8.3 Migrating to Newer Operating Systems

8.3.1 Migrating Administration Consoles from SLES 10 to SLES 11

The following procedure can be used to migrate a stand-alone Administration Console or an Administration Console installed either with the Identity Server or the SSL VPN server, or both of them:

  1. Make a note of the DNS name and the IP address of the primary Administration Console.

  2. Back up your 3.1.5 configuration.

    For instructions, see Backing Up the Access Manager Configuration in the Novell Access Manager 3.1 SP5 Administration Console Guide.

  3. Move the backup configuration file to a different machine.

    If you are going to re-install on the same machine, all data of the machine is lost. If you install on new hardware, the old machine must be removed from the network.

  4. (Conditional) If an Identity Server is installed on the same machine as the Administration Console:

    1. Remove the Identity Server from the L4 switch configuration.

    2. Back up any customized files on the Identity Server.

  5. (Conditional) If you are planning to install the primary Administration Console on new hardware, bring down the existing primary Administration Console and remove it from the network.

  6. Perform a fresh install of SLES 11.

  7. Make sure the following packages are installed:

    • gettext: The required library and tools to create and maintain message catalogs.

    • python (interpreter): The basic Python object-oriented programming package.

    • compat: Libraries to address compatibility issues. On SLES 11, the compat-32bit package is available in the SLES11-Extras repository. For information on enabling this repository, see TID 7004701.

    Use YaST to install the packages.

    Use the following command to verify:

    rpm -qa | grep <package name>

  8. Copy the backup configuration file to the machine.

  9. Copy the SP5 installation file to the machine.

  10. Remove this machine from the network.

    NOTE:This step is required to avoid any traffic from the remote devices to this Administration Console in the current state. This also avoids any conflict between the eDirectory tree names of the primary and secondary Administration Console.

  11. Install the 3.1.5 version of the Administration Console.

    Use the same IP address and DNS name. For instructions, see Installing the Access Manager Administration Console.

  12. Restore your configuration.

    For instructions, see Restoring an Administration Console Configuration in the Novell Access Manager 3.1 SP5 Administration Console Guide.

  13. Open iMonitor on the primary Administration Console:

    1. Enter the following URL:

      https://<ip-address>:8030/nds

      Replace <ip-address> with the IP address of your Administration Console.

    2. Disable the outbound and inbound synchronization in the primary Administration Console eDirectory.

      For more information, see “Enabling/Disabling Normal Synchronization” in the eDirectory documentation.

  14. Connect this machine to the network so that the primary Administration Console is visible to all the devices.

  15. (Conditional) If an Identity Server was installed on the same machine as the Administration Console:

    1. Remove the Identity Server from the cluster configuration.

    2. Delete the Identity Server from the Administration Console.

    3. Install the 3.1.5 version of the Identity Server.

    4. Restore any customized files to the Identity Server.

    5. Add the Identity Server to the cluster configuration.

    6. Add the Identity Server to the L4 switch configuration.

  16. (Conditional) If an SSL VPN server was installed on the same machine as the Administration Console, install the 3.1.5 version of the SSL VPN server.

  17. Bring down any secondary consoles.

  18. Re-enable eDirectory synchronization on the primary Administration Console:

    1. Enter the following URL:

      https://<ip-address>:8030/nds

      Replace <ip-address> with the IP address of your primary Administration Console.

    2. Enable the outbound and inbound synchronization.

      For more information, see “Enabling/Disabling Normal Synchronization” in the eDirectory documentation.

  19. Remove any secondary consoles from the configuration:

    1. In the Administration Console, click Auditing > Troubleshooting.

    2. In the Other Known Device Manager Servers section, use the Remove button to remove any secondary consoles.

  20. Uninstall the secondary consoles. For instructions, see Section 9.4, Uninstalling the Administration Console.

  21. Reinstall the secondary consoles as secondary consoles to the new primary console.

    Install SLES 11, then install the SP5 version of the Administration Console.

8.3.2 Migrating Administration Consoles with or without Identity Servers from Windows 2003 to Windows 2008

  1. Back up your 3.1.5 configuration.

    For instructions, see Backing Up the Access Manager Configuration in the Novell Access Manager 3.1 SP5 Administration Console Guide.

  2. (Conditional) Back up any customized files on the Identity Server.

  3. (Conditional) Remove the Identity Server from the L4 switch configuration.

  4. (Conditional) Remove the Identity Server from the cluster configuration.

  5. Perform a fresh install of Windows 2008.

  6. If you have secondary consoles, bring them down.

  7. Install the 3.1.5 version of the Administration Console.

    Use the same IP address and DNS name.

  8. Restore your configuration.

    For instructions, see Restoring an Administration Console Configuration in the Novell Access Manager 3.1 SP5 Administration Console Guide.

