Multi-Domain Server General

What can I do here?

Use this window to configure the general properties for a Multi-Domain Server or Multi-Domain Log Servers.

Getting Here - SmartConsole for Multi-Domain Server > Multi Domain > New > Multi-Domain Server > General page

Or:

SmartConsole for Multi-Domain Server > Multi Domain > New > Multi-Domain Log Servers > Multi-Domain page

Multi-Domain Server General

Basic Details:

Type Object Name - Enter a unique name for this Multi-Domain Server or Multi-Domain Log Servers.
Type Object Comment - Optional: Enter a textual description or comment for this Multi-Domain Server or Multi-Domain Log Servers.
IP Address - Enter the Multi-Domain Server or Multi-Domain Log Servers IP address
Important - You must always assign an IPv4 address to a Multi-Domain Server or Multi-Domain Log Servers.
Connect - Click to establish SIC trust
Revoke - Click to revoke a certificate
View - Click to see SIC details

Platform

OS - Select an operating system
Version - Select a release version
Hardware - Select the appliance model or computer type

Note - Platform details are not automatically entered when the Primary MDS is created. You can select the correct details but the fields have no functionality.

Creating a Secondary Multi-Domain Server

This section shows you how to create a new secondary Multi-Domain Server.

Important: Before you start this procedure, make sure to define the physical server as the correct server type (Secondary Multi-Domain Server or Multi-Domain Log Server) during installation. An incorrect definition can cause deployment failure.

To create a new, secondary Multi-Domain Server:

If you did not do so, install a new R80.10 secondary Multi-Domain Server.
Follow the procedures in the R80.10 Installation and Upgrade Guide. Make sure to define this server as a secondary Multi-Domain Server in the First Time Wizard. Connect to the Primary Multi-Domain Server with SmartConsole and go the Domains view.
In the Multi-Domain navigation toolbar, click New > Multi-Domain Server.
Enter a unique name for this Multi-Domain Server.
To get the IP address automatically, the name must be in the DNS.
Enter the IPv4 address or click Resolve IP to get the IP address from the DNS.
Select the platform operating system, software version, and hardware type.
Click Connect to establish SIC trust.

The new Multi-Domain Server automatically synchronizes with all existing Multi-Domain Servers and Multi-Domain Log Servers. The synchronization operation can take some time to complete, during which a notification indicator shows in the task information area.

Changing an Existing Multi-Domain Server

You can change the settings for an existing Multi-Domain Server or Multi-Domain Log Server.

To change the settings for an existing Multi-Domain Server:

Double-click the Multi-Domain Server or Multi-Domain Log Server in the top row of the Domains grid.
In the Multi-Domain Server window, change the parameters in the General, Multi-Domain and Log Settings views.

Note - You cannot change the Multi-Domain Server name.

Re-Establishing SIC Trust for a Secondary Multi-Domain Server

Important - You can only re-establish SIC trust on a Secondary Multi-Domain Server or Multi-Domain Log Servers. There is no option to establish SIC trust on the Primary Multi-Domain Server.

It is occasionally necessary to re-establish trust between a Primary and secondary Multi-Domain Server or Multi-Domain Log Server. This can occur for many reasons, including:

Changes to the IP address of the Primary Multi-Domain Server, Secondary Multi-Domain Server or Multi-Domain Log Server
Failure and recovery of the Primary Multi-Domain Server
Promotion of a Secondary Multi-Domain Server to Primary Multi-Domain Server
Internal Certificate Authority (ICA) failure on the Primary Multi-Domain Server

To re-establish SIC trust:

Open a command line interface to the Secondary Multi-Domain Server or Multi-Domain Log Server.
Log in and run: mdsconfig
Enter the number for Secure Internal Communication, and then press Enter.
Enter y to confirm.
Enter and confirm the activation key.
Enter the number for Exit.
Wait for Check Point processes to stop and automatically restart.
In the SmartConsole Multi-Domain view, double-click a Secondary Multi-Domain Server or Multi-Domain Log Server object.
In the Multi-Domain Server window, click Connect.
In the Initialize SIC window, enter activation key that you entered in step 5 above.
If successful, the Certificate State field shows Trust established.

Deleting a Secondary Multi-Domain Server or Multi-Domain Log Server

To delete a secondary Multi-Domain Server:

Move each Active Domain Management Server on the secondary Multi-Domain Server to another Domain Management Server.
Connect to the command line on the Multi-Domain Server to be deleted and run: mdsstop
In SmartConsole, right-click the secondary Multi-Domain Server, and then select Delete Multi-Domain Server.
Confirm the action and click OK.
Publish the change.

Note - This procedure deletes all standby and non-primary Domain Management Servers on the Secondary Multi-Domain Server. You cannot delete the Primary or Active Domain Management Server.

Overview of High Availability

High Availability is redundancy and database backup for management servers. Synchronized servers have the same policies, rules, user definitions, network objects, and system configuration settings.

