1

Back up your current configuration.

2

See the Upgrade Options and Prerequisites.

3

In R80 and above, examine the SmartConsole sessions:

1. Connect with the SmartConsole to each Domain Management Server.
2. From the left navigation panel, click Manage & Settings > Sessions > View Sessions.
3. You must publish or discard all sessions, for which the Changes column shows a number greater than zero.

   Right-click on such session and select Publish or Discard.

4

You must close all GUI clients (SmartConsole applications) connected to the source Multi-Domain Servers.

5

Install the latest version of the CPUSE from sk92449.

Note - The default CPUSE does not support the required Upgrade Tools package.

1

Connect with SmartConsole to the Primary R80.20.M1 / R80.20.M2 Multi-Domain Server.

2

From the left navigation panel, click Multi Domain > Domains.

The table shows Domains and Multi-Domain Servers:

• Every column shows a Multi-Domain Server.
• Active Domain Management Servers (for a Domain) on a Multi-Domain Server are marked with a solid black "barrel" icon.
• Standby Domain Management Servers (for a Domain) on a Multi-Domain Server are marked with an empty "barrel" icon.

3

In the leftmost column Domains, examine the bottom row Global for the Primary Multi-Domain Server.

If the Global Domain is in the Standby state on the Primary Multi-Domain Server (marked with an empty "barrel" icon), then make it Active:

1. Right-click on the Primary Multi-Domain Server and click Connect to Domain Server. High Availability Status window opens.
2. In the section Connected To, click Actions > Set Active.
3. Click Yes to confirm.
4. Wait for the full synchronization to complete.
5. Close SmartConsole.

1

Download the required Upgrade Tools from sk135172.

Note - This is a CPUSE Offline package.

2

Install the required Upgrade Tools with CPUSE.

See Installing Software Packages on Gaia and follow the applicable action plan for the local offline installation.

3

Make sure the package is installed.

Run this command in the Expert mode:

[Expert@MDS:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.30 BuildNumber 1

The output must show the same build number you see in the name of the downloaded package.

Example:

Name of the downloaded package: ngm_upgrade_wrapper_992000043_1.tgz

[Expert@MDS:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.30 BuildNumber 1
992000043
[Expert@MDS:0]#

1

Connect to the command line on the current Multi-Domain Server.

2

Log in with the superuser credentials.

3

Log in to the Expert mode.

4

Run the Pre-Upgrade Verifier.

• If this Multi-Domain Server is connected to the Internet, run:

  [Expert@MDS:0]# $MDS_FWDIR/scripts/migrate_server verify -v R80.30

• If this Multi-Domain Server is not connected to the Internet, run:

  [Expert@MDS:0]# $MDS_FWDIR/scripts/migrate_server verify -v R80.30 -skip_upgrade_tools_check

Syntax options:

• -v R80.30 - Specifies the version, to which you plan to upgrade.
• -skip_upgrade_tools_check - Does not try to connect to Check Point Cloud to check for a more recent version of the Upgrade Tools.

5

Read the Pre-Upgrade Verifier output.

If you need to fix errors:

1. Follow the instructions in the report.
2. Run the Pre-Upgrade Verifier again.

1

Connect to the command line on the current Multi-Domain Server.

2

Log in with the superuser credentials.

3

Log in to the Expert mode.

4

Run the Pre-Upgrade Verifier.

• If this Multi-Domain Server is connected to the Internet, run:

  [Expert@MDS:0]# $MDS_FWDIR/scripts/migrate_server verify -v R80.30

• If this Multi-Domain Server is not connected to the Internet, run:

  [Expert@MDS:0]# $MDS_FWDIR/scripts/migrate_server verify -v R80.30 -skip_upgrade_tools_check

Syntax options:

• -v R80.30 - Specifies the version, to which you plan to upgrade.
• -skip_upgrade_tools_check - Does not try to connect to Check Point Cloud to check for a more recent version of the Upgrade Tools.

5

Read the Pre-Upgrade Verifier output.

If you need to fix errors:

1. Follow the instructions in the report.
2. Run the Pre-Upgrade Verifier again.

1

Connect to the command line on the current Multi-Domain Server.

2

Log in with the superuser credentials.

