Upgrading a Security Management Server or Log Server from R80.20 and higher with Migration

In a migration and upgrade scenario, you perform the procedure on the source Check Point server and the different target Check Point server.

Notes: This procedure is supported only for servers that run R80.20.M1, R80.20, R80.20.M2, or R80.30 versions. These instructions equally apply to: Security Management Server Endpoint Security Management Server Dedicated Log Server Dedicated SmartEvent Server For additional information related to this upgrade, see sk163814.

Important - Before you upgrade a Management Server or Log Server: Step Instructions 1 Back up your current configuration (see Backing Up and Restoring). 2 See the Upgrade Options and Prerequisites. 3 Only the latest published database revision is upgraded. If there are pending changes, we recommend to Publish the session. 4 You must close all GUI clients (SmartConsole applications) connected to the source Security Management Server. 5 Install the latest version of the CPUSE from sk92449. Note - This is to make sure the CPUSE is able to support the required Upgrade Tools package. 6 Run the Pre-Upgrade Verifier on all source servers and fix all detected issues before you start the upgrade. 7 In Management High Availability, make sure the Primary Security Management Server is upgraded and runs, before you start the upgrade on other servers.

Procedure:

1. Get the required Upgrade Tools on the source server

   Important - See Management Server Migration Tool and Upgrade Tools to understand if your server can download and install the latest version of the Upgrade Tools automatically.

   Step	Instructions
   1	Download the R80.40 Upgrade Tools from the sk135172. (See Management Server Migration Tool and Upgrade Tools.) Note - This is a CPUSE Offline package.
   2	Install the R80.40 Upgrade Tools with CPUSE. See Installing Software Packages on Gaia and follow the applicable action plan for the Local - Offline installation.
   3	Make sure the package is installed. Run this command in the Expert mode: cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1 The output must show the same build number you see in the name of the downloaded TGZ package. Example Name of the downloaded package: ngm_upgrade_wrapper_993000222_1.tgz [Expert@HostName:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1 993000222 [Expert@HostName:0]#

   Note - The command "migrate_server" from these Upgrade Tools always tries to connect to Check Point Cloud over the Internet. This is to make sure you always have the latest version of these Upgrade Tools installed. If the connection to Check Point Cloud fails, this message appears: Timeout. Failed to retrieve Upgrade Tools package. To download the package manually, refer to sk135172.

2. On the current Security Management Server, run the Pre-Upgrade Verifier and export the entire management database

   Step	Instructions
   1	Connect to the command line on the source Security Management Server.
   2	Log in to the Expert mode.
   3	Go to the $FWDIR/scripts/ directory: cd $FWDIR/scripts
   4	Run the Pre-Upgrade Verifier. If this Security Management Server is connected to the Internet, run: ./migrate_server verify -v R80.40 If this Security Management Server is not connected to the Internet, run: ./migrate_server verify -v R80.40 -skip_upgrade_tools_check For details, see the R80.40 CLI Reference Guide - Chapter Security Management Server Commands - Section migrate_server.
   5	Read the Pre-Upgrade Verifier output. If it is necessary to fix errors: Follow the instructions in the report. Run the Pre-Upgrade Verifier again.
   6	Export the management database: If this Security Management Server is connected to the Internet, run: ./migrate_server export -v R80.40 [-l | -x] /<Full Path>/<Name of Exported File> If this Security Management Server is not connected to the Internet, run: ./migrate_server export -v R80.40 -skip_upgrade_tools_check [-l | -x] /<Full Path>/<Name of Exported File> For details, see the R80.40 CLI Reference Guide - Chapter Security Management Server Commands - Section migrate_server.
   7	Calculate the MD5 for the exported database files: md5sum /<Full Path>/<Name of Database File>.tgz
   8	Transfer the exported databases from the source Security Management Server to an external storage: /<Full Path>/<Name of Database File>.tgz Note - Make sure to transfer the file in the binary mode.

