R75 Splat 32 bits to R77 Gaia 64 bits with machines changing

[rodjeur69]

Hello guys,

I'm planning for the next week to replace my old Open Server's Security Gateway ClusterXL under SPLAT 32 bits to GAIA 64 bits. Two new machines are already installed and configured under GAIA 77; ClusterXL functionality is enabled on them. the management server is already migrated to R77 too (under Windows). CCP protocol on existing Cluster is broadcast.

I'd like to share with you my planned scenario for doing this:
- integrate one of the new R77 machine into cluster from dashboard; verify communication via SIC, licenses, topology, and other stuff
- change the Cluster version from R75 to R77
- stop cluster on one of the old machine
- push policies with the "For Gateways Clusters, install on all the members, if it fails do not install at all" option unchecked
- verify that the remaining old R75 machine cluster status is "Active Attention"
- verify that the newly inserted R77 gateway is on "Ready state"
- run "cpstop" on the remaining old R75 machine cluster, forcing a failover toward new R77 machine
- verify that all is working well, and inserting the second R77 machine into cluster

Is it a good way to do that in your opinion ?

Thanks in advance.

Rodjeur

[EricAnderson]

Sounds like you've got it licked. Just don't expect sync between the R75 and R77.

-E

[ShadowPeak.com]

Looks good, couple of notes:

1) Use R77.20 on the new boxes which is a very good release instead of R77 vanilla

2) Because you won't be able to have a fully stateful failover (via the "fw fcu" command) when you first fail over onto the new R77.20 box, a great trick is to temporarily uncheck the "Drop out of state TCP connections" under Global Properties...Stateful Inspection for the duration of the cutover. (This would be just prior to step 4 in your proposed workflow) When connections start attempting to pass through the new member normally they would be dropped as "out of state". However when the box is unchecked the existing connections will be allowed to "resurrect" into the new firewall's state table and continue. This helps keep inevitably stupid applications from getting hung up and needing to be restarted/reset when their long-running connections (like SQL) get silently killed by the failover.

Don't forget to recheck the box once the upgrade is complete! Very important!

[rodjeur69]

Ok, many thanks, I will manage my migration using your opinion.
One question more, about our license: this one is until now established for 2 cores only, but on my new R77.20 gateways, we have 8 cores, and CoreXL activated with default configuration: can I attach the old license without consequence, or it will not work at all or just with 2 cores ? What about CoreXL ?

Rodjeur

[mcnallym]

Ok, many thanks, I will manage my migration using your opinion.
One question more, about our license: this one is until now established for 2 cores only, but on my new R77.20 gateways, we have 8 cores, and CoreXL activated with default configuration: can I attach the old license without consequence, or it will not work at all or just with 2 cores ? What about CoreXL ?

Rodjeur

The Gateway will simply use 2 Cores of the 8 as you have a 2 Core License. If you want to use all 8 Cores the would need to upgrade to an 8 Core license. If you have working at the moment with an Eval then will use the 8 Cores, so when apply the 2 Core Production License will say that need to reboot as the number of cores changes.

From my previous experience then TAC have tended to say that if only having 2 Cores then use SecureXL rather the CoreXL.

Michael

[rodjeur69]

The Gateway will simply use 2 Cores of the 8 as you have a 2 Core License. If you want to use all 8 Cores the would need to upgrade to an 8 Core license. If you have working at the moment with an Eval then will use the 8 Cores, so when apply the 2 Core Production License will say that need to reboot as the number of cores changes.

From my previous experience then TAC have tended to say that if only having 2 Cores then use SecureXL rather the CoreXL.

Michael

Thanks Michael, I think we'll upgrade our license to 8 cores.

Rodjeur