9.5 Migrating to Newer Operating Systems

9.5.1 Migrating Administration Consoles from SLES 10 to SLES 11

The following procedure can be used to migrate a stand-alone Administration Console or an Administration Console installed either with the Identity Server or the SSL VPN server, or both of them:

  1. Make a note of the DNS name and the IP address of the primary Administration Console.

  2. Back up your 3.1.2 configuration.

    For instructions, see Backing Up the Access Manager Configuration in the Novell Access Manager 3.1 SP2 Administration Console Guide.

  3. Move the backup configuration file to a different machine.

    If you are going to re-install on the same machine, all data of the machine is lost. If you install on new hardware, the old machine must be removed from the network.

  4. (Conditional) If an Identity Server is installed on the same machine as the Administration Console:

    1. If the Identity Server is behind L4 Switch, then disable the Identity Server in the L4 switch configuration.

    2. Remove the Identity Server from the cluster configuration.

    3. Back up any customized files on the Identity Server.

  5. (Conditional) If you are planning to install the primary Administration Console on new hardware, down the existing primary Administration Console and remove it from the network.

  6. Perform a fresh install of SLES 11.

  7. Make sure the following packages are installed:

    • gettext: The required library and tools to create and maintain message catalogs.

    • python (interpreter): The basic Python object-oriented programming package.

    • compat: Libraries to address compatibility issues. On SLES 11, the compat-32bit package is available in the SLES11-Extras repository. For information on enabling this repository, see TID 7004701.

    Use YaST to install the packages.

    Use the following command to verify:

    rpm -qa | grep <package name>

  8. Copy the backup configuration file to the machine.

  9. Copy the SP2 installation file to the machine.

  10. Remove this machine from the network.

    NOTE:This step is required to avoid any traffic from the remote devices to this Administration Console in the current state. This also avoids any conflict between the eDirectory tree names of the primary and secondary Administration Console.

  11. Install the 3.1.2 version of the Administration Console.

    Use the same IP address and DNS name. For instructions, see Installing the Access Manager Administration Console.

  12. Restore your configuration.

    For instructions, see Restoring an Administration Console Configuration in the Novell Access Manager 3.1 SP2 Administration Console Guide.

  13. Open iMonitor on the primary Administration Console:

    1. Enter the following URL:

      https://<ip-address>:8030/nds

      Replace <ip-address> with the IP address of your Administration Console.

    2. Disable the outbound and inbound synchronization in the primary Administration Console eDirectory.

      For more information, see “Enabling/Disabling Normal Synchronization” in the eDirectory documentation.

  14. Connect this machine to the network so that the primary Administration Console is visible to all the devices.

  15. (Conditional) If an Identity Server was installed on the same machine as the Administration Console:

    1. Install the 3.1.2 version of the Identity Server.

    2. Restore any customized files to the Identity Server.

    3. Add the Identity Server to the cluster configuration.

    4. If the Identity Server is behind L4 Switch, then enable the Identity Server in the L4 switch configuration.

  16. (Conditional) If an SSL VPN server was installed on the same machine as the Administration Console, install the 3.1.2 version of the SSL VPN server.

  17. Down any secondary consoles.

  18. Re-enable eDirectory synchronization on the primary Administration Console:

    1. Enter the following URL:

      https://<ip-address>:8030/nds

      Replace <ip-address> with the IP address of your primary Administration Console.

    2. Enable the outbound and inbound synchronization.

      For more information, see “Enabling/Disabling Normal Synchronization” in the eDirectory documentation.

  19. Remove any secondary consoles from the configuration:

    1. In the Administration Console, click Auditing > Troubleshooting.

    2. In the Other Known Device Manager Servers section, use the Remove button to remove any secondary consoles.

  20. Uninstall the secondary consoles. For instructions, see Section 10.4, Uninstalling the Administration Console.

  21. Reinstall the secondary consoles as secondary consoles to the new primary console.

    Install SLES 11, then install the SP2 version of the Administration Console.

9.5.2 Migrating Administration Consoles with or without Identity Servers from Windows 2003 to Windows 2008

  1. Back up your 3.1.2 configuration.

    For instructions, see Backing Up the Access Manager Configuration in the Novell Access Manager 3.1 SP2 Administration Console Guide.

  2. (Conditional) Back up any customized files on the Identity Server.

