1

Back up your current configuration.

2

See the Upgrade Options and Prerequisites.

3

In R80 and above, examine the SmartConsole sessions:

1. Connect with the SmartConsole to the Security Management Server.
2. From the left navigation panel, click Manage & Settings > Sessions > View Sessions.
3. You must publish or discard all sessions, for which the Changes column shows a number greater than zero.

   Right-click on such session and select Publish or Discard.

4

You must close all GUI clients (SmartConsole applications) connected to the source Security Management Server.

5

Install the latest version of the CPUSE from sk92449.

Note - The default CPUSE does not support the required Upgrade Tools package.

1

Download the required Upgrade Tools from sk135172.

Note - This is a CPUSE Offline package.

2

Install the required Upgrade Tools with CPUSE.

See Installing Software Packages on Gaia and follow the applicable action plan for the local offline installation.

3

Make sure the package is installed.

Run this command in the Expert mode:

[Expert@MGMT:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.20 BuildNumber 1

The output must show the same build number you see in the name of the downloaded package.

Example:

Name of the downloaded package: ngm_upgrade_wrapper_992000043_1.tgz

[Expert@MGMT:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.20 BuildNumber 1
992000043
[Expert@MGMT:0]#

1

Connect to the command line on the current Security Management Server.

2

Log in to the Expert mode.

3

Run the Pre-Upgrade Verifier.

• If this Security Management Server is connected to the Internet, run:

  [Expert@MGMT:0]# $FWDIR/scripts/migrate_server verify -v R80.20

• If this Security Management Server is not connected to the Internet, run:

  [Expert@MGMT:0]# $FWDIR/scripts/migrate_server verify -v R80.20 -skip_upgrade_tools_check

4

Read the Pre-Upgrade Verifier output.

If you need to fix errors:

1. Follow the instructions in the report.
2. Run the Pre-Upgrade Verifier again.

5

Go to the $FWDIR/scripts/ directory:

[Expert@MGMT:0]# cd $FWDIR/scripts

6

Export the management database:

• If Endpoint Policy Management blade is disabled on this Security Management Server and:
  • This Security Management Server is connected to the Internet, run:

    [Expert@MGMT:0]# ./migrate_server export -v R80.20 [-l | -x] /<Full Path>/<Name of Exported File>.tgz

  • This Security Management Server is not connected to the Internet, run:

    [Expert@MGMT:0]# ./migrate_server export -v R80.20 -skip_upgrade_tools_check [-l | -x] /<Full Path>/<Name of Exported File>.tgz

• If Endpoint Policy Management blade is enabled on this Security Management Server and:
  • This Security Management Server is connected to the Internet, run:

    [Expert@MGMT:0]# ./migrate_server export -v R80.20 [-l | -x] [--include-uepm-msi-files] /<Full Path>/<Name of Exported File>.tgz

  • This Security Management Server is not connected to the Internet, run:

    [Expert@MGMT:0]# ./migrate_server export -v R80.20 -skip_upgrade_tools_check [-l | -x] [--include-uepm-msi-files] /<Full Path>/<Name of Exported File>.tgz

Syntax options:

• -v R80.20 - Specifies the version, to which you plan to upgrade.
• -skip_upgrade_tools_check - Does not try to connect to Check Point Cloud to check for a more recent version of the Upgrade Tools.
• -l - Exports the Check Point logs without log indexes in the $FWDIR/log/ directory. Note - The command can export only closed logs (to which the information is not currently written).
• -x - Exports the Check Point logs with their log indexes in the $FWDIR/log/ directory. Note - The command can export only closed logs (to which the information is not currently written).
• --include-uepm-msi-files - Backs up the MSI files from the Endpoint Security Management Server during the export operation.

7

Calculate the MD5 for the exported database files:

[Expert@MGMT:0]# md5sum /<Full Path>/<Name of Database File>.tgz

8

Transfer the exported databases from the current Security Management Server to an external storage:

/<Full Path>/<Name of Database File>.tgz

Note - Make sure to transfer the file in the binary mode.

1

Download the required Upgrade Tools from sk135172.

Note - This is a CPUSE Offline package.

2

Install the required Upgrade Tools with CPUSE.

