Migrating Database from an R7x Standalone to an R80.40 Domain Management Server

Migration from a Standalone to a Domain Management Server is supported only from R7x versions to a Domain Management Server on a Multi-Domain Server R80.20 or higher.

To do this, you have to separate the Security Management Server and Security Gateway on the R7x Standalone. Then you manage the former Standalone as a Security Gateway only, from the R80.40 Domain Management Server.

Important - Before you migrate the database:

Step

Instructions

1

Make sure that the target Domain Management Server can communicate with all the Security Gateways managed by the R7x Standalone.

2

Back up your current configuration (see Backing Up and Restoring).

Procedure:

  1. Step

    Instructions

    1

    Connect with R7x SmartDashboard to the R7x Standalone.

    2

    Create a new Check Point Host object to represent the R80.40 Domain Management Server and define it as a Secondary Security Management Server.

    1. Create the object in one of these ways:

      • From the top toolbar, click the New () > More > Check Point Host.

      • In the top left corner, click Objects menu > More object types > Network Object > Gateways & Servers > New Check Point Host.

      • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Check Point Host.

    2. In the Name field, enter the applicable name.

    3. In the IPv4 Address and IPv6 Address fields, enter the applicable IP addresses of the R80.40 Domain Management Server.

    4. In the Platform section:

      • In the Hardware field, select the applicable option

      • In the Version field, select the highest version.

      • In the OS field, select Gaia

    5. Do not initialize the SIC communication.

    6. On the General Properties page, click the Management tab.

      Make sure the Secondary Server is selected and grayed out.

    7. Click OK.

    3

    Create the applicable Firewall rules in all applicable policies to allow the new Check Point Host object (that represents the R80.40 Domain Management Server) to communicate with all managed Security Gateways.

    4

    Install the Network Security policies on all managed Security Gateways.

    5

    Delete the new Check Point Host object (that represents the R80.40 Domain Management Server) and the Firewall rules created in Steps 2 - 4.

    6

    Save the changes (click File > Save).

  2. Step

    Instructions

    1

    If the R7x Standalone object participates in a VPN community, remove it from the VPN community and delete its certificate.

    Note these settings, to configure them again after the migration.

    2

    Remove the R7x Standalone object from the Install On column in all policies.

    3

    Open the R7x Standalone object.

    4

    Click General Properties page > Network Security tab.

    5

    Clear all the Software Blades.

    6

    Click OK.

    7

    Save the changes (click File > Save).

    8

    Do not install the Network Security policy on the R7x Standalone object.

    9

    Close the SmartDashboard.

  3. Step

    Instructions

    1

    Download the R80.40 Management Server Migration Tool from the R80.40 Home Page SK (see Management Server Migration Tool and Upgrade Tools).

    2

    Transfer the R80.40 Management Server Migration Tool package to the current server to some directory (for example, /var/log/path_to_migration_tool/).

    Note - Make sure to transfer the file in the binary mode.

  4. Step

    Instructions

    1

    Connect to the command line on the R7x Standalone.

    2

    Log in to the Expert mode.

    3

    Go to the directory, where you put the R80.40 Management Server Migration Tool package:

    cd /var/log/path_to_migration_tool/

    4

    Extract the R80.40 Management Server Migration Tool package:

    tar zxvf <Name of Management Server Migration Tool Package>.tgz

    5

    Export the entire management database:

    yes | nohup ./migrate export [-f] [-n] /<Full Path>/<Name of R7x StandAlone Exported File>

    For details, see the R80.40 CLI Reference Guide - Chapter Security Management Server Commands - Section migrate.

    6

    Calculate the MD5 for the exported database file:

    md5sum /<Full Path>/<Name of R7x StandAlone Exported File>.tgz

    7

    Transfer the exported database from the R7x Standalone to an external storage:

    /<Full Path>/<Name of R7x StandAlone Exported File>.tgz

    Note - Make sure to transfer the file in the binary mode.

  5. Step

    Instructions

    1

    Connect to the command line on the R80.40 Multi-Domain Server.

    2

    Log in to the Expert mode.

    3

    Create a new Domain Management Server:

    Note - This is one long command will multiple parameters.

    mgmt_cli --root true add domain name <Name of New Domain> comments "<Desired Comment Text>" servers.ip-address <IPv4 Address of New Domain> servers.name <Name of New Domain Management Server> servers.multi-domain-server <Name of R80.40 Multi-Domain Server> servers.skip-start-domain-server true

    For more information, see the Check Point Management API Reference - mgmt_cli tool - Chapter Multi-Domain - Section Domain - Subsection add domain.

    Important - After you create the new Domain with this command, do not change the Domain IPv4 address until you run the "cma_migrate" command.

  6. Step

    Instructions

    1

    Transfer the exported R7x Standalone management database from an external storage to the R80.40 Multi-Domain Server, to some directory.

