RMA Mode

Collecting RMA Backup Information

• The RMA Mode backup operation saves minimal information for these:

  • All Security Gateways in the Installation Candidates List File (see Installation Candidates List File)

    or

  • All connected Security Gateways, if you use the "-backupall" option

  The information saved:

  • Number and Builds of the installed Check Point version.

  • List of all installed Hotfixes.

  • Check Point and Linux configuration files:

    Table: Configuration files

    File	Description
    FTW_settings.conf	Configuration file for Automatic First Time Configuration Wizard. The CLI command "config_system" also uses this file to run automatic First Time Configuration Wizard (sk69701).
    machine_settings.conf	Output of the Gaia Clish command "save configuration".
    SIC_settings.conf	Configuration file to restore SIC settings in the Check Point Registry ($CPDIR/registry/HKLM_registry.data).
    exported_sic_cert.p12	SIC certificate file.
    additional_settings.sh	Backup script (for example, to restore the cluster mode, SNMP extension, and other settings).
    various.tar	Contains these files: File Contents of the File $CPDIR/conf/cp.license Installed Check Point licenses $FWDIR/boot/boot.conf Specific Check Point boot parameters $FWDIR/conf/objects.C Applicable objects configured in SmartDashboard or SmartConsole $FWDIR/conf/fwauth.NDB Users configured in SmartConsole / SmartDashboard $FWDIR/boot/modules/fwkern.conf Firewall kernel parameters and their values $PPKDIR/conf/simkern.conf (in R80.20 and above) $PPKDIR/boot/modules/simkern.conf (in R80.10 and below) SecureXL kernel parameters and their values $PPKDIR/conf/sim_aff.conf (in R80.20 and above) $PPKDIR/boot/modules/sim_aff.conf (in R80.10 and below) SecureXL Interface Affinity configuration $FWDIR/conf/fwaffinity.conf CoreXL Interface Affinity configuration $FWDIR/conf/dispatcher_mode.conf CoreXL Dynamic Dispatcher (sk105261) and Firewall Priority Queues (sk105762) internal settings $FWDIR/conf/dynamic_dispatcher_mode.conf CoreXL Dynamic Dispatcher (sk105261) internal settings $FWDIR/boot/mq.conf Multi-Queue settings /etc/snmp/userDefinedSettings.conf User-defined SNMP settings (sk90860) /boot/grub/grub.conf Linux GRUB configuration file /etc/rc.d/rc.local Linux start-up script (administrator can add the desired Linux commands to this script to run at boot)

• CDT saves the RMA backup information on the Management Server in the repository path as configured in the CDT configuration file.

  Each Security Gateway's backup is saved in a file name corresponding to the Security Gateway's object name in the management database.

  The size of the RMA backup file is approximately 200kB for each backed up Security Gateway or Cluster Member.

• Each time you change the settings of a Security Gateway (in SmartConsole, or in Gaia operating system), you must collect a new backup of that Security Gateway.

• Optional: Add more files to the RMA Backup.

  1. Prepare a plain-text file with a list of full paths to the files it is necessary to collect.

  2. Write full path to each file on a different line.

  3. Add this parameter to the syntax:

     -additional_files=<Path to and Name of File with List of Additional Files, including File Extension>

  Notes: "<File with List of Additional Files>" is plain-text file that contains absolute paths to the files you want to add to the RMA Backup. All the files you specify must be located on all the Security Gateways and Cluster Members. If a specified file is not located on one of the remote targets, the RMA Backup fails on that target.                     You cannot backup the /var/log/ directory.

Restoring RMA Backup Information

• The RMA restore operation uses the RMA backup information to reconfigure a replaced Security Gateway.

• Requirements for the RMA restore process:

  • The replaced Security Gateway appliance must be the same model as the replaced Security Gateway appliance.

  • The replaced Security Gateway must have the default username and password (admin/admin).

    If you changed the default username or password, restore the Gaia to factory defaults.

  • The replaced Security Gateway must have the same physical interface configuration as the replaced Security Gateway.

  • The replaced Security Gateway must have the same networking configuration (IP address, default gateway, and so on).

  • The replaced Security Gateway must not be configured with the Gaia First Time Configuration Wizard.

    If the First Time Configuration Wizard was already done, you must restore the Gaia to the factory defaults before you can run the RMA restore.

  • You must have all the required packages to install in the repository configured in the primary configuration file.

    That is, you must have the CPUSE package for Clean Install of the version and the CPUSE packages of all the Hotfixes that were installed on the replaced Security Gateway.

    To see the required packages and other backup information, run in the Expert mode:

    $CDTDIR/CentralDeploymentTool -rma -info -gateway=<Name of Security Gateway or Cluster Member Object>

  • If the CDT could not recognize the CPUSE package file name of the installed version, you must explicitly specify the name of the CPUSE package for Clean Install.

    See the syntax in the procedure RMA Mode.

Note - License information is not restored on Check Point appliance, because it depends on the appliance's MAC address.

Notes: If these files are not found on your Management Server, most likely the CDT could not transfer them from the Security Gateway or Cluster Member. You can find these files on the Security Gateway or Cluster Member in the /var/log/CPrma/ directory. The log file with outputs of Gaia Clish commands contains special characters. To see this log file on Gaia OS, use the Linux less command. To see this log file on Windows OS, use an advanced text editor, like Notepad++.