Upgrading one Multi-Domain Server from R80.20 and higher with Advanced Upgrade

In an advanced upgrade scenario, you perform the upgrade procedure on the same Multi-Domain Server Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS..

Notes: This procedure is supported only for servers that run R80.20.M1, R80.20, R80.20.M2, R80.30, or higher versions. For additional information related to this upgrade, see sk163814.

Important - Before you upgrade a Multi-Domain Server: Step Instructions 1 Back up your current configuration (see Backing Up and Restoring). 2 See the Upgrade Options and Prerequisites. 3 Only the latest published database revision is upgraded. If there are pending changes, we recommend to Publish the session. 4 If there are Global Policies configured on the Global Domain: Connect with SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Global Domain on your source Multi-Domain Server. Reassign all Global Policies to all applicable Domains. Important - Do not publish any changes in the Global Domain until you complete the upgrade to the next available version. This is necessary to avoid any potential issues caused by different policy revisions on the Global Domain and on other Domains. 5 You must close all GUI clients (SmartConsole applications) connected to the source Multi-Domain Server. 6 Install the latest version of the CPUSE Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS, and the Gaia OS itself. from sk92449. Note - This is to make sure the CPUSE is able to support the required Upgrade Tools package. 7 Run the Pre-Upgrade Verifier on all source servers and fix all detected issues before you start the upgrade. 8 In Management High Availability, before you start the upgrade on other servers: Make sure the Primary Multi-Domain Server is upgraded and runs. Make sure the Multi-Domain Security Management Servers can communicate with each other and SIC Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server. works between these servers. For details, see sk179794.

Procedure:

1. Get the required Upgrade Tools on the source server

   Important - See Upgrade Tools to understand if your server can download and install the latest version of the Upgrade Tools automatically.

   Step	Instructions
   1	Download the R81 Upgrade Tools from the sk135172. (See Upgrade Tools.) Note - This is a CPUSE Offline package.
   2	Install the R81 Upgrade Tools with CPUSE. See Installing Software Packages on Gaia and follow the applicable action plan for the Local - Offline installation.
   3	Make sure the package is installed. Run this command in the Expert mode: cpprod_util CPPROD_GetValue CPupgrade-tools-R81 BuildNumber 1 The output must show the same build number you see in the name of the downloaded TGZ package. Example Name of the downloaded package: ngm_upgrade_wrapper_993000222_1.tgz [Expert@HostName:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R81 BuildNumber 1 993000222 [Expert@HostName:0]#

   Note - The command "migrate_server" from these Upgrade Tools always tries to connect to Check Point Cloud over the Internet. This is to make sure you always have the latest version of these Upgrade Tools installed. If the connection to Check Point Cloud fails, this message appears: Timeout. Failed to retrieve Upgrade Tools package. To download the package manually, refer to sk135172.

2. On the current Multi-Domain Server, run the Pre-Upgrade Verifier and export the entire management database

   Step	Instructions
   1	Connect to the command line on the current Multi-Domain Server.
   2	Log in with the superuser credentials.
   3	Log in to the Expert mode.
   4	Run the Pre-Upgrade Verifier. If this Multi-Domain Server is connected to the Internet, run: $MDS_FWDIR/scripts/migrate_server verify -v R81 If this Multi-Domain Server is not connected to the Internet, run: $MDS_FWDIR/scripts/migrate_server verify -v R81 -skip_upgrade_tools_check For details, see the R81 CLI Reference Guide - Chapter Multi-Domain Security Management Commands - Section migrate_server.
   5	Read the Pre-Upgrade Verifier output. If it is necessary to fix errors: Follow the instructions in the report. Run the Pre-Upgrade Verifier again.
   6	Go to the $MDS_FWDIR/scripts/ directory: cd $MDS_FWDIR/scripts
   7	Export the management database: If this Multi-Domain Server is connected to the Internet, run: ./migrate_server export -v R81 [-l | -x] /<Full Path>/<Name of Exported File> If this Multi-Domain Server is not connected to the Internet, run: ./migrate_server export -v R81 -skip_upgrade_tools_check [-l | -x] /<Full Path>/<Name of Exported File> For details, see the R81 CLI Reference Guide - Chapter Multi-Domain Security Management Commands - Section migrate_server.
   8	Calculate the MD5 for the exported database files: md5sum /<Full Path>/<Name of Database File>.tgz
   9	Transfer the exported databases from the source Multi-Domain Server to an external storage: /<Full Path>/<Name of Database File>.tgz Note - Make sure to transfer the file in the binary mode.

3. Install a new R81 Multi-Domain Server

   Step	Instructions
   1	See the R81 Release Notes for requirements.
   2	Perform the clean install in one of these ways (do not perform initial configuration in SmartConsole): Follow Installing Software Packages on Gaia - select the R81 package and perform Clean Install. See sk92449 for detailed steps. Follow Installing One Multi-Domain Server Only, or Primary Multi-Domain Server in Management High Availability.

