HOW TO MIGRATE MY BASTION TO BASTION12
Customer Success
TECHDOC340
Classification: Public
WALLIX
250 bis rue du Faubourg Saint-Honoré 75008 Paris
Tél : +331 53 42 12 90 – Fax : + 33 1 43 87 66 38
SARL au capital de 50 000 Euros – RCS PARIS B 450 401 153 – FR67 450 401 153
FOLLOW-UP SHEET
Visa
Name
Writer
Guillaume GENDRE
Arthur GUILLEMYN
Function
Cybersecurity
consultant
Date
09 2024
Visa
GGE
AGU
Jérémy GINFRAY
JGI
Checker
Bryce SIMON
Field CTO
10 2024
BSI
Approver
Pierre Ganchegui
Cybersecurity Expert
11 2024
PGI
Review
Version
Nature
Author
Date
09 2024
1.0
Creation
1.1
Revision
Bryce SIMON
10 2024
1.2
Update
Julien PINCHON
02 2025
© WALLIX
2 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public
TABLE OF CONTENTS
INTRODUCTION ____________________________________________________________________________ 4
I
II
OBJECT ___________________________________________________________________________ 4
DISCLAIMER ______________________________________________________________________ 4
III
IV
PREREQUISITES ____________________________________________________________________ 4
UPGRADE PROCEDURE _____________________________________________________________ 5
V
V.1
PHYSICAL APPLIANCE _____________________________________________________________ 7
HOW TO CREATE A BOOTABLE USB KEY______________________________________________ 7
V.2
V.3
STANDALONE _____________________________________________________________________ 7
HA DRBD CLUSTER _________________________________________________________________ 7
V.4
V.5
MYSQL MASTER/MASTER CLUSTER ___________________________________________________ 8
MYSQL MASTER/SLAVE CLUSTER ____________________________________________________ 8
V.6
VI
MYSQL MASTER MULTIPLE SLAVE CLUSTER____________________________________________ 9
VIRTUAL APPLIANCE ______________________________________________________________10
VI.1
VI.2
STANDALONE ____________________________________________________________________10
MYSQL MASTER/MASTER CLUSTER __________________________________________________10
VI.3
VI.4
MYSQL MASTER/SLAVE CLUSTER ___________________________________________________10
MYSQL MASTER MULTIPLE SLAVE CLUSTER___________________________________________10
VII
VIII
IN CASE OF HAVING A DRP _______________________________________________________11
ATTENTION POINTS _______________________________________________________________11
© WALLIX
3 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public
INTRODUCTION
I
OBJECT
This document provides all needed instruction and recommendations to successfully migrate to
WALLIX Bastion 12+.
II
DISCLAIMER
You can’t upgrade the existing platform to bastion 12.
This is due to core changes made to get the best performance and stability in this new version.
For this reason, “upgrading to Bastion 12” is more a “Migration to Bastion 12”.
You will need a new platform on which you are going to import existing data using WALLIX
Backup.
Therefore, you should prepare it whether it is virtual or physical appliance from a network point
of view.
Please refer to the following sizing’s documentation: https://support.wallix.com/hc/enus/articles/22098207347613-What-should-be-the-sizing-of-my-Wallix-Bastion
As for any other IT project, we recommend strongly using a staging environment before setting
it up in production.
We are aware that it’s a change on how you generally upgrade our Products, but it was a
necessary step to ensure that you will get the best experience in the future.
Once migrated to any 12+ version, you will be able to upgrade in a more common way.
III PREREQUISITES
As a perquisite, you should have a backup of your previous Bastion platform.
Supported backup versions:
• WALLIX Bastion 9.0
• WALLIX Bastion 9.1.0
• WALLIX Bastion 10.0
• WALLIX Bastion 10.1.0
• WALLIX Bastion 10.3.0
• WALLIX Bastion 10.4.3
• WALLIX Bastion 11.0.0
The latest hotfixes of the major releases are available on the support portal.
If you don’t use remote storage, you should also prepare a session archive to be imported on
your new platform.
© WALLIX
4 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public
IV UPGRADE PROCEDURE
1. Create a backup of the current WALLIX Bastion configuration.
a. On the web interface, go to the System > Backup/Restore page.
b. Define a Backup key and confirm that key. The key must be exactly 16 characters
long. Avoid non alphanumerical characters.
c. Store the key somewhere safe.
d. Click Create.
e. Click Download created backup file.
NB: You can also create the backup in CLI using the command
/opt/wab/bin/WALLIX-config-backup.py
Usage:
WALLIX-config-backup.py
Options:
-h, --help
-d
-h
[options]
show this help message and exit
DIRECTORY,
--directory=DIRECTORY
Directory
where
you
want
to
store
your
backup.
Set this option to store the Backup in the sdcard.
