vsx_util reconfigure

Description

Restores VSXClosed Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. configuration on a VSX GatewayClosed Physical server that hosts VSX virtual networks, including all Virtual Devices that provide the functionality of physical network devices. It holds at least one Virtual System, which is called VS0. or VSX Cluster MemberClosed Security Gateway that is part of a cluster. (for example, after you perform clean install after a system failure).

Syntax

vsx_util reconfigure

Important - Before you run the vsx_util commands:

Important - Before you run this command on the Management Server, you must configure specific settings on the cleanly installed VSX Gateway or VSX Cluster Member as they were:

Required Input

Comments

  • Execute the command and follow the instructions on the screen.

  • The new VSX Gateway or VSX Cluster Member:

    • Must be a new installation.

      You cannot use a VSX Gateway or VSX Cluster Member with a previous VSX configuration.

    • Must have the same hardware specifications as the original.

      Most importantly, it must have at least the same number of interfaces.

    • Must have the same Gaia OS configuration as the original.

      Most importantly, it must have the same VSX Management IP address.

Limitations

The reconfigure process does not restore the local configuration that was performed on VSX Gateway or VSX Cluster Member itself (because this configuration is not stored on the Management Server).

Important - After the reconfigure process is complete and you rebooted VSX Gateway or VSX Cluster Member, you must manually configure these settings from scratch or from backed up files.

These settings and files are not restored during the reconfigure process and you must manually configure them again:

  • Per Virtual SystemClosed Virtual Device on a VSX Gateway or VSX Cluster Member that implements the functionality of a Security Gateway. Acronym: VS. State - run the "cpconfig" command and examine the option "Per Virtual System State". The title of this option must be the same on each VSX Cluster Member - either "Enable Check Point Per Virtual System State" or "Disable Check Point Per Virtual System State". To change this configuration, enter the number of this option and follow the instructions on the screen.

    Note - Do not change the value of the kernel parameter "fwha_enable_state_machine_by_vs" in the $FWDIR/boot/modules/fwkern.conf file. The VSX Cluster changes this value automatically.

  • Any OS configuration (for example, DNS, NTP, DHCP, Dynamic Routing, DHCP Relay, and so on).

  • Backup files and Gaia snapshots saved in the past on the VSX Gateway or VSX Cluster Member.

  • Any settings manually defined in various configuration files on the VSX Gateway or VSX Cluster Member.

  • Any Check Point configuration files.

    Note - Some of these files do not exist by default. Some files are configured on each VSX Gateway and VSX Cluster Member, and some files are configured for each Virtual System.

    Note - Some of these files do not exist by default. Some files are configured on each VSX Gateway and VSX Cluster Member, and some files are configured in the context of each Virtual System.

    This list is sorted alphabetically.

    • $CVPNDIR/conf/cvpnd.C

    • $FWDIR/boot/modules/fwkern.conf

    • $FWDIR/conf/cpha_bond_ls_config.conf

    • $FWDIR/conf/cpha_specific_vlan_data.conf (see sk92784)

    • $FWDIR/conf/discntd.if

    • $FWDIR/conf/fw_fast_accel_export_configuration.conf (see sk156672)

    • $FWDIR/conf/fwaffinity.conf

    • $FWDIR/conf/fwauthd.conf

    • $FWDIR/conf/hsm_configuration.C

    • $FWDIR/conf/identity_broker.C

    • $FWDIR/conf/ipassignment.conf

    • $FWDIR/conf/local.arp (see sk30197)

    • $FWDIR/conf/malware_config

    • $FWDIR/conf/prioq.conf (see sk105762)

    • $FWDIR/conf/rad_conf.C

    • $FWDIR/conf/synatk.conf

    • $FWDIR/conf/te.conf

    • $FWDIR/conf/thresholds.conf

    • $FWDIR/conf/trac_client_1.ttm

    • $FWDIR/conf/vsaffinity_exception.conf

    • $PPKDIR/conf/simkern.conf

    • /var/ace/sdconf.rec

    • /var/ace/sdopts.rec

    • /var/ace/sdstatus.12

    • /var/ace/securid

This example shows how the VSX configuration is restored on a VSX Cluster Member.

[Expert@MDS:0]# vsx_util reconfigure

******************************************************************************************
* Note: the operation you are about to perform changes the information in the management *
* database. Back up the database before continuing.                                      *
******************************************************************************************

Enter Security Management Server/main Domain Management Server IP address (Hit 'ENTER' for 'localhost'): 192.168.3.240
Enter Administrator Name: ******
Enter Administrator Password: ******
Select VSX gateway/cluster object name:
  1)    VSX_Cluster
Select: 1


Select VSX member name to reconfigure:
  1)    VSX1_192.168.3.241
  2)    VSX2_192.168.3.242
Select: 1
You are about to perform reconfigure on VSX gateway/cluster, please read sk97552.
Are you sure you want to continue [y/n]? y
Enter Activation Key:
Retype Activation Key:


 1/10 : Certificate Revocation              [#######################################] 100%   00:00:01
 2/10 : Certificate Replacement             [#######################################] 100%   00:00:06
 3/10 : Connectivity Check                  [#######################################] 100%   00:00:05
 4/10 : Fetching Configuration              [#######################################] 100%   00:00:02
 5/10 : Verifying Configuration             [#######################################] 100%   00:00:00
 6/10 : Installing policy on: VSX_Cluster   [#######################################] 100%   00:00:21
 7/10 : Converting Gateway to VSX           [#######################################] 100%   00:02:13
 8/10 : Generating Activation Keys          [#######################################] 100%   00:00:00
 9/10 : Reconfiguring                       [#######################################] 100%   00:00:03
10/10 : Pushing Configuration               [#######################################] 100%   00:00:44

Database saved successfully.

===================== SUMMARY =====================
---- Reconfigure gateway operation completed successfully

************************************************************
IMPORTANT:
   When you are managing a VSX cluster,
   make sure that the new reconfigured member has the same number of
   IPv4, and IPv6 firewall instances as the other VSX cluster members.
   Run cpconfig command to show and edit CoreXL settings.
NOTE:
   In case of adding a new cluster member to a VSX Cluster,
   while using 'ClusterXL Virtual System Load Sharing'
   make sure to run 'vsx_util vsls' after rebooting the
   gateway in order for the Virtual Systems to become active
   on the newly added VSX cluster member.

IMPORTANT: Please reboot the gateway

************************************************************

Logging details are available at /opt/CPmds-R81.10/customers/MyDomain_Server/CPsuite-R81.10/fw1/log/vsx_util_20190917_13_16.log

[Expert@MDS:0]#