Migrating to a New ProxySG Appliance. ProxySG 900/9000 to ProxySG S400/500

Transcription

1 Migrating to a New ProxySG Appliance ProxySG 900/9000 to ProxySG S400/500

2 Migrating to a New Blue Coat ProxySG Appliance Copyright 2017 Symantec Corp. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Blue Coat, and the Blue Coat logo are trademarks or registered trademarks of Symantec Corp. or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. SYMANTEC CORPORATION PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU. Americas: Rest of the World: Symantec Corporation Symantec Limited 350 Ellis Street Ballycoolin Business Park Mountain View, CA Blanchardstown, Dublin 15, Ireland Document Revision: 10/2017 ii

3 Table of Contents ProxySG Migration Process... 3 Additional Upgrade Information and Assistance... 3 Recommended Migration Path... 4 High-Level Process... 5 Tasks to Perform on the Source Appliance... 5 Tasks to Perform on the Target Appliance... 7 Prepare the Source Appliance Prepare the Target Appliance Next Steps

4 2

5 Section 1 ProxySG Migration Process This document describes how to migrate from the Blue Coat ProxySG 900 or 9000 appliance ( source ) to the Blue Coat ProxySG S400 or S500 appliance ( target ). The migration process requires that both the source appliance and the target appliance be upgraded to the same SGOS release; the version must be SGOS or later. Note: Symantec recommends that you upgrade to the version recommended in this guide because it includes fixes for issues that could impact the migration process. After migration is complete, you can upgrade the target appliance to your preferred long-term SGOS release. Additional Upgrade Information and Assistance If your appliance is running an older version of SGOS, you may want to review the features introduced between your current version and the upgrade version; refer to the SGOS Release Notes at MySymantec ( You require a MySymantec login to review release notes and download system images. To review any upgrade impacts, refer to the SGOS Upgrade/Downgrade WebGuide: For an overview of the migration process, view a 12-minute self-paced video (login is required): common/ledetail/ Symantec Support or your reseller's professional services group can also provide assistance if you need help with your upgrade. 3

6 Recommended Migration Path Symantec recommends the following migration path when replacing an End-of-Life (EOL) model. EOL Model Recommended Model , S , S S , S S400-30, S400-40, S S400-40, S S Note: The minimum supported version on the ProxySG S400 is SGOS The minimum supported version on the ProxySG S500 is SGOS Do not attempt to install earlier versions on these appliances. 4

7 Section 2 High-Level Process Migrating from one ProxySG appliance to another involves exporting the configuration from the source appliance and importing it to the target appliance. To transfer the configuration, use the SGOS configuration archiving feature. Because new SGOS versions introduce new features, remove obsolete features, and sometimes change default behaviors, you may need to edit the configuration to get the same results in the new configuration. The high-level process for migrating your configuration from one appliance to another is listed below. Detailed instructions begin on page 13. Note: To minimize any disruption in your network, or to prevent loss of data in your access logs or event logs, Symantec recommends completing this migration during a maintenance window. Tasks to Perform on the Source Appliance Note: The steps below are high-level; for detailed steps, see Prepare the Source Appliance on page Determine whether a software upgrade is required, download necessary images from MySymantec, and install the image(s). Refer to the SGOS Upgrade/Downgrade WebGuide ( to determine the upgrade path. Depending on which version your appliance is currently running, the upgrade path may require an upgrade to an interim release. Upgrade to SGOS or later. 2. Review the policy rules defined in your configuration and verify whether they are supported in the SGOS version you are upgrading to. A policy rule that is no longer supported is referred to as a CPL deprecation. For example, Instant Messaging policy gestures were deprecated in SGOS Note: You can either resolve the policy deprecations or ignore them. Symantec recommends that you examine the deprecations and resolve them to ensure that your security policies are not compromised. Refer to the Deprecated Policy Constructs section of the SGOS Upgrade/Downgrade Webguide and look for all deprecations in software releases between your current version and the version you are upgrading to. 3. Back up your configuration by creating a configuration archive with keyrings 1 and save it to a local system. 4. (Optional) Download access logs, event logs, and a sysinfo snapshot from the source appliance to preserve them. Note: If you intend the target appliance to use the same IP address that the source appliance currently uses, you will have to power down the source appliance before migration. Thus, it is is especially important to download the logs and snapshots from the source appliance before proceeding. 5. Record the network configuration settings (IP address, gateway, DNS, etc.). 1.Only keyrings created or imported on the ProxySG appliance as showable can be backed up using this method. 5