-s, --sdcard
You can also use the automatic backup stored in /var/wab/backup generated with the key
azertyuiopwxcvbn or with the key set-in configuration > configuration option> global > backup
key
2. Optional: If you use local storage, export the recordings using the # WABSessionLogExport -h
Command.
All sessions for the period defined will also be removed, unless option -p has been used.
It is possible to archive and/or purge sessions according to their IDs using option --sessions.
It is possible to specify a passphrase for the archive using option --passphrase. The latter should
however not be used as the passphrase is displayed as a string on the command-line.
Example:
WABSessionLogExport --no-purge --passphrase-file /tmp/passphrase --start-date 2003-10-23 -end-date $(date --date='tomorrow' +'%Y-%m-%d')
Since WABSessionLogExport only ask archive password once, it is better to use a passphrase file
3. Install WALLIX Bastion 12.
This step erases all data on the machine, whether you have a virtual machine or a physical
one.
a. Retrieve the image for latest WALLIX Bastion 12 version available:
▪ For ISO and on-premises images, refer to Deploying ISO and on-premises
images.
▪ For Cloud images, refer to Deploying Cloud tenant images (on page 13).
b. Proceed with the initialization. For the complete procedure, refer to Initialization of
© WALLIX
5 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public
WALLIX Bastion.
4. Import the backup of WALLIX Bastion created in step 1. (Warning: there is a size limit ~35Mo,
for bigger backup use a cli)
a. On the web interface, go to the System > Backup/Restore page.
b. Enter the backup key to decrypt the backup file.
c. If the Bastion has an encryption passphrase configured, enter the passphrase.
If you changed the passphrase, ensure you are using the passphrase used in the
backed-up version of the Bastion.
d. Import the backup file.
e. Click Restore.
NB: you can also use the command # WALLIX-config-restore.py
5. Optional: If you use local storage, import the recordings.
To import the archive: # /opt/wab/bin/WABSessionLogImport -h
Example: # WABSessionLogImport --passphrase-file /tmp/passsphrase -f archive
© WALLIX
6 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public
V
PHYSICAL APPLIANCE
V.1
HOW TO CREATE A BOOTABLE USB KEY
•
On Windows, use a tool like Win32DiskImager
(https://sourceforge.net/projects/win32diskimager/)
Change the filter from *.img to *.iso to select the file.
•
On Linux, simply use the dd command as follows:
dd
if=Bastion-10.0.7.0.iso
of=<usb_device>
bs=4M;
sync
then check by entering the following command:
sed
's/Bastion-10.0.7.0.iso/-/'
Bastion-10.0.7.0.iso.sha256sum
\
>stdin.sha256sum
head
-c
`stat
-c%s
Bastion-10.0.7.0.iso`
<usb_device>|
\
sha256sum
-c
stdin.sha256sum
where <usb_device> must be replaced by the device onto which the USB key is connected,
typically something like /dev/sdb.
V.2
STANDALONE
For a Hardware standalone Bastion. The main point you should watch is availability.
Because of the process of upgrading to Bastion 12, if you have only one hardware appliance
available you will lose access during the operation.
Therefore, if this point is important for you, you should either:
- Use a spare appliance
- Buy a new appliance
- Switch to virtual either for short or long term
Globally the process is described in the III. Upgrade procedure.
V.3
HA DRBD CLUSTER
In Bastion 12, the DRBD feature has been deprecated and removed. That means you will have to
switch to MySQL Replication (Section 5. of our deployment guide).
The process to upgrade should be:
1. Create a backup of the Master node and a session archive (if no remote storage is used).
2. Disable wabha on the master: # systemctl stop wabha
3. Upgrade the SLAVE (so you keep the availability of the Master).
a. You can follow the III. Upgrade procedure section.
b. Restoring the backup.
c. Import session archive (if need to).
© WALLIX
7 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public
d. Test your uses cases.
4. Once it is done, you can start to use the new Bastion and decommission the old Master
(from a network point of view). Exporting session now is the best scenario as it will allow
you to export without experiencing downtime or poor performance due to the archive
creation
5. Upgrade the old Master (use the III. Upgrade procedure section).
6. Install MySQL Replication. The configuration will be replicated from old slave to old
master. The schema used doesn’t matter (master/master or master/slave)
NB: old session will only be available on the first node we upgraded.
V.4
MYSQL MASTER/MASTER CLUSTER
1. For a Master Master replication, we suggest starting by uninstalling the replication using
the command: # /root/sqlreplication/replication --uninstall
2. After that you should start by upgrading the node that is not performing password
rotation. By doing so, you will maintain availability and password rotation.
a. You can follow the III. Upgrade procedure section.
b. Restoring the backup.
c. Import session archive (if need to).
d. Test your use cases.
e. Take care to not perform any password rotation (so you won’t cause any error
regarding the first node).
