> Source: [sk155632](https://support.checkpoint.com/results/sk/sk155632) # sk155632 - How to perform Advanced Upgrade for Cloud Firewall Management in AWS, Azure, GCP, Huawei Cloud, or Tencent Cloud (Side-by-Side upgrade) | Property | Value | |----------|-------| | Solution ID | sk155632 | | Date Created | 2019-06-10 | | Last Modified | 2026-04-13 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R82.10, R81 (EOS), R81.10 (EOS), R81.20, R82 | | OS | Gaia | | Platform | AWS, Azure, GCP, Huawei, Tencent | ## Solution Introduction {#Introduction} ---------------------------- This guide explains how to upgrade Security Management Server deployed in AWS, Azure, GCP, Huawei, or Tencent Cloud in a Side-by-Side method. **The recommended upgrade procedure is in-place upgrade as described in [sk177714](https://support.checkpoint.com/results/sk/sk177714)** Prerequisites {#Prerequisites} ------------------------------ * **Source Machine and** **Target Machine**: Security Management Server running supported version * If you use a **BYOL license**not related to your elastic/public IP address, it is necessary to generate a new license before proceeding with the instructions below. * If you use **PAYG license** , it is important to use `--exclude-license` flag when exporting and importing the Management server. For example, this command will exclude licenses when exporting management database: `$FWDIR/scripts/migrate_server export --exclude-licenses /var/log/Migrate_Export` Procedure {#Procedure} ---------------------- **Note:** Do not perform the First Time Wizard because this can cause different issues. Instead, wait around 30 min and then run `$FWDIR/scripts/cpm_status.sh` to see when its finished and the Management server is ready to proceed. Click Here to Show the Entire Procedure **Note**: Make sure that the target VM has connectivity to the Security Gateways it will manage. #### 1. Copy the Migration Tools to the source Management Server {#Procedure_1} Show / Hide this section A. In the source machine, create a dedicated folder to extract the MGMT DB (do not extract or copy migration files to the folder */home/admin*). B. Go to the home page SecureKnowledge articles of the **target** version and download the migration tools to the source dedicated folder (created in step #1). **Note:** You cannot copy the migration tools from the target machine. For the latest version of Upgrade Tools go to [sk135172 - Upgrade Tools package](https://support.checkpoint.com/results/sk/sk135172). **Make sure to run Pre-Upgrade Verifier on all source servers and to** **fix all detected issues before you start the export.** On the current Security Management Server, run the Pre-Upgrade Verifier: If this Security Management Server is **connected** to the Internet, run: `./migrate_server verify -v R81.20` If this Security Management Server is **not connected** to the Internet, run: `./migrate_server verify -v R81.20 -skip_upgrade_tools_check` **It is important to read the Pre-Upgrade Verifier output and if necessary to fix errors.** 1. Follow the instructions in the report. 2. Run the Pre-Upgrade Verifier again before the DB export.
**2. Export the DB on the source Management Server** Show / Hide this section A. Log in to the Expert mode on the source machine. B. Extract the migration tools: `tar -zxvf Check_point_XXX.tgz` C. Export the Management DB **without the license files** by running this command in the dedicated folder: `./migrate export .tgz` **Notes:** * Excluding license flags is available only from R80.20 Jumbo Hotfix Take 73. * If you see PUV errors, look for these errors in Check Point Support Center.
**Migrate server instructions** `$FWDIR/scripts/migrate_server export -skip_upgrade_tools_check -v ` Note: In case of Multi-Domain Security Management Server, use `$MDS_FWDIR/scripts/` #### 3. Import the database on the target Management Server {#Procedure_3} Show / Hide this section If you installed the target Security Management Server with a different IP address than the source Security Management Server, you must create a special JSON configuration file before you import the management database from the source Security Management Server. Note that you have to issue licenses for the new IP address. **To create the required JSON configuration file:** On the target Security Management Server Create the `/var/log/mdss.jso`n file that contains each server that migrates to a new IP address. Format for migrating a single Security Management Server to a new IP address: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/R8120IUP202311211417582.png) **Import the database:** A. Log in to the Expert mode on the target machine. B. Create a temporary folder to extract the DB For example: `mkdir /var/log/DB` **Important** - Do **not** extract or copy DB files to the folder*/home/admin/* C. Copy the exported DB file to the Target machine to the temporary folder. D. Go to this folder: `cd $FWDIR/bin/upgrade_tools` E. Import the DB: `./migrate import .tgz` **Migrate server instructions** `$FWDIR/scripts/migrate_server import -skip_upgrade_tools_check -v ` Note: In case of Multi-Domain Security Management Server, use `$MDS_FWDIR/scripts/ ` #### 4. Associate the source elastic/public IP address to the target server IP address {#Procedure_4} Show / Hide this section **Instructions for AWS** Show / Hide this section A. Go to the AWS Management Console site of your account: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1560188899097/21906101139.jpg) B. Go to EC2: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1560188899097/31906101141.jpg) C. Stop the source machine in the navigation pane. 1. Select**Instances** and select the instance. 2. Select**Actions** , select **Instance State** , and then select **Stop**. If **Stop** is disabled, the instance is already stopped. 3. In the confirmation dialog box, select **Yes, Stop**. It can take a few minutes for the instance to stop. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1560188899097/41906101145.jpg) D. Disassociate the elastic IP from the source. **Note** that Disassociation will access the MGMT from this point. a. In the navigation pane, select **Elastic IPs**. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1560188899097/51906101153.jpg) b. Select the Elastic IP address, Sselect **Actions** , and then select **Disassociate address**. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1560188899097/61906101152.jpg) E. Associate the EIP with the target: a. Select the address that you disassociated in the previous step. For **Actions** , select **Associate address**. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1560188899097/71906101204.jpg) b. Select the new instance from **Instance** , and then select **Associate**. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1560188899097/81906101206.jpg) F. Connect to the target machine through SSH. G. Log in to Gaia Clish on the target machine. H. Remove the old alias interface: ` delete interface eth0 alias eth0:1` I. Add a new interface with the source EIP (mask must be /32): ` add interface eth0 alias source-public-ip/32` J. Save your changes: ` save config`
**Instructions for Azure** Show / Hide this section A. Go to the Azure Portal. B. Navigate to the **Virtual machines** blade. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk155632/a1908220223.png) C. Stop the source Management Server VM in the navigation pane. D. Disassociate the public IP from the source NIC. **Note** - disassociation will prevent access to the source Management Server through the public IP address. a. From the source VM resource, select the public IP address. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/d1908220226.png) b. From the navigation pane, select **Overview**. c. Select **Disassociate**. In the confirmation dialog box, Sselect **Yes**. Save the name of the public IP resource for the next steps.
