Upgrade Prerequisites

In This Section:

Before you upgrade:

If you are already at NGX R65, do not use this guide to upgrade to a NGX R65.xx version.
Upgrade instructions are in the NGX R65.xx Release Notes.
For information about supported upgrade paths, see the Release Notes.
Make sure that you have the latest version of this document.

If you use Mobile Access Software Blade and you edited the configurations, review the edits before you upgrade to R77!

Open these files and make note of your changes.

Data	Path

Gateway Configurations	$CVPNDIR/conf/cvpnd.C
Apache Configuration Files	$CVPNDIR/conf/httpd.conf
Apache Configuration Files	$CVPNDIR/conf/includes/*
Local certificate authorities	$CVPNDIR/var/ssl/ca-bundle/
DynamicID (SMS OTP) Local Phone List	$CVPNDIR/conf/SmsPhones.lst
RSA configuration	/var/ace/sdconf.rec
Any PHP files that were edited
Any image file that was replaced (.gif, .jpg)

Upgrade to R77.
Update Endpoint Compliance (SmartDashboard > Mobile Access > Endpoint Security On Demand > Update Databases Now).
Manually edit the new versions of the files, to include your changes.
Do not overwrite the R77 files with your customized files!

Contract Verification

A valid Service Contract is required for all upgrades. The installation procedure makes sure that a service contract is in force before continuing with installation.

Upgrade Tools

Before you upgrade appliances or computers, get the upgrade tools. There is a different package of tools for each source platform. After installation, you can find the upgrade tools in the installation directory.

Gaia, SecurePlatform, Linux: $FWDIR/bin/upgrade_tools
Windows: %FWDIR%/bin/upgrade_tools

To make sure you have the latest version of the upgrade tools, you can download the appropriate package from the Check Point Support site.

When you open the upgrade_tools package, you see these files:

Package	Description
migrate.conf	Holds configuration settings for Advanced Upgrade / Database Migration.
migrate	Runs Advanced Upgrade or migration. On Windows, this is migrate.exe.
pre_upgrade_verifier.exe	Analyzes compatibility of the currently installed configuration with the upgrade version. It gives a report on the actions to take before and after the upgrade.
migrate export	Backs up all Check Point configurations, without operating system information. On Windows, this is migrate.exe export
migrate import	Restores backed up configuration. On Windows, this is migrate.exe import

Using the Pre-Upgrade Verifier Tool

The Pre-upgrade Verifier runs automatically during the upgrade process. You can also run it manually with this command.

Syntax:

pre_upgrade_verifier.exe -p <ServerPath> -c <CurrentVersion> (-t <TargetVersion> | -i) [-f <FileName>]

Parameters:

Parameter	Description
-p	Path of the installed Security Management Server (FWDIR)
-c	Currently installed version
-t -i	Target version If `-i` is used, only the INSPECT files are analyzed, to see if they were customized.
-f	Output report to this file
-w	Output report to a web format file Note - HTML output is given by default in R80.10. This flag is not required.

Upgrading Successfully

When upgrading a Security Management Server, IPS profiles remain in effect on earlier Gateways and can be managed from the IPS tab. When the gateway is upgraded, install the policy to get the new IPS profile.
When upgrading a Security Gateway, remember to change the gateway object in SmartDashboard to the new version.

If you encounter unforeseen obstacles during the upgrade process, consult the Support Center or contact your Reseller.

Uninstalling Packages

Some upgrade procedures require an uninstall of certain packages. You must uninstall Check Point packages in the opposite order from which they were installed. For example, CPsuite is the first package installed, so it is the last package uninstalled.

To see a list of the installed packages:

SecurePlatform: rpm -e <package name>
Windows: Use the Control Panel > Add / Remove Programs utility