3. Once it is done, you can start to use the new Bastion and decommission the first node
(from a network point of view).
4. Upgrade the old Master without forgetting session archive if needed (use the III. Upgrade
procedure section).
5. Install MySQL Replication.
V.5
MYSQL MASTER/SLAVE CLUSTER
1. For a Master Slave replication, we suggest starting by uninstalling the replication using
the command: # /root/sqlreplication/replication --uninstall
2. After that you should start by upgrading the Slave.
a. You can follow the III. Upgrade procedure section.
b. Restoring the backup.
c. Import session archive (if need to).
d. Test your uses cases.
e. Take care to not perform any password rotation (so you won’t cause any error
regarding the old master).
6. Once it is done, you can start to use the new Bastion and decommission the old master
(from a network point of view).
7. Upgrade the old Master without forgetting session archive if needed (use the III. Upgrade
procedure section).
8. Install MySQL Replication.
© WALLIX
8 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public
V.6
MYSQL MASTER MULTIPLE SLAVE CLUSTER
1. For a Master multiple slave replication, we suggest starting by uninstalling the replication
using the command: # /root/sqlreplication/replication --uninstall
2. After that, you should start by upgrading the Slave one by one and keeping the master
up.
a. You can follow the III. Upgrade procedure section.
b. Restoring the backup.
c. Import session archive (if need to).
d. Test your uses cases.
e. Take care to not perform any password rotation (so you won’t cause any error
regarding the old master).
3. Once it is done, you can start to use the new Bastions and decommission the old master
(from a network point of view).
4. Install the MySQL Replication.
5. Upgrade the old Master without forgetting session archive if needed (use the III. Upgrade
procedure section).
© WALLIX
9 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public
VI VIRTUAL APPLIANCE
VI.1 STANDALONE
For a virtual standalone Bastion, the process should be:
•
•
•
To maintain availability, we suggest creating a new VM and keeping the old one until all
your use cases have been tested.
Upgrade following the process described in the III. Upgrade procedure.
o Install Bastion 12
o Import your sessions back if you don’t use a remote storage
Test your use cases
If you can’t create any new VM for various reasons, you can still install Bastion 12 on your original
Bastion, but you will lose every data that is present inside it and service will be disrupted.
However, with snapshots, this can be mitigated.
VI.2 MYSQL MASTER/MASTER CLUSTER
For a virtual master/master Bastion, the process should be:
•
•
•
To maintain availability, we suggest creating new VMs and keeping the old ones until all
your use cases have been tested.
Upgrade following the process described in the III. Upgrade procedure.
o Install your Bastions 12
o Import your sessions if you don’t use a remote storage
Test your use cases
If you can’t create any new VM for various reasons, we suggest the following IV.4 section that is
dedicated to physical appliances to keep some availability during the maintenance. However,
you will lose every data that is present inside your Bastion.
VI.3 MYSQL MASTER/SLAVE CLUSTER
For a virtual master/slave Bastion, the process should be:
•
•
•
To maintain availability, we suggest creating new VMs and keeping the old ones until all
your use cases have been tested.
Upgrade following the process described in the III. Upgrade procedure.
o Install your Bastions 12
o Import your sessions back if you don’t use a remote storage
Test your use cases
If you can’t create any new VM for various reasons, we suggest following IV.5 section that is
dedicated to physical appliances to keep some availability during the maintenance.
VI.4 MYSQL MASTER MULTIPLE SLAVE CLUSTER
For a virtual master multiple Bastion, the process should be:
•
•
To maintain availability, we suggest creating new VMs and keeping the old ones until all
your use cases have been tested.
Upgrade following the process described in the III. Upgrade procedure.
o Install your Bastions 12
© WALLIX
10 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public
•
o Import your sessions back if you don’t use a remote storage
Test your use cases
If you can’t create any new VM for various reasons, we suggest following IV.6 section that is
dedicated to physical appliances to keep some availability during the maintenance. However,
you will lose every data that is present inside your Bastion.
VII IN CASE OF HAVING A DRP
If you have a DRP in your architecture, using it as your main Bastion while you are upgrading your
main cluster (physical or virtual) should be the right call.
We also advise upgrading it in last compared to your other Bastion. That way the DRP will only
be used as a spare wheel. When upgrading your main Bastion, the DRP script will be erased (as
it intended), therefore you will need to redeploy it after (and only after) you have upgraded your
DRP to the same version (12.0.X).
VIII ATTENTION POINTS
You can find an article with all the known issues and limitations in Bastion 12. The article is
updated regularly.
https://support.wallix.com/hc/en-us/articles/22098184069405-Known-issues-limitations
© WALLIX
11 / 11
TECHDOC340 : HOW TO MIGRATE MY BASTION TO BASTION12
Classification : Public