8 6. Power down, uncable, and unrack the source appliance. For information on recycling ProxySG appliances, refer to the following: Edit the Source Configuration Archive Note: For detailed steps, refer to Edit the Source Configuration File on page 17. Edit the configuration archive that you stored on a local system, and address the following issues: 1. If the target appliance will have different network settings from the old appliance, remove the settings from the configuration archive. Failure to delete these settings will result in an inability to restore the configuration archive. 2. Reconcile the interface numbering scheme on your old configuration with the interface numbering scheme on the new one. The interface numbering for each port is unique because it references the slot to which the port belongs and the port number. When you replace the hardware model, the interface numbering scheme might change because the order and numbering of the slots, the number of Ethernet ports in a slot, and the bridge pairs available on the interface module vary by platform and model of the ProxySG appliance. The slot number is shown on the rear of the appliance. 3. If your ProxySG was running SGOS version through , the configuration archive has a few lines of incorrect configuration due to a bug; you must delete the incorrect configuration before restoring the archive on the ProxySG S400/S500. For specifics on what needs to be deleted, see Edit the Source Configuration File on page To preserve the default keyring, extract the configuration that imports the default keyring and certificate from the archive. You will later import this to the new ProxySG before importing the rest of the configuration. Otherwise, to preserve the default keyring from your old ProxySG, delete the keyring (key and certificate) from the archive configuration. 6

9 Tasks to Perform on the Target Appliance Note: For detailed steps, refer to Prepare the Target Appliance on page Install the ProxySG S400/S500 in your network and perform initial configuration. Refer to the network settings you recorded in step 4 of "Tasks to Perform on the Source Appliance" on page Load the license on the target appliance. 3. Upgrade the appliance to same SGOS version that the source appliance was upgraded to when you exported the configuration. 4. If you extracted the default keyring configuration to its own file, restore this configuration on the target appliance. 5. Restore the archived, edited configuration onto the target appliance. Interface Mapping When you replace an appliance with a different hardware model, the interface numbering scheme might change. The interface modules the slot, interface labeling, and bridge pair groups on the newer ProxySG appliance models may be different from that of the older models. You must verify the interface configuration on your source appliance and perform the necessary adjustments to maintain consistency in your network configuration before restoring your configuration archive on to the target appliance. The illustrations below indicate the port and slot numbers available on the new appliances. ProxySG S400 7

10 ProxySG S500 Note: Slots 5 7 are functional on ProxySG S only. In the tables on the following pages, locate the model numbers of the appliances you are migrating from and to, and then take the action indicated to retain equivalent functionality on the target appliance. The specific steps for the actions are provided in the detailed instructions that follow. 8

11 MIGRATING FROM: SG 900 MIGRATING TO: SG S400 SG 900 interfaces (2) integrated (on board) NICs Equivalent interfaces on SG S400 (2) integrated (on board) NICs Action to take to retain equivalent functionality No action required. 0:0 1:0 (2) integrated (on board) GigE NICs 0:0 1:0 Use the (2) integrated 1000Base-T ports with a hardware bridge (also called passthru or bypass). No action required. 2:0 (Bridge: passthru-2) 2:1 (Bridge: passthru-2) Optional NIC Cards? Quad GigE fiber NIC w/bypass Slot 3: 3:2 (Bridge: passthru-3:2) 3:3 (Bridge: passthru-3:2) Slot 4: 4:0 (Bridge: passthru-4) 4:1 (Bridge: passthru-4) 4:2 (Bridge: passthru-4:2) 4:3 (Bridge: passthru-4:2) 2:0 (Bridge: passthru-2) 2:1 (Bridge: passthru-2) Purchase Quad fiber NIC w/ bypass and install in Slot 3. 3:2 (Bridge: passthru-3:2) 3:3 (Bridge: passthru-3:2) If the NIC was installed in Slot 3 on the SG 900, no action is required. If the NIC was installed in Slot 4, edit interface numbers and bridge names in configuration file as described on page 17. Quad GigE copper NIC w/bypass Slot 3: 3:2 (Bridge: passthru-3:2) 3:3 (Bridge: passthru-3:2) Slot 4: 4:0 (Bridge: passthru-4) 4:1 (Bridge: passthru-4) 4:2 (Bridge: passthru-4:2) 4:3 (Bridge: passthru-4:2) Purchase Quad 10/100/1000Base- T NIC w/bypass and install in Slot 3 or 4. Slot 3: 3:2 (Bridge: passthru-3:2) 3:3 (Bridge: passthru-3:2) Slot 4: 4:0 (Bridge: passthru-4) 4:1 (Bridge: passthru-4) 4:2 (Bridge: passthru-4:2) 4:3 (Bridge: passthru-4:2) No action is required. 9