Multi-Domain Security Management implements High Availability at these levels:

Multi-Domain Server High Availability is an Active/Active redundancy solution that uses two or more fully synchronized Multi-Domain Servers for continuous redundancy. All Multi-Domain Servers are Active. You can log into and work with the primary or secondary Multi-Domain Servers.
Domain Management Server High Availability is both a redundancy and a Load Sharing solution for Domains. You create a Domain Management Server on two or more Multi-Domain Servers. These Domain Management Servers synchronize fully for continuous redundancy.
One Domain Management Server is Active and the others are Standby. Each Multi-Domain Server can have both Active and Standby Domain Servers. You can configure the Active Domain Management Server on different Multi-Domain Servers for effective load sharing.

All High Availability deployments include one Primary Multi-Domain Server and one or more Secondary servers. Synchronization occurs automatically when administrators publish sessions with changes to Policies, objects or configuration settings.

Primary and Secondary Multi-Domain Servers

The order in which you install Multi-Domain Servers is significant. You must define the first physical server as a Primary Multi-Domain Server in the First Time Wizard. You must define all other Multi-Domain Servers as Secondary in the First Time Wizard.

Active and Standby Domain Management Servers

You can only use the Active Domain Management Server to manage Domain Security Gateways, networks, Security Policies objects and system configuration. Standby Domain Management Servers synchronize fully for redundancy. You can connect to a Standby Domain Management Server in the Read Only mode to look at current object configurations and Rule Base.

In the standard configuration, there is only one Active Domain Management Server for each Domain. All others are Standby Domain Management Servers. If the Active Domain Management Server fails, you must manually change a Standby Domain Management Server to Active.

Important notes about backing up and restoring in Management High Availability environment:

To back up and restore a consistent environment, make sure to collect and restore the backups and snapshots from all servers in the High Availability environment at the same time. (This does not apply to Multi-Domain Log Servers.)
Make sure other administrators do not make changes in SmartConsole until the backup operation is completed.

For more information:

About Gaia Backup and Gaia Snapshot, see the R80.10 Gaia Administration Guide.
About the migrate export and migrate import commands, see the R80.10 CLI Reference Guide.
About the mds_backup and mds_restore commands, see the R80.10 Multi-Domain Security Management Administration Guide.
About Virtual Machine Snapshots, see the vendor documentation.

Multi-Site High Availability Deployment Example

This example shows a Multi-Site, High Availability deployment with two Multi-Domain Servers and one Multi-Domain Log Server. A real-life deployment will have many more assets.

Each Multi-Domain Server has two Domains configured for Load Sharing, where a different Domain Management Server is Active at each location. Administrators can connect to all Multi-Domain Servers. For best performance, connect to the Multi-Domain Server nearest to your geographical location.

Item	Description
1	London Multi-Domain Server with an Active Domain Management Server for London and a Standby Domain Management Server for Tokyo
2	Multi-Domain Log Server with Domain Log Servers for London and Tokyo
3	Tokyo Multi-Domain Server with an Active Domain Management Server for Tokyo and a Standby Domain Management Server for London
4	Tokyo network
5	London network
6	Internet
	Active Domain Management Server
	Standby Domain Management Server
	Domain Log Server

This illustration shows the configuration grid in the SmartConsole Multi Domain view for the example deployment:

The system automatically creates the Global Domain when you install Multi-Domain Security Management.

Synchronization

In a multi-domain environment, the Multi-Domain Servers work in active-active mode. All Multi-Domain Servers are active and synchronize each other.

The Domains managed by the Multi-Domain Server work in active-standby mode, where the Active Domain Server synchronizes all the standby Domain Servers.

The system automatically synchronizes periodically and when an administrator publishes changes to the configuration.

Multi-Domain Server ICA Database Synchronization

When you create a new secondary Multi-Domain Server, the Internal Certificate Authority (ICA) on the Primary Multi-Domain Server generates a certificate when you establish SIC trust. The ICA can generate a certificate for a new administrator, if required by the authentication method. In a High Availability deployment with more than one Multi-Domain Server, the system synchronizes the ICA databases as necessary.

Initial Synchronization

Initial synchronization occurs automatically when you create a secondary Multi-Domain Server, Multi-Domain Log Server, or Domain Management Server. The system generates a task to copy all databases and system information from the connected server to the new server.

Multi-Domain Server and Multi-Domain Log Server synchronization tasks show in the Task Information area, in the Multi-Domain Server SmartConsole. Domain synchronization tasks show in the Domain SmartConsole.

Periodic Synchronization

Multi-Domain Servers synchronize with all other peers and Multi-Domain Log Servers. Periodic synchronization occurs automatically, and when an administrator publishes a session. Private (non-published) sessions do not synchronize.

Periodic synchronizations are incremental. Only database changes synchronize with peers. Active Domain Management Servers synchronize to the standby Domain Management Servers.

Manual Synchronization

Manual synchronization is a full synchronization that overwrites all data on the peers. It disconnects all connected clients and overrides active sessions and running tasks.

When changes made in a session are published on the Active server (made public), the changes are synchronized to the Standby server. Unpublished, private sessions are not synchronized.

