Pulse Policy Secure. IC Series to MAG Series Hardware Migration Guide. Product Release 5.2. Document Revision 1.0. Published:

Transcription

1 Pulse Policy Secure IC Series to MAG Series Hardware Migration Guide Product Release 5.2 Document Revision 1.0 Published:

2 Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose, CA Pulse Secure and the Pulse Secure logo are trademarks of Pulse Secure, LLC in the United States. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Pulse Secure, LLC assumes no responsibility for any inaccuracies in this document. Pulse Secure, LLC reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Pulse Policy Secure IC Series to MAG Series Hardware Migration Guide The information in this document is current as of the date on the title page. END USER LICENSE AGREEMENT The Pulse Secure product that is the subject of this technical documentation consists of (or is intended for use with) Pulse Secure software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at By downloading, installing or using such software, you agree to the terms and conditions of that EULA.

3 Table of Contents OVERVIEW... 4 PREPARATION FOR MIGRATION... 4 NOTES:... 4 STEP-BY-STEP PROCEDURE (STANDALONE)... 5 STEP-BY-STEP PROCEDURE (CLUSTER)... 8 REFERENCES:... 16

4 OVERVIEW This document describes guidelines and procedures for migrating the configuration from an IC Series to a MAG Series device. The guidelines and procedures apply to devices deployed as a standalone system or as a high availability solution, either in a two-node or multi-node cluster configuration. We recommend you use the binary export feature to transfer configuration and settings from old to new platform. Although the steps seem simple, we strongly recommend that you follow the steps in order and that you do not skip steps or details. PREPARATION FOR MIGRATION Listed below are necessary items to prepare for migration: 1. Site assessment: Ensure proper cooling and ventilation; and also ensure network between nodes that are to be clustered are in high bandwidth, low latency LAN type connection. 2. Hardware: Ensure that hardware ordered are complete (chassis, blades, fans, PSU, hard drives, or kits). Also ensure to match serial numbers of the hard drives and the blades, incorrectly using a non-paired drives could cause bootup issues and could result in an RMA. 3. Licenses: Needed licenses should be procured and ready, and whether you need to configure as license member in an Enterprise Licensing Server environment. 4. Software: MAG Series devices are delivered with 4.1R1.1 factory build, and so, determine what software version will be used for the new devices and upgrade accordingly. 5. Configuration backup: Back up the system.cfg and user.cfg binary files immediately prior to migration. 6. Configuration documentation: Before you take the previous systems offline, take note of and document local settings. These must be manually re-entered on the new systems. NOTES: 1. The process of converting an existing IC Series standalone or cluster devices to the equivalent MAG Series devices involves manually entering some settings, such as networking and clustering parameters, so please make note of these settings. 2. If you are converting a cluster, all MAG series devices to be put in cluster should have same version and build of software, and same hardware platforms (for example, all SM160 or all SM360). 3. If you are using Active Directory or ACE authentication servers, you must recreate some of the configuration. For the AD, you must recreate computer objects. For ACE, you must regenerate/re-import the SDCONF.REC file if authentication fails after the migration. 4. The procedure provided in this document assumes that the MAG Series devices are installed in the same networks as the IC Series devices they are replacing. 5. The term migration suggests that you are replacing the existing IC Series device with a MAG Series device. This document instructs you to shut down the first device, and then configure its replacement with the same hostname, IP address, and network settings. If you configure a replacement device in an Active/Active cluster with a new fully qualified domain name or IP address, be sure to reconfigure your load balancer to communicate with the replacement device.

5 STEP-BY-STEP PROCEDURE (STANDALONE) The below procedure applies to a standalone migration. To migrate a configuration: 1. On the IC Series system, log into the system and export the binary configuration files (system.cfg and user.cfg). a. Select Maintenance > Import/Export > Configuration. b. Under Export, enter a password if you d like to password-protect the configuration file. c. Click Save Config As to save the file. By default, the filename is system.cfg. d. Select Maintenance > Import/Export > User Accounts. e. Under Export, enter a password if you d like to password-protect the configuration file. f. Click Save Config As to save the file. By default, the filename is user.cfg. 2. Make notes of all the local settings for both nodes (if not yet done during preparation stage): IP information, virtual ports, VLANs, hosts, routes, DNS settings, SNMP (if configured). 3. Shut down the IC Series device.

6 4. Configure the new MAG devices with same internal/external/management ports IPs with same IP addresses as the IC device it is replacing. Configure proper DNS settings. Do not configure any other settings at this time. 5. Install the appropriate licenses for the new MAG device. If you are using the Enterprise License Server feature, you have to manually recreate the client and re-establish connection to the license server later at the end of migration. 6. Import the system.cfg file. a. Select Maintenance > Import/Export > Configuration. b. Specify whether you want to import device certificate. Note: The certificate is not imported unless you check the Import Device Certificate(s)? checkbox. c. Select Import everything except network settings and licenses. This option imports all configuration settings except the network, cluster and license settings. d. Browse to the configuration file, which is named system.cfg by default. e. If applicable, enter the password you specified for the file. f. Click Import Config.

7 7. Import the user.cfg binary file. a. Select Maintenance > Import/Export > User Accounts. b. Browse to the configuration file, which is named user.cfg by default. c. Enter the password you specified for the file. If you did not specify a password before exporting the file, then leave this field blank. d. Click Import Config. 8. After importing system.cfg and user.cfg files, check and/or modify the remaining local settings and other settings such as: a. Network>Overview settings. b. Network>Routes (for internal, external and other ports). c. Network>Hosts. d. Network>Internal Port/ External Port>Virtual Ports. e. Network>VLANs. f. Log/Monitoring>SNMP. g. Configuration>Certificates>Device Certificates (and its ports bindings). h. Auth Servers>ACE Auth server, if used (check the node secret file status). i. Configuration>Licensing - License client-server settings (if used as license client in Enterprise Licensing Server environment), proper licenses installed. 9. Test the authentication using AD, ACE, etc, and all other functionalities enabled, such as Pulse. This completes the migration.

8 STEP-BY-STEP PROCEDURE (CLUSTER) The below procedure applies to a cluster migration. To migrate a configuration for a cluster: 1. On the IC Series system, log into the primary node of the cluster and export the binary configuration files (system.cfg and user.cfg). a. Select Maintenance > Import/Export > Configuration. b. Under Export, enter a password if you d like to password-protect the configuration file. c. Click Save Config As to save the file. By default, the filename is system.cfg. d. Select Maintenance > Import/Export > User Accounts. e. Under Export, enter a password if you d like to password-protect the configuration file. f. Click Save Config As to save the file. By default, the filename is user.cfg. 2. Make notes of all the local settings for both nodes (if not yet done during preparation stage): IP information, clustering, virtual ports, VLANs, hosts, routes, DNS settings, SNMP (if configured).

9 3. Shut down each of the devices in the cluster. 4. Configure the new MAG devices with same internal/external/management ports IPs with same IP addresses as the IC devices they are replacing. Configure proper DNS settings. Do not configure any other settings at this time. 5. Install the appropriate licenses for the new MAG devices. If you are using the Enterprise License Server feature, you have to manually recreate the client and re-establish connection to the license server later at the end of migration. 6. In the admin console for the first device, manually create a new cluster with same name and settings as the old IC cluster. The default new cluster configuration, shown here, is for an Active/Active cluster.

10 For an active/passive cluster, reset the configuration to Active/Passive, and add the cluster VIP addresses: Save the cluster configuration settings: Change confirmation:

11 7. Add the second device to the cluster in the primary node cluster configuration and save the settings. Add a member by clicking Add Members: Enter member node name and IP and check netmask and gateway, then click Add:

12 Then click Save Changes: Check the cluster status. It should go transitioning for short period: Then, the first node becomes enabled and status should be Leader; the second node remains Enabled, Unreachable until it joins the cluster:

13 8. Log into the second MAG device and join this node to the cluster by Clustering>Join Cluster. On the confirmation page, click Join: After successful join, the admin session is forced off the secondary node that just joined.

14 9. Log into primary node and check the cluster status. It should stabilize in a few minutes. 10. Import the system.cfg file for the primary node. a. Select Maintenance > Import/Export > Configuration. b. Specify whether you want to import device certificate. Note: The certificate is not imported unless you check the Import Device Certificate(s)? checkbox. c. Select Import everything except network settings and licenses. This option imports all configuration settings except the network, cluster and license settings. d. Browse to the configuration file, which is named system.cfg by default. e. If applicable, enter the password you specified for the file. f. Click Import Config.

15 11. Import the user.cfg binary file. a. Select Maintenance > Import/Export > User Accounts. b. Browse to the configuration file, which is named user.cfg by default. c. Enter the password you specified for the file. If you did not specify a password before exporting the file, then leave this field blank. d. Click Import Config. 12. After importing system.cfg and user.cfg files, check and/or modify the remaining local settings and other settings such as: a. Network>Overview settings (set in cluster or individual nodes). b. Network>Routes (for internal, external and other ports). c. Network>Hosts (set in cluster or individual nodes). d. Network>Internal Port/ External Port>Virtual Ports (if clustered, set this up in cluster Entire Cluster ). e. Network>VLANs (if clustered, set this up in cluster Entire Cluster ). f. Log/Monitoring>SNMP (set in cluster or individual nodes). g. Configuration>Certificates>Device Certificates (and its ports bindings). h. Auth Servers>ACE Auth server, if used (check the node secret file status). i. Configuration>Licensing - License client-server settings (if used as license client in Enterprise Licensing Server environment), proper licenses installed. 13. If clustered, check the cluster status and test operation by logging in to the cluster VIPs (or the standalone MAG device IP). Test the authentication using AD, ACE, etc, and all other functionalities enabled, such as Pulse. This completes the migration.

16 REFERENCES: Pulse Connect Secure Administration Guide: Pulse Connect Secure Clustering Feature Guide: MAG Series Devices Setup video: