Upgrading one R7x Multi-Domain Server with Gradual Migration of Domain Management Servers

Attention:

This upgrade method is supported only when you upgrade from R7x versions.

We recommend to upgrade the entire Multi-Domain Server at once with one of these methods:

Because upgrade of the entire Multi-Domain Server at once is the default recommended method, use the Gradual Migration of Domain Management Servers only in these cases:

  • The entire Multi-Domain Server cannot be upgraded at once because of a business impact.

  • During the upgrade, it is necessary to rename some or all of the Domain Management Servers.

  • In Multi-Domain Server High Availability deployment, it is necessary to change the number of Domain Management Servers on Multi-Domain Servers.

If you use the Gradual Migration method:

  • You must migrate the Global Policies before you migrate the databases from other Domains.

  • You can migrate the Global Policies only one time from the R7x Multi-Domain Server.

  • Until the entire migration procedure is completed, you cannot make changes in the Global Policies on the source Multi-Domain Servers.

    If it is necessary to make changes on the source Multi-Domain Servers, follow these guidelines:

    • If you deleted or modified a global object in the source R7x Multi-Domain Server database, you must make the same changes in the migrated Global Policies on the target R80.40 Multi-Domain Server.

    • If you added a global object in the source R7x Multi-Domain Server database, you must delete that global object before you export the databases from other Domains.

Procedure:

  1. Perform a clean install of the R80.40 Multi-Domain Server on another computer.

    Do not perform initial configuration in SmartConsole.

    See Installing One Multi-Domain Server Only, or Primary Multi-Domain Server in Management High Availability.

    Important - The IP addresses of the source and target R80.40 servers must be the same. If it is necessary to have a different IP address on the R80.40 server, you can change it only after the upgrade procedure. Note that you have to issue licenses for the new IP address. See Changing the IP Address of a Multi-Domain Server or Multi-Domain Log Server.

  2. See Installing SmartConsole.

  3. Create the Domain Management Servers, into which you import the entire management database from the source Domain Management Servers.

    Important:

    • Do not start the new Domain Management Servers.

    • Do not configure anything in the new Domain Management Servers.

    You can create the Domain Management Servers in one these ways:

  4. Step

    Instructions

    1

    Close all GUI clients (SmartConsole applications) connected to the R7x Multi-Domain Server.

    2

    Connect to the command line on the R7x Multi-Domain Server.

    3

    Log in with the superuser credentials.

    4

    Log in to the Expert mode.

    5

    Go to the directory, where you put the R80.40 Management Server Migration Tool package:

    cd /var/log/path_to_migration_tool/

    6

    Extract the R80.40 Management Server Migration Tool package:

    tar zxvf <Name of Management Server Migration Tool Package>.tgz

    7

    Go to the main MDS context:

    mdsenv

    8

    Export the entire management database:

    yes | nohup ./migrate export [-f] [-n] /<Full Path>/R7x_global_policies &

    Notes:

    • yes | nohup ... & are mandatory parts of the syntax.

    • R7x_global_policies is the name of the export file.

    • For details, see the R80.40 CLI Reference Guide - Chapter Multi-Domain Security Management Commands - Section migrate.

    9

    Calculate the MD5 for the exported database file:

    md5sum /<Full Path>/R7x_global_policies.tgz

    10

    Transfer the exported database from the R7x Multi-Domain Server to an external storage:

    /<Full Path>/R7x_global_policies.tgz

    Note - Make sure to transfer the file in the binary mode.

  5. Important - Before you import the management database, we strongly recommend to install the latest General Availability Take of the R80.40 Jumbo Hotfix Accumulator. This makes sure the R80.40 server has the latest improvements for reported import issues.

    Step

    Instructions

    1

    Connect to the command line on the R80.40 Multi-Domain Server.

    Note - In Multi-Domain Server High Availability environment, connect to the Primary Multi-Domain Server.

    2

    Log in with the superuser credentials.

    3

    Log in to the Expert mode.

    4

    Make sure a valid license is installed:

    mdsenv

    cplic print

    If it is not already installed, then install a valid license now.