    Note - Make sure to transfer the file in the binary mode.

    2

    Make sure the transferred file is not corrupted.

    Calculate the MD5 for the transferred file and compare it to the MD5 that you calculated on the R7x Standalone:

    md5sum /<Full Path>/<Name of R7x StandAlone Exported File>.tgz

  7. Step

    Instructions

    1

    Unset the shell idle environment variable:

    unset TMOUT

    2

    Import the R7x Standalone management database:

    cma_migrate /<Full Path>/<Name of R7x StandAlone Exported File>.tgz /<Full Path>/<$FWDIR Directory of the New Domain Management Server>/

    Example:

    cma_migrate /var/log/orig_R7x_database.tgz /opt/CPmds-R80.40/customers/MyDomain3/CPsuite-R80.40/fw1/

    Note - This command updates the database schema before it imports. First, the command runs pre-upgrade verification. If no errors are found, migration continues. If there are errors, you must fix them on the source R7x Standalone according to instructions in the error messages. Then do this procedure again.

  8. Important:

    • This step applies if the new R80.40 Domain Management Server has a different IPv4 address than the source R7x Standalone.

    • In a Cluster, you must configure all the Cluster Members in the same way.

    When a Management Server and a managed Security Gateway establish SIC Trust, the Security Gateway saves the IP address of the Internal Certificate Authority (ICA) of its Management Server. The Security Gateway uses this IP address for Automatic Certificate Renewal process when the certificate on the Security Gateway expires.

    To force the Security Gateway to update the saved IP address of the Management Server's ICA, follow one of these procedures:

    Warning:

    • In Cluster, this procedure can cause a failover.

    • Until Check Point processes restart, traffic does not pass through the Security Gateway (Cluster Member).

    For more information, see sk65764: How to reset SIC.

    1. Connect to the command line on the Security Gateway (every Cluster Member).

    2. Start the Check Point Configuration Tool. Run:

      cpconfig

    3. Choose the option Secure Internal Communication from the menu - enter 5 press the Enter key.

      Follow the instructions on the screen to re-initialize the communication and to enter the Activation Key.

    4. Exit the Check Point Configuration Tool.

    5. Wait for Check Point processes to restart.

    6. Connect with SmartConsole to the Management Server that manages the Security Gateway (Cluster) object.

    7. From the left navigation panel, click Gateways & Servers.

    8. Double-click the Security Gateway (Cluster) object.

    9. From the left tree, click General Properties.

      In a Cluster object, click Cluster Members and edit every Cluster Member object.

    10. Click Communication.

    11. Click Reset.

    12. Enter the same Activation Key you entered on the Security Gateway (Cluster Member).

    13. Click Initialize.

    14. The Trust State field must show Trust established.

    15. Click Close.

    16. Click OK.

    17. Publish the SmartConsole session.

    18. Install the Access Control Policy on the Security Gateway (Cluster) object.

    For more information, see sk103356: How to renew SIC after changing IP Address of Security Management Server.

    1. Connect to the command line on the Security Gateway (every Cluster Member).

    2. Log in to the Expert mode.

    3. Back up the current $CPDIR/registry/HKLM_registry.data file:

      cp -v $CPDIR/registry/HKLM_registry.data{,_BKP}

    4. Edit the current $CPDIR/registry/HKLM_registry.data file:

      vi $CPDIR/registry/HKLM_registry.data

    5. Search for:

      :ICAip

      Example of the applicable section:

      : (SIC
    :ICAdn ("O=R80.40-Manager..ntk6rk")
    :MySICname ("CN=R80.40-MyGW,O=R80.40-Manager..ntk6rk")
    :HasCertificate ("[4]1")
    :CertPath ("/opt/CPshrd-R80.40/conf/sic_cert.p12")
    :ICAip (192.168.41.80)

    6. Change the value of the ":ICAip" to the new IP address.

    7. Save the changes in the file and exit the editor.

  		9.

    Important - This step applies if the original R7x Standalone managed VPN gateways.

    There can be an issue with the IKE certificates after you migrate the management database, if a VPN tunnel is established between a Check Point Security Gateway and an externally managed, third-party gateway.

    The VPN Security Gateway presents its IKE certificate to its peer.

    The third-party gateway uses the FQDN of the certificate to retrieve the host name and IP address of the Certificate Authority.

    If the IKE certificate was issued by a Check Point Internal CA, then the FQDN contains the host name of the original Management Server.

    The peer gateway will fail to contact the original server and will not accept the certificate.

    To fix:

    • Update the external DNS server to resolve the host name to the IP address of the applicable Domain Management Server.

    • Revoke the IKE certificate for the Security Gateway and create a new one.

  10. The Domain Management Server object represents the Management Server component of the R7x Standalone.

    Step

    Instructions

    1

    Connect with SmartConsole to the R80.40 Domain Management Server.

