In This Section: |
High Availability is redundancy and database backup for management servers. Synchronized servers have the same policies, rules, user definitions, network objects, and system configuration settings. The first management server installed is the primary. If the primary Security Management Server fails, or is off line for maintenance, the secondary server takes over.
When you use Check Point Endpoint Security, the Endpoint Security Management Server is fully integrated with the Network Security Management Server on the same computer. This means that the Security Management High Availability solution supplies backup and redundancy for the Network Security Management Server and the Endpoint Security Management Server databases.
Only one Secondary server is supported with Endpoint Security.
For general information about configuring and managing a High Availability environment, see "Management High Availability" in the R80.20 Security Management Administration Guide.
Information that is different for environments with Endpoint Security is included in this guide.
Environments that include Endpoint Security require some additional steps for:
To add a secondary server for an Endpoint Security environment, you must follow the workflow defined here. You must create communication between the servers and install the database BEFORE you enable Endpoint Security. After the first database installation and synchronization are completed, you enable Endpoint Security with the Endpoint Policy Management Software Blade, and then install the database again.
To add a secondary server and establish communication between the servers:
Secondary Server, Logging & Status, and Provisioning are selected automatically
DO NOT enable Endpoint Policy Management on the server.
To enable Endpoint Security on the secondary server:
Each time you download a new MSI package or driver that is related to Endpoint Security, for example, a Smart Card driver, you must synchronize these file throughout the High Availability environment. This is not done automatically with synchronization because the files can be very large.
To synchronize MSI packages and drivers:
Note: The MSI folder contains many folders with unique names. When you add a new file to a folder on the Active server, copy this file to the same folder on the Standby server.
$FWDIR/conf/SMC_Files/uepm/msi
$FWDIR/conf/SMC_Files/uepm/msi
$FWDIR/conf/SMC_Files/uepm/DRIVERS
$FWDIR/conf/SMC_Files/uepm/DRIVERS
In R80.10 and higher, the Endpoint Security database uses online synchronization. Online synchronization synchronizes the Endpoint Security Management Servers each time the database is modified.
Online synchronization is supported on Gaia servers only.
To check the status of the first synchronization:
Run this command on each server: PgOnlineSyncUtil is_initial_load_over
When the synchronization finishes, the command output is Initial load is over
.
Whenever possible, change the Active Endpoint Security Management Server to Standby before you change the Standby Endpoint Security Management Server to Active, and check online synchronization status on the Secondary server and all Remote Help servers.
Notes -
If a High Availability configuration was exported, you must re-configure it after the import.
Best practice is to re-install all Secondary Servers and Remote Help Servers after the migrate import procedure.
Install new Secondary Servers and Remote Help Servers of the same version as the primary server and synchronize all servers.
When you change a Standby Security Management Server to Active, the new Active Security Management Server can have an older Policy Assignment Table (PAT) version than the clients. If the PAT version on the server is lower than the PAT version on the client, the client will not download policy updates.
To fix this, update the PAT number on the Active server.
To get the PAT version:
If the Active Security Management Server is available, get the last PAT version from it.
On the Active Server:
Run: uepm
patver get
If the Active Security Management Server is not available, get the last PAT version from a client that was connected to the server before it went down.
On the client computer:
HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\EndPoint Security\Device Agent
The Edit String window opens.
To change the PAT version on the server:
uepm.exe)
and set the new PAT version:uepm patver set <old_PAT_version_number> + 10
uepm patver get
You can delete a Remote Help server or a Secondary Endpoint Security Management Server. Before you do that, make sure none of the remaining servers have connectivity to the deleted entities.