Sangfor Cross

Version
Migrate&Upgrade

Product HCI
Document Version 1.0

Released on Jan. 02, 2024

Version 01 (Mar.24, 2021) Confidentiality: Public in Company 1

Copyright © Sangfor Technologies Inc. 2023. All rights reserved.
Unless otherwise stated or authorized, Sangfor Technologies Inc. (hereinafter referred to as
"Sangfor") and its affiliates reserve all intellectual property rights, including but not
limited to copyrights, trademarks, patents, and trade secrets, and related rights to text,
images, pictures, photographs, audio, videos, charts, colors, and layouts as presented in or
concerning this document and content therein. Without prior written consent of Sangfor,
this document and content therein must not be reproduced, forwarded, adapted, modified
or displayed or distributed by any other means for any purpose.

Disclaimer

Products, services or features described in this document, whether wholly or in part, may
be not within your purchase scope or usage scope. The products, services or features you
purchase must be subject to the commercial contract and terms as agreed by you and
Sangfor. Unless otherwise provided in the contract, Sangfor disclaims warranties of any
kind, either express or implied, for the content of this document.
Due to product version upgrades or other reasons, the content of this document will be
updated from time to time. Unless otherwise agreed, this document is used for reference
only, and all statements, information, and recommendations therein do not constitute any
express or implied warranties.
Technical Support
For technical support, please visit: https://www.sangfor.com/en/about-
us/contact-us/technical-support
Send information about errors or any product related problem to [email protected].

1
About This Document
For HCI low version can’t active upgrade to HCI 6.7.0 and higher version,this
document provide one method make HCI can upgrade to the higher version but no
impact the business.

Intended Audience
This document is intended for For internal use only

Note Icons
English Icon Description

Indicates an imminently hazardous situation which, if not avoided,

will result in death or serious injury.

Indicates a potentially hazardous situation which, if not avoided,

could result in death or serious injury.

Indicates a hazardous situation, which if not avoided, could result in

minor or moderate injury.

Indicates a hazardous situation, which if not avoided, could result in

settings failing to take effect, equipment damage, or data loss.
NOTICE addresses practices not related to personal injury.

Calls attention to important information, best practices, and tips.

NOTE addresses information not related to personal injury or equipment
damage.

Change Log
Date Change Description

Jun. 01, 2023 This is the first release of this document.

2
 Contents
Technical Support.......................................................................................................................1
Change Log......................................................................................................................................2
1 Pre-check.......................................................................................................................................4
2 Overview.................................................................................................................................4
3 Important Steps................................................................................................................ 4
3.1 Step 1 prepare a transmit cluster...................................................................................4
3.2 Setp 2 upgrade lower version to HCI 6.3.0R1 and install the newest collection patch
5
3.3 step 3 migrate SCP from 6.3.0R1 to transit cluster................................................5
3.4 step 4 upgrade SCP to 6.9.0..........................................................................................5
3.4.1 How SCP turn VKEY to U-KEY License..............................................................5
3.5 Setp 5 SCP manage transit cluster and allocate quotas................................................8
3.6 Setp 6 Migrate VM to transit cluster.....................................................................9
3.7 Step 7 Upgrade original cluster to 6.9.0.....................................................................10
3.8 Step 8 Migrate VM from transit cluster to back to original cluster.....................10

3
1 Pre-check
The prerequisite requirements for this program are as follows:
1. need prepare a transit cluster
2. HCI can be managed by SCP but the vpc network is not deployed
3. If the SCP use vkey license should turn it to U-key license (for V-key license if SCP
version higher than 6.8.0 it can’t license to HCI which version lower than 6.8.0)
4. If HCI or SCP has installed patch before please make sure it can upgrade