12 MIGRATING FROM: SG 9000 MIGRATING TO: SG S400 SG 9000 interfaces (2) integrated (on board) NICs 0:0 0:1 (2) integrated (on board) GigE NICs with bypass Equivalent interfaces on SG S400 (2) integrated (on board) NICs 0:0 1:0 Use the (2) integrated 1000Base-T ports with a hardware bridge (also called passthru or bypass). Action to take to retain equivalent functionality Edit interface numbers in configuration file as described on page 17. Edit interface numbers in configuration file as described on page 17. 0:2 (Bridge: passthru-0:2) 0:3 (Bridge: passthru-0:2) Optional NICs? Quad GigE Fiber-SX or 1000 Base- T NIC w/bypass In Slot 1: 1:0 (Bridge: passthru-1) 1:1 (Bridge: passthru-1) 1:2 (Bridge: passthru-1:2) 1:3 (Bridge: passthru-1:2) In Slot 2: 2:0 (Bridge: passthru-2) 2:1 (Bridge: passthru-2) 2:2 (Bridge: passthru-2:2) 2:3 (Bridge: passthru-2:2) In Slot 3 (N/A ): 3:2 (Bridge: passthru-3:2) 3:3 (Bridge: passthru-3:2) Dual 10G Fiber or Copper NIC w/ bypass In Slot 1: 1:0 (Bridge: passthru-1) 1:1 (Bridge: passthru-1) In Slot 2: 2:0 (Bridge: passthru-2) 2:1 (Bridge: passthru-2) In Slot 3 (N/A ): 2:0 (Bridge: passthru-2) 2:1 (Bridge: passthru-2) Purchase Quad GigE Fiber-SX or 1000 Base-T NIC w/bypass and install in Slot 3. 3:2 (Bridge: passthru-3:2) 3:3 (Bridge: passthru-3:2) Purchase Dual 10G Fiber (SR or LR) or Copper w/bypass and install in Slot 3 or 4. In Slot 3: In Slot 4: 4:0 (Bridge: passthru-4) 4:1 (Bridge: passthru-4) If the NIC was installed in Slot 3 on the SG 9000, no action is required. If the NIC was installed in Slot 1 or 2, edit interface numbers in configuration file as described on page 17. Edit interface numbers and bridge names in configuration file as described on page

13 MIGRATING FROM: SG 9000 MIGRATING TO: SG S500 SG 9000 interfaces (2) integrated (on board) NICs 0:0 0:1 (2) integrated (on board) GigE NICs with bypass 0:2 (Bridge: passthru-0:2) 0:3 (Bridge: passthru-0:2) Optional NICs? Quad GigE Fiber-SX or 1000 Base-T NIC w/bypass In Slot 1: 1:0 (Bridge: passthru-1) 1:1 (Bridge: passthru-1) 1:2 (Bridge: passthru-1:2) 1:3 (Bridge: passthru-1:2) In Slot 2: 2:0 (Bridge: passthru-2) 2:1 (Bridge: passthru-2) 2:2 (Bridge: passthru-2:2) 2:3 (Bridge: passthru-2:2) In Slot 3 (N/A ): 3:2 (Bridge: passthru-3:2) 3:3 (Bridge: passthru-3:2) Equivalent interfaces on SG S500 (2) integrated (on board) NICs 0:0 2:0 or 2:1 Use the (2) integrated 10G Base-T ports with bypass. 1:0 (Bridge: passthru-1) 1:1 (Bridge: passthru-1) Or, if you need the 10G ports elsewhere, purchase a GigE copper NIC and install in Slot 3 or 4. For example, in Slot 3: Purchase Quad GigE Fiber-SX or 1000 Base-T NIC w/bypass and install in Slot 3 or 4. In Slot 3: 3:2 (Bridge: passthru-3:2) 3:3 (Bridge: passthru-3:2) In Slot 4: 4:0 (Bridge: passthru-4) 4:1 (Bridge: passthru-4) 4:2 (Bridge: passthru-4:2) 4:3 (Bridge: passthru-4:2) Action to take to retain equivalent functionality Edit interface numbers in configuration file as described on page 17. Edit interface numbers in configuration file as described on page 17. If the NIC was installed in Slot 3 on the SG 9000 and the equivalent NIC is installed in Slot 3 on the SG S500, no action is required. Otherwise, edit interface numbers in configuration file as described on page

