How to upgrade Win2008 + SEC + ClusterSQL -> Win2016 + SEC + ClusterSQL

Hello Yann,

an in-place OS upgrade is not supported - personally I'm not a fan of Windows upgrades anyway, YMMV.

Are your child SUMs (A1 and B1) also Message Relays? Will the new servers have new names and IPs?

Christian

Hi Christian,

Thanks for the information with the upgrade in place. ;-)

For Message Relays : No we are not using messenging with Sophos Enterprise Console/Server.

For IP and name : Me I prefer to install a new server in the same VLAN dedicated with a new IP. We will probably move the database on a new SQL Cluster 2017 for lan.local but the SQL Cluster 2017 is not available for the DMZ so it will live with the old 2014 SQL cluster for the moment.

If I can, I will create a CNAME on the old server, reconfigure the policies with the Cname, then when we are ready, just change the CNAME from OLD to NEW SEC. Any problem with certificates ?

Same things with the SUMs. Any problem with certificates ?

It is more quick & easy to reconfigure a Cname than Policies and place I don't know XD

But I don't know to much the Sophos Certificates parts... I already had problems with another antivirus... I cross fingers.

Yann

Hello Yann,

not using messaging
just to make sure, messaging and Message Relays refer to the communication (status →, policies and commands ←) between endpoint and management server - the RMS component.

same VLAN [...] CNAME [...] certificates
VLAN doesn't play a role (proveded a path exists of course). CNAMEs work but just changing policies isn't sufficient. RMS doesn't use the policies, the pivot is mrinit.conf. It's used to distribute the keys required for certificate verification, certificates aren't pinned to a certain name or IP. Thus as long as you reuse the certificates of an existing installation the server is the "same" from the POV of the endpoints. SUMs are just redistribution points.

HTH
Christian

Hi Christian

Oh sorry I misunderstood that.

Yes all clients (servers) are communicating with the both SEC servers :

- servers in DMZ with the DMZ SEC 

- servers in LAN with the LAN SEC

And ours teams use SEC Console to manage both

- VDI clients in DMZ manage DMZ SEC

- Workstation in Lan manage LAN SEC

Updates Servers post updates and servers go on shares to take updates (if I don't do mistake, I need to check that part)

Sorry I know much better Trend Micro or Symantec solution.

Sophos is quiet new for me. That s why I posted in the community part :D

Cheers

Yann

Hello Yann,

no problem. And naturally the forum is here for - amongst other things - sharing knowledge. Feel free to ask, and if in doubt please do ask before you try something you're not sure it'll work.And if something didn't work out as expected it's perhaps better NOT to try to "correct" the problem before asking for help. [:)]

Christian

I upgraded the DMZ SEC 5.5.0 to 5.5.1 without problem.

But i have some DB SOPHOS540 and SOPHOS550 in my instance. I figure I can delete them. But about the old SOPHOSENC52. Someone knows ?

I will have at the end the 3 db : SOPHOS551 / SOPHOSPATCH52 / SophosSecurity

I need to deploy the Console only on some Computers. Is there any KB to explain me how to create a powershell script and parameters ?

I called support today about reducing the 500 Mb installer, but it seems it is not possible, does it ?

Hello Yann,

the older databases can be dropped. SOPHOSENC52 is not used since SEC 5.4.0, either Full Disk Encryption has never been installed/initialized or has been uninstalled before installation of 5.4.0 or a later version. It can be dropped as well.

deploy the Console
neither scripted install nor pruning of the package is supported. And I have not done it - you'd have to experiment (it's not supported) and the question is whether it's actually saving time and effort. Repeat, it's unsupported and I don't recommend it. Given that it is a rather minor upgrade and assuming you desperately want to try it: Basically setup.exe just calls msiexec.exe to install the Console64.msi package. You can find the parameters used in either the Sophos_bootstrapper or the Sophos_Console64msi log in %ProgramData%\Sophos\Management Installer\. From \sec_551\ServerInstaller\ you probably don't need all the subfolders and the files whose names start with SUM, DB, Database, Svr, and Server. As said, unsupported and not tested.

Christian       

Hello Yann,

the older databases can be dropped. SOPHOSENC52 is not used since SEC 5.4.0, either Full Disk Encryption has never been installed/initialized or has been uninstalled before installation of 5.4.0 or a later version. It can be dropped as well.

deploy the Console
neither scripted install nor pruning of the package is supported. And I have not done it - you'd have to experiment (it's not supported) and the question is whether it's actually saving time and effort. Repeat, it's unsupported and I don't recommend it. Given that it is a rather minor upgrade and assuming you desperately want to try it: Basically setup.exe just calls msiexec.exe to install the Console64.msi package. You can find the parameters used in either the Sophos_bootstrapper or the Sophos_Console64msi log in %ProgramData%\Sophos\Management Installer\. From \sec_551\ServerInstaller\ you probably don't need all the subfolders and the files whose names start with SUM, DB, Database, Svr, and Server. As said, unsupported and not tested.

Christian