Upgrading a Multi-Domain Log Server from R80.10 and lower with Migration

In a migration and upgrade scenario, you perform the procedure on the source Multi-Domain Log Server and the different target Multi-Domain Log Server.

Note - To upgrade from R80.20 and higher, see Upgrading a Multi-Domain Log Server from R80.20 and higher with Migration.

Important - Before you upgrade a Multi-Domain Log Server:

Step

Instructions

1

Back up your current configuration (see Backing Up and Restoring).

2

See the Upgrade Options and Prerequisites.

3

You must upgrade your Multi-Domain Servers.

4

You must close all GUI clients (SmartConsole applications) connected to the source Multi-Domain Log Server.

5

Run the Pre-Upgrade Verifier on all source servers and fix all detected issues before you start the upgrade.

Procedure:

  1. Step

    Instructions

    1

    Download the R80.40 Clean Install ISO file from the R80.40 Home Page SK.

    2

    Transfer the R80.40 ISO file to the current server to some directory (for example, /var/log/path_to_iso/).

    Note - Make sure to transfer the file in the binary mode.

  2. Step

    Instructions

    1

    Connect to the command line on the current Multi-Domain Log Server.

    2

    Log in with the superuser credentials.

    3

    Log in to the Expert mode.

    4

    Stop all Check Point services:

    mdsstop

    5

    Go to the main MDS context:

    mdsenv

    6

    Mount the R80.40 ISO file:

    mount -o loop /var/log/path_to_iso/<R80.40_Gaia>.iso /mnt/cdrom

    7

    Go to the installation folder in the ISO:

    cd /mnt/cdrom/linux/p1_install/

    8

    Run the installation script:

    ./mds_setup

    This menu shows:

    (1) Run Pre-upgrade verification only [recommended before upgrade]

    (2) Backup current Multi-Domain Server

    (3) Export current Multi-Domain Server

        Or 'Q' to quit.

    9

    Enter 1 to run the Pre-Upgrade Verifier.

    Note - The Pre-Upgrade Verifier analyzes compatibility of the currently installed configuration with the version, to which you upgrade. A detailed report shows the steps to do before and after the upgrade.

    10

    Read the Pre-Upgrade Verifier output.

    If it is necessary to fix errors:

    1. Start all Check Point services:

      mdsstart

    2. Follow the instructions in the report.

    3. In a Management High Availability environment R77.30 and lower:

      If you made changes, synchronize the Domain Management Servers immediately after these changes.

      (In R80 and higher, this synchronization occurs automatically.)

    4. Stop all Check Point services again:

      mdsstop

    5. Run the installation script again:

      ./mds_setup

      This menu shows:

      (1) Run Pre-upgrade verification only [recommended before upgrade]

      (2) Backup current Multi-Domain Server

      (3) Export current Multi-Domain Server

          Or 'Q' to quit.

    11

    Enter 3 to export the current Multi-Domain Log Server configuration.

    12

    Answer the interactive questions:

    Would you like to proceed with the export now [yes/no] ? yes

    Please enter target directory for your Multi-Domain Server export (or 'Q' to quit): /var/log

    Do you plan to import to a version newer than R80.40 [yes/no] ? no

    Using migrate_tools from disk.

    Do you wish to export the log database [yes/no] ? yes

    Note - If you enter no in the question "Do you wish to export the log database", the configuration is still exported.

    13

    Make sure the export file is created in the specified directory:

    ls -l /var/log/exported_mds.<DDMMYYYY-HHMMSS>.tgz

    14

    Calculate the MD5 for the exported file:

    md5sum /var/log/exported_mds.<DDMMYYYY-HHMMSS>.tgz

    15

    Transfer the exported database from the current Multi-Domain Log Server to an external storage:

    /var/log/exported_mds.<DDMMYYYY-HHMMSS>.tgz

    Note - Make sure to transfer the file in the binary mode.

  3. Step

    Instructions

    1

    See the R80.40 Release Notes for requirements.

    2

    Perform the clean install on another server in one of these ways (do not perform initial configuration in SmartConsole):

    Important - The IP addresses of the source and target R80.40 servers must be the same. If it is necessary to have a different IP address on the R80.40 server, you can change it only after the upgrade procedure. Note that you have to issue licenses for the new IP address. See Changing the IP Address of a Multi-Domain Server or Multi-Domain Log Server.

  4. Important - Before you import the management database, we strongly recommend to install the latest General Availability Take of the R80.40 Jumbo Hotfix Accumulator. This makes sure the R80.40 server has the latest improvements for reported import issues.

    Step

    Instructions

    1

    Connect to the command line on the R80.40 Multi-Domain Log Server.

    2

    Log in with the superuser credentials.

    3

    Log in to the Expert mode.

    4

    Make sure a valid license is installed:

    cplic print

    If it is not already installed, then install a valid license now.

    5

    Transfer the exported database from an external storage to the R80.40 Multi-Domain Log Server, to some directory.

    Note - Make sure to transfer the file in the binary mode.

    6

    Make sure the transferred file is not corrupted.

