Changing the IP Address of a Multi-Domain Server or Multi-Domain Log Server

This procedure lets you change the current IP Address of a Multi-Domain Server Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. or Multi-Domain Log Server Dedicated Check Point server that runs Check Point software to store and process logs in a Multi-Domain Security Management environment. The Multi-Domain Log Server consists of Domain Log Servers that store and process logs from Security Gateways that are managed by the corresponding Domain Management Servers. Acronym: MDLS..

Note - In environments with multiple Multi-Domain Servers or Multi-Domain Log Servers, perform the procedure for each applicable Multi-Domain Server or Multi-Domain Log Server Dedicated Check Point server that runs Check Point software to store and process logs..

Procedure:

1. Back up the current R81.10 Multi-Domain Server or Multi-Domain Log Server

   See Backing Up and Restoring.

2. Change the IP address on the applicable interface

   Note - This step applies only if it is necessary to use the same physical interface, but with a different IP address.

   See the R81.10 Gaia Administration Guide > Chapter Network Management > Section Network Interfaces > Section Physical Interfaces.

3. Install the new license for the new IP address

   Step	Instructions
   1	Connect to your Check Point User Center account.
   2	Issue a new license for the new IP address of your Multi-Domain Server or Multi-Domain Log Server.
   3	Get the new license and Support Contract.
   4	Install the new license and Support Contract in the MDS context on your Multi-Domain Server or Multi-Domain Log Server. See Working with Licenses.

4. Connect to the command line on the Multi-Domain Server or Multi-Domain Log Server

   Step	Instructions
   1	Connect over SSH, or serial console.
   2	Log in with the superuser credentials.
   3	Log in to the Expert mode.
   4	Go to the MDS context: mdsenv

5. Stop all processes in the MDS context

   Step	Instructions
   1	Stop all processes in the MDS context: mdsstop -m Important - While these process are stopped, SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. cannot connect.
   2	Make sure all processes stopped in the MDS context: mdsstat -m All the daemons (FWM, FWD, CPD, and CPCA) must be in the state "down".

6. Change the IP address in the MDS database

   Important - This step applies only if the MDS object already exists in the database. For example, this step does not apply to a new Secondary Multi-Domain Server or Multi-Domain Log Server in a clean installation.

   Step	Instructions
   1	Change the IP address: $MDSDIR/bin/mdscmd change-mds-ip <Current IP Address> <New IP Address> ipv4 -x Example: $MDSDIR/bin/mdscmd change-mds-ip 192.168.20.30 172.30.40.50 ipv4 -x
   2	Make sure the IP address is updated in the dleobjectderef_data database: Save the applicable data from this database to a file: psql_client -c "select fwset from dleobjectderef_data where cpmitable='mdss' and not deleted and dlesession=0" -o /tmp/dleobject.txt cpm postgres Examine the IP address: cat /tmp/dleobject.txt | egrep -w 'name|ipaddr' Example output: :name (My_MDS_Server) :ipaddr (172.30.40.50)
   3	Make sure the IP address is updated in the cpnetworkobject_data database: Save the applicable data from this database to a file: psql_client -c "select name, ipaddress4 from cpnetworkobject_data where not deleted and dlesession=0" -o /tmp/cpnetworkobject.txt cpm postgres Examine the IP address: cat /tmp/cpnetworkobject.txt Example output: name | ipaddress4 ---------------+-------------- My_MDS_Server | 172.30.40.50

7. Modify the $MDSDIR/conf/external.if file

   Important: This step applies if you change the Leading Interface to another physical interface. This step applies if you migrated the entire management database from a source Multi-Domain Server or Multi-Domain Log Server to a target Multi-Domain Server or Multi-Domain Log Server, and the target server uses a different external interface (for example, eth0 on the source server and eth1 on the target server).

   Step	Instructions
   1	Back up the current $MDSDIR/conf/external.if file: cp -v $MDSDIR/conf/external.if{,_BKP}
   2	Edit the current $MDSDIR/conf/external.if file: vi $MDSDIR/conf/external.if
   3	Change the current interface name to the name of the applicable main interface. This is the interface, on which you configured the main IPv4 address of your Multi-Domain Server or Multi-Domain Log Server.
   4	Save the changes and exit the Vi editor.
   5	Go to the context of each existing Domain Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server.: mdsenv <IP Address or Name of Domain Management Server>
   6	Back up the current $FWDIR/conf/vip_index.conf file: cp -v $FWDIR/conf/vip_index.conf{,_BKP}
   7	Edit the current $FWDIR/conf/vip_index.conf file: vi $FWDIR/conf/vip_index.conf
   8	Change the current interface name to the name of the applicable main interface. This is the interface, on which you configured the main IPv4 address of your Multi-Domain Server or Multi-Domain Log Server.
   9	Save the changes and exit the Vi editor.

8. Modify the $MDSDIR/conf/LeadingIP file

   Step	Instructions
   1	Back up the current $MDSDIR/conf/LeadingIP file: cp -v $MDSDIR/conf/LeadingIP{,_BKP}
   2	Edit the current file: vi $MDSDIR/conf/LeadingIP
   3	Change the current IP address to the new IP address.
   4	Save the changes in the file and exit the editor.

9. Modify the $MDSDIR/conf/mdsdb/mdss.C file

   Step	Instructions
   1	Back up the current $MDSDIR/conf/mdsdb/mdss.C file: cp -v $MDSDIR/conf/mdsdb/mdss.C{,_BKP}
   2	Edit the current $MDSDIR/conf/mdsdb/mdss.C file: vi $MDSDIR/conf/mdsdb/mdss.C
   3	Find the object of your Multi-Domain Server or Multi-Domain Log Server that has the current IP address.
   4	Change the object's IP address to the new IP address.
   5	Do not change the object's name.
   6	Save the changes in the file and exit the editor.

10. Modify the $SMARTLOGDIR/smartlog_settings.txt file

    Step	Instructions
    1	Back up the current $SMARTLOGDIR/smartlog_settings.txt file: cp -v $SMARTLOGDIR/smartlog_settings.txt{,_BKP}
    2	Edit the current file: vi $SMARTLOGDIR/smartlog_settings.txt
    3	Change the current IP address to the new IP address in these parameters: Parameter :server_port () Section :connections > Section :domain > Section :management > Parameter :name () Section :connections > Section :domain > Section :log_servers > Parameter :name ()
    4	Save the changes in the file and exit the editor.

11. Modify the $INDEXERDIR/log_indexer_custom_settings.conf file

    Step	Instructions
    1	Back up the current $INDEXERDIR/log_indexer_custom_settings.conf file: cp -v $INDEXERDIR/log_indexer_custom_settings.conf{,_BKP}
    2	Edit the current file: vi $INDEXERDIR/log_indexer_custom_settings.conf
    3	Change the current IP address to the new IP address in these parameters: Parameter :server_port () Section :connections > Section :domain > Section :management > Parameter :name () Section :connections > Section :domain > Section :log_servers > Parameter :name ()
    4	Save the changes in the file and exit the editor.

12. Start all processes in the MDS context

    Step	Instructions
    1	Start all processes in the MDS context: mdsstart -m
    2	Make sure all processes started in the MDS context: mdsstat -m All the daemons (FWM, FWD, CPD, and CPCA) must be in the state "up" and show their PID.

13. Change the IP addresses of all existing Domain Management Servers and Domain Log Servers

    Follow Changing the IP Address of a Domain Management Server or Domain Log Server.