14 SG 9000 interfaces Dual 10G Copper NIC w/bypass In Slot 1: 1:0 (Bridge: passthru-1) 1:1 (Bridge: passthru-1) In Slot 2: 2:0 (Bridge: passthru-2) 2:1 (Bridge: passthru-2) In Slot 3 (N/A ): Dual 10G Fiber NIC w/bypass In Slot 1: 1:0 (Bridge: passthru-1) 1:1 (Bridge: passthru-1) In Slot 2: 2:0 (Bridge: passthru-2) 2:1 (Bridge: passthru-2) In Slot 3 (N/A ): Equivalent interfaces on SG S500 Use the (2) integrated 10G Base-T ports w/bypass. 1:0 (Bridge: passthru-1) 1:1 (Bridge: passthru-1) Purchase a Dual 10G Fiber (SR or LR) NIC w/bypass. The NIC can be installed in any open slot. For example, in Slot 3: Action to take to retain equivalent functionality If the NIC was installed in Slot 1 on the SG 9000, no action is required. If the NIC was installed in Slot 2 or Slot 3, edit interface numbers and bridge names in configuration file as described on page 17. If necessary, edit interface numbers and bridge names in configuration file as described on page

15 Section 3 Prepare the Source Appliance Perform the following procedure to upgrade the ProxySG 900 or ProxySG 9000 to the required software image, archive the configuration, download logs, and record any additional settings you will need when configuring the new appliance. Preparing the Source Appliance Step 1 Step 2 Determine your upgrade path. Obtain the required software images. The ProxySG 900/9000 must be running SGOS or later. Refer to the SGOS Upgrade/Downgrade WebGuide ( to determine the upgrade path. Depending on which version your ProxySG appliance is currently running, you might have to upgrade to an interim SGOS version. a. Go to MySymantec: b. Select Downloads > Network Protection (Blue Coat) Downloads. c. When prompted, log in with your MySymantec credentials. d. Select your product. e. Select your appliance model (if applicable). f. Select a software version. g. Accept the License Agreement. h. Select the file(s) to download and click Download Selected Files. Note: The first time you download files, you are prompted to install the Download Manager. Follow the onscreen prompts to download and run the installer. For more information, refer to Step 3 (Optional, but recommended) Before upgrading to a new software version, create a back up of your ProxySG appliance configuration. i. The Download Manager window opens. Select the download location. j. Download the new software image and put it on a workstation the ProxySG can access. k. Download the release notes and review them. See Step 6 on page 15 for details. 13

16 Preparing the Source Appliance (Continued) Step 4 Step 5 Install any interim SGOS releases required to upgrade to your required SGOS version. If you have a direct upgrade, go to Step 5. Install the required SGOS version: SGOS or later a. Log in to your ProxySG 900 or ProxySG 9000 using a supported web browser. See for supported browser versions. b. Select the Maintenance > Upgrade > Upgrade tab. c. Click Upload and browse to the interim release image you downloaded in Step 2 on page 13. d. Click Install. e. When notified, resolve CPL deprecation warnings before you restart the latest image you downloaded. Refer to Deprecated Policy Constructs in the SGOS Upgrade/Downgrade Webguide for more information. f. Click Restart. The reboot requires several minutes and logs you out of the ProxySG appliance. a. After the reboot is complete, log in to the appliance. b. Look at the Management Console banner to verify that the appliance is running the correct SGOS release. a. Log in to your ProxySG 900 or ProxySG b. Select the Maintenance > Upgrade > Upgrade tab. c. Click Upload and browse to the release image you downloaded in Step 2. d. Click Install. e. When notified, resolve CPL deprecation warnings before you restart the latest image you downloaded. Refer to the Deprecated Policy Constructs section of the SGOS Upgrade/ Downgrade Webguide for more information. f. Click Restart. The reboot requires several minutes and logs you out of the ProxySG appliance. g. When the reboot is complete, log in to the appliance. h. Look at the Management Console banner to verify that the appliance is running the correct SGOS release. 14