   Important - If it is necessary to have a different IP address on the new R81 server, you have to issue licenses for the new IP address.

4. Get the required Upgrade Tools on the R81 server

   Important - See Upgrade Tools to understand if your server can download and install the latest version of the Upgrade Tools automatically.

   Step	Instructions
   1	Download the R81 Upgrade Tools from the sk135172. (See Upgrade Tools.) Note - This is a CPUSE Offline package.
   2	Install the R81 Upgrade Tools with CPUSE. See Installing Software Packages on Gaia and follow the applicable action plan for the Local - Offline installation.
   3	Make sure the package is installed. Run this command in the Expert mode: cpprod_util CPPROD_GetValue CPupgrade-tools-R81 BuildNumber 1 The output must show the same build number you see in the name of the downloaded TGZ package. Example Name of the downloaded package: ngm_upgrade_wrapper_993000222_1.tgz [Expert@HostName:0]# cpprod_util CPPROD_GetValue CPupgrade-tools-R81 BuildNumber 1 993000222 [Expert@HostName:0]#

   Note - The command "migrate_server" from these Upgrade Tools always tries to connect to Check Point Cloud over the Internet. This is to make sure you always have the latest version of these Upgrade Tools installed. If the connection to Check Point Cloud fails, this message appears: Timeout. Failed to retrieve Upgrade Tools package. To download the package manually, refer to sk135172.

5. On the R81 Multi-Domain Server, import the databases

   Step	Instructions
   1	Connect to the command line on the R81 Multi-Domain Server.
   2	Log in with the superuser credentials.
   3	Log in to the Expert mode.
   4	Make sure a valid license is installed: cplic print If it is not already installed, then install a valid license now.
   5	Transfer the exported database from an external storage to the R81 Multi-Domain Server, to some directory. Note - Make sure to transfer the file in the binary mode.
   6	Make sure the transferred file is not corrupted. Calculate the MD5 for the transferred file and compare it to the MD5 that you calculated on the original Multi-Domain Server: md5sum /<Full Path>/<Name of Exported File>.tgz
   7	Go to the $MDS_FWDIR/scripts/ directory: cd $MDS_FWDIR/scripts/
   8	Import the management database: If this Multi-Domain Server is connected to the Internet, run: ./migrate_server import -v R81 [-l | -x] /<Full Path>/<Name of Exported File>.tgz If this Multi-Domain Server is not connected to the Internet, run: ./migrate_server import -v R81 -skip_upgrade_tools_check [-l | -x] /<Full Path>/<Name of Exported File>.tgz For details, see the R81 CLI Reference Guide - Chapter Multi-Domain Security Management Commands - Section migrate_server.
   9	Make sure that all the required daemons (FWM, FWD, CPD, and CPCA) are in the state "up" and show their PID (the "pnd" state is also acceptable): mdsstat If some of the required daemons on a Domain Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. are in the state "down", then wait for 5-10 minutes, restart that Domain Management Server, and check again. Run these three commands: mdsstop_customer <IP Address or Name of Domain Management Server> mdsstart_customer <IP Address or Name of Domain Management Server> mdsstat

6. Install the R81 SmartConsole

   See Installing SmartConsole.

7. Upgrade the Multi-Domain Log Servers, dedicated Log Servers, and dedicated SmartEvent Servers

   Important - If your Multi-Domain Server manages Multi-Domain Log Servers, dedicated Log Servers, or dedicated SmartEvent Servers, you must upgrade these dedicated servers to the same version as the Multi-Domain Server.

   Select the applicable upgrade option:

   • Upgrading a Multi-Domain Log Server from R80.20 and higher

   • Upgrading a Security Management Server or Log Server from R80.20 and higher

8. Reconfigure the Log Exporter

   Step	Instructions
   1	Connect to the command line on the server.
   2	Log in to the Expert mode.
   3	Restore the Log Exporter configuration as described in sk127653.
   4	Reconfigure the Log Exporter: cp_log_export reconf
   5	Restart the Log Exporter: cp_log_export restart

   For more information, see the R81 Logging and Monitoring Administration Guide > Chapter Log Exporter.

9. In SmartConsole of each applicable Domain Management Server, install policy on all SmartLSM Security Profiles

   Important - This step applies to each Domain Management Server that manages SmartLSM Security Profiles.

   Step	Instructions
   1	Install the Access Control Policy: Click Install Policy. In the Policy field, select the applicable Access Control Policy. Select the applicable SmartLSM Security Profile objects. Click Install. The Access Control Policy must install successfully.
   2	Install the Threat Prevention Policy: Click Install Policy. In the Policy field, select the applicable Threat Prevention Policy. Select the applicable SmartLSM Security Profile objects. Click Install. The Threat Prevention Policy must install successfully.

   For more information, see the R81 SmartProvisioning Administration Guide.

10. Test the functionality on the R81 Multi-Domain Server

    Step	Instructions
    1	Connect with SmartConsole to the R81 Multi-Domain Server.
    2	Make sure the management database and configuration were upgraded correctly.