3

Log in to the Expert mode.

6

Go to the $MDS_FWDIR/scripts/ directory:

[Expert@MDS:0]# cd $MDS_FWDIR/scripts

7

Export the management database:

• This Multi-Domain Server is connected to the Internet, run:

  [Expert@MDS:0]# ./migrate_server export -v R80.30 [-l | -x] /<Full Path>/<Name of Exported File>.tgz

• This Multi-Domain Server is not connected to the Internet, run:

  [Expert@MDS:0]# ./migrate_server export -v R80.30 -skip_upgrade_tools_check [-l | -x] /<Full Path>/<Name of Exported File>.tgz

Syntax options:

• -v R80.30 - Specifies the version, to which you plan to upgrade.
• -skip_upgrade_tools_check - Does not try to connect to Check Point Cloud to check for a more recent version of the Upgrade Tools.
• -l - Exports the Check Point logs without log indexes in the $FWDIR/log/ directory. Note - The command can export only closed logs (to which the information is not currently written).
• -x - Exports the Check Point logs with their log indexes in the $FWDIR/log/ directory. Note - The command can export only closed logs (to which the information is not currently written).

8

Calculate the MD5 for the exported database files:

[Expert@MDS:0]# md5sum /<Full Path>/<Name of Database File>.tgz

9

Transfer the exported databases from the current Multi-Domain Server to an external storage:

/<Full Path>/<Name of Database File>.tgz

Note - Make sure to transfer the file in the binary mode.

1

Connect to the command line on the current Multi-Domain Server.

2

Log in with the superuser credentials.

3

Log in to the Expert mode.

6

Go to the $MDS_FWDIR/scripts/ directory:

[Expert@MDS:0]# cd $MDS_FWDIR/scripts

7

Export the management database:

• This Multi-Domain Server is connected to the Internet, run:

  [Expert@MDS:0]# ./migrate_server export -v R80.30 [-l | -x] /<Full Path>/<Name of Exported File>.tgz

• This Multi-Domain Server is not connected to the Internet, run:

  [Expert@MDS:0]# ./migrate_server export -v R80.30 -skip_upgrade_tools_check [-l | -x] /<Full Path>/<Name of Exported File>.tgz

Syntax options:

• -v R80.30 - Specifies the version, to which you plan to upgrade.
• -skip_upgrade_tools_check - Does not try to connect to Check Point Cloud to check for a more recent version of the Upgrade Tools.
• -l - Exports the Check Point logs without log indexes in the $FWDIR/log/ directory. Note - The command can export only closed logs (to which the information is not currently written).
• -x - Exports the Check Point logs with their log indexes in the $FWDIR/log/ directory. Note - The command can export only closed logs (to which the information is not currently written).

8

Calculate the MD5 for the exported database files:

[Expert@MDS:0]# md5sum /<Full Path>/<Name of Database File>.tgz

9

Transfer the exported databases from the current Multi-Domain Server to an external storage:

/<Full Path>/<Name of Database File>.tgz

Note - Make sure to transfer the file in the binary mode.

1

Download the required Upgrade Tools from sk135172.

Note - This is a CPUSE Offline package.

2

Install the required Upgrade Tools with CPUSE.

See Installing Software Packages on Gaia and follow the applicable action plan for the local offline installation.

3

Make sure the package is installed.

Run this command in the Expert mode:

[Expert@MDS:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.30 BuildNumber 1

The output must show the same build number you see in the name of the downloaded package.

Example:

Name of the downloaded package: ngm_upgrade_wrapper_992000043_1.tgz

[Expert@MDS:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.30 BuildNumber 1
992000043
[Expert@MDS:0]#

1

Connect to the command line on the target R80.30 Multi-Domain Server.

2

Log in to the Expert mode.

3

Create the /var/log/mdss.json file that contains every server migrated to a new IP address.