2 Overview
HCI 6.3.0R1_EN and 6.3.0R2_EN can cross cluster migrate VM to 6.9.0.so we can use this
new feature achieve active upgrade.the steps are as follows:
1. prepare a transmit cluster (HCI version 6.9.0)
2. upgrade low version to HCI 6.3.0R1 and install the newest collection patch
3. Migrate SCP from 6.3.0R1 to transit cluster(if the SCP is not running on the HCI
cluster need upgrade can choice migrate it or not)
4. upgrade SCP to 6.9.0 (turn it to U-key license if SCP use vkey license) and get new
license (enough for original and transit cluster)
5. SCP manage transit cluster and allocate quotas
6. Migrate VM by SCP from 6.3.0R1 to transit cluster
7. Upgrade HCI 6.3.0R1 to 6.9.0
8. Migrate VM by SCP from transit cluster to original cluster (if no need original
cluster any more can keep the VM in the transit cluster and turn it to business
cluster)
For the impact please refer to the detail step

3 Detail Steps
3.1 Step 1 prepare a transmit cluster
Before the migrate and upgrade it’s need to prepare a transit cluster.the transit cluster
physical resource should not lower than the original cluster.

4
CPU: can lower than the original cluster but If the difference is too much The VM will
become slowly
Memoery: should not be lower than the total memory of the VM that have been
powered on and need be power on plus the memory HCI node itself need (about 64 G
per node) and at least one node that is not lower than the highest configuration in the
original cluster in the transit cluster.
Storage: should not be lower than original cluster the storage has been used (after all
VM migrated the transit cluster useage should be lower than 80%)
Network: make sure the management network of original cluster and transit cluster can
connect with each other;make sure after VM migrated the VM can provide business
access success by the edge network

3.2 Setp 2 upgrade lower version to HCI

6.3.0R1 and install the newest collection
patch
If the HCI version is not 6.3.0R1 or 6.3.0R2and not install the newest collection patch
can’t migrate VM to 6.9.0 or higher version
download link for 6.3.0R1 collection patch
download link for 6.3.0R2 collection patch

3.3 step 3 migrate SCP from 6.3.0R1 to

transit cluster
in most Scenes SCP always managed 2 or more HCI if the SCP running on the cluster no
need to upgrade you can choice migrate it to transit cluster or not

3.4 step 4 upgrade SCP to 6.9.0

Because the versions of SCP and HCI need to match,when HCI upgrade SCP also needs
to upgrade. SCP upgrade please refer to the SCP upgrade guide.befor SCP upgrade
please take a snapshot

3.4.1 How SCP turn VKEY to U-KEY License

If SCP use VKEY license and it’s version is 6.8.0 or higher than 6.8.0 SCP can’t

5
license to HCI which version is lower than 6.8.0,but if SCP use U-key license that will not
be a problem.there follow is the detail steps how SCP turn VKEY license to U-key license
First and important you need get a U-key and insert it to the HCI cluster where the
SCP will running on(the U-key can use test key).
1. SCP revoke all cluster all license

2. take a snapshot of SCP

notice: this is very very important if not do this it’s forbid to do the next steps
3. login the SCP backend check the current license status
acmp_sn_tool -s hci_x86 | jq .
if the result shows like the below The key value displayed as "VIRTUAL-KEY",
indicating that it is vkey license.

4. Move the vkey tag file to the /sf/data/local directory and keep it
cd /sf/cfg/license/etc/

mv sf_license.lic VKEY-FLAG /sf/data/local/

6
5. Check the license status
The license page becomes about to expire. Query
license status again in the backend acmp_sn_tool -s
hci_x86 | jq .

At this time, the key vaule is an empty string, because is still vkey license, and the

vkey mark files has been removed.