See Installing Software Packages on Gaia and follow the applicable action plan for the local offline installation.

3

Make sure the package is installed.

Run this command in the Expert mode:

[Expert@MGMT:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.20 BuildNumber 1

The output must show the same build number you see in the name of the downloaded package.

Example:

Name of the downloaded package: ngm_upgrade_wrapper_992000043_1.tgz

[Expert@MGMT:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.20 BuildNumber 1
992000043
[Expert@MGMT:0]#

1

Connect to the command line on the R80.20 Security Management Server.

2

Log in to the Expert mode.

3

Make sure a valid license is installed:

cplic print

If it is not already installed, then install a valid license now.

4

Transfer the exported databases from an external storage to the R80.20 Security Management Server, to some directory.

Note - Make sure to transfer the files in the binary mode.

5

Make sure the transferred files are not corrupted. Calculate the MD5 for the transferred files and compare them to the MD5 that you calculated on the original Security Management Server:

[Expert@MGMT:0]# md5sum /<Full Path>/<Name of Database File>.tgz

6

Go to the $FWDIR/scripts/ directory:

[Expert@MGMT:0]# cd $FWDIR/scripts/

7

Import the management database:

• If Endpoint Policy Management blade is disabled on this Security Management Server and:
  • This Security Management Server is connected to the Internet, run:

    [Expert@MGMT:0]# ./migrate_server import -v R80.20 [-l | -x] /<Full Path>/<Name of Exported File>.tgz

  • This Security Management Server is not connected to the Internet, run:

    [Expert@MGMT:0]# ./migrate_server import -v R80.20 -skip_upgrade_tools_check [-l | -x] /<Full Path>/<Name of Exported File>.tgz

• If Endpoint Policy Management blade is enabled on this Security Management Server and:
  • This Security Management Server is connected to the Internet, run:

    [Expert@MGMT:0]# ./migrate_server import -v R80.20 [-l | -x] [--include-uepm-msi-files] /<Full Path>/<Name of Exported File>.tgz

  • This Security Management Server is not connected to the Internet, run:

    [Expert@MGMT:0]# ./migrate_server import -v R80.20 -skip_upgrade_tools_check [-l | -x] [--include-uepm-msi-files] /<Full Path>/<Name of Exported File>.tgz

Note - The migrate_server import command automatically restarts Check Point services (performs cpstop and cpstart).

Syntax options:

• -v R80.20 - Specifies the version, to which you plan to upgrade.
• -skip_upgrade_tools_check - Does not try to connect to Check Point Cloud to check for a more recent version of the Upgrade Tools.
• -l - Imports the Check Point logs without log indexes in the $FWDIR/log/ directory.
• -x - Imports the Check Point logs with their log indexes in the $FWDIR/log/ directory.
• --include-uepm-msi-files - Restores the MSI files from the Endpoint Security Management Server during the import operation.

1

Issue licenses for the new IP address in your Check Point User Center account.

2

Install the new licenses on the R80.20 Security Management Server.

You can do this either in the CLI with the cplic put command, or in the Gaia Portal.

3

Wait for a couple of minutes for the Security Management Server to detect the new licenses.

Alternatively, restart Check Point services:

[Expert@MGMT:0]# cpstop

[Expert@MGMT:0]# cpstart

1

Connect with SmartConsole to the R80.20 Security Management Server.

2

In the top left corner, click Menu > Install database.

3

Select all objects.

4

Click Install.

5

Click OK.

1

Connect with the SmartConsole to the R80.20 Security Management Server.

2

In the SmartConsole, from the left navigation panel, click Logs & Monitor.

3

At the top, click + to open a new tab.

4

In the bottom left corner, in the External Apps section, click SmartEvent Settings & Policy.

The Legacy SmartEvent client opens.

5

In the top left corner, click Menu > Actions > Install Event Policy.

6

Confirm.

7

Wait for these messages to appear:

SmartEvent Policy Installer installation complete

SmartEvent Policy Installer installation succeeded

8

Click Close.

9

Close the Legacy SmartEvent client.

1

Connect with the SmartConsole to the R80.20 Security Management Server.

2

Make sure the management database and configuration were upgraded correctly.