Upgrading from R55 to R62

[CPone]

Dears

i have two IP 710 with IPSO 4.1 and NG R55, i bought two IP 2450 with IPSO 4.2 and CP NGX R 62,
can someone have a checklist on how to migrate from the old boxes to the new one with minimal down time ?

thanks in advance

[RayPesek]

Where is the SmartCenter?

Ray

[CPone]

Originally Posted by RayPesek

Where is the SmartCenter?

Ray

the smartcenter is on a w2k server.

[RayPesek]

The SmartCenter is already on R62 or R65, right? It must be on the same or a higher version of the firewalls.

Since the firewalls are on different versions of IPSO you can't use Nokia's backup and restore functions. Your best bet is to print off the System Configuration page from Voyager on the existing one and use it to manually configure the new one. Be certain to make the interfaces the same.

Once the new one is built up, print off its configuration and compare the two.

Build up a test SmartCenter on an old desktop using SPLAT. Use upgrade_export on the real SmartCenter to create a backup. Import it into the test SmartCenter with upgrade_import. Connect the test SmartCenter to the new firewall with a router or something to handle the different subnets (assuming the SmartCenter is on a different subnet than the internal interface of the firewall).

Establish SIC and do some test policy pushes. Once you're sure it's good, reset SIC on the firewall. It now has the current firewall policy and is ready to have SIC established with the real SmartCenter.

When you go to swap them out, remember you'll probably have a problem with ARP caching on the devices connected directly to the existing firewall. If you don't know how to flush their ARP caches, just reboot them. If you just let the ARP caches expire, you could have fifteen minutes or more of no traffic. Since the firewalls already have a policy that's very close to the current one, they should just start to work. Note: Certificate-based site-to-site VPNs may not start up until the SmartCenter comes online.

Establish SIC with the real firewall and check the gateway properties for FW-1 and OS versions.

Ray

[CPone]

Originally Posted by RayPesek

The SmartCenter is already on R62 or R65, right? It must be on the same or a higher version of the firewalls.

Since the firewalls are on different versions of IPSO you can't use Nokia's backup and restore functions. Your best bet is to print off the System Configuration page from Voyager on the existing one and use it to manually configure the new one. Be certain to make the interfaces the same.

Once the new one is built up, print off its configuration and compare the two.

Build up a test SmartCenter on an old desktop using SPLAT. Use upgrade_export on the real SmartCenter to create a backup. Import it into the test SmartCenter with upgrade_import. Connect the test SmartCenter to the new firewall with a router or something to handle the different subnets (assuming the SmartCenter is on a different subnet than the internal interface of the firewall).

Establish SIC and do some test policy pushes. Once you're sure it's good, reset SIC on the firewall. It now has the current firewall policy and is ready to have SIC established with the real SmartCenter.

When you go to swap them out, remember you'll probably have a problem with ARP caching on the devices connected directly to the existing firewall. If you don't know how to flush their ARP caches, just reboot them. If you just let the ARP caches expire, you could have fifteen minutes or more of no traffic. Since the firewalls already have a policy that's very close to the current one, they should just start to work. Note: Certificate-based site-to-site VPNs may not start up until the SmartCenter comes online.

Establish SIC with the real firewall and check the gateway properties for FW-1 and OS versions.

Ray

thanks ray for the information,

actually the smartcenter is on R55, but for sure i will make a temporary one , install the R62 or 65 and then switch to a permanent one

[bolingoman]

Hi,

I'd suggest upgrading to any NGX other than R62. From experience, it's the least stable version of all NGX family. Remember, you'll one day be obliged to change the version as there is no HFA / patch availble for R62.

so, go for R65 or R60.

[rokudan]

I've heard about more issues with R65 than any other R6x version.

I have a couple of my Nokia's on R62, and have had no problems as of yet.