• Format for migrating only the Primary Multi-Domain Server to a new IP address:

  [{"name":"<Name of Primary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Primary R80.30 Multi-Domain Server>"}]

• Format for migrating both the Primary and the Secondary Multi-Domain Servers to new IP addresses:

  [{"name":"<Name of Primary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Primary R80.30 Multi-Domain Server>"},{"name":"<Name of Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Secondary R80.30 Multi-Domain Server>"}]

• Format for migrating both the Primary and the Secondary Multi-Domain Servers, and the Multi-Domain Log Server to new IP addresses:

  [{"name":"<Name of Primary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Primary R80.30 Multi-Domain Server>"},{"name":"<Name of Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Secondary R80.30 Multi-Domain Server>"},{"name":"<Name of R80.20.M1 or R80.20.M2 Multi-Domain Log Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of R80.30 Multi-Domain Log Server"}]

Example:

There are 3 servers in the Multi-Domain Security Management environment - the Primary Multi-Domain Server, the Secondary Multi-Domain Server, and the Multi-Domain Log Server. Both the Primary and the Secondary Multi-Domain Servers are migrated to new IP addresses. The Multi-Domain Log Server remains with the original IP address.

1. The current IPv4 address of the source Primary R80.20.M1 or R80.20.M2 Multi-Domain Server is:

   192.168.10.21

2. The current IPv4 address of the source Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server is:

   192.168.10.22

3. The name of the source Primary R80.20.M1 or R80.20.M2 Multi-Domain Server object in SmartConsole is:

   MyPrimaryMultiDomainServer

4. The name of the source Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server object in SmartConsole is:

   MySecondaryMultiDomainServer

5. The new IPv4 address of the target Primary R80.30 Multi-Domain Server is:

   172.30.40.51

6. The new IPv4 address of the target Secondary R80.30 Multi-Domain Server is:

   172.30.40.52

7. The required syntax for the JSON configuration file you must use on both the Primary and the Secondary Multi-Domain Servers, and on the Multi-Domain Log Server:

   [{"name":"MyPrimaryMultiDomainServer","newIpAddress4":"172.30.40.51"},{"name":"MySecondaryMultiDomainServer","newIpAddress4":"172.30.40.52"}]

   Clarification - All servers in this environment must get this information.

1

Connect to the command line the R80.30 Multi-Domain Server.

2

Log in with the superuser credentials.

3

Log in to the Expert mode.

4

Make sure a valid license is installed:

mdsenv

cplic print

If it is not already installed, then install a valid license now.

5

Transfer the exported database from an external storage to the R80.30 Multi-Domain Server, to some directory.

Note - Make sure to transfer the file in the binary mode.

6

Make sure the transferred file is not corrupted.

Calculate the MD5 for the transferred file and compare it to the MD5 that you calculated on the original Multi-Domain Server:

[Expert@MDS:0]# md5sum /<Full Path>/<Name of Exported File>.tgz

7

Go to the $MDS_FWDIR/scripts/ directory:

[Expert@MDS:0]# cd $MDS_FWDIR/scripts/

8

Import the management database:

• This Multi-Domain Server is connected to the Internet, run:

  [Expert@MDS:0]# ./migrate_server import -v R80.30 [-l | -x] [-change_ips_file /var/log/mdss.json] /<Full Path>/<Name of Exported File>.tgz

• This Multi-Domain Server is not connected to the Internet, run:

  [Expert@MDS:0]# ./migrate_server import -v R80.30 -skip_upgrade_tools_check [-l | -x] [-change_ips_file /var/log/mdss.json] /<Full Path>/<Name of Exported File>.tgz

Syntax options:

• -v R80.30 - Specifies the version, to which you plan to upgrade.
• -skip_upgrade_tools_check - Does not try to connect to Check Point Cloud to check for a more recent version of the Upgrade Tools.
• -l - Imports the Check Point logs without log indexes in the $FWDIR/log/ directory.
• -x - Imports the Check Point logs with their log indexes in the $FWDIR/log/ directory.
• -change_ips_file /var/log/mdss.json - Specifies the JSON file with a new IPv4 address

9

Make sure that on all Domain Management Servers, none of the required daemons (FWM, FWD, CPD, and CPCA) are in the state "down" (the "pnd" state is acceptable):

[Expert@MDS:0]# mdsstat

If some of the required daemons on a Domain Management Server are in the state "down", wait for 5-10 minutes, restart that Domain Management Server and check again. Run these three commands:

[Expert@MDS:0]# mdsstop_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstart_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstat

1

Connect to the command line on the R80.30 Multi-Domain Server.