17 Preparing the Source Appliance (Continued) Step 6 Create a back up of your ProxySG appliance configuration using SSH- Console session. The archive generated in this step includes the showable keyrings on the appliance. a. In your terminal emulation application, enable session logging. Configure the application to log the session output and save that file on your local system. The following example uses PuTTY: IMPORTANT: Keys are exported in clear text with no encryption or obfuscation. Take precautions to secure the archive file appropriately. The archive does not include keyrings saved with the Do not show keypair option. For keyrings that are not included in the archive, you must manually create a new keyring and import the key and the certificate into the new ProxySG appliance before you are instructed to restore this archive. This example is an excerpt from the output file, showing the beginning and the end of the configuration content. The... indicates the middle sections that aren t shown in this example. b. Access the CLI on the appliance and enter the following commands from the CLI command prompt: SGOS# enable SGOS# config terminal SGOS(config) show configuration noprompts withkeyrings SGOS(config) c. Exit the terminal emulation application, making sure that session logging is turned off. d. Open the session log/output file (ProxySG_archive_12_2015, in this example) and delete all the text/commands before and after the configuration. For example:!- Version: SGOS Proxy Edition!- Serial number: xxxxxxxxxxxxxx!- Local time: :41:29-00:00UTC!- BEGIN networking interface 0:0 ;mode ip-address interface 2:0 ;mode label "WAN" ip-address interface 2:1 ;mode label "LAN" ip-default-gateway dns-forwarding ;mode edit primary clear server add server !- END networking...!- END policy!- BEGIN general line-vty ;mode length 36!- END general e. Save this text file on your local system or hard drive (ProxySG_archive_12_2015, in this example). 15

18 Preparing the Source Appliance (Continued) Step 7 (Optional) Download access logs, event logs, and a sysinfo snapshot from the old appliance if you want to preserve them. a. Enter the following URLs in your web browser, substituting the IP address of your ProxySG: b. Save the content of each in a text file. Note Download the logs and snapshot information off the old machine just as soon as the box is taken off-line during the maintenance window, before migrating anything over to the new appliance. If the new appliance will be using the same IP address as the old one, you ll have to turn the old one off before you bring the new one up, so it ll be important to have all the logs downloaded before that happens. Step 8 Record the network configuration information you will need to configure the management interface on the new appliance. For example: Management Interface: 0:0 IP address: Subnet mask: Default gateway: Primary DNS server: Alternate DNS server: N/A Look in the configuration archive and record the following information about the old appliance: Management Interface: IP address: Subnet mask: Default gateway: Primary DNS server: Alternate DNS server: Step 9 Power down the appliance, uncable it, and unrack it. 16

19 Edit the Source Configuration File Modify the configuration archive that you stored on a local system to address configuration differences between the source appliance and the target appliance. Editing the Configuration File Step 1 Step 2 Step 3 Edit the configuration file that you stored on a local system. If the target appliance will have different network settings from the source appliance, remove the settings from the configuration archive. Failure to delete these settings will result in an inability to restore the configuration archive. Reconcile the interface numbering scheme on your source configuration with the interface numbering scheme on the target appliance Open the configuration file (ProxySG_archive_12_2015, in this example) in your preferred text editor. a. For the management interface, delete the network configuration details, such as IP address, subnet mask, and default gateway.!- BEGIN networking interface 0:0 ;mode ip-address interface 0:0.101 ;mode ip-address interface 1:0 ;mode reject-inbound disable virtual-ip clear virtual-ip address failover ;mode create edit multicast-address enable ip-default-gateway dns-forwarding ;mode edit primary clear server add server !- END networking a. Edit interface numbers and bridge names in the configuration file so they correspond to those used in the new appliance. Refer to Interface Mapping on page 7. b. To prevent errors, delete the configuration settings for interfaces and bridge groups that are no longer valid on the new appliance. Note: Slot numbers are shown on the rear of the appliance.!- BEGIN networking interface 0:0 ;mode ip-address interface 0:2 ;mode label "WAN" ip-address interface 0:3 ;mode label "LAN" ip-default-gateway dns-forwarding ;mode edit primary clear server add server !- END networking 17