    2

    From the left navigation panel, click Gateways & Servers.

    3

    Locate these objects:

    • An object with the Name and IP address of the Domain Management Server.

      Previous references to the R7x Standalone object now refer to this object.

    • An object for each Security Gateway managed previously by the R7x Standalone.

    4

    Open the Domain Management Server object.

    5

    From the left navigation tree, click Network Management.

    6

    Delete all interfaces:

    1. Select each interface.

    2. Click Actions > Delete Interface.

    3. Click Yes.

    7

    Click OK.

    8

    Publish the SmartConsole session.

  11. You must create a new Security Gateway object to represent the Gateway component of the R7x Standalone.

    This new Security Gateway object represents the separate Security Gateway.

    Step

    Instructions

    1

    Connect with SmartConsole to the R80.40 Domain Management Server.

    2

    From the left navigation panel, click Gateways & Servers.

    3

    Create a new Security Gateway object (that represents the Gateway component of the R7x Standalone) in one of these ways:

    • From the top toolbar, click the New () > Gateway.

    • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > New Gateway.

    • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Gateway.

    4

    In the Check Point Security Gateway Creation window, click Classic Mode.

    Check Point Gateway properties window opens on the General Properties page.

    5

    In the Name field, enter the applicable name for this Security Gateway object.

    6

    In the IPv4 address (and IPv6 address) field, enter some dummy IP address.

    Later, you change this IP address to the real IP address.

    7

    Do not establish the Secure Internal Communication.

    8

    In the Platform section, select the correct options:

    1. In the Hardware field:

      • If you install the Security Gateway on a Check Point Appliance, select the correct appliances series.

      • If you install the Security Gateway on an Open Server, select Open server.

    2. In the Version field, select R80.40.

    3. In the OS field, select Gaia.

    9

    On the General Properties page:

    • On the Network Security tab, enable the applicable Software Blades.

    • On the Threat Prevention tab, enable the applicable Software Blades.

    10

    Click OK.

    11

    Publish the SmartConsole session.

  12. You must install a separate Security Gateway to represent the Gateway component of the R7x Standalone.

    You can install the Security Gateway from scratch on the former R7x Standalone server.

    Step

    Instructions

    A

    Install the Gaia Operating System:

    B

    Follow Configuring Gaia for the First Time.

    C

    During the First Time Configuration Wizard, you must configure these settings:

    • In the Installation Type window, select Security Gateway and/or Security Management.

    • In the Products window:

      1. In the Products section, select Security Gateway only.

      2. In the Clustering section, clear Unit is a part of a cluster, type.

    • In the Dynamically Assigned IP window, select the No.

    • In the Secure Internal Communication window, enter the applicable Activation Key (between 4 and 127 characters long).

  13. Step

    Instructions

    1

    Connect with SmartConsole to the new R80.40 Domain Management Server.

    2

    From the left navigation panel, click Gateways & Servers.

    3

    Open the Security Gateway object that represents the Gateway component of the R7x Standalone.

    4

    In the IPv4 address and IPv6 address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Security Gateway's First Time Configuration Wizard.

    Make sure the Security Management Server or Multi-Domain Server can connect to these IP addresses.

    5

    Establish the Secure Internal Communication (SIC) between the Management Server and this Security Gateway:

    1. Near the Secure Internal Communication field, click Communication.

    2. In the Platform field:

      • Select Open server / Appliance for all Check Point models 3000 and higher.

      • Select Open server / Appliance for an Open Server.

    3. Enter the same Activation Key you entered during the Security Gateway's First Time Configuration Wizard.

    4. Click Initialize.

    5. Click OK.

     

    If the Certificate state field does not show Established, perform these steps:

    1. Connect to the command line on the Security Gateway.

    2. Make sure there is a physical connectivity between the Security Gateway and the Management Server (for example, pings can pass).

    3. Run:

      cpconfig

    4. Enter the number of this option:

      Secure Internal Communication

    5. Follow the instructions on the screen to change the Activation Key.

    6. In SmartConsole, click Reset.

    7. Enter the same Activation Key you entered in the cpconfig menu.

    8. In SmartConsole, click Initialize.

    6

    Click OK.

    7

    Publish the SmartConsole session.

  14. You must create a new Security Gateway object to represent the Gateway component of the R7x Standalone.

    This new Security Gateway object represents the separate Security Gateway.

    Step

    Instructions

    1

    Connect with SmartConsole to the new R80.40 Domain Management Server.

    2

    From the left navigation panel, click Security Policies.

    3

    In all existing policies, replace the R7x Standalone object with the new Security Gateway object that represents the Gateway component of the R7x Standalone.

    4

    Publish the SmartConsole session.

    5

    Install the Access Control Policy on all applicable Security Gateways.

    5

    Install the Threat Prevention Policy on all applicable Security Gateways.