Migrating from Astaro ASG 525 to Sophos SG 210

Hi, Luc, and welcome to the UTM Community!

You're making this more complicated than it needs to be.  Unless you need to change the host name of the UTM or you want to change all of the certificates, start with a full backup from the 525.  Load that onto one of the two new 210s, leaving the other one off and completely unconfigured - if you've configured it at all, do a Factory Reset from the front panel and power it off.

In the running 210, make the needed changes in 'Management >> High Availability'.  Cable the other 210 identically to the first one, connect the sync interfaces of the two units and then power the second unit on.  The unit you configured will take over the second unit as its Slave and will sync the configuration to it.

You used the word "Cluster" in your description.  If you want an Active-Active setup, you will need to modify the license so that it is for two nodes - that will reduce the length of the subscription by half.  If you want an Active-Passive (the second unit only does work when the first one fails and the second unit takes over as the new Master), you do not need to modify your license.

Cheers - Bob

Hi Bob,

Thanks for your reply. I'm afraid I didn't make myself clear.

I'm doing it exactely the way you describe. But you say : "start with a full backup from the 525.  Load that onto one of the two new 210s". Well, that is precisely the part that's not working. As soon as I start to load the backup to one of the new 210, its NIC freezes (both led's turn off) and I loose the connection to it.

I join a screenshot where it hangs when I restore the backup file to the 210.

(Percentage may vary with each attempt, it's sometimes more.)

At that point, all NICs seem to be deactivated. The only way to get them back is to do a factory reset. Well, not exactly all NICs. The only one that still "lives" is E3/HA. But I'm unable to use it to dialog with the 210.

Hope this clears things up.

But your reply made me think about another possible solution. Maybe I could do it in a three steps procedure. But I'm not sure this could work. (It depends if I can build a cluster with two different appliances)

1. Build a cluster with the first 210 along with the old 525. That should copy the configuration to the new 210.

2. Remove the 525 and leave the first 210 as standalone.

3. Build the definitive cluster by adding the second 210.

I'm just afraid to "damage" the 525 which is in production as firewall of my company's network. What do you think?

Thanks again for your help. It's highly appreciated.

Luc.

It's not possible to have a 210 and a 525 in the same High Availability group, so that shortcut idea can't work.

You cannot have any network cables attached to the 210 when you upload the backup. It would probably be a good idea to connect a laptop at this point and confirm that you have the same order of NICs in your 210 as you do in the 525 - they're different enough that I'm a bit paranoid that you might not know which cable to plug in where.  At the command line:

more </etc/udev/rules.d/70-persistent-net.rules

Once you've done that and you have it powered up near the 525, power down the 525 and move the Ethernet cables to the 210.  Now you connect all of the Ethernet cables to the second 210, power it up and off it should go.

Cheers - Bob

It's not possible to have a 210 and a 525 in the same High Availability group, so that shortcut idea can't work.

You cannot have any network cables attached to the 210 when you upload the backup. It would probably be a good idea to connect a laptop at this point and confirm that you have the same order of NICs in your 210 as you do in the 525 - they're different enough that I'm a bit paranoid that you might not know which cable to plug in where.  At the command line:

more </etc/udev/rules.d/70-persistent-net.rules

Once you've done that and you have it powered up near the 525, power down the 525 and move the Ethernet cables to the 210.  Now you connect all of the Ethernet cables to the second 210, power it up and off it should go.

Cheers - Bob