  3. (Conditional) If the Identity Server is behind L4 Switch, then disable the Identity Server in the L4 switch configuration.

  4. (Conditional) Remove the Identity Server from the cluster configuration.

  5. Perform a fresh install of Windows 2008.

  6. If you have secondary consoles, down them.

  7. Install the 3.1.2 version of the Administration Console.

    Use the same IP address and DNS name.

  8. Restore your configuration.

    For instructions, see Restoring an Administration Console Configuration in the Novell Access Manager 3.1 SP2 Administration Console Guide.

  9. Modify keystore locations in the server.xml file:

    1. Log in to the Administration Console machine as the administrator.

    2. Open the server.xml file.

      \Program Files (x86)\Novell\Tomcat\conf\server.xml

    3. Search for devman.keystore.

    4. Change the path from

      \Program Files\Novell\Tomcat\webapps\roma\WEB-INF\conf\devman.keystore

      to

      \Program Files (x86)\Novell\Tomcat\webapps\roma\WEB-INF\conf\
devman.keystore

    5. Search for tomcat.keystore.

    6. Change the path from

      C:\Program Files\Novell\Tomcat\webapps\roma\WEB-INF\conf\tomcat.keystore

      to

      C:\Program Files (x86)\Novell\Tomcat\webapps\roma\WEB-INF\conf\tomcat.keystore

    7. Save the file.

    8. Restart Tomcat.

      net stop Tomcat5

      net start Tomcat5

  10. (Conditional) Install the 3.1.2 version of the Identity Server.

  11. (Conditional) Restore any customized files to the Identity Server.

  12. (Conditional) Add the Identity Server to the cluster configuration.

  13. (Conditional) If the Identity Server is behind L4 Switch, then enable the Identity Server in the L4 switch configuration.

  14. Remove any secondary consoles from the configuration:

    1. In the Administration Console, click Auditing > Troubleshooting.

    2. In the Other Known Device Manager Servers section, use the Remove button to remove any secondary consoles.

  15. Uninstall the secondary consoles. For instructions, see Section 10.4, Uninstalling the Administration Console.

  16. Reinstall the secondary consoles as secondary consoles to the new primary console.

9.5.3 Migrating Identity Servers from SLES 10 to SLES 11

The following procedure can be used to migrate a stand-alone Identity Server, or the Identity Server installed with the SSL VPN server:

  1. (Conditional) If the Identity Server is behind L4 Switch, then disable the Identity Server in the L4 switch configuration.

  2. Remove the Identity Server from the cluster configuration.

  3. Back up any customized files.

  4. Perform a fresh install of SLES 11.

  5. Make sure the following packages are installed:

    • gettext: The required library and tools to create and maintain message catalogs.

    • python (interpreter): The basic Python object-oriented programming package.

    • compat: Libraries to address compatibility issues. On SLES 11, the compat-32bit package is available in the SLES11-Extras repository. For information on enabling this repository, see TID 7004701.

    Use YaST to install the packages.

    Use the following command to verify:

    rpm -qa | grep <package name>

  6. Install the 3.1.2 version of the Identity Server.

    Use the same IP address and DNS name for the Identity Server.

  7. Restore any customized files.

  8. Add the Identity Server to the cluster configuration.

  9. (Conditional) If the Identity Server is behind L4 Switch, then enable the Identity Server in the L4 switch configuration.

9.5.4 Migrating Stand-Alone Identity Servers from Windows 2003 to Windows 2008

  1. (Conditional) If the Identity Server is behind L4 Switch, then disable the Identity Server in the L4 switch configuration.

  2. Remove the Identity Server from the cluster configuration.

  3. Back up any customized files.

  4. Perform a fresh install of Windows 2008.

  5. Install the 3.1 SP2 version of the Identity Server.

    Use the same IP address and DNS name for the Identity Server.

  6. Restore any customized files.

  7. Add the Identity Server to the cluster configuration.

  8. (Conditional) If the Identity Server is behind L4 Switch, then enable the Identity Server in the L4 switch configuration.

9.5.5 Migrating to the SLES 11 Access Gateway Appliance

Use the following procedure to migrate the SLES 9 version of the 3.1 SP2 Access Gateway Appliance and SSL VPN server installed along with the Access Gateway Appliance to SLES 11. If you have not upgraded the Access Gateway Appliance to SP2 or later, complete this upgrade task before migrating to SLES 11.

