Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
505 Views 4 Replies Latest reply: Feb 28, 2014 3:13 PM by cod6208 RSS
gavincreach Newcomer 3 posts since
Jan 17, 2011
Currently Being Moderated

Jan 21, 2014 12:16 PM

McAfee Firewall Config from version 8.1 to 8.3 and upgrade path from 8.1 to 8.3

All,

 

I'm looking for a solution to copy configuration from old firewall on 8.1 to new on 8.3.  I realize there are a few options.

 

1.  Doing it from scratch

2.  Updating the source firewall to 8.3, exporting a backup, then importing the backup to the target firewall

3.  Creating a VM on the same version as the source.  Exporting a backup and importing, while walking it through the various patches.

 

 

I found some discussions in 2010 stating there would be an easier path for copying the config over.  Are there any updates to that?

 

Also, if I were to upgrade a firewall from 8.1 to 8.3 could I do this easily walking it through patches?  What would be the specific steps?

 

Thanks in advance.

 

Gavin

  • PhilM Champion 528 posts since
    Jan 7, 2010

    Any of those three options is feasible. Really depends on what you want to do.

     

    Given the difference between the two versions is relatively minor (not like trying to take an old v7 installation and transfer it to new hardware which will be shipped with v8) I would personally look at either the 2nd of your two options - as long as it is still in maintenance, otherwise you won't be able to install the patches. Or, I'd take the new appliance, retro-install 8.1 (which you can download from the McAfee Product Downloads section of their web site using your grant number to gain access). Backup and transfer the config from the old box to the new one and then upgrade to the latest 8.3 patch level.

     

    -Phil.

  • PhilM Champion 528 posts since
    Jan 7, 2010

    Based on experience, I would say that much of that would depend on how different the old and new hardware appliances are. McAfee now appear to have standardized their interface naming convention starting 1-0 and then 1-1, 1-2, etc... This means that you can actually transfer a configuration between two appliances and aside from needing to re-enter the serial number & re-activate the license, the network configuration shouldn't be affected.

     

    But if the source appliance had interfaces which were identified by the operating system as em1, em2 and such like when restoring the configuration to an appliance with different interface types, you will find that the target appliance won't be able to communicate over the network. This isn't a disaster as you will still be able to access the command line (either with a screen and keyboard attached directly or via a serial connection, depending on which appliance you are dealing with).

     

    The "ifconfig" command can be used to identify the physical interfaces on the appliance and the labels assigned to them by the operating system.

     

    Then you can use the cf interface command to alter one of Firewall interface definitions so that it ties in with a physical interfaces.

     

    So, imagine the internal interface on the old firewall appliance was called "em1" and the corresponding interface on the new device is "1-1", you should be able to use the following command to link the logical interface definition with the physical device:-

     

    cf interface modify name=internal_network hwdevice=1-1

     

    - substitute "internal_network" with whatever name the interface definition is actually called - a "cf interface query entrytype=interface" will tell you what the interface definitions are acutally called.

     

    This will allow you to communicate again with the Firewall over network connection and establish an Admin Console session, from which you will then be able to modify & re-assign all the other interfaces on the box.

     

    -Phil.

  • cod6208 Newcomer 18 posts since
    Apr 4, 2011

    I have done exactly what Phil said to do, when we moved from 2150D to a 5032.  Moving the config file disabled the named interfaces.  I had to issue a cf int mod command to enable the interface and to assign the interface to the interface I wanted.

     

    cf interface modify name=internal hwdevice=1-0  enabled=yes

     

    This got all my burbs back on line, took me about 1 hour to reconfigure, apply  license and update patches.

     

    Mark

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points