Check Point VPN-1/FireWall-1

Steps for Upgrade from version 4.1 to Next Generation FP1

Backup your system

Perform a complete backup (full system) of your productive VPN-1/FireWall-1 4.1 for backing out.

Backup files which are needed by the upgrade

• Copy the files to a floppy disk for import later
• Unix/Linux ($FWDIR usually points to /opt/CPfw1-41, assuming also floppy disk mounted on /mnt/floppy)
• cp $FWDIR/conf/objects.C /mnt/floppy/objects41.C
• cp $FWDIR/conf/rulebases.fws /mnt/floppy/
• cp $FWDIR/conf/fwauth.NDB* /mnt/floppy/
• Windows  (assuming firewall is installed at C:\WINNT\FW1\4.1 and floppy disk is a:)
• copy C:\WINNT\FW1\4.1\conf\objects.C a:\objects41.C
• copy C:\WINNT\FW1\4.1\conf\rulebases.fws a:\
• copy C:\WINNT\FW1\4.1\conf\fwauth.NDB* a:\

Upgrade from 4.1 to Next Generation with new hardware

• Take a new box
• Install the OS with all fixes, also the latest ones
• Harden the OS, if necessary (hints for hardening can be found e.g. at Lance Spitzners's site)
• Install the latest version of Check Point Next Generation with backward compatibility for 4.1
• Reboot the system after having completed these steps

Upgrade from 4.1 to Next Generation on the same hardware

• Uninstall Check Point VPN-1/FireWall-1 4.1 completely
• Reboot
• Install Check Point VPN-1/FireWall-1 Next Generation including Feature Pack 1, take care to install it with backward compatibility
• If your OS is Solaris be sure that your environment variables are set correctly. Example for /etc/profile:
  • FWDIR=/opt/CPfw1-50; export FWDIR
  • CPDIR=/opt/CPshared/5.0; export CPDIR
  • PATH="$PATH:/usr/local/bin:$FWDIR/bin:$CPDIR/bin"
  • LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$FWDIR/lib:$CPDIR/lib; export LD_LIBRARY_PATH
  • CPSTAT=$CPDIR/bin/cpstat; export CPSTAT
  • FW_BOOT_DIR=/etc/fw.boot; export FW_BOOT_DIR
• Reboot the system after having completed these steps

In both cases

• Stop Next Generation by cpstop
• Rename the unmodified file $FWDIR/conf/objects.C to $FWDIR/conf/ngobjects.C
• Rename $FWDIR/conf/objects_5_0.C to $FWDIR/conf/50objects.C
• Rename $FWDIR/conf/rulebases_5_0.fws to $FWDIR/conf/50rulebases.fws
• Copy the previously saved files objects41.C, rulebases.fws and fwauth.NDB to $FWDIR/conf/
• Merge the objects by using
$FWDIR/bin/fw confmerge $FWDIR/conf/objects41.C $FWDIR/conf/ngobjects.C > $FWDIR/conf/objects.C
• Check the objects using
$FWDIR/bin/fw checkobj
If you are not using FloodGate-1, you might ignore errors resulting from this command.
• Next, you have to upgrade CPMI
$FWDIR/bin/fw cpmi_upgrade
• Copy this default_objects.C (MD5: 78e271db669eaf600afac0efe1e9a64b)by Warren Barrow in $FWDIR/conf
• Perform the upgrade by
$FWDIR/bin/fw upgrade sp1
• Issue cpstart to start Next Generation with your own objects and test the whole thing. Wait at least 10 minutes before logging in with the GUI, the conversion takes it's time.

---

• Caution! If you use explicit rules to allow FW-1 control connetions (not the implicit ones from "Global Properties") communication between modules will fail. The control ports have changed from 4.1 to NG. (list of ports used by NG)
• Rules with "Install On Gateways" will raise a warning when the rulebase is first loaded into the Policy Editor. "Gateways" will be replaced by "Policy Targets".
• NG will create an object for the Management Module. This may lead to two objects for the same machine.
• Norman Sutorius has reported good success with this upgrade script (MD5: f1d873bd7fb00947066246188a4352aa). (README file is included within the tar ball)

No warranty at all, your Feedback is welcome!
© 2002-2008 AERAsec Network Services and Security GmbH, last change 2002-11-28
back to http://www.vpn-1.de