Backing Up and Restoring the System

Important:

  • You can restore a backup file on Gaia OS with the same software version, Jumbo Hotfix Accumulator, and hotfixes as installed on the source Gaia OS, on which you collected this backup file.

  • If you restored a backup on a Security Gateway / Cluster Member, install the Security Policy.

  • To back up the Quantum Maestro Orchestrator configuration, follow the instructions in sk174202.

  • Maestro Security Groups that contain different Security Appliance models do not support Gaia Backup operations (in the Global Gaia Portal or Global Gaia Clish).

    To collect or import a Gaia Backup in such a Security Group, connect directly to Gaia Portal or Gaia Clish on each Security Appliance in the Security Group.

Note - Gaia Operating System uses this template for the name of a manual backup output file regardless of the Gaia Display Format for Time and Date:

backup_--_<HostName>.<Domain>_<YYYY>_<MM>_<DD>_<HH>_<MM>_<SS>.tgz

Example for 20 May 2024, 18:04:43:

backup_--_MyGW.MyDomain.com_2024_May_20_18_04_43.tgz

Note - In addition to the regular backup file, the Gaia Operating System also creates a file with the required metadata. If you later need to upload this regular backup file to Check Point cloud (for example, Zero Touch), then you also have to upload this metadata file. The Gaia Operating System uses this template for the name of a regular backup metadata file regardless of the Gaia Display Format for Time and Date (the same file name as the regular backup file, with a different file extension):

backup_--_<HostName>.<Domain>_<YYYY>_<MM>_<DD>_<HH>_<MM>_<SS>.info

Example for 20 May 2024, 18:04:43:

backup_--_MyGW.MyDomain.com_2024_May_20_18_04_43.info

Excluding Files from the Gaia Backup

The Gaia Operating System contains backup configuration files (schema files) that control which files to collect during the backup for different software modules.

File

Software Blade / Feature

Security Gateway

Management Server,

Log Server

/var/CPbackup/schemes/cvpn.cpbak

Mobile Access

/var/CPbackup/schemes/dlp_gw.cpbak

Data Loss Prevention

/var/CPbackup/schemes/dtps.cpbak

Desktop Policy Server for SecureClients

/var/CPbackup/schemes/fg1.cpbak

QoS

/var/CPbackup/schemes/fw1.cpbak

Firewall

/var/CPbackup/schemes/fw1logs.cpbak

Firewall Logs

/var/CPbackup/schemes/ioc.cpbak

External IoC Feeds

/var/CPbackup/schemes/mgmts.cpbak

Network Management

/var/CPbackup/schemes/ppak.cpbak

SecureXL

/CPbackup/schemes/rt.cpbak

SmartReporter

/var/CPbackup/schemes/rtm.cpbak

Monitoring

/var/CPbackup/schemes/scalable_platform.cpbak

Scalable Platforms (Maestro and Chassis)

/var/CPbackup/schemes/snapshot.cpbak

Snapshot Utility

/var/CPbackup/schemes/svn.cpbak

Common Infrastructure ($CPDIR)

/var/CPbackup/schemes/system_configuration.cpbak

Gaia OS

/var/CPbackup/schemes/te.cpbak

Threat Emulation

/var/CPbackup/schemes/uepm.cpbak

Endpoint Policy Management

/var/CPbackup/schemes/vsx.cpbak

VSX

/var/CPbackup/schemes/vsx_mgmt.cpbak

VSX Policy

Step

Instructions

1

Connect to the command line on the Gaia server.

On Scalable Platforms (Maestro and Chassis), you must connect to the applicable Security Group.

2

Log in to the Expert mode.