3. Install a new R80.40 Security Management Server

   Step	Instructions
   1	See the R80.40 Release Notes for requirements.
   2	Perform the clean install in one of these ways (do not perform initial configuration in SmartConsole): Follow Installing Software Packages on Gaia - select the R80.40 package and perform Clean Install. See sk92449 for detailed steps. Follow Installing One Security Management Server only, or Primary Security Management Server in Management High Availability.

   Important - These options are available: The IP addresses of the source and target Security Management Servers can be the same. If in the future it is necessary to have a different IP address on the R80.40 Security Management Server, you can change it. For applicable procedures, see sk40993 and sk65451. Note that you have to issue licenses for the new IP address. The IP addresses of the source and target Security Management Servers can be different. Note that you have to issue licenses for the new IP address. You must install the new licenses only after you import the databases.

4. Get the required Upgrade Tools on the target R80.40 server

   Important - See Management Server Migration Tool and Upgrade Tools to understand if your server can download and install the latest version of the Upgrade Tools automatically.

   Step	Instructions
   1	Download the R80.40 Upgrade Tools from the sk135172. (See Management Server Migration Tool and Upgrade Tools.) Note - This is a CPUSE Offline package.
   2	Install the R80.40 Upgrade Tools with CPUSE. See Installing Software Packages on Gaia and follow the applicable action plan for the Local - Offline installation.
   3	Make sure the package is installed. Run this command in the Expert mode: cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1 The output must show the same build number you see in the name of the downloaded TGZ package. Example Name of the downloaded package: ngm_upgrade_wrapper_993000222_1.tgz [Expert@HostName:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1 993000222 [Expert@HostName:0]#

   Note - The command "migrate_server" from these Upgrade Tools always tries to connect to Check Point Cloud over the Internet. This is to make sure you always have the latest version of these Upgrade Tools installed. If the connection to Check Point Cloud fails, this message appears: Timeout. Failed to retrieve Upgrade Tools package. To download the package manually, refer to sk135172.

5. On the target R80.40 Security Management Server, import the databases

   Important - Before you import the management database, we strongly recommend to install the latest General Availability Take of the R80.40 Jumbo Hotfix Accumulator. This makes sure the R80.40 server has the latest improvements for reported import issues.

   Step	Instructions
   1	Connect to the command line on the R80.40 Security Management Server.
   2	Log in to the Expert mode.
   3	Make sure a valid license is installed: cplic print If it is not already installed, then install a valid license now.
   4	Transfer the exported databases from an external storage to the R80.40 Security Management Server, to some directory. Note - Make sure to transfer the files in the binary mode.
   5	Make sure the transferred files are not corrupted. Calculate the MD5 for the transferred files and compare them to the MD5 that you calculated on the original Security Management Server: md5sum /<Full Path>/<Name of Database File>.tgz
   6	Go to the $FWDIR/scripts/ directory: cd $FWDIR/scripts/
   7	Import the management database: If this Security Management Server is connected to the Internet, run: ./migrate_server import -v R80.40 [-l | -x] /<Full Path>/<Name of Exported File>.tgz If this Security Management Server is not connected to the Internet, run: ./migrate_server import -v R80.40 -skip_upgrade_tools_check [-l | -x] /<Full Path>/<Name of Exported File>.tgz Important - The "migrate_server import" command automatically restarts Check Point services (runs the "cpstop" and "cpstart" commands). For details, see the R80.40 CLI Reference Guide - Chapter Security Management Server Commands - Section migrate_server.

6. Install the R80.40 SmartConsole

   See Installing SmartConsole.

7. Install the new licenses

   Important - This step applies only if the target R80.40 Security Management Server has a different IP address than the source Security Management Server.