    Calculate the MD5 for the transferred file and compare it to the MD5 that you calculated on the original Multi-Domain Log Server:

    md5sum /<Full Path>/exported_mds.<DDMMYYYY-HHMMSS>.tgz

    7

    Import the configuration:

    yes | nohup $MDSDIR/scripts/mds_import.sh /<Full Path>/exported_mds.<DDMMYYYY-HHMMSS>.tgz &

    Notes:

    • yes | nohup ... & are mandatory parts of the syntax.

    • For details, see the R80.40 CLI Reference Guide - Chapter Multi-Domain Security Management Commands - Section migrate.

    8

    Make sure that all the required daemons have the correct state:

    mdsstat

    • The state of the FWM, FWD, and CPD daemons must be "up" on all levels.

      These daemons must show their PID, or "pnd".

    • The state of the CPCA daemon must be "N/R" on the MDS level.

    • The state of the CPCA daemon must be "down" on the Domain Log Server level.

    If the state of one of the required daemons (FWM, FWD, or CPD) on a Domain Log Server is "down", then wait for 5-10 minutes, restart that Domain Log Server, and check again. Run these three commands:

    mdsstop_customer <IP Address or Name of Domain Log Server>

    mdsstart_customer <IP Address or Name of Domain Log Server>

    mdsstat

  5. Step

    Instructions

    1

    Connect with SmartConsole to the R80.40 Multi-Domain Server that manages the Multi-Domain Log Server.

    2

    From the left navigation panel, click Multi-Domain > Domains.

    3

    From the top toolbar, open the Multi-Domain Log Server object.

    4

    From the left tree, click General.

    5

    In the Platform section > in the Version field, select R80.40.

    6

    Click OK.

  6. Step

    Instructions

    1

    Connect with SmartConsole to each Domain Management Server that manages the Domain Log Server.

    2

    In the top left corner, click Menu > Install database.

    3

    Select all objects.

    4

    Click Install.

    5

    Click OK.

  7. Step

    Instructions

    1

    Connect to the command line on the R80.40 Multi-Domain Log Server.

    2

    Log in with the superuser credentials.

    3

    Log in to the Expert mode.

    4

    Make sure that all the required daemons have the correct state:

    mdsstat

    • The state of the FWM, FWD, and CPD daemons must be "up" on all levels.

      These daemons must show their PID, or "pnd".

    • The state of the CPCA daemon must be "N/R" on the MDS level.

    • The state of the CPCA daemon must be "down" on the Domain Log Server level.

    If the state of one of the required daemons (FWM, FWD, or CPD) on a Domain Log Server is "down", then wait for 5-10 minutes, restart that Domain Log Server, and check again. Run these three commands:

    mdsstop_customer <IP Address or Name of Domain Log Server>

    mdsstart_customer <IP Address or Name of Domain Log Server>

    mdsstat

    5

    Go to the main MDS context:

    mdsenv

    6

    Upgrade the attributes of all managed objects in all Domain Log Servers at once:

    $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL

    Notes:

    • Because the command prompts you for a 'yes/no' for each Domain and each object in the Domain, you can explicitly provide the 'yes' answer to all questions with this command:

      yes | $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL

    • You can perform this action on one Domain Log Server at a time with this command:

      $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL -n <Name of Domain Log Server>

    7

    Allow the database synchronization to run:

    $CPDIR/bin/cpprod_util CPPROD_SetValue "FW1/6.0" AfterUpgradeDbsyncIndication 1 1 0

    Restart the Check Point services:

    mdsstop

    mdsstart

    For more information, see sk121718.

    8

    Make sure that all the required daemons have the correct state:

    mdsstat

    • The state of the FWM, FWD, and CPD daemons must be "up" on all levels.

      These daemons must show their PID, or "pnd".

    • The state of the CPCA daemon must be "N/R" on the MDS level.

    • The state of the CPCA daemon must be "down" on the Domain Log Server level.

    If the state of one of the required daemons (FWM, FWD, or CPD) on a Domain Log Server is "down", then wait for 5-10 minutes, restart that Domain Log Server, and check again. Run these three commands:

    mdsstop_customer <IP Address or Name of Domain Log Server>

    mdsstart_customer <IP Address or Name of Domain Log Server>

    mdsstat

  8. Step

    Instructions

    1

    Connect to the command line on the server.

    2

    Log in to the Expert mode.

    3

    Restore the Log Exporter configuration as described in sk127653.

    4

    Reconfigure the Log Exporter:

    cp_log_export reconf

    5

    Restart the Log Exporter:

    cp_log_export restart

    For more information, see the R80.40 Logging and Monitoring Administration Guide > Chapter Log Exporter.

  9. Step

    Instructions

    1

    Connect with SmartConsole to the R80.40 Multi-Domain Log Server.

    2

    Make sure the management database and configuration were upgraded correctly.

  10. Step

    Instructions

    1

    Connect with SmartConsole to the R80.40 Multi-Domain Server.

    2

    Make sure the management database and configuration were upgraded correctly.

  11. Disconnect the network cables the old Multi-Domain Log Server.

  12. Connect the network cables to the new Multi-Domain Log Server.