3

Back up the current configuration file:

  • On a Security Gateway / Cluster Member / Management Server / Log Server:

    cp -v /var/CPbackup/schemes/<Name-of-File>.cpbak{,_BKP}

  • On a Scalable Platform Security Group:

    g_all cp -v /var/CPbackup/schemes/<Name-of-File>.cpbak{,_BKP}

4

Edit the current configuration file:

vi /var/CPbackup/schemes/<Name-of-File>.cpbak

5

Make the required changes in the applicable section:

  • The section <INCLUDE_FILES> controls which files to include during the backup.

  • The section <EXCLUDE_FILES> controls which files not to include during the backup.

6

Save the changes in the file and exit the editor.

7

On a Scalable Platform Security Group, copy the modified file to all Security Group Members:

asg_cp2blades /var/CPbackup/schemes/<Name-of-File>.cpbak

Backing Up and Restoring the System in Gaia Portal

Step

Instructions

1

In the navigation tree, click Maintenance > System Backup.

Refer to the Regular Backup section.

2

Click Backup.

3

Select the location of the backup file:

  • This appliance

    To keep the collected backup locally in the /var/log/CPbackup/backups/ directory.

  • Management

    To send the collected backup to the Management Server that manages this Security Gateway.

    Enter the Username and Password for the applicable SCP user.

    The Security Gateway (or Cluster Member) uploads the file to the /home/<username>/ directory on the Management Server.

    Important - Follow sk164234 to configure the Security Gateway (or Cluster Member) as a trusted host on the Management Server.

  • Private server:

    In the Protocol field, select the server type.

    • FTP

      To send the collected backup to an FTP server.

      Enter the IPv4 address, Username, Password, and Upload Path.

    • TFTP

      To send the collected backup to a TFTP server.

      Enter the IPv4 address.

    • SCP

      To send the collected backup to an SCP server.

      Enter the IPv4 address, Username, Password, and Upload Path.

      Important - First, you must follow sk164234 to configure the SCP server as a trusted host on Gaia.

  • Cloud storage

    In the Cloud type field, select the cloud vendor.

    • Amazon S3

      To send the collected backup to an Amazon S3 bucket.

      Enter the S3 Region, S3 Bucket Name, Upload Path, S3 Access Key, and S3 Secret Access Key.

    • Azure Storage

      To send the collected backup to a Microsoft Azure storage container.

      Enter the Storage Account, Storage Container, SAS Token, and Upload Path.

Important:

  • Gaia Portal does not support the change of backup file names. You can change a backup file name in the Expert mode. Make sure not to use special characters.

  • Gaia OS backup on Quantum Maestro Orchestrators does not contain the Maestro configuration files (for example, sgdb.json).

    To back up the Quantum Maestro Orchestrator configuration, use this Gaia Clish command on the Quantum Maestro Orchestrator:

    set maestro export <options>

    For a use case, see sk174202.

Step

Instructions

1

In the navigation tree, click Maintenance > System Backup.

Refer to the Regular Backup section.

2

Select the backup file.

3

Click Restore.

Step

Instructions

1

In the navigation tree, click Maintenance > System Backup.

Refer to the Regular Backup section.

2

Click Restore Remote Backup.

3

Enter the full name of the backup file on a remote server.

4

Select the location of the backup file:

  • This appliance

    To restore the collected backup from this appliance.

  • Management

    To restore the collected backup from the Management Server that manages this Security Gateway.

  • Private server:

    In the Protocol field, select the server type.

    • FTP

      To restore the collected backup from an FTP server.

      Enter the IPv4 address, Username, Password, and Upload Path.

    • TFTP

      To restore the collected backup from a TFTP server

      Enter the IPv4 address.

    • SCP

      To restore the collected backup from an SCP server.

      Enter the IPv4 address, Username, Password, and Upload Path.

  • Cloud storage

    In the Cloud type field, select the cloud vendor.

    • Amazon S3

      To restore the collected backup from an Amazon S3 bucket.

      Enter the S3 Region, S3 Bucket Name, Upload Path, S3 Access Key, and S3 Secret Access Key.

    • Azure Storage

      To restore the collected backup from a Microsoft Azure storage container.

