MVP

Oct 09, 2023

Hi igssv,

You need to do this for platform migration , glad you are successful, you can refer this process for future migrations:

modify sys crypto master-key prompt-for-password

https://my.f5.com/manage/s/article/K82540512

==================================

K82540512: Overview of the UCS archive 'platform-migrate' option

Published Date: Oct 1, 2018Updated Date: Jul 12, 2023

Topic

F5 added the "platform-migrate" option to the tmsh load sys ucs command. This option enables you to migrate configurations from older platforms to newer platforms using an existing user configuration set (UCS) file. The new platform can be a newer generation hardware device, an F5OS tenant, a Virtual Clustered Multiprocessing (vCMP) guest, or BIG-IP Virtual Edition (VE).

Description

Starting In BIG-IP12.1.3 and 13.1.0, F5 introduces the platform-migrate option to better facilitate cross-platform configuration migrations. In previous versions, you can create a UCS on one platform type and install it on another using the no-platform-check option. However, the no-platform-check option installs the base configuration, so it may not be optimal when installing to different platforms.

You can enable the platform-migrate option using the following TMOS Shell (tmsh) command syntax:

tmsh load sys ucs <filename> platform-migrate

The platform-migrate option causes the UCS loader to ignore some platform dependent configuration objects when installing the UCS configuration. For example, when you install a UCS file using the platform-migrate option, configuration objects related to the following items may not be installed from the UCS file:

Interfaces
Interface bundles
Management IP and route
Assignments to trunks and VLANs
For example, a trunk is loaded on the new platform but interfaces, interface bundles, and VLANs assigned to it previously are not loaded.
Note: When you install a UCS file using the platform-migrate option, the system saves a list of any configuration objects that it ignores or does not install to the /var/local/ucs/platform_migrate_ignored_objects file.

Limitations

When using the platform-migrate option, consider the following limitations:
- The platform-migrate parameter does not work for migrating BIG-IP UCS files from BIG-IP 10.x. If you are migrating the BIG-IP system, you must start with a BIG-IP configuration from a BIG-IP 11.x installation.
- After you load the UCS using the platform-migrate parameter, you may need to perform extra steps to get the device fully functional.
  For example:
  - You may need to reassign your new interfaces to VLANs.
  - In a high-availability (HA) environment, you may need to synchronize the configuration (enter configsync).
  - You may need to rebuild your device group if your new device's management IP address is changing as part of the migration. You can specify the "keep-current-management-ip" option to the "load sys ucs" command to keep current Management IP when restore ucs archive. For more information, refer to K000132494: Overview of the UCS archive 'keep-current-management-ip' option.
  - If you use the platform-migrate parameter to bring up a new F5OS tenant or vCMP guest, you configure the VLANs from the host.
  - If the management IP address on the old platform used Dynamic Host Configuration Protocol (DHCP) relay, and you use the platform-migrate parameter, the management address of the new platform changes to use DHCP.
    Recommended Action
    
    Consider using the platform-migrate option if you are migrating from old or obsolete BIG-IP appliances to a newer platform family. F5 recommends that you use the platform-migrate option for:
    - BIG-IP Appliance-to-appliance migration
    - BIG-IP Appliance-to-vCMP guest migration
    - F5OS tenant-to-tenant migration
    - vCMP guest-to-guest migration
      Procedures
      
      To complete a platform migration using the platform-migrate option, perform the following procedures:
      - Saving UCS files on the device to be replaced
      - Loading UCS configurations on the new device
      - Resolving issues
        Saving UCS files on the device to be replacedImportant: If your configuration contains DNSSEC keys and you are running BIG-IP version prior to 16.0.0, do not use tmsh modify sys crypto master-key. Use the workaround provided in ID 639606.
        
        Log in to tmsh of the device you are replacing by entering the following command:
        tmsh
        
        Set the device master key and password by entering the following command (remember this password because you'll need to use the same password on the destination device):
        modify sys crypto master-key prompt-for-password
        
        Create the UCS file on the device to be replaced using the following command syntax:
        save sys ucs <file name>
        
        Copy the UCS file to an offline location.
        
        On the device to be replaced, force it offline by entering the following command:
        run sys failover offline
        
        This ensures that the system moves the traffic to the other device before shutting it down.
        