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/f1908220226.png) To Associate the public IP address with target Management Server VM. a. Select your Virtual Machine and Under the Settings menu in the left pane, click on Networking-\>Network settings ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/Screenshot 2026-04-09 114910202604091158241.png) b. Select the Network Interface/IP configuration: Click on the name of the Network interface listed for the VM. Edit IP Configuration: Under the NIC's Settings, select IP configurations ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/Screenshot 2026-04-09 121621202604091217082.png) c. Choose the specific configuration (usually named member-ip and cluster-vip) you want to modify. Select the member-ip d. Associate IP: In the Edit IP configuration window, set Public IP address to Associate. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/Screenshot 2026-04-09 122833202604091231373.png) E. Associate the public IP address with target Management Server VM. a. Go to the target Management Server VM resource group. b. Select the network interface **eth0** *.* *![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/g1908220227.png)* c. In the navigation pane select **IP Configuration**. d. Select the existing configuration (**ipconfig1**). ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/i1908220228.png) e. Edit the configuration to use the public IP resource from step D and click **Save**. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/j1908220229.png) F. Connect to the target Management Server VM through SSH. G. Log in to Gaia Clish. H. Remove the old alias interface: `delete interface eth0 alias eth0:1` I. Add a new interface alias with the source public IP address (mask must be /32): `add interface eth0 alias source-public-ip /32` J. Save your changes: `save config`
**Instructions for GCP** Show / Hide this section A. Go to the GCP Console. B. Navigate to the **VM Instance** page. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/11911040007.png) C. Stop the source Management Server VM in the navigation pane by choosing the VM and clicking **Stop** in the navigation pane. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/21911040007.png) ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/31911040007.png) D. Disassociate the External IP address from the source Management Server and associate it to the target Management Server. **Note** - Disassociation will prevent access to the source Management Server via the public IP address. a. Navigate to the **External IP Addresses** page. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/41911040008.png) b. Locate the source Management Server address and select **Change**. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/51911040008.png) c. In the **Attach IP address** pop-up menu, select the target Management Server in the drop- down list and clear the box for assigning a new ephemeral IP address to the VM. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/61911040009.png) d. Release the Target Management Server address by checking its box and clicking **Release Static Address**. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/71911040009.png) ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/81911040009.png) E. Connect to the Target Management Server VM through SSH. F. Log in to Gaia Clish. G. Remove the old alias interface: `delete interface eth0 alias eth0:1` H. Add a new interface alias with the source public IP address (mask must be /32): `add interface eth0 alias source-public-ip /32` I. Save your changes: `save config`
**Instructions for Huawei Cloud** Show / Hide this section A. Go to the Huawei Cloud Console. B. Create new management without an EIP. C. On the old management, navigate to the EIP tab. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/pic1202412301503503.png) D. On the management's EIP, click "Unbind". ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/pic2202412301504334.png) E. On the new management, navigate to the EIP tab. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/pic3202412301503152.png) F. Click "Bind EIP" G. Select the frontend NIC and the EIP to be bound and click "OK" ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/pic4202412301503051.png) **Instructions for Tencent Cloud** Show / Hide this section A. Go to the Tencent Cloud Console. B. Create new management without an EIP. C. On the old management, navigate to the Flexible Network Card tab. Click on "Ordinary public IP" to convert it to an EIP. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/tencent-old-mgmt202603131535431.png) D. Click to convert the ordinary public IP to an EIP. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/tencent-convert-eip202603131539142.png) E. Unbind the EIP from the management. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/tencent-unbind-eip202603131545415.png) F. On the new management, navigate to the Flexible Network Card tab. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/tencent-new-mgmt-bind202603131541343.png) G. Bind the EIP of the old management to the new management. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk155632/tencent-bind-eip-new-mgmt202603131543274.png) #### 5. Copy the CME from the source server to the target server {#Procedure_5} Show / Hide this section 1. Follow the instruction from [sk157492](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk157492) to install the latest version of CME on the target Management Server. 2. Make sure that the service is registered on the target machine: `service cme status` Make sure the service exists and, perhaps, is UP/DOWN. **Note:** When upgrading from R80.10 to a higher version, if the Management Server manages a scale set / auto scaling group, scale-in to 0 instances and scale-out. When upgrading a GCP Management Server that manages a GCP AutoScaling solution with outbound inspection use-case, make sure to adjust the routes according to the new instances.
#### 6. Attach the correct license on the target machine {#Procedure_6} Show / Hide this section * **PAYG:** No need to attach the license. * **BYOL:** If the license is attached to a private IP, you will need to generate a fresh license for the new private IP that will be defined on the new Management Server. Otherwise, use the license from the source machine. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content