Migrating Database from an R81 Domain Management Server to an R81 Security Management Server

This procedure lets you export the entire management database from a Domain Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. on an R81 Multi-Domain Server Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. and import it on an R81 Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server..

For the list of known limitations, see sk156072.

Prerequisites on the source Domain Management Server:

• Back up the current Multi-Domain Server. See Backing Up and Restoring.

• Make sure to publish all changes you wish to migrate.

• Close the active Security log ($FWDIR/log/fw.log) and Audit log ($FWDIR/log/fw.adtlog) files:

  mdsenv <Name or IP Address of Domain Management Server> fw logswitch fw logswitch -audit

• If the target Security Management Server must have a different IP address than the source Domain Management Server, then you must prepare the source database before the export.

  Instructions in SmartConsole

  1. Create a new Host object with the new IP address of the target Security Management Server.

  2. In each Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection., add a new Access Control rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. to allow specific traffic from the Host object with new IP address to all managed Security Gateways and Clusters.

     No	Name	Source	Destination	VPN	Services & Applications	Action	Track	Install On
     1	Traffic from new Security Management Server to managed Gateways	Host object with new IP address	Applicable objects of managed Security Gateways and Clusters	Any	FW1 FW1_CPRID CPD	Accept	None	Policy Targets

     Notes: You must use the pre-defined Check Point services. If the source Domain Management Server manages VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Gateways or VSX Clusters, you must also add this Access Control rule to their default VSX policies. These default policies are called: <Name of VSX Gateway or VSX Cluster Object>_VSX

  3. Install all updated Access Control Policies.

Prerequisites on the target Security Management Server:

• Perform a clean install of an R81 Security Management Server.

  See Installing One Security Management Server only, or Primary Security Management Server in Management High Availability.

• Make sure you install the required license.

Procedure:

1. On the source R81 Multi-Domain Server, export the Domain Management Server

   1. Run this API:

      migrate-export-domain

      For API documentation, see the Check Point Management API Reference - search for migrate-export-domain.

      Example:

      mgmt_cli -d "System Data" migrate-export-domain domain "MyDomain3" file-path "/var/log/MyDomain3_Export.tgz" include-logs "false"

      Important - The option -d "System Data" is mandatory.

   2. Calculate the MD5 of the export file:

      md5sum /<Full Path to Export File>.tgz

2. Transfer the export file to the target R81 Security Management Server

   1. Transfer the export file from the source Multi-Domain Server to the target Security Management Server, to some directory.

      Note - Make sure to transfer the file in the binary mode.

   2. Make sure the transferred file is not corrupted.

      Calculate the MD5 for the transferred file and compare it to the MD5 that you calculated on the source Multi-Domain Server:

      md5sum /<Full Path>/<Name of Exported File>.tgz

3. On the target R81 Security Management Server, import the Domain Management Server database

   Step	Instructions
   1	Connect to the command line the target Security Management Server.
   2	Log in to the Expert mode.
   3	Go to the $MDS_FWDIR/scripts/ directory: cd $MDS_FWDIR/scripts/
   4	Import the management database: If this Security Management Server is connected to the Internet: ./migrate_server migrate_import_domain -v R81 [-l | -x] /<Full Path>/<Name of Exported File>.tgz If this Security Management Server is not connected to the Internet: ./migrate_server migrate_import_domain -v R81 -skip_upgrade_tools_check [-l | -x] /<Full Path>/<Name of Exported File>.tgz For details, see the R81 CLI Reference Guide - Chapter Security Management Server Commands - Section migrate_server.
   5	Make sure that all the required daemons (FWM, FWD, CPD, and CPM) are in the state "E" and show their PID: cpwd_admin list If some of the required daemons on the Security Management Server are in the state "T", then wait for 5-10 minutes, restart the Security Management Server and check again. Run these two commands: cpstop cpstart

4. Configure and assign the Administrators and GUI clients

   You must again configure the Security Management Server Administrators and GUI clients.

   1. Run the cpconfig command.

   2. Configure the Administrators.

   3. Configure the GUI clients.

   4. Exit the cpconfig menu.

5. Stop the source R81 Domain Management Server

   1. Connect to the command line on the source Multi-Domain Server.

   2. Stop the source Domain Management Server you migrated:

      mdsstop_customer <IP address or Name of Domain Management Server>

6. Test the functionality on the target R81 Security Management Server

   1. Connect with SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the target Security Management Server.

   2. Make sure the management database and configuration were imported correctly.

7. Install policy on all managed Security Gateways and Clusters

   In SmartConsole, install the applicable policies on all managed Security Gateways and Clusters.

8. Delete the source R81 Domain Management Server

   Make sure you backed up the Multi-Domain Server. See Backing Up and Restoring.

   1. Connect with SmartConsole to the source Multi-Domain Server to the MDS context.

   2. From the left navigation panel, click Multi Domain > Domains.

   3. Right-click the Domain Management Server object you migrated and select Delete.

9. Delete the special Access Control rule you added before migration

   Important - This step applies only if the target Security Management Server has a different IP address than the source Domain Management Server.

   1. Connect with SmartConsole to the target Security Management Server.

   2. In each Security Policy, delete the Access Control rule with the new Host object you added on the source Domain Management Server before migration.

   3. Delete the Host object you added on the source Domain Management Server before migration.

   4. Install the applicable policies on all managed Security Gateways and Clusters.