Migration from standalone gateway to HA cluster pair

**ivyma** · 2017-12-07

Hi, I currently have a standalone 5600 appliance running 77.30 that I am planning to soon upgrade to R80.10 before beginning other work. I have a new 5600 appliance that I would like to incorporate with the existing to create a HA cluster pair. The new GW was shipped already with R80.10. Looking for documentation and I haven't found anything too helpful. What is the best or recommended path for performing this task? My environment is a multi domain management server using SmartConsole.

**msjouw** · 2017-12-08

If you say you have a Multi Domain server, do you mean you have a R80.10 only or do you need to migrate both the management and the gateway to R80.10?
How much down time is allowed?

to give you some ideas when you have it all in 1 R80.10 management:

in the R80.10 management create a new cluster object and add the new 5600 to it, SIC it, make sure to assign a free IP to the cluster object.
set the clustering method to VRRP
in the cluster object assign all interfaces a free IP in each network it is connected to and add them to the topology
Assign the IP's currently on the active 5600 to the cluster interfaces
you should be able to push policy
when ready to migrate, disconnect the interfaces from the network or assign new IP's to each interface
set the clustering method to ClusterXL and change the Cluster IP to the IP of the old 5600 and push policy
get the other 5600 to R80.10 and add assign the new IP's to it, add them to the config and do a get interfaces from the smart console
now go to the cluster object and add a existing member and add the object of the old 5600
now your cluster is complete and you can push policy.

Not all details are taken into account like ant spoofing but I hope you get the drift.
The reason for setting the cluster to VRRP first is that it will not assign the Custer IP's to the member as with VRRP you assign them from clish, by switching back when you migrate it is all ready and assgined to go.

**ivyma** · 2017-12-11

Thanks for the reply. To answer your questions, my management server is already R80.10 and existing single firewall is R77.30. I plan to upgrade the single firewall to R80.10 before doing anything else and the new firewall that I would like to introduce will be R80.10. My goal is to have a clustered HA pair in the end. Some downtime is expected and acceptable in this environment but as always I would like it to be as little as possible however, it’s not a super critical environment.