Best practice - Use this option with caution, and only in cases of synchronization error. We recommend that you publish changes before initiating full sync.

For Domain Management Servers, you can only run a manual synchronization from the active Domain Management Server to the standby peers.

Manually Synchronizing a Multi-Domain Server

You can manually synchronize the connected Multi-Domain Server with a peer Multi-Domain Server.

To manually synchronize Multi-Domain Servers:

Click the Synchronization Status area at the bottom of the SmartConsole window.
In the High Availability Status window, select a peer Multi-Domain Server to synchronize.
Click Sync Peer.

Synchronization starts immediately and the status shows in the window. The synchronization operation can take many minutes to complete.

Warning: Use manual synchronization with caution. This can overwrite all data on the peer Multi-Domain Server if they do not synchronize correctly.

Manually Synchronizing Domain Management Servers

You can manually synchronization a Standby Domain Management Server with the Active Domain Management Server on a different Multi-Domain Server.

To manually synchronize Domain Management Servers for a Domain:

Open SmartConsole for the active Domain Management Server.
Click Menu > High Availability.
In the High Availability Status window, click Actions > Sync Peer.

Synchronization starts immediately and the status shows in the window. The synchronization operation can take many minutes to complete.

Looking at High Availability Status

To see Multi-Domain Server and Multi-Domain Log Server High Availability status:

Select Management High Availability from the SmartConsole menu.

The High Availability Status window shows all Multi-Domain Servers and Multi-Domain Log Servers in your environment, together with their synchronization status.

Icon	Status
	Multi-Domain Server (that you are connected to) - Synchronization OK
	Multi-Domain Server Synchronization OK
	Multi-Domain Log Server Synchronization OK
	Multi-Domain Server - Not synchronized - No connection with peer

To see Domain Management Server High Availability status:

Connect to a Domain with SmartConsole.
By default, SmartConsole connects to the Active Domain Management Server.

Select Management High Availability from the SmartConsole menu.

The High Availability Status window shows the status of all Domain Management Servers for the selected Domain. You can manually synchronize the peer servers with the Domain Management Server to which you are connected. You can also connect with SmartConsole to a peer Domain Management Server in the Read Only mode.

Icon	Status
	Active Domain Management Server - Synchronization OK
	Standby Domain Management Server - Synchronization OK
	Domain Log Server - Synchronization OK
	Domain Management Server not synchronized - No connection with peer
	Domain Management Server synchronization in process or has a problem

Note - Domain servers status is reflected also in the Domains view in the SmartConsole connected to the Multi-Domain Server. For more information on synchronization status see the R80.10 Security Management Administrator Guide.

Domain Management Server High Availability and Load Sharing

This section includes procedures for configuring the Multi-Domain Security Management environment for secondary Multi-Domain Servers and a Multi-Domain Log Server. When you install Multi-Domain Security Management for the first time, select Primary Multi-Domain Server in the First Time Wizard. For High Availability and Load Sharing, select Secondary Multi-Domain Server in the First Time Wizard.

Each Domain has one Active and one or more Standby Domain Management Servers. For example, if a deployment has three Multi-Domain Servers, each Domain can have one Active and two Standby Domain Management Servers. This lets the Domains load be shared between several physical Multi-Domain Servers.

Example of Domain Management Server High Availability with Load Sharing:

By default, the Primary Domain Management Server is Active. All other Domain Management Servers for that Domain are Standbys. You can change a Standby Domain Management Server to Active as necessary.

All Domain management operations, such as working with Security Policies, users, networks and other objects, occur on the Active Domain Management Server. Standby Domain Management Servers automatically synchronize with the Active Domain Management Server. Security Gateways can get a Security Policy and a Certificate Revocation List (CRL) from either the Active or Standby Domain Management Servers.

Changing the Active Domain Management Server

If the current Active Domain Management Server is responsive, use this procedure to set a different Domain Management Server to Active.

To change an Active Domain Management Server:

Right-click the cell for a Standby Domain Management Server, and then select Connect to Domain Management Server.
In the Domain SmartConsole instance, click Menu > High Availability.
In the High Availability Status window, click a Standby Domain Management Server Actions > Set Active.
Close SmartConsole and re-connect to the newly Active Domain SmartConsole.

The Standby Domain Management Server changes to Active. The Standby Domain Management Servers automatically synchronize, and a confirmation message shows in the High Availability Status window. The synchronization operation can take many minutes to complete.

To manually set the Active Domain Management Server to Standby

Right-click the cell for the Active Domain Management Server, and select Connect to Domain Management Server.
Click Menu > Management High Availability.
In the High Availability Status window, click Actions > Set Standby.
Confirm when prompted.

The Active Domain Management Server changes to Standby. Continue the procedure to set a different Domain Management Server to Active. Until you do this, Domain SmartConsole clients open in the Read Only mode and you cannot work with Domain objects or Policies.

Note - SmartConsole clients connected to the Active Domain Management Server will be disconnected during the procedure for changing the Active Domain Management Server.