      Enter the Storage Account, Storage Container, SAS Token, and Upload Path.

5

Click Restore.

Step

Instructions

1

In the navigation tree, click Maintenance > System Backup.

Refer to the Regular Backup section.

2

Select the backup file.

3

Click Export.

4

Click OK to confirm.

Make sure you have enough free disk space on your computer.

Step

Instructions

1

In the navigation tree, click Maintenance > System Backup.

Refer to the Regular Backup section.

2

Select the backup file.

3

Click Import.

4

Click Browse and select the backup file on your computer.

5

Click Import.

Step

Instructions

1

In the navigation tree, click Maintenance > System Backup.

Refer to the Regular Backup section.

2

Select the backup file.

3

Click Delete.

4

Click OK to confirm.

Backing Up the System in Gaia Clish

Syntax

add backup local [interactive]

add backup scp ip <IPv4 Address of SCP Server> path <Path on SCP Server> username <Username on SCP Server> [password <Password in Plain Text>] [interactive]

add backup ftp ip <IPv4 Address of FTP Server> path <Path on FTP Server> username <Username on FTP Server> [password <Password in Plain Text>] [interactive]

add backup tftp ip <IPv4 Address of TFTP Server> [interactive]

add backup aws region <AWS S3 Region> bucket <AWS S3 Bucket> path <Path in AWS S3 Bucket> access-key <AWS S3 Access Key> secret-access-key <AWS S3 Secret Access Key> [interactive]

add backup aws region <AWS S3 Region> bucket <AWS S3 Bucket> path <Path in AWS S3 Bucket> access-key <AWS S3 Access Key> secret-access-key <AWS S3 Secret Access Key> security-token <AWS S3 Security Token> [interactive]

add backup azure storage <Azure Storage> container <Azure Container> path <Path in Azure Container> sas-token <Azure SAS Token> [interactive]

show backup {last-successful | logs | status}

show backups

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently. Scalable Platforms save the changes automatically.

Important:

  • Gaia Clish does not support the change of backup file names. You can change a backup file name in the Expert mode. Make sure not to use special characters.

MyGW> add backup local

Creating backup package. Use the command 'show backups' to monitor creation progress.

MyGW>

MyGW> show backup status

Performing local backup

MyGW>

MyGW> show backups

backup_--_MyGW.MyDomain.com_2024_May_20_18_04_43.tgz Mon, May 20, 2024 109.73 MB

MyGW>

Restoring the System in Gaia Clish

Syntax

set backup restore local<SPACE><TAB>

set backup restore scp ip <IPv4 Address of SCP Server> path <Path on SCP Server> file <Name of Backup File> username <Username on SCP Server> [password <Password in Plain Text>] [interactive]

set backup restore ftp ip <IPv4 Address of FTP Server> path <Path on FTP Server> file <Name of Backup File> username <Username on FTP Server> [password <Password in Plain Text>] [interactive]

set backup restore tftp ip <IPv4 Address of TFTP Server> file <Name of Backup File> [interactive]

set backup restore aws region <AWS S3 Region> bucket <AWS S3 Bucket> path <Path in AWS S3 Bucket> file <Name of Backup File> access-key <AWS S3 Access Key> secret-access-key <AWS S3 Secret Access Key> [interactive]

set backup restore aws region <AWS S3 Region> bucket <AWS S3 Bucket> path <Path in AWS S3 Bucket> file <Name of Backup File> access-key <AWS S3 Access Key> secret-access-key <AWS S3 Secret Access Key> security-token <AWS S3 Security Token> [interactive]

set backup restore azure storage <Azure Storage> container <Azure Container> path <Path in Azure Container> file <Name of Backup File> sas-token <Azure SAS Token> [interactive]

Note - To restore the Gaia OS configuration quickly after a system failure or migration, use the Gaia Clish "configuration" feature (see Working with System Configuration in Gaia Clish).