20 Editing the Configuration File Step 4 Step 5 If your ProxySG was running a SGOS version from to , the configuration archive has a few lines of incorrect configuration due to a bug; you must delete these lines before restoring the archive on the ProxySG S400/ S500. If you do not want to preserve the default keyring from your old ProxySG, delete the keyring (key and certificate) from the archive configuration. Note: The... indicates sets of lines not shown here in the example configuration. Delete the following from the archive (if it exists): create ccl bluecoat-appliance edit ccl bluecoat-appliance ;mode add BC_Engineering_CA add ABRCA_root Delete the keyring configuration lines. For example: inline keyring show default "end inline" -----BEGIN RSA PRIVATE KEY END RSA PRIVATE KEY BEGIN CERTIFICATE END CERTIFICATE----- end inline Step 6 Or, if you want to preserve the default keyring, extract the config that imports the default keyring and certificate from the archive. You will later import this to the new ProxySG before importing the rest of the configuration. Separating the certificate configuration from the main configuration avoids issues with importing a certificate that is already in use. Note: The... indicates sets of lines not shown here in the example configuration. Extract the following sections and save to a new text file (keyring.txt):!- BEGIN ssl ssl ;mode inline keyring show default "end inline" -----BEGIN RSA PRIVATE KEY END RSA PRIVATE KEY BEGIN CERTIFICATE END CERTIFICATE----- end inline... Step 7 Save the updated configuration file. Save the file (ProxySG_archive_12_2015, in this example). 18

21 Section 4 Prepare the Target Appliance Use the following procedure to install and configure the target appliance. Installing the Target Appliance Step 1 Step 2 Rack mount and cable the target ProxySG appliance. Activate the serial console on the target appliance. Cable the appliance the same way that the source appliance was cabled. Typically you would cable it as follows: For in-path deployments, connect the LAN interface to the switch and connect the WAN interface to the router. For virtually in-path deployments (WCCP), connect the LAN interface to a dedicated interface on the router. For rack mounting instructions, refer to the Quick Start Guide poster for your ProxySG platform: SG-S400: SG-S500: a. Connect the serial cable from your laptop to the ProxySG S400 or S500 appliance. b. Using terminal emulation software on your laptop (such as PuTTY), connect to the ProxySG appliance serial console (9600, 8, N, 1). c. Power on the appliance. The appliance bootup process begins. d. Press Enter three times to activate the ProxySG appliance serial console. The serial console prompts take you through the initial configuration of the appliance. Note If you have previously configured this appliance, the CLI does not display the initial configuration prompt. To launch the initial configuration script, you must restore the appliance to factory defaults. Enter the following command from the CLI: restore-defaults factory-defaults 19

22 Installing the Target Appliance (Continued) Step 3 Run the initial configuration wizard to configure network access. a. Enter a to specify that you want to perform a manual setup. b. Enter b to choose Other solution. c. Enter the number that corresponds to the interface you want to configure. d. Specify whether you want to configure a non-native VLAN. If you enter Y, you are prompted for the VLAN ID. e. Assign the network addresses (management IP address, subnet mask, default gateway, and primary DNS server). Refer to the information that you recorded in Step 8 on page 16. f. Set the console username and password. g. Set an enable mode password. h. When prompted to secure the console or not, select your preference Y/N. i. When prompted to restrict Management Console access to a specific workstation, select your preference Y/N. j. If prompted for a license edition, select the appropriate edition. k. Close the serial console connection after the CLI displays the configuration complete message. Step 4 Install the license. a. In the Management Console, select Maintenance > Licensing > Install. b. Click Retrieve. The console displays the Request License Key dialog box. c. Enter your MySymantec User ID and Password and then click Request license. d. Click OK to retrieve the license. 20

23 Installing the Target Appliance (Continued) Step 5 Upgrade the target appliance to the same SGOS version ( and later) as you had on the source appliance when you exported the configuration. Obtain the release image: a. Go to MySymantec: b. Select Downloads > Network Protection (Blue Coat) Downloads. c. When prompted, log in with your MySymantec credentials. d. Select your product. e. Select your appliance model (if applicable). f. Select a software version. g. Accept the License Agreement. h. Select the file(s) to download and click Download Selected Files. Note: The first time you download files, you are prompted to install the Download Manager. Follow the onscreen prompts to download and run the installer. For more information, refer to i. The Download Manager window opens. Select the download location. j. Download the new software image and put it on a workstation the ProxySG can access. k. Download the release notes and review them. Install the image: a. Log in to your ProxySG using a supported web browser. See for supported browser versions. b. Select the Maintenance > Upgrade > Upgrade tab. c. Click Upload and browse to the image. d. Click Install. e. Click Restart. The appliance will reboot. This might take several minutes. When the appliance has completed rebooting, you will be logged out of the appliance. a. Log in to the appliance. b. Verify the SGOS version shown on the Management Console banner. 21

24 Installing the Target Appliance (Continued) Step 6 If you extracted the default keyring configuration to its own file (for example, keyring.txt), restore this configuration. a. From the Management Console, select Configuration > General > Archive > Archive Configuration. b. In the Install Configuration from drop-down, select Local File and then click Install. The Open dialog box displays. c. Browse to the keyring configuration text file (keyring.txt, in this example) and then click Open. d. If prompted, click Continue in the Security Warning window. If the configuration installed without any errors or warnings, you will see a message indicating the file was successfully installed. Otherwise, the Install Results window opens (see Step 9). Step 7 Download databases for Symantec services and enable the services. If your configuration includes elements from Symantec WebFilter, Application Protection, Threat Risk, Application Classification, or Geolocation databases, you must download the databases for these services and enable them. This step includes the Symantec WebFilter service as an example: a. Select Proxy > Configuration > Content Filtering > Blue Coat > Download. b. Click Download Now. The download begins. Depending on your link speed, the initial download can take up to thirty minutes. c. Once complete, browse to Proxy > Configuration > Content Filtering > General. d. Check Blue Coat and click Apply. e. Repeat this process for any other service databases your configuration requires. Step 8 Note Restore the configuration archive. For all keyrings that were archived with the Do not show keypair option, you must manually create new keyrings and import the keypair one at a time. a. From the Management Console, select Configuration > General > Archive > Archive Configuration. b. In the Install Configuration from drop-down, select Local File and then click Install. The Open dialog box displays. c. Browse to the edited configuration archive text file (ProxySG_archive_12_2015, in this example) and then click Open. d. If prompted, click Continue in the Security Warning window. If the configuration installed without any errors or warnings, you will see a message indicating the file was successfully installed. Otherwise, the Install Results window opens (see Step 9). 22

25 Installing the Target Appliance (Continued) Step 9 Review any warnings or errors after installing the configuration archive. Address any issues discovered during archive installation: a. Copy the content of the Install Results window and paste into a text editor. b. To locate error messages, search for %. (Each error message is preceded by a percent sign.) c. To locate warning messages, search for Warning: d. Look in the Management Console for the setting mentioned in the error or warning message, and make any necessary changes. Step 10 For security reasons, SSLv2 and SSLv3 are disabled by default in SGOS and later. If you are migrating from a system running an older SGOS release and haven t changed the SSL versions for the HTTPS Reverse Proxy service, you will automatically get this change. If you need to continue to support the older SSL protocol versions, you will need to enable them in the HTTPS Reverse Proxy service after the upgrade. IMPORTANT: No change is needed here if you want the HTTPS Reverse Proxy service to use the new default SSL protocol versions in SGOS v and later (TLSv1, TLSv1.1 and TLSv1.2) and the supported cipher-suite for those versions. Step 11 Upgrade to your preferred long term release. (Downgrading is not recommended.) To enable the default protocols for HTTPS Reverse Proxy that were used in 6.4.x: a. From the Management Console, select Configuration > Services > Proxy Services > Proxy Services. b. Locate your HTTPS Reverse Proxy service and click Edit Service. c. Enable the default SSL protocols used in older SGOS versions: TLSv1, SSLv3, SSLv2; disable other protocols, if desired. d. Click OK. e. Apply the changes. Evaluate the recommended long-term releases on MySymantec to determine if you want to upgrade to one of these releases. The final upgrade version must be SGOS or later. Step 12 Delete the previous key files and configuration file so that your keys and other sensitive information are not available to others. Congratulations! You have successfully completed migrating your configuration to a new ProxySG appliance. 23

26 Section 5 Next Steps If your previous appliance was running a pre version of SGOS, you may want to review the features and changes introduced in SGOS between the previous version and your current version. Refer to the SGOS Release Notes at MySymantec (login is required). To review any upgrade impacts, refer to the SGOS Upgrade/Downgrade WebGuide: 24