Print Download PDF Send Feedback

Previous

Next

Migrating Database from an R80.30 Security Management Server to an R80.30 Domain Management Server

Starting from Take 135 of R80.30 Jumbo Hotfix Accumulator (PRJ-5250), you can export the entire management database from a Domain Management Server on an R80.30Multi-Domain Server and import it on an R80.30Security Management Server.

For the list of known limitations, see sk156072.

Prerequisites on the source Domain Management Server:

Prerequisites on the target Security Management Server:

Workflow:

  1. On the source R80.30 Domain Management Server, export the database.
  2. Transfer the export file to the target R80.30 Security Management Server.
  3. On the target Security Management Server, import the Domain Management Server database.
  4. Configure and assign the Administrators and GUI clients.
  5. Stop the source R80.30 Domain Management Server.
  6. Test the functionality on the target R80.30 Security Management Server.
  7. Install policy on all managed Security Gateways and Clusters.
  8. Delete the source R80.30 Domain Management Server.
  9. Delete the special Access Control rule you added before migration.

Step 1 of 9: On the source R80.30 Domain Management Server, export the database

Step

Description

1

Run this API:

migrate-export-domain

For API documentation, see the Check Point Management API Reference - search for migrate-export-domain.

Example:

mgmt_cli migrate-export-domain domain "MyDomain3" file-path "/var/log/MyDomain3_Export.tgz" include-logs "false"

2

Calculate the MD5 of the export file:

md5sum <Full Path to Export File>.tgz

Step 2 of 9: Transfer the export file to the target R80.30 Security Management Server

Step

Description

1

Transfer the export file from the source Multi-Domain Server to the target Security Management Server, to some directory.

Note - Make sure to transfer the file in the binary mode.

2

Make sure the transferred file is not corrupted.

Calculate the MD5 for the transferred file and compare it to the MD5 that you calculated on the source Multi-Domain Server:

md5sum <Full Path to Export File>.tgz

Step 3 of 9: On the target Security Management Server, import the Domain Management Server database

Step

Description

1

Connect to the command line.

2

Log in to the Expert mode.

3

In a plain-text editor, prepare the applicable syntax for your environment:

$MDS_FWDIR/scripts/migrate_import_domain.sh -sn <Name of New Security Management Server> -dsi <IP Address of New Security Management Server> -o <Full Path to Exported File>.tgz [-skip_logs]

Where:

  • -sn <Name of New Security Management Server>

    Specifies a new name of the new Security Management Server object.

  • -dsi <IP Address of New Security Management Server>

    Specifies a new IP Address of the new Security Management Server object.

  • -o <Full Path to Exported File>.tgz

    Specifies the full path to the export file you transferred from the source R80.30 Multi-Domain Server.

  • -skip_logs

    Optional. Specifies not to import log files $FWDIR/log/fw.*log.

4

On the target Security Management Server, run the $MDS_FWDIR/scripts/migrate_import_domain.sh script with the syntax you prepared.

Step 4 of 9: Configure and assign the Administrators and GUI clients

Configure the Multi-Domain Server Administrators and GUI clients:

  1. Run the cpconfig command
  2. Configure the Administrators
  3. Configure the GUI clients
  4. Exit the cpconfig menu

Step 5 of 9: Stop the source R80.30 Domain Management Server

Step

Description

1

Connect to the command line on the source Multi-Domain Server.

2

Stop the source Domain Management Server you migrated:

mdsstop_customer <IP address or Name of Domain Management Server>

Step 6 of 9: Test the functionality on the target R80.30 Security Management Server

Step

Description

1

Connect with SmartConsole to the target Security Management Server.

2

Make sure the management database and configuration were imported correctly.

Step 7 of 9: Install policy on all managed Security Gateways and Clusters

Install the applicable policies on all managed Security Gateways and Clusters.

Step 8 of 9: Delete the source R80.30 Domain Management Server

Make sure you backed up the Multi-Domain Server. See Backing Up and Restoring.

Step

Description

1

Connect with SmartConsole to the source Multi-Domain Server to the MDS context.

2

From the left navigation panel, click Multi Domain > Domains.

3

Right-click the Domain Management Server object you migrated and select Delete.

Step 9 of 9: Delete the special Access Control rule you added before migration

Important - This step applies only if the target Security Management Server has a different IP address than the source Domain Management Server.

Step

Description

1

Connect with SmartConsole to the Domain Management Server.

2

In each Security Policy, delete the Access Control rule with the new Host object you added on the source Security Management Server before migration.

3

Delete the Host object you added on the source Security Management Server before migration.

4

Install the applicable policies on all managed Security Gateways and Clusters.