    5

    Transfer the exported database from an external storage to the R80.40 Primary Multi-Domain Server, to some directory.

    Note - Make sure to transfer the file in the binary mode.

    6

    Make sure the transferred file is not corrupted.

    Calculate the MD5 for the transferred file and compare it to the MD5 that you calculated on the original R7x Multi-Domain Server:

    md5sum /<Full Path>/R7x_global_policies.tgz

    7

    Go to the main MDS context:

    mdsenv

    8

    Import the global management database:

    migrate_global_policies /<Full Path>/R7x_global_policies.tgz

    Note - This commands stops the Multi-Domain Server.

    9

    Restart the Check Point services:

    mdsstop

    mdsstart

    10

    Make sure that all the required daemons (FWM, FWD, CPD, and CPCA) are in the state "up" and show their PID (the "pnd" state is also acceptable):

    mdsstat

    If some of the required daemons on a Domain Management Server are in the state "down", then wait for 5-10 minutes, restart that Domain Management Server, and check again. Run these three commands:

    mdsstop_customer <IP Address or Name of Domain Management Server>

    mdsstart_customer <IP Address or Name of Domain Management Server>

    mdsstat

  6. Step

    Instructions

    1

    Connect to the command line on the R7x Multi-Domain Server.

    2

    Log in with the superuser credentials.

    3

    Log in to the Expert mode.

    4

    Go to the directory, where you put the R80.40 Management Server Migration Tool package:

    cd /var/log/path_to_migration_tool/

    5

    Extract the R80.40 Management Server Migration Tool package:

    tar zxvf <Name of Management Server Migration Tool Package>.tgz

    6

    Go to the context of each applicable Domain Management Server:

    mdsenv <IP Address or Name of Domain Management Server>

    7

    Export the entire management database from each applicable Domain Management Server:

    yes | nohup ./migrate export [-l | -x] /<Full Path>/<Name of R7x Domain Exported File>

    For details, see the R80.40 CLI Reference Guide - Chapter Multi-Domain Security Management Commands - Section migrate.

    8

    Calculate the MD5 for each exported database file:

    md5sum /<Full Path>/<Name of R7x Domain Exported File>.tgz

    9

    Transfer each exported Domain Management Server database from the current Multi-Domain Server to an external storage:

    /<Full Path>/<Name of R7x Domain Exported File>.tgz

    Note - Make sure to transfer the file in the binary mode.

  7. Step

    Instructions

    1

    Transfer the exported R7x Domain Management Server management databases from an external storage to the R80.40 Multi-Domain Server, to some directory.

    Note - Make sure to transfer the file in the binary mode.

    2

    Make sure the transferred files are not corrupted.

    Calculate the MD5 for the transferred files and compare them to the MD5 that you calculated on the R7x Multi-Domain Server:

    md5sum /<Full Path>/<Name of R7x Domain Exported File>.tgz

  8. Step

    Instructions

    1

    Connect to the command line on the R80.40 Multi-Domain Server.

    2

    Log in with the superuser credentials.

    3

    Log in to the Expert mode.

    4

    Unset the shell idle environment variable:

    unset TMOUT

    5

    Import the R7x Domain Management Server management databases one by one:

    cma_migrate /<Full Path>/<Name of R7x Domain Exported File>.tgz /<Full Path>/<$FWDIR Directory of the New Domain Management Server>/

    Example:

    cma_migrate /var/log/orig_R7x_database.tgz /opt/CPmds-R80.40/customers/MyDomain3/CPsuite-R80.40/fw1/

    Note - This command updates the database schema before it imports. First, the command runs pre-upgrade verification. If no errors are found, migration continues. If there are errors, you must fix them on the source R7x Domain Management Server according to instructions in the error messages. Then do this procedure again.