6. Delete all original vkey license records Use
the follow command login the databae
cr=$(crudini --get /sf/cfg/envpasswd.conf mysql platform_manage);pwd=$(python
/sf/bin/encryption_tool.py --is_encrypt false --text "${cr}");mysqlx="mysql -uroot
- p${pwd}";

Execute the following command line directly (copy multiple lines directly, do not
copy separate lines), execute directly
systemctl stop authorize_server.service authorize_client.service vtsn.service;

$mysqlx fuel

update sysfiles set content='' where file != "auth_cluster_id";

exit;

systemctl start authorize_server.service authorize_client.service vtsn.service;

7
 At this time, go to the SCP page and you can see that all license have been removed.
mapp the U-key to the SCP in the HCI but after that you can’t get the keyid in the web
page you need login to the SCP backend excute acmp_sn_tool -s hci_x86 | jq . to
get the keyid(the key value is the keyid)

Then use the keyid get the license after you get license click Update License Key
and in the pop-up window import the license key file (ignore the pop-up window is
a vkey license page just import the license )

3.5 Setp 5 SCP manage transit cluster

and allocate quotas
The transit cluster need managed by SCP. If there have tenant associated with

8
the original cluster the quotas allocate to tenant of the transit cluster should not less than
original cluster allocated and configrate the same network for tenant

3.6 Setp 6 Migrate VM to transit cluster

If HCI managed by SCP VM must be migrate by SCP and had better migrate a test VM first
to test the everything is well
The migrage operation need to login SCP and select migrate

in some scenarios VM can’t be active migrated or can’t be migrate. The scenarios are list
belows:
1、The physical machine CPU models of the original cluster and the transit cluster
must be the same (if they are different, please contact R&D for confirmation)
2 、 If the VM is enabled the host cpu, the CPU Architecture(X86 AMD) of the transit
node must same with the CPU Architecture of the original cluster node otherwise active
migration is not supported.
3、NFV migrate is not supported
4 、 VM migration within a consistency group is not supported.(need delete VM from
consistency group first)
5、VM with special hardware do not support migration. Special hardware includes:
graphics cards, shared disks (RAC virtual machines do not support migration), and
physical disks.
6、Encrypted virtual machine migration is not supported

9
 7、Cross-cluster migration is not supported when the VMtool is not restarted after
the virtual machine is installed/uninstalled.
And there are some otherthings need pay attention to:
1、If HCI is managed by SCP the VM should migrate by SCP.if migrate by HCI the VM
will show lost in SCP and need re-allocation to the tenant.
2 、 The relevant policies of the original cluster VM will not be migrated, and you
need to manually create and associate the virtual machines after migration,the policies are
included backup/CDP policy, snapshot policy, distributed firewall policy, virtual machine
scheduling policy, disaster recovery policy, etc
3 、 VM’s snapshots, backup files, and CDP backup files are not support migrate
(backup, snapshots, and disaster recovery files will be lost after migration)
4 、 When the virtual machine memory change rate is greater than the migrate speed the
VM migrate will be stuck at 94%. If you want the migration to be successful, you need to
click force migrate button. force migrate will cause the virtual machine to suspend (1-5
minutes). Please evaluate the business impact before proceeding.
5、If the virtual machine has mapped USB and CD/DVD before migration, the USB can
still be used during the migration process, but it will not be available at the last switching
moment after the migration is completed. and need to insert the usb into the transit cluster
and remap it (if USB device has requirements for the hardware environment of the virtual
machine, you need to contact R&D for evaluation otherwise the business will
unavailable)
6 、 active upgrade of virtual machines will fail when the source cluster host has
insufficient memory, but migration will not be affected.
After the virtual machine is migrated, it will run in compatibility mode. You can
upgrade the compatibility on the virtual machine details page (need to restart the VM you
can do it when the VM can reboot). Before the compatibility mode is upgraded, the
virtual machine in compatibility mode cannot perform the following operations:
a) Unable to modify operating system type
b) Unable to enable I3 cache
c) Enabling escape detection is not supported;
d) Unable to convert to an encrypted virtual machine;
e) The upper limit of the virtual machine description field is 100 and cannot exceed
100.

3.7 Step 7 Upgrade original cluster to 6.9.0

For upgrade pealse refer to upgrade guide document

3.8 Step 8 Migrate VM from transit cluster to

back to original cluster
After the original cluster has upgraded there have two choice

1
 1. if don’t need the original cluster any more can turn the transit cluster into
business cluster
2. migrate VM back to original cluster
the migrate operate is a cross cluster migrate between same version

1
1