Thursday, February 24, 2011

MGMT direct upgrade from R65 to R71.10 - beware

I have had an exiting weekend working with one of my customers in Geneva to upgrade Provider-1 system to R71.10 from R65.

While the lab test were showing success, the actual production upgrade failed badly.



The failure was only detected when we started pushing policy from the upgraded system. Suddenly we have started getting syntax errors during policy compilation. These error did not make any sense, they seem to be just random lines of INSPECT code failing. There we no actual problem with syntax, at least I have not managed to find any obvious one.

Rest of the functionality, including VSX provisioning ad logging, was perfectly fine.

We have tried to update IPS definitions, because the problem seemed similar to old R55 to R60 errors. No luck, the problem remained even after IPS update.

With service windows closing on us we had to roll back to R65.

The problem is reproducible in the lab. Nevertheless new lab tests we made this week show that while R65 to R71 upgrade fails, R65 to R70 upgrade path seems to be still working.

So here is my recommendation: do not skip major versions while going up from R65 on your management system. Otherwise you have a good chance to pull some extra hours as I have done. Guys, it is no fun.
Posted by at

8 comments:

  1. UnknownFebruary 24, 2011 at 11:30 AM

    Hey - quick thought, check and see if there's reserved words in existing objects. "broadcast" is one I recall is now a reserved word, but used in existing objects, that would cause something like this perhaps....

    ReplyDelete
  2. Valeri LoukineFebruary 24, 2011 at 11:33 AM

    Checked that, it is not the case. Thanks for a hint though.

    ReplyDelete
  3. AnonymousFebruary 25, 2011 at 6:03 PM

    did you made a Smartdefense Upgrade BEFORE upgrading the mgmt? in my scenarios this was sometimes the resolving hint...

    ReplyDelete
  4. Valeri LoukineFebruary 27, 2011 at 9:54 AM

    Hi Tom!

    Thanks for the suggestion, but the customer does not use SD at all. There is no subscription, there is no Internet access. Any way, I do not understand why R65 to R70 works and R65 to R71 does not.

    Should not be that different.

    ReplyDelete
  5. stievenMarch 16, 2011 at 3:22 PM

    i usually do a fresh installation and used migrate tools. Seems to cause less issues.

    ReplyDelete
  6. Valeri LoukineMarch 16, 2011 at 4:58 PM

    did not work in this specific case, sorry

    ReplyDelete
  7. OScarApril 3, 2011 at 10:00 PM

    I've upgraded R65 SC to R71.30 directly. Were was error as you describe while pushing policy and IPS update doesn't solve them. I have copied IPS files from clean R71.30 system to upgraded systems and then updated IPS definitions. After that policy was installed successfully. And I haven't IPS Blade enabled too, but it still affects policy compilation.

    ReplyDelete
  8. Valeri LoukineApril 4, 2011 at 8:50 AM

    did you copy just R71 files or also R65 BC files?

    ReplyDelete

Subscribe to: Post Comments (Atom)