Prerequisites for Migration

software isa hardware or virtual appliance should be available and online prior to starting the migration deployment this is a server to server migration and cannot be performed in place on the same hardware licenses isa appliances require new licenses procure the new licenses and keep them handy isa hardware would not require any additional core/cpu licenses settings identify the network settings for each of the configured ports for the target isa gateway configuration backup it is preferred to back up the system cfg and user cfg binary files, along with xml export of entire configuration immediately prior to migration for more information, see exporting configurations docid 3h70kfw0h ak4w2cyky64 upgrade it is recommended to upgrade your existing 22 8r2 isa appliance to 25 1 0 0 or later and import backup configure to isa appliance only, if required configuration documentation local settings that are mostly kept in system cfg should be documented, as some of these may need to be manually re entered to the isa device note down the following settings before migration ip pool filters cluster configuration virtual port configuration and certificates mapping snmp configuration log settings, syslog can be configured in either cluster mode or individual nodes deprecated features are not supported in 25 1 0 0 please refer to deprecated features docid 3yx6yc99wwhbu1ahdm0wc for the list of deprecated features connect secure only in an active/active cluster, attention should be given to the network > vpn tunneling > ip address filter and vpn tunneling profile ip pool settings this is particularly important as the assumption of this guide is that both the existing and target deployment will be active at the same time if the ip pools overlap, this may cause impact to production users if testing is done on the target deployment during production time specifically, the same ip may be leased to two independent users which will cause addressing clashes some settings such as snmp, log settings, and the syslog configuration can be set in either cluster mode or individual nodes configuration migration path the following table describes the tested migration paths migrate to isa hardware device migrate from (supported versions) va migrate from (supported versions) connect secure 25 1 3 1 25 1 3 0 , 25 1 2 2, 25 1 1 1, 22 7r2 14 25 1 3 0 , 25 1 2 2, 25 1 1 1, 22 7r2 14 25 1 3 0 25 1 2 2, 25 1 2 1, 25 1 2 0, 25 1 1 1, 25 1 1 0, 22 8r2 4, 22 7r2 14 25 1 2 2, 25 1 2 1, 25 1 2 0, 25 1 1 1, 25 1 1 0, 22 8r2 4, 22 7r2 14 25 1 2 2 25 1 2 1, 25 1 1 1, 25 1 0 1, 25 1 1 0, 22 8r2 4, 22 8r2 3, 22 7r2 13, 22 7r2 12 na 25 1 2 1 25 1 0 1, 25 1 1 0, 22 8r2 3, 22 7r2 12 na 25 1 2 0 25 1 1 0, 22 8r2 3, 22 7r2 12 na 25 1 1 1 25 1 1 0, 22 8r2 3 25 1 1 0, 22 8r2 3 25 1 1 0 25 1 0 1, 25 1 0 0, 22 8r2 3, 22 8r2 2, 22 8r2 1, 22 7r2 12, 22 7r2 11 25 1 0 1, 25 1 0 0, 22 8r2 3, 22 8r2 2, 22 8r2 1, 22 7r2 12, 22 7r2 11 25 1 0 1 25 1 0 0, 22 8r2 and 22 7r2 8 25 1 0 0, 22 8r2 and 22 7r2 8 25 1 0 0 22 8r2, 22 7r2 8, and 22 7r2 7 22 8r2, 22 7r2 8, and 22 7r2 7 upgrade the servers to the nearest matching version per the table to proceed with migration if the exact versions are not listed deprecated features to improve stability and overall security posture in new ics, ivanti has decided to deprecate old set of features for ivanti connect secure features and options becoming unsupported or deprecated in 22 7rx, 22 8rx, and 25 x, refer to article https //forums ivanti com/s/article/ivanti connect secure features and options becoming unsupported or deprecated in 22 7rx 22 8rx and 25 x configs with deprecated features will be upgraded or imported to 25 x but will not be qualified please refer the kb https //forums ivanti com/s/article/how to the complete upgrade guide for more details refer to prerequisites for migration docid 3yx6yc99wwhbu1ahdm0wc and supported configuration migration path docid 3yx6yc99wwhbu1ahdm0wc before starting the migration post migration activities after performing the migration steps, it is recommended that the following settings be checked and validated manually system > network > overview settings (set in cluster or individual nodes) system > network > routes (for internal, external and other ports) system > network > hosts (set in cluster or individual nodes) system > network > internal port/ external port>virtual ports (if clustered, set this up in cluster “entire cluster”) system > network > vlans (if clustered, set this up in cluster “entire cluster”) ics only system > network > vpn tunneling (set in cluster or individual nodes) system > log/monitoring > snmp (set in cluster or individual nodes) system > configuration > certificates > device certificates (and its ports bindings) ics only users > resource policies > vpn tunneling > connection profiles (if configured) system > configuration > licensing license client server settings (if used as license client in enterprise licensing server environment), proper licenses installed