Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Andhra_Bank
Participant

Upgrade_Import got failed

Hello Everyone,

We are in the middle of Migration from Windows MGMT R77.10 to Gaia R80.10. We have exported the configuration by using R80.10 Migration export tool and it was successfully exported when we tried to Import the file in to new Gaia R80.10 MGMT server getting error as follows " Execution finished with error. The Log details has been shared over here. Could you please help me on this.

Thanks,

Mohamed

13 Replies
PhoneBoy
Admin
Admin

This looks very similar to: Importing CMA from R77.30 to R80.10 using cma_migrate fails 

In this case, the SK suggests the export is somehow corrupt.

Make sure you are using the correct version of the migration tools here: R80.10 Management Server Migration Tools for Windows 

If you're still having issues, I recommend getting the TAC involved: Contact Support | Check Point Software 

Also, did you utilize the R80.x Upgrade Verification Service beforehand?

See: R80.10 Upgrade Verification and Environment Simulation service 

0 Kudos
Andhra_Bank
Participant

Thanks Dameon. I raised a case with TAC however it's not complex setup just using firewall blade. Can we export firewall policy from existing Windows security manager(R77.10) and Import in to new Gaia R80.10. Also guide me if there is a way to export objects as well. Thanks in advance.

0 Kudos
PhoneBoy
Admin
Admin

The migration tools should get the policy and all the objects.

That's what those tools are for. Smiley Happy

Even if Firewall only, did you run through the upgrade verifier as suggested earlier?

What was the result of this?

My first thought when I saw the output you provided was: have you recently updated the IPS signatures?

Even if you're not using IPS, this is taken as part of the migration export.

Might not hurt to update the IPS signatures on the management also to ensure that data isn't corrupt.

0 Kudos
Robert_Mueller
Collaborator

Hi - We have the same issue but on a GAiA based Mgmt and raised a TAC but one question.. how long does it take to get response from the "special team" which is responsible for the pre-upgrade verfier service??? 

0 Kudos
PhoneBoy
Admin
Admin

Not sure what the SLA is for this.

Please send the SR privately, I can investigate.

0 Kudos
Andhra_Bank
Participant

The migration tools should get the policy and all the objects.

That's what those tools are for.

Oh Ok.

Even if Firewall only, did you run through the upgrade verifier as suggested earlier?

What was the result of this?

since it's running on windows server could you please verify the command which is given in the below.

pre_upgrade_verifier.exe -p c:\windows\FW1\R77\fw1\ -c R77.10 -t R80.10 –f c:\desktop\CPMGM001 w

My first thought when I saw the output you provided was: have you recently updated the IPS signatures?

No. IPS not used

Might not hurt to update the IPS signatures on the management also to ensure that data isn't corrupt.

How to verify that? Please guide me. Thanks in advance.

0 Kudos
PhoneBoy
Admin
Admin

You should run the Pre Upgrade Verifier regardless of what blades are active.

Your command line looks correct to the best of my knowledge.

To update IPS signatures, go here in SmartDashboard:


0 Kudos
Tomer_Sole
Mentor
Mentor

0 Kudos
PhoneBoy
Admin
Admin

I mentioned that earlier.

It doesn't support Windows, which is relevant here.

0 Kudos
Hugo_vd_Kooij
Advisor

In the objects I noticed a lot of backward compatiblility stuff:

:installed_products ("IDA,CPFC,FW1,SecurePlatform,CPinfo,DIAG,SmartPortal,Reporting Module,CPuepm,VSEC,SmartLog,R7520CMP,R7540CMP,R7540VSCMP,R76CMP,SFWR77CMP,R77CMP,R75CMP,NGXCMP,EdgeCmp,SFWCMP,FLICMP,SFWR75CMP,MGMTAPI,rtm")

You might want to strip off those features, as much as possible, first before you run another export.

<< We make miracles happen while you wait. The impossible jobs take just a wee bit longer. >>
0 Kudos
Ofer_Barzvi
Employee
Employee

Please upload also $CPDIR/log/ips* , $FWDIR/log/cpm* files

It's also recommended to install latest available Jumbo mentioned in sk116380 before running the import.

0 Kudos
avisheen_shetty
Participant

Make sure the export file when transferred from management server to ftp/sftp server is bin and not ASCII. I faced similar problem. Also update the Add on package if any applicable for R80.10

0 Kudos
Ruan_Kotze
Advisor

I have come across similar issues, and while this may not solve your problem, it might put you on the correct path.  Have had two instances where the Endpoint Policy Management Blade was not properly de-activated (we traced the issue to EPM by analyzing the log files).  We resolved it by like so:

On the R77.30 SMS -

1. Active EPM Blade - Save - Install Database

2. Reboot SMS

3 De-active EPM blade - Save - Install database

4 Execute the following from the CLI "cpprod_util CPPROD_SetValue CPuepm ProdActive 1 0 1"

We then ran the migrate export / import with the --exclude-uepm-postgres-db switch.

As I said, chances are 99% that this is not your exact issue, but by taking a close look at the logs you should be able to see why the import fails and then take it from there.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events