    6

    Start the new Domain Management Server with the imported R7x management database:

    mdsstart_customer <IP Address or Name of Domain Management Server>

    7

    Make sure that all the required daemons (FWM, FWD, CPD, and CPCA) are in the state "up" and show their PID (the "pnd" state is also acceptable):

    mdsstat

    If some of the required daemons on a Domain Management Server are in the state "down", then wait for 5-10 minutes, restart that Domain Management Server, and check again. Run these three commands:

    mdsstop_customer <IP Address or Name of Domain Management Server>

    mdsstart_customer <IP Address or Name of Domain Management Server>

    mdsstat

  9. Step

    Instructions

    1

    Connect to the command line on the R80.40 Multi-Domain Server.

    2

    Log in with the superuser credentials.

    3

    Log in to the Expert mode.

    4

    Make sure that all the required daemons (FWM, FWD, CPD, and CPCA) are in the state "up" and show their PID (the "pnd" state is also acceptable):

    mdsstat

    If some of the required daemons on a Domain Management Server are in the state "down", then wait for 5-10 minutes, restart that Domain Management Server, and check again. Run these three commands:

    mdsstop_customer <IP Address or Name of Domain Management Server>

    mdsstart_customer <IP Address or Name of Domain Management Server>

    mdsstat

    5

    Go to the main MDS context:

    mdsenv

    6

    Upgrade the attributes of all managed objects in each new target Domain Management Server (one at a time):

    $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL -n <Name of Domain Management Server>

    Note - Because the command prompts you for a 'yes/no' for the Domain and each object in the Domain, you can explicitly provide the 'yes' answer to all questions with this command:

    yes | $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL -n <Name of Domain Management Server>

    7

    Allow the database synchronization to run:

    $CPDIR/bin/cpprod_util CPPROD_SetValue "FW1/6.0" AfterUpgradeDbsyncIndication 1 1 0

    Restart the Check Point services:

    mdsstop

    mdsstart

    For more information, see sk121718.

    8

    Make sure that all the required daemons (FWM, FWD, CPD, and CPCA) are in the state "up" and show their PID (the "pnd" state is also acceptable):

    mdsstat

    If some of the required daemons on a Domain Management Server are in the state "down", then wait for 5-10 minutes, restart that Domain Management Server, and check again. Run these three commands:

    mdsstop_customer <IP Address or Name of Domain Management Server>

    mdsstart_customer <IP Address or Name of Domain Management Server>

    mdsstat

  10. The gradual upgrade does not keep all data.

    You must manually redefine and reassign the Multi-Domain Server administrators and GUI clients to Domains after the gradual upgrade.

    Step

    Instructions

    1

    Run the mdsconfig command and configure the options Administrators and GUI clients.

    See Post-Installation Configuration.

    2

    See the R80.40 Multi-Domain Security Management Administration Guide - Chapter Managing Domains - Section Creating a New Domain - Subsection Assigning Trusted Clients to Domains.

  11. Important:

    • This step applies only if the target R80.40 Domain Management Server has a different IPv4 address than the source R7x Domain Management Server.

    • In a Cluster, you must configure all the Cluster Members in the same way.

    When a Management Server and a managed Security Gateway establish SIC Trust, the Security Gateway saves the IP address of the Internal Certificate Authority (ICA) of its Management Server. The Security Gateway uses this IP address for Automatic Certificate Renewal process when the certificate on the Security Gateway expires.

    To force the Security Gateway to update the saved IP address of the Management Server's ICA, follow one of these procedures:

    Warning:

    • In Cluster, this procedure can cause a failover.

    • Until Check Point processes restart, traffic does not pass through the Security Gateway (Cluster Member).

    For more information, see sk65764: How to reset SIC.

    1. Connect to the command line on the Security Gateway (every Cluster Member).

    2. Start the Check Point Configuration Tool. Run:

      cpconfig

    3. Choose the option Secure Internal Communication from the menu - enter 5 press the Enter key.

      Follow the instructions on the screen to re-initialize the communication and to enter the Activation Key.

    4. Exit the Check Point Configuration Tool.

    5. Wait for Check Point processes to restart.

    6. Connect with SmartConsole to the Management Server that manages the Security Gateway (Cluster) object.

    7. From the left navigation panel, click Gateways & Servers.

    8. Double-click the Security Gateway (Cluster) object.

    9. From the left tree, click General Properties.

      In a Cluster object, click Cluster Members and edit every Cluster Member object.

    10. Click Communication.

    11. Click Reset.

    12. Enter the same Activation Key you entered on the Security Gateway (Cluster Member).

    13. Click Initialize.

    14. The Trust State field must show Trust established.

    15. Click Close.

    16. Click OK.

    17. Publish the SmartConsole session.

    18. Install the Access Control Policy on the Security Gateway (Cluster) object.

    For more information, see sk103356: How to renew SIC after changing IP Address of Security Management Server.

    1. Connect to the command line on the Security Gateway (every Cluster Member).

    2. Log in to the Expert mode.

    3. Back up the current $CPDIR/registry/HKLM_registry.data file:

      cp -v $CPDIR/registry/HKLM_registry.data{,_BKP}

    4. Edit the current $CPDIR/registry/HKLM_registry.data file:

      vi $CPDIR/registry/HKLM_registry.data

    5. Search for:

      :ICAip

      Example of the applicable section:

      : (SIC
    :ICAdn ("O=R80.40-Manager..ntk6rk")
    :MySICname ("CN=R80.40-MyGW,O=R80.40-Manager..ntk6rk")
    :HasCertificate ("[4]1")
    :CertPath ("/opt/CPshrd-R80.40/conf/sic_cert.p12")
    :ICAip (192.168.41.80)

    6. Change the value of the ":ICAip" to the new IP address.

    7. Save the changes in the file and exit the editor.

  12. The gradual upgrade does not keep all data.

    Step

    Instructions

    1

    Connect to the command line on the R80.40 Multi-Domain Server.

    2

    Log in with the superuser credentials.

    3

    Log in to the Expert mode.

    4

    Go to the main MDS context:

    mdsenv

    5

    Rebuild the status of Global VPN communities:

    fwm mds rebuild_global_communities_status all

  13. Important - This step applies if the original R7x Domain Management Server managed VPN gateways.

    There can be an issue with the IKE certificates after you migrate the management database, if a VPN tunnel is established between a Check Point Security Gateway and an externally managed, third-party gateway.

    The VPN Security Gateway presents its IKE certificate to its peer.

    The third-party gateway uses the FQDN of the certificate to retrieve the host name and IP address of the Certificate Authority.

    If the IKE certificate was issued by a Check Point Internal CA, then the FQDN contains the host name of the original Management Server.

    The peer gateway will fail to contact the original server and will not accept the certificate.

    To fix:

    • Update the external DNS server to resolve the host name to the IP address of the applicable Domain Management Server.

    • Revoke the IKE certificate for the Security Gateway and create a new one.

  14. Step

    Instructions

    1

    Connect to the command line on the server.

    2

    Log in to the Expert mode.

    3

    Restore the Log Exporter configuration as described in sk127653.

    4

    Reconfigure the Log Exporter:

    cp_log_export reconf

    5

    Restart the Log Exporter:

    cp_log_export restart

    For more information, see the R80.40 Logging and Monitoring Administration Guide > Chapter Log Exporter.

  		15.

    Important - This step applies to each Domain Management Server that manages SmartLSM Security Profiles.

    Step

    Instructions

    1

    Install the Access Control Policy:

    1. Click Install Policy.

    2. In the Policy field, select the applicable Access Control Policy.

    3. Select the applicable SmartLSM Security Profile objects.

    4. Click Install.

    5. The Access Control Policy must install successfully.

    2

    Install the Threat Prevention Policy:

    1. Click Install Policy.

    2. In the Policy field, select the applicable Threat Prevention Policy.

    3. Select the applicable SmartLSM Security Profile objects.

    4. Click Install.

    5. The Threat Prevention Policy must install successfully.

    For more information, see the R80.40 SmartProvisioning Administration Guide.

  16. Step

    Instructions

    1

    Connect with SmartConsole to the R80.40 Multi-Domain Server.

    2

    Make sure the management database and configuration were upgraded correctly on each Domain Management Server.