Prerequisites for Upgrading and Migrating of Security Gateways and Clusters

Prerequisites:

• Make sure you use the latest version of this document (see the Important Information page for links).

• See the R81 Release Notes for:

  • Supported upgrade paths

  • Minimum hardware and operating system requirements

  • Supported Security Gateways

• Make sure to read all applicable known limitations in the R81 Known Limitations SK.

• Before starting an upgrade of your Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. and Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Members, you must upgrade the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

• On your Security Gateways and Cluster Members:

  Make a copy of all custom configurations in the applicable directories and files.

  The upgrade process replaces all existing files with default files. You must not copy the customized configuration files from the current version to the upgraded version, because these files can be unique for each version. You must make all the custom configurations again after the upgrade.

  List of the most important directories

  Note - On VSX Gateway Physical server that hosts VSX virtual networks, including all Virtual Devices that provide the functionality of physical network devices. It holds at least one Virtual System, which is called VS0. and VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Cluster Member Security Gateway that is part of a cluster., some of these directories exist in the context of each Virtual Device.

  • $FWDIR/boot/modules/

  • $FWDIR/conf/

  • $FWDIR/lib/

  • $FWDIR/database/

  • $CVPNDIR/conf/

  • $PPKDIR/boot/modules/

  • /var/ace/

  List of the most important files

  Note - Some of these files do not exist by default. Some files are configured on each VSX Gateway and VSX Cluster Member, and some files are configured for each Virtual System.

  • $FWDIR/boot/modules/fwkern.conf

  • $FWDIR/boot/modules/vpnkern.conf

  • $FWDIR/conf/fwaffinity.conf

  • $FWDIR/conf/fwauthd.conf

  • $FWDIR/conf/local.arp

  • $FWDIR/conf/discntd.if

  • $FWDIR/conf/cpha_bond_ls_config.conf

  • $FWDIR/conf/resctrl

  • $FWDIR/conf/vsaffinity_exception.conf

  • $FWDIR/database/qos_policy.C

  • $PPKDIR/conf/simkern.conf:

  • $PPKDIR/conf/sim_aff.conf:

  • $CPDIR/tmp/.CPprofile.sh

  • $CPDIR/tmp/.CPprofile.csh

  • /var/ace/sdconf.rec

  • /var/ace/sdopts.rec

  • /var/ace/sdstatus.12

  • /var/ace/securid

  List of the most important files

  Note - Some of these files do not exist by default. Some files are configured on each VSX Gateway and VSX Cluster Member, and some files are configured for each Virtual System.

  • $FWDIR/boot/modules/fwkern.conf

  • $FWDIR/boot/modules/vpnkern.conf

  • $FWDIR/conf/fwaffinity.conf

  • $FWDIR/conf/fwauthd.conf

  • $FWDIR/conf/local.arp

  • $FWDIR/conf/discntd.if

  • $FWDIR/conf/cpha_bond_ls_config.conf

  • $FWDIR/conf/resctrl

  • $FWDIR/conf/vsaffinity_exception.conf

  • $FWDIR/database/qos_policy.C

  • simkern.conf

    • In R80.20 and higher: $PPKDIR/conf/simkern.conf

    • In R80.10 and lower: $PPKDIR/boot/modules/simkern.conf

  • sim_aff.conf

    • In R80.20 and higher: $PPKDIR/conf/sim_aff.conf

    • In R80.10 and lower: $PPKDIR/boot/modules/sim_aff.conf

  • /var/ace/sdconf.rec

  • /var/ace/sdopts.rec

  • /var/ace/sdstatus.12

  • /var/ace/securid

• Licenses and Service Contracts:

  • Make sure you have valid licenses installed on all applicable Check Point computers - source and target.

  • Make sure you have a valid Service Contract that includes software upgrades and major releases registered to your Check Point User Center account (see Contract Verification).

    The contract file is stored on the Management Server and downloaded to Check Point Security Gateways during the upgrade process.

    For more information about Service Contracts, see sk33089.