that involves replicating the Gaia configuration, creating a new ElasticXL cluster object, replacing it everywhere the old ClusterXL HA object was, and then deleting the old object. Obviously, running "Where Used" on the old ClusterXL HA object helps with this process; however, at some point, a "Replace" button started appearing on this screen, which makes object substitution in the config much easier. Once that button is clicked, a pick-list then appears for the object replacement:
Nice!
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
| 28 | |
| 15 | |
| 13 | |
| 13 | |
| 12 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 |
Wed 26 Nov 2025 @ 12:00 PM (COT)
Panama City: Risk Management a la Parrilla: ERM, TEM & Meat LunchWed 03 Dec 2025 @ 10:00 AM (COT)
Última Sesión del Año – CheckMates LATAM: ERM & TEM con ExpertosThu 04 Dec 2025 @ 12:30 PM (SGT)
End-of-Year Event: Securing AI Transformation in a Hyperconnected World - APACThu 04 Dec 2025 @ 03:00 PM (CET)
End-of-Year Event: Securing AI Transformation in a Hyperconnected World - EMEAThu 04 Dec 2025 @ 02:00 PM (EST)
End-of-Year Event: Securing AI Transformation in a Hyperconnected World - AmericasWed 03 Dec 2025 @ 10:00 AM (COT)
Última Sesión del Año – CheckMates LATAM: ERM & TEM con ExpertosThu 04 Dec 2025 @ 12:30 PM (SGT)
End-of-Year Event: Securing AI Transformation in a Hyperconnected World - APACThu 04 Dec 2025 @ 03:00 PM (CET)
End-of-Year Event: Securing AI Transformation in a Hyperconnected World - EMEAThu 04 Dec 2025 @ 02:00 PM (EST)
End-of-Year Event: Securing AI Transformation in a Hyperconnected World - AmericasWed 26 Nov 2025 @ 12:00 PM (COT)
Panama City: Risk Management a la Parrilla: ERM, TEM & Meat LunchAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY