Upgrade Prerequisites

In This Section: Contract Verification Upgrade Tools Using the Pre-Upgrade Verifier Tool Upgrading Successfully Service Contract Files

Before you upgrade:

• If you are already at R77, do not use this guide to upgrade to a R77.xx version.
  Upgrade instructions are in the R77.xx Release Notes.
• For information about supported upgrade paths, see the Release Notes.
• Make sure that you have the latest version of this document.

If you use Mobile Access Software Blade and you edited the configurations, review the edits before you upgrade to R77!

1. Open these files and make note of your changes.

   Data	Path
   Gateway Configurations	$CVPNDIR/conf/cvpnd.C
   Apache Configuration Files	$CVPNDIR/conf/httpd.conf
   	$CVPNDIR/conf/includes/*
   Local certificate authorities	$CVPNDIR/var/ssl/ca-bundle/
   DynamicID (SMS OTP) Local Phone List	$CVPNDIR/conf/SmsPhones.lst
   RSA configuration	/var/ace/sdconf.rec
   Any PHP files that were edited
   Any image file that was replaced (*.gif, *.jpg)

2. Upgrade to R77.
3. Update Endpoint Compliance (SmartDashboard > Mobile Access > Endpoint Security On Demand > Update Databases Now).
4. Manually edit the new versions of the files, to include your changes.

   Do not overwrite the R77 files with your customized files!

Contract Verification

A valid Service Contract is required for all upgrades. The installation procedure makes sure that a service contract is in force before continuing with installation.

Upgrade Tools

Before you upgrade appliances or computers, get the upgrade tools. There is a different package of tools for each source platform. After installation, you can find the upgrade tools in the installation directory.

• Gaia, SecurePlatform, Linux: $FWDIR/bin/upgrade_tools
• Windows: %FWDIR%/bin/upgrade_tools

To make sure you have the latest version of the upgrade tools, you can download the appropriate package from the Check Point Support site.

When you open the upgrade_tools package, you see these files:

Package	Description
migrate.conf	Holds configuration settings for Advanced Upgrade / Database Migration.
migrate	Runs Advanced Upgrade or migration. On Windows, this is migrate.exe.
pre_upgrade_verifier.exe	Analyzes compatibility of the currently installed configuration with the upgrade version. It gives a report on the actions to take before and after the upgrade.
migrate export	Backs up all Check Point configurations, without operating system information. On Windows, this is migrate.exe export
migrate import	Restores backed up configuration. On Windows, this is migrate.exe import

Using the Pre-Upgrade Verifier Tool

The Pre-upgrade Verifier runs automatically during the upgrade process. You can also run it manually with this command.

Syntax:

pre_upgrade_verifier.exe -p <ServerPath> -c <CurrentVersion> (-t <TargetVersion> | -i) [-f <FileName>]

Parameters:

Parameter	Description
-p	Path of the installed Security Management Server (FWDIR)
-c	Currently installed version
-t -i	Target version If -i is used, only the INSPECT files are analyzed, to see if they were customized.
-f	Output report to this file
-w	Output report to a web format file Note - HTML output is given by default in R80.10. This flag is not required.

Upgrading Successfully

• When upgrading a Security Management Server, IPS profiles remain in effect on earlier Gateways and can be managed from the IPS tab. When the gateway is upgraded, install the policy to get the new IPS profile.
• When upgrading a Security Gateway, remember to change the gateway object in SmartDashboard to the new version.

If you encounter unforeseen obstacles during the upgrade process, consult the Support Center or contact your Reseller.

Service Contract Files

Introduction

Before upgrading a gateway or Security Management Server to R77, you need to have a valid support contract that includes software upgrade and major releases registered to your Check Point User Center account. The Security Management Server stores the contract file and downloads it to Security Gateways during the upgrade. By verifying your status with the User Center, the contract file enables you to easily remain compliant with current Check Point licensing standards.

Working with Contract Files

As in all upgrade procedures, first upgrade your Security Management Server or Multi-Domain Server before upgrading the Gateways. Once the management has been successfully upgraded and contains a contract file, the contract file is transferred to a gateway when the gateway is upgraded (the contract file is retrieved from the management).

Note - Multiple user accounts at the User Center are supported.

Installing a Contract File on the Security Management Server

When you upgrade a Management Server, the upgrade process checks to see whether a Contract File is already present on the v. If not, you get the main options for getting a contract. You can download a Contract File or import it.

If the Contract File does not cover the Management Server, a message informs you that the Management Server is not eligible for upgrade. The absence of a valid Contract File does not prevent upgrade. You can download a valid Contract File later in SmartUpdate.

• To download a contracts file from the User Center

  If you have Internet access and a valid user account, download a Contract File directly from your User Center account. If you choose to download the contract information from the User Center, you are prompted to enter your:

  • User name
  • Password
  • Proxy server address (if applicable)
• To import a local contract file

  If the Management Server does not have Internet access:

  1. On a computer with Internet access, log in to the User Center.
  2. In the top menu, click Assets/Info > Download Contract File and follow the instructions on the screen.
  3. Transfer the downloaded file to the Management Server.
  4. After selecting Import a local contracts file, enter the full path to the location where you stored the file.
• To continue without contract information

  Select this option if you intend to get and install a valid Contract File at a later date. Note that at this point your Security Gateways are not strictly eligible for an upgrade; you may be in violation of your Check Point Licensing Agreement, as shown in the final message of the upgrade process.

Installing a Contract File On Security Gateways

After you accept the End User License Agreement (EULA), the upgrade process searches for a valid contract on the gateway. If a valid contract is not located, the upgrade process attempts to retrieve the latest contract file from the Security Management Server. If not found, you can download or import a contract.

If the contract file does not cover the gateway, a message informs you (on Download or Import) that the gateway is not eligible for upgrade. The absence of a valid contract file does not prevent upgrade. When the upgrade is complete, contact your local support provider to obtain a valid contract. Use SmartUpdate to install the contract file.

Use the download or import instructions for installing a contract file on a Security Management Server.

If you continue without a contract, you install a valid contract file later. But the gateway is not eligible for upgrade. You may be in violation of your Check Point Licensing Agreement, as shown in the final message of the upgrade process. Contact your reseller.