2

Log in with the superuser credentials.

3

Log in to the Expert mode.

4

Make sure that on all Domain Management Servers, none of the required daemons (FWM, FWD, CPD, and CPCA) are in the state "down" (the "pnd" state is acceptable):

[Expert@MDS:0]# mdsstat

If some of the required daemons on a Domain Management Server are in the state "down", wait for 5-10 minutes, restart that Domain Management Server and check again. Run these three commands:

[Expert@MDS:0]# mdsstop_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstart_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstat

5

Go to the main MDS context:

[Expert@MDS:0]# mdsenv

6

Upgrade the attributes of all managed objects in all Domain Management Servers at once:

[Expert@MDS:0]# $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL

Notes:

• Because the command prompts you for a 'yes/no' for each Domain and each object in the Domain, you can explicitly provide the 'yes' answer to all questions with this command:

  [Expert@MDS:0]# yes | $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL

• You can perform this action on one Multi-Domain Server at a time with this command:

  [Expert@MDS:0]# $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL -n <Name of Multi-Domain Server>

7

Make sure that on all Domain Management Servers, none of the required daemons (FWM, FWD, CPD, and CPCA) are in the state "down" (the "pnd" state is acceptable):

[Expert@MDS:0]# mdsstat

If some of the required daemons on a Domain Management Server are in the state "down", wait for 5-10 minutes, restart that Domain Management Server and check again. Run these three commands:

[Expert@MDS:0]# mdsstop_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstart_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstat

1

Connect to the command line on the target R80.30 Multi-Domain Server.

2

Log in to the Expert mode.

3

Create the /var/log/mdss.json file that contains every server migrated to a new IP address.

• Format for migrating only the Primary Multi-Domain Server to a new IP address:

  [{"name":"<Name of Primary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Primary R80.30 Multi-Domain Server>"}]

• Format for migrating both the Primary and the Secondary Multi-Domain Servers to new IP addresses:

  [{"name":"<Name of Primary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Primary R80.30 Multi-Domain Server>"},{"name":"<Name of Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Secondary R80.30 Multi-Domain Server>"}]

• Format for migrating both the Primary and the Secondary Multi-Domain Servers, and the Multi-Domain Log Server to new IP addresses:

  [{"name":"<Name of Primary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Primary R80.30 Multi-Domain Server>"},{"name":"<Name of Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Secondary R80.30 Multi-Domain Server>"},{"name":"<Name of R80.20.M1 or R80.20.M2 Multi-Domain Log Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of R80.30 Multi-Domain Log Server"}]

Example:

There are 3 servers in the Multi-Domain Security Management environment - the Primary Multi-Domain Server, the Secondary Multi-Domain Server, and the Multi-Domain Log Server. Both the Primary and the Secondary Multi-Domain Servers are migrated to new IP addresses. The Multi-Domain Log Server remains with the original IP address.

1. The current IPv4 address of the source Primary R80.20.M1 or R80.20.M2 Multi-Domain Server is:

   192.168.10.21

2. The current IPv4 address of the source Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server is:

   192.168.10.22

3. The name of the source Primary R80.20.M1 or R80.20.M2 Multi-Domain Server object in SmartConsole is:

   MyPrimaryMultiDomainServer

4. The name of the source Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server object in SmartConsole is:

   MySecondaryMultiDomainServer

5. The new IPv4 address of the target Primary R80.30 Multi-Domain Server is:

   172.30.40.51

6. The new IPv4 address of the target Secondary R80.30 Multi-Domain Server is:

   172.30.40.52

7. The required syntax for the JSON configuration file you must use on both the Primary and the Secondary Multi-Domain Servers, and on the Multi-Domain Log Server:

   [{"name":"MyPrimaryMultiDomainServer","newIpAddress4":"172.30.40.51"},{"name":"MySecondaryMultiDomainServer","newIpAddress4":"172.30.40.52"}]

   Clarification - All servers in this environment must get this information.

1

Connect to the command line on the target R80.30 Multi-Domain Server.

2

Log in to the Expert mode.

3

Create the /var/log/mdss.json file that contains every server migrated to a new IP address.