   Step	Instructions
   1	Issue licenses for the new IP address in your Check Point User Center account.
   2	Install the new licenses on the R80.40 Security Management Server. You can do this either in the CLI with the "cplic put" command, or in the Gaia Portal.
   3	Wait for a couple of minutes for the Security Management Server to detect the new licenses. Alternatively, restart Check Point services: cpstop cpstart

8. Upgrade the dedicated Log Servers and dedicated SmartEvent Servers

   This step is part of the upgrade procedure of a Security Management Server server. If you upgrade a dedicated Log Server or SmartEvent Server, then skip this step."

   Important - If your Security Management Server manages dedicated Log Servers or SmartEvent Servers, you must upgrade these dedicated servers to the same version as the Security Management Server.

   Select the applicable upgrade option from these:

   • For R80.20 and higher:

     • Upgrading a Security Management Server or Log Server from R80.20 and higher

   • For R80.10 and lower:

     • Upgrading a Dedicated Log Server from R80.10 and lower

     • Upgrading a Dedicated SmartEvent Server from R80.10 and lower

9. Update the object version of the dedicated Log Servers and SmartEvent Servers

   Important - If your Security Management Server manages dedicated Log Servers or SmartEvent Servers, you must update the version of the corresponding objects in SmartConsole.

   Step	Instructions
   1	Connect with SmartConsole to the R80.40 Security Management Server that manages the dedicated Log Server or SmartEvent Server.
   2	From the left navigation panel, click Gateways & Servers.
   3	Open the object of the dedicated Log Server or SmartEvent Server.
   4	From the left tree, click General Properties.
   5	In the Platform section > in the Version field, select R80.40.
   6	Click OK.

10. Install the management database

    Step	Instructions
    1	Connect with SmartConsole to the R80.40 Security Management Server.
    2	In the top left corner, click Menu > Install database.
    3	Select all objects.
    4	Click Install.
    5	Click OK.

11. Install the Event Policy

    Important - This step applies only if the SmartEvent Correlation Unit Software Blade is enabled on the R80.40 Security Management Server.

    Step	Instructions
    1	Connect with the SmartConsole to the R80.40 Security Management Server.
    2	In the SmartConsole, from the left navigation panel, click Logs & Monitor.
    3	At the top, click + to open a new tab.
    4	In the bottom left corner, in the External Apps section, click SmartEvent Settings & Policy. The Legacy SmartEvent client opens.
    5	In the top left corner, click Menu > Actions > Install Event Policy.
    6	Confirm.
    7	Wait for these messages to appear: SmartEvent Policy Installer installation complete SmartEvent Policy Installer installation succeeded
    8	Click Close.
    9	Close the Legacy SmartEvent client.

12. Reconfigure the Log Exporter

    Step	Instructions
    1	Connect to the command line on the server.
    2	Log in to the Expert mode.
    3	Restore the Log Exporter configuration as described in sk127653.
    4	Reconfigure the Log Exporter: cp_log_export reconf
    5	Restart the Log Exporter: cp_log_export restart

    For more information, see the R80.40 Logging and Monitoring Administration Guide > Chapter Log Exporter.

13. In SmartConsole, install policy on all SmartLSM Security Profiles

    Important - This step applies only if you enabled the SmartProvisioning Software Blade on this Management Server.

    Step	Instructions
    1	Install the Access Control Policy: Click Install Policy. In the Policy field, select the applicable Access Control Policy. Select the applicable SmartLSM Security Profile objects. Click Install. The Access Control Policy must install successfully.
    2	Install the Threat Prevention Policy: Click Install Policy. In the Policy field, select the applicable Threat Prevention Policy. Select the applicable SmartLSM Security Profile objects. Click Install. The Threat Prevention Policy must install successfully.

    For more information, see the R80.40 SmartProvisioning Administration Guide.

14. Test the functionality on the R80.40 Security Management Server

    Step	Instructions
    1	Connect with SmartConsole to the R80.40 Security Management Server.
    2	Make sure the management database and configuration were upgraded correctly.

15. Disconnect the old Security Management Server from the network

    Disconnect the cables from the old Security Management Server.

16. Connect the new Security Management Server to the network

    Connect the cables to the new Security Management Server.