  9. Modify keystore locations in the server.xml file:

    1. Log in to the Administration Console machine as the administrator.

    2. Open the server.xml file.

      \Program Files (x86)\Novell\Tomcat\conf\server.xml

    3. Search for devman.keystore.

    4. Change the path from

      \Program Files\Novell\Tomcat\webapps\roma\WEB-INF\conf\devman.keystore

      to

      \Program Files (x86)\Novell\Tomcat\webapps\roma\WEB-INF\conf\
devman.keystore

    5. Search for tomcat.keystore.

    6. Change the path from

      C:\Program Files\Novell\Tomcat\webapps\roma\WEB-INF\conf\tomcat.keystore

      to

      C:\Program Files (x86)\Novell\Tomcat\webapps\roma\WEB-INF\conf\tomcat.keystore

    7. Save the file.

    8. Restart Tomcat.

      net stop Tomcat5

      net start Tomcat5

  10. (Conditional) Install the 3.1.5 version of the Identity Server.

  11. (Conditional) Restore any customized files to the Identity Server.

  12. (Conditional) Add the Identity Server to the cluster configuration.

  13. (Conditional) Add the Identity Server to the L4 switch configuration.

  14. Remove any secondary consoles from the configuration:

    1. In the Administration Console, click Auditing > Troubleshooting.

    2. In the Other Known Device Manager Servers section, use the Remove button to remove any secondary consoles.

  15. Uninstall the secondary consoles. For instructions, see Section 9.4, Uninstalling the Administration Console.

  16. Reinstall the secondary consoles as secondary consoles to the new primary console.

8.3.3 Migrating Identity Servers from SLES 10 to SLES 11

The following procedure can be used to migrate a stand-alone Identity Server, or the Identity Server installed with the SSL VPN server:

  1. Remove the Identity Server from the L4 switch configuration.

  2. Remove the Identity Server from the cluster configuration.

  3. Back up any customized files.

  4. Perform a fresh install of SLES 11.

  5. Make sure the following packages are installed:

    • gettext: The required library and tools to create and maintain message catalogs.

    • python (interpreter): The basic Python object-oriented programming package.

    • compat: Libraries to address compatibility issues. On SLES 11, the compat-32bit package is available in the SLES11-Extras repository. For information on enabling this repository, see TID 7004701.

    Use YaST to install the packages.

    Use the following command to verify:

    rpm -qa | grep <package name>

  6. Install the 3.1.5 version of the Identity Server.

    Use the same IP address and DNS name for the Identity Server.

    After the installation it might take 15 - 20 minutes for the health status of Identity Server to turn green.This time is utilized for importing and registering certificates from Administration Console.

    IMPORTANT:Do NOT restart any device or service until the health status of Identity Server turns green.

  7. Once the Identity Server's health turns green, restart Tomcat, else NIDP page might not be accessible

  8. Restore any customized files.

  9. Add the Identity Server to the cluster configuration.

  10. Add the Identity Server to the L4 switch configuration.

8.3.4 Migrating Stand-Alone Identity Servers from Windows 2003 to Windows 2008

  1. Remove the Identity Server from the L4 switch configuration.

  2. Remove the Identity Server from the cluster configuration.

  3. Back up any customized files.

  4. Perform a fresh install of Windows 2008.

  5. Install the 3.1 SP5 version of the Identity Server.

    Use the same IP address and DNS name for the Identity Server.

  6. Restore any customized files.

  7. Add the Identity Server to the cluster configuration.

  8. Add the Identity Server to the L4 switch configuration.

8.3.5 Migrating the SSL VPN Server to SLES 11

If the SSL VPN server was installed along with the Administration Console, Identity Server, or the Linux Access Gateway Appliance, the SSL VPN server is automatically migrated to SLES 11, along with the other components. For more information, see the relevant migration sections:

The following sections explain how to migrate the stand-alone SSL VPN server to SLES 11:

Migrating Stand-Alone SSL VPN Servers from SLES 10 to SLES 11

  1. Remove the SSL VPN server from the cluster configuration, if the server is part of a cluster.

  2. (Conditional) If you have customized the SSL VPN user interface, back up all the files in the jsp/html folder.

    For more information on customizing the SSL VPN user interface, see Customizing the SSL VPN User Interface in the NetIQ Access Manager 3.1 SP5 SSL VPN Server Guide.

  3. Stop the SLES 10 machine.

  4. Perform a fresh install of SLES 11.

  5. Install the 3.1.5 version of the SSL VPN Server.

    Use the same IP address and DNS name for the SSL VPN Server.

  6. (Conditional) Restore the configuration if you have backed it up in step 2.

  7. Add the SSL VPN Server to the L4 switch configuration.