• Format for migrating only the Primary Multi-Domain Server to a new IP address:

  [{"name":"<Name of Primary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Primary R80.30 Multi-Domain Server>"}]

• Format for migrating both the Primary and the Secondary Multi-Domain Servers to new IP addresses:

  [{"name":"<Name of Primary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Primary R80.30 Multi-Domain Server>"},{"name":"<Name of Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Secondary R80.30 Multi-Domain Server>"}]

• Format for migrating both the Primary and the Secondary Multi-Domain Servers, and the Multi-Domain Log Server to new IP addresses:

  [{"name":"<Name of Primary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Primary R80.30 Multi-Domain Server>"},{"name":"<Name of Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Secondary R80.30 Multi-Domain Server>"},{"name":"<Name of R80.20.M1 or R80.20.M2 Multi-Domain Log Server Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of R80.30 Multi-Domain Log Server"}]

Example:

There are 3 servers in the Multi-Domain Security Management environment - the Primary Multi-Domain Server, the Secondary Multi-Domain Server, and the Multi-Domain Log Server. Both the Primary and the Secondary Multi-Domain Servers are migrated to new IP addresses. The Multi-Domain Log Server remains with the original IP address.

1. The current IPv4 address of the source Primary R80.20.M1 or R80.20.M2 Multi-Domain Server is:

   192.168.10.21

2. The current IPv4 address of the source Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server is:

   192.168.10.22

3. The name of the source Primary R80.20.M1 or R80.20.M2 Multi-Domain Server object in SmartConsole is:

   MyPrimaryMultiDomainServer

4. The name of the source Secondary R80.20.M1 or R80.20.M2 Multi-Domain Server object in SmartConsole is:

   MySecondaryMultiDomainServer

5. The new IPv4 address of the target Primary R80.30 Multi-Domain Server is:

   172.30.40.51

6. The new IPv4 address of the target Secondary R80.30 Multi-Domain Server is:

   172.30.40.52

7. The required syntax for the JSON configuration file you must use on both the Primary and the Secondary Multi-Domain Servers, and on the Multi-Domain Log Server:

   [{"name":"MyPrimaryMultiDomainServer","newIpAddress4":"172.30.40.51"},{"name":"MySecondaryMultiDomainServer","newIpAddress4":"172.30.40.52"}]

   Clarification - All servers in this environment must get this information.

1

Connect with SmartConsole to each Domain Management Server.

2

In the top left corner, click Menu > Install database.

3

Select all objects.

4

Click Install.

5

Click OK.

1

Connect to the command line every Multi-Domain Server that has at least one Active Domain Management Server.

2

Log in with the superuser credentials.

3

Log in to the Expert mode.

4

Make sure that on all Domain Management Servers, none of the required daemons (FWM, FWD, CPD, and CPCA) are in the state "down" (the "pnd" state is acceptable):

[Expert@MDS:0]# mdsstat

If some of the required daemons on a Domain Management Server are in the state "down", wait for 5-10 minutes, restart that Domain Management Server and check again. Run these three commands:

[Expert@MDS:0]# mdsstop_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstart_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstat

5

Go to the main MDS context:

[Expert@MDS:0]# mdsenv

6

Upgrade the attributes of all managed objects in all Domain Management Servers at once:

[Expert@MDS:0]# $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL

Notes:

• Because the command prompts you for a 'yes/no' for each Domain and each object in the Domain, you can explicitly provide the 'yes' answer to all questions with this command:

  [Expert@MDS:0]# yes | $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL

• You can perform this action on one Multi-Domain Server at a time with this command:

  [Expert@MDS:0]# $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL -n <Name of Multi-Domain Server>

7

Make sure that on all Domain Management Servers, none of the required daemons (FWM, FWD, CPD, and CPCA) are in the state "down" (the "pnd" state is acceptable):

[Expert@MDS:0]# mdsstat

If some of the required daemons on a Domain Management Server are in the state "down", wait for 5-10 minutes, restart that Domain Management Server and check again. Run these three commands:

[Expert@MDS:0]# mdsstop_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstart_customer <IP Address or Name of Domain Management Server>

[Expert@MDS:0]# mdsstat

1

Connect with SmartConsole to the R80.30 Multi-Domain Server.

2

Make sure the management database and configuration were imported correctly.

3

Test the Management High Availability functionality.