  1. Log in to the Access Gateway as root.

  2. Back up the customized files:

    1. Change to the /chroot/lag/opt/novell/bin directory.

    2. Enter the following command to back up the customized files:

      sh lag-backup-restore.sh

    3. Select Option [1].

      The script creates two files in the current directory:

      lagRestore.tar.gz: This file contains touch files, custom error pages, a pre-apply script, and a post-apply script.

      lagNoRestore.tar.gz: The file contains the config.xml file, backup error pages, and the server.xml file. (This file is not restored but created for debugging in case of failure.)

    4. Select Option [3] to exit.

  3. Copy the tar files to another physical location.

  4. (Conditional) If the Access Gateway is behind L4 Switch, then disable the Access Gateway in the L4 switch configuration.

  5. Install the 3.1 SP2 or later version of the SLES 11 Access Gateway Appliance.

    If you have installed the SSL VPN server along with the Access Gateway Appliance, make sure that you select the option to install the SSL VPN server.

    Use the same IP address and DNS name.

    For more information, see Section 6.0, Installing the Linux Access Gateway Appliance.

  6. Restore your custom configuration files:

    1. Log in to the Access Gateway as root.

    2. Copy the lagRestore.tar.gz file to the /chroot/lag/opt/novell/bin directory.

    3. Change to the /chroot/lag/opt/novell/bin directory.

    4. Enter the following command to restore the customized files:

      sh lag-backup-restore.sh

    5. Select Option [2].

      This restores the custom files.

    6. Select Option [3] to exit.

  7. Restart the Access Gateway:

    /etc/init.d/novell-vmc start

  8. (Conditional) If the Access Gateway is behind L4 Switch, then enable the Access Gateway in the L4 switch configuration.

  9. To complete the migration, you must update the Access Gateway configuration on all the Gateways in the cluster. Make a change to the Access Gateway configuration. You can either select Update All to update the configuration on all the Linux Access Gateways or update the Gateways one by one. Selecting Update All can cause a temporary disruption in service.

  10. (Conditional) If the health status of the newly migrated Access Gateway stays red and the Health page on the Administration Console displays a keystore error, you need to run the keystore cleanup script. For more information, see Section A.7.1, After You Migrate from SLES 9 to SLES 11, the Health Status Indicates That the Embedded Service Provider Cannot Find the Keystores.

9.5.6 Migrating the SSL VPN Server to SLES 11

If the SSL VPN server was installed along with the Administration Console, Identity Server, or the Linux Access Gateway Appliance, the SSL VPN server is automatically migrated to SLES 11, along with the other components. For more information, see the relevant migration sections:

The following sections explain how to migrate the stand-alone SSL VPN server to SLES 11:

Migrating SSL VPN 3.0.4 Installed on SLES 9 to SSL VPN 3.1 SP2 on SLES 11

  1. Log in as root.

  2. Make a backup of the configuration and copy it to another location.

  3. Shut down the SLES 9 machine.

  4. Perform a fresh install of SLES 11.

    Use the same IP address and DNS name for the SSL VPN server.

  5. Download the compat-openssl097g-0.9.7g-13.2.i586 RPMs from Novell Web site

  6. Specify the following command to install the RPM:

    rpm -- compat-openssl097g-0.9.7g-13.2.i586

  7. Install SSL VPN 3.0.4.

  8. Restart the SSL VPN server by using the following commands:

    sslvpn -down

    sslvpn -up

  9. Upgrade to SSL VPN 3.1.2.

  10. Restart the SSL VPN server.

Migrating Stand-Alone SSL VPN Servers from SLES 10 to SLES 11

  1. Remove the SSL VPN server from the cluster configuration, if the server is part of a cluster.

  2. Make a backup of the configuration

    NOTE:If you have customized the SSL VPN user interface, make a backup of all the files in the jsp/html folder. For more information on customizing the SSL VPN user interface, see Customizing the SSL VPN User Interface in the Novell Access Manager 3.1 SP2 SSL VPN Server Guide.

  3. Stop the SLES 10 machine.

  4. Perform a fresh install of SLES 11.

  5. Install the 3.1.2 version of the SSL VPN Server.

    Use the same IP address and DNS name for the SSL VPN Server.

  6. Restore the configuration.

  7. Add the SSL VPN Server to the L4 switch configuration.