Upgrade 4200 appliances running as ClusterXL to Virtual system.

[hle2001]

Hi,

I am new to this board but I am a long time Checkpoint customer since version R77.xx, but I have not done CP gateway on virtual system so your comments will be greatly appreciated.

I have a VM Security Management GaiA server running on Hyper-V for a few years now, and a pair 4200 appliances running R80.40 as ClusterXL Active/Standby function, however the 4200 will be discontinue soon.

I am planning to build two dedicate Dell rack servers running windows server 2016 Hyper-V platform and install 2 VM Checkpoint gateway version R81.10 and set them up as clusterXL just like I have with the 4200. I saw on YouTube that you can install R81.10 on Windows Hyper-V but can it setup to run ClusterXL as active/standby using a dedicate dumb switch as sync interface? Keep in mind it is not a Full HA.

Also can I copy and import rules, objects from 4200 appliances to the new virtual system?

My management security GiaA R80.40 is already running as VM on Windows Hyper-V. Can I upgrade it to R81.10 and still manage 4200 gateway R80.40? Can it also connect to manage new Cluster R81.10 virtual system or I have to create another new R81.10 management security VM for the new virtual system. Again thank for your comments.

-Robert Lee

robert.lee@ineos.com

[Chris_Atkinson]

R81.10 SMS can manage R80.40 gateways. Provided it meets the requirement it (Mgmt) can be upgraded in-place with necessary preparations e.g. backups / snapshots etc

The rules are stored in the management, the same management can manage both sets of gateways assuming the license covers the number of gateways.

The existing policy can be reused for the new cluster likely with some modification.

[hle2001]

Hi Chris,

We changed our approach, we will upgrade our cluster 4200 to 3600 appliances. I notice the pair 3600 came with R81.10, so I will plan to upgrade my Management gateway VM from R80.40 to R81.10.

As far as, to replace the clusterXL Active/standby 4200 with 3600 can you provide me some steps and guideline to do this with zero downtime possible? Thank you very much. 

[Chris_Atkinson]

They cannot be clustered together as are different models/versions, hence a parallel build and move cables / unshut switch ports.

There are also options to temporarily disable out-of-state traffic drops if that is a concern.