        Shut down the old device.
        Loading UCS configurations on the new device
        
        Important: Before you load the configuration on the new device, you must first license, provision, and manually configure the low-level configuration on the new system. Before installing the UCS configuration, use tmsh or the Configuration utility to configure the management IP address (unless you are using DHCP) and configure the interface settings required for your environment.
        
        To load the UCS configuration onto the new device, perform the following procedure:
        
        Copy the UCS file that you prepared on the old device, to the new device.
        You can do this using the Configuration utility by going to System > Archives > Upload or by manually uploading the configuration to the /var/local/ucs directory on the new device.
        
        Log in to tmsh by entering the following command:
        tmsh
        
        Set the master-key password on the new device by entering the following commands:
        modify sys crypto master-key prompt-for-password
        save sys config
        
        Important: If you configured the management IP address of the new device to use a static IP address, and the old device used DHCP, the management IP address may change when you load the UCS using the platform-migrate option. Make sure you have appropriate console access available that does not require that you use the management IP address.
        
        Load the UCS file from tmsh by entering the following command:
        load /sys ucs <filename> no-license platform-migrate
        
        If the platform-migrate command completes successfully, the system displays the following message:
        
        Platform migrate loaded successfully. Saving configuration.
        
        Confirm that the system is in the running state by entering the following command:
        show sys mcp
        
        The system displays the following message:
        
        ---------------------------------------------------------
        Sys::mcpd State:
        ---------------------------------------------------------
        Running Phase running
        Last Configuration Load Status full-config-load-succeeded
        
        Confirm the new device joined the trust group and is in Standby mode. If your management IP address changes, you must reconfigure the Failover Unicast address so that it matches the management IP address.
        
        Bring the new device back online in the HA configuration by entering the following command:
        run sys failover online
        
        Resolving issues
        
        While installing a UCS with the platform-migrate option greatly reduces the time it takes to migrate from an old or obsolete platform to a new one, installing a UCS with the platform-migrate option does not guarantee that the configuration will successfully load on the new system. You may encounter errors if you do not create the low-level configuration in advance. If you encounter an error, review the error message, make the appropriate changes, and then run the command again.
        
        Warning: The system is not in a running state after it produces an error, and the system will not save the configuration changes.
        
        If the platform-migrate command fails, Master Control Program (MCP) is placed in a non-running state; enter the following command to check the MCP state:
        
        tmsh show sys mcp
        
        This command indicates that the running phase is called platform and the load status is high-config-load-failed.
        
        Example output:
        
        [root@bigip1:Active:Standalone] shared # tmsh show sys mcp
        ---------------------------------------------------------
        Sys::mcpd State:
        ---------------------------------------------------------
        Running Phase platform
        Last Configuration Load Status high-config-load-failed
        
        Therefore, the command tmsh save sys config fails to save the configuration and generates an error message. As you add the required low-level configuration objects, note that until the platform-migrate command succeeds, you can change the configuration, but you cannot save it.
        
        Related Content
        
        K14906: Overview of the UCS no-platform-check tmsh option
        
        K4423: Overview of UCS archives
        
        K15496: Migrating new BIG-IP platforms to an existing device group
        
        K13408: Overview of single configuration files (11.x - 14.x)
        
        K9420: Installing UCS files containing encrypted passwords or passphrases (11.5.x and later)
        
        Welcome to the F5 BIG-IP Migration Assistant on DevCentral
        
        K000132494: Overview of the UCS archive 'keep-current-management-ip' option
        
        Please mark it as solution in case if you feel your query has been responded and saved your time and giving pointers toward resolving your issue, as it will help other to use your query scenario to solve their similar issue.
        
        HTH
        
        F5 Design Engineer
        
        🙏

Forum Discussion

UCS Import Errors on BIG-IP VE (12.1.5.2) from i2800 – Need Assistance

K82540512: Overview of the UCS archive 'platform-migrate' option

Related Content

Recent Discussions

self-directed requests fail because of no certificate

Decode ObjectSID from Base64-encode string

iRule - Url rewrite and header replace and pool selection not working

ip x-forwarding

F5 ASM API-Protection Policy

Related Content

Re: Welcome to the F5 BIG-IP Migration Assistant

iRule to assist with CVE-2022-22965 mitigation

Security for IoT Devices and Why It’s Important

import f5!

iRule interpretation assistance

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS