Upgrading Email Protection Solutions

Applies to:
  • Forcepoint Email Security, v8.5.x
  • Forcepoint Appliances, v8.5.x

The Forcepoint Email Security v8.5.x upgrade process includes appliance components (V Series appliance, X Series security blade, or virtual appliance), along with Forcepoint Security Manager and Email Log Server Windows components. A virtual appliance upgrade applies only to version 7.8.0 and later, and an X Series security blade upgrade applies only to version 7.8.4 and later.

These instructions cover the upgrade of a Websense Email Security Gateway, TRITON AP-EMAIL, or Forcepoint Email Security solution to Forcepoint Email Security version 8.5.0, 8.5.3, or 8.5.4, installed on-premises or in Microsoft Azure.

  • You can upgrade directly to on-premises version 8.5.4 from Forcepoint Email Security version 8.4.0, 8.5.0, or 8.5.3.
  • You can upgrade directly to on-premises version 8.5.3 from TRITON AP-EMAIL version 8.2.0 and 8.3.0, or from Forcepoint Email Security version 8.4.0 or 8.5.0.
  • You can upgrade directly to on-premises version 8.5.0 from TRITON AP-EMAIL version 8.1.0, 8.2.0, and 8.3.0, or from Forcepoint Email Security version 8.4.0.
  • You can upgrade to Forcepoint Email Security in Azure version 8.5.4 from Forcepoint Email Security in Azure version 8.5.0 or 8.5.3, or migrate from on-premises versions 8.4.0, 8.5.0, and 8.5.3.
  • You can upgrade to Forcepoint Email Security in Azure version 8.5.3 from Forcepoint Email Security in Azure version 8.5.0, or migrate from on-premises versions 8.2.0, 8.3.0, 8.4.0, and 8.5.0. If you are running AP-DATA Email Gateway version 8.3, it is not possible to upgrade to version 8.5.3; a new appliance must be installed. See Installing Forcepoint Email Security in Microsoft Azure for installation steps.
  • You can upgrade to Forcepoint Email Security in Azure version 8.5.0 from AP-DATA Email Gateway version 8.3 or from Forcepoint Email Security in Azure version 8.5.0.
  • If you are planning to deploy Forcepoint Email Security and Forcepoint Security Manager together in Azure:
    • For Forcepoint Email Security in Azure version 8.5.4, you must first upgrade Forcepoint Security Manager to version 8.5.5.
    • For Forcepoint Email Security in Azure version 8.5.3, you must first upgrade Forcepoint Security Manager to version 8.5.3.
Platform Version Mode First Step First Version Second Step Final Version
Physical 7.8.4 single upgrade 8.4.0 upgrade 8.5.0
Physical 8.0.0 single upgrade 8.3.0 upgrade 8.5.0
Physical 8.0.1 single upgrade 8.3.0 upgrade 8.5.0
Physical 8.1.0 single     upgrade 8.5.0
Physical 8.2.0 single     upgrade

migrate

 8.5.0, 8.5.3

8.5.3 Azure
Physical 8.3.0 single     upgrade

migrate

 8.5.0, 8.5.0

8.5.3 Azure
Physical 8.4.0 single     upgrade

migrate

8.5.0, 8.5.3, 8.5.4

8.5.3 Azure, 8.5.4 Azure
Physical 8.5.0 single     upgrade

migrate

8.5.0, 8.5.3, 8.5.4

8.5.3 Azure, 8.5.4 Azure
Physical 8.5.3 single     upgrade

migrate

8.5.4

8.5.4 Azure
Physical 7.8.4 dual migrate 8.4.0 upgrade 8.5.0
Physical 8.0.0 dual migrate 8.3.0 upgrade 8.5.0
Physical 8.0.1 dual migrate 8.3.0 upgrade 8.5.0
Physical 8.1.0 dual     migrate 8.5.0
Physical 8.2.0 dual     migrate 8.5.0
Virtual 7.8.4 single migrate 8.4.0 upgrade 8.5.0
Virtual 8.0.0 single migrate 8.3.0 upgrade 8.5.0
Virtual 8.0.1 single migrate 8.3.0 upgrade 8.5.0
Virtual 8.1.0 single     upgrade 8.5.0
Virtual 8.2.0 single     upgrade

migrate

 8.5.0, 8.5.3

8.5.3 Azure
Virtual 8.3.0* single     upgrade

migrate

 8.5.0, 8.5.3

8.5.3 Azure
Azure 8.3.0 single     migrate 8.5.0 Azure
Virtual 8.4.0 single     upgrade

migrate

 8.5.0, 8.5.3, 8.5.4

8.5.3 Azure, 8.5.4 Azure
Virtual 8.5.0 single     upgrade

migrate

 8.5.3, 8.5.4

8.5.3 Azure, 8.5.4 Azure
Azure 8.5.0 single     migrate

migrate

 8.5.0 Azure

8.5.3 Azure, 8.5.4 Azure
Virtual 8.5.3 single     upgrade

migrate

 8.5.4

8.5.4 Azure
Azure 8.5.3 single     upgrade 8.5.4 Azure
The version 8.3 virtual appliance was updated and re-released on June 2, 2017. Direct upgrade from a version 8.3 appliance to version 8.5.x is available only if you deployed from the updated OVA file released on June 2, 2017. If you deployed from the original OVA file released on December 19, 2016, you must use the migration process described in Migrate to version 8.5.x.
Important:

Starting in version 8.5, vCPU specifications changed for virtual appliances, which will require you to increase your vCPU and RAM allocations following an upgrade from version 8.3 or lower.

See the Knowledge Base article Resource Upgrade on OVA and Forcepoint Appliances Getting Started Guide for additional information and virtual appliance specifications.

For systems running a version 7.6.x or 7.7x deployment, and requiring an upgrade to version 8.5.x, it is necessary to upgrade to version 7.7.0 or 7.8.0 first, then upgrade to version 7.8.4, then to version 8.4, and finally to version 8.5.x. See the following:

For systems running Email Security Gateway on an X10G security blade, it is necessary to upgrade to version 8.0.0 before upgrading to version 8.3. Next, a direct upgrade to version 8.5.0 is possible.

Certain older V10000 and V5000 appliances are not supported with version 8.0.0 and later. See V Series appliances supported with version 8.x.

Any version 7.6.x Email Security component that is currently installed on Windows Server 2003 must be migrated to Windows Server 2008 R2 before the upgrade to v7.7.0. Migration to Windows Server 2012 may be performed after an upgrade to v7.8.0.

Ensure that third-party components are upgraded as well, to work with your new email protection solution version.

For upgrade instructions, see:

We recommend that you perform a complete system backup in the event your system experiences a power outage or other interruption during the upgrade process. Recovery procedures are also included in case they are needed.

The upgrade process includes Forcepoint appliance components (V Series appliance, virtual appliance, or X Series chassis security blade), along with Forcepoint Security Manager and Email Log Server Windows components. Ensure that your deployment additionally includes Forcepoint DLP for data loss prevention (DLP) capabilities. The upgrade process detects and upgrades this module during the Security Manager upgrade.
Warning: Please contact Technical Support before you begin the upgrade process if Forcepoint personnel have customized any Email Security Gateway, TRITON AP-EMAIL, or Forcepoint Email Security back-end configuration settings.

Starting with v8.3.0, a single ISO image (v8.x.x Unified Appliance Installer) is offered to restore an appliance back to the factory settings as well as to upgrade all installed modules in the target appliance to the corresponding version.

Modules include:
  • App - Base appliance infrastructure and appliance controller Forcepoint Web Security:

    Forcepoint Web Security:

  • Web - Forcepoint Web Security core components
  • Proxy - Content Gateway web proxy

    Forcepoint Email Security:

  • Email - Forcepoint Email Security core components

To upgrade an appliance prior to v8.3.0, the legacy RPM upgrade package is required. Refer to the dedicated upgrade guide for V Series or X Series appliances.

Dual-Mode Appliances

The V Series appliance and the email virtual appliance were re-architected at version 8.3. Dual security mode on the V Series appliance (TRITON AP-EMAIL and TRITON AP-WEB or Web Filter & Security) is no longer supported. It is recommended to migrate the Email module off any dual-mode appliance to a new version 8.5.x appliance, leaving the web security system on the existing appliance. Before beginning the upgrade, see Upgrading V Series Dual-Mode Appliances to Version 8.5 for important upgrade instructions. Email data and messages on an existing virtual appliance must also be migrated to a new version 8.5.x appliance. See Migrate to version 8.5.x.