https://community.checkpoint.com/t5/Firewall-and-Security-Management/Rules-Migration-from-Smart-1-Cloud-Management-to-Onpremise/m-p/276336#M105162 <P>Hello everyone,</P><P>I have the following scenario:</P><P>- Cloudguard R81.20 Cluster (Active/Standby). Created by Marketplace.</P><P>- Smart-1 Cloud on portal.checkpoint.com</P><P>I'm working on migrating a Manager from Smart-1 Cloud to an on-premise Manager. I created all the rules, NATs, and VPNs in the new management system and got everything ready for the day of the Manager change. During the change, I successfully performed the SIC with the Cloudguard Firewall and applied the policy.</P><P>However, when I made the change, I noticed that some services were not working correctly. One of the VPNs did not start, and other services that use the Azure environment also stopped. I restarted the gateway and the VM, and I noticed an improvement in connectivity, but still without establishing an important Site-to-Site VPN (between checkpoints); only phase-1 was established.</P><P>I would like to know if anyone has experienced a situation like this and what measures I can take to avoid this problem in the next change. I'm thinking of setting up a parallel environment so I can work on the change more safely, but I wanted to know if you had any details to share.</P> Thu, 30 Apr 2026 19:15:19 GMT jslimma_soloiro 2026-04-30T19:15:19Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Rules-Migration-from-Smart-1-Cloud-Management-to-Onpremise/m-p/276336#M105162 <P>Hello everyone,</P><P>I have the following scenario:</P><P>- Cloudguard R81.20 Cluster (Active/Standby). Created by Marketplace.</P><P>- Smart-1 Cloud on portal.checkpoint.com</P><P>I'm working on migrating a Manager from Smart-1 Cloud to an on-premise Manager. I created all the rules, NATs, and VPNs in the new management system and got everything ready for the day of the Manager change. During the change, I successfully performed the SIC with the Cloudguard Firewall and applied the policy.</P><P>However, when I made the change, I noticed that some services were not working correctly. One of the VPNs did not start, and other services that use the Azure environment also stopped. I restarted the gateway and the VM, and I noticed an improvement in connectivity, but still without establishing an important Site-to-Site VPN (between checkpoints); only phase-1 was established.</P><P>I would like to know if anyone has experienced a situation like this and what measures I can take to avoid this problem in the next change. I'm thinking of setting up a parallel environment so I can work on the change more safely, but I wanted to know if you had any details to share.</P> Thu, 30 Apr 2026 19:15:19 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Rules-Migration-from-Smart-1-Cloud-Management-to-Onpremise/m-p/276336#M105162 jslimma_soloiro 2026-04-30T19:15:19Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Rules-Migration-from-Smart-1-Cloud-Management-to-Onpremise/m-p/276337#M105163 <P>Have not had that issue myself, but just wondering, is it multiple tunnels with same phase 2 issue or just one?</P> Thu, 30 Apr 2026 19:21:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Rules-Migration-from-Smart-1-Cloud-Management-to-Onpremise/m-p/276337#M105163 the_rock 2026-04-30T19:21:24Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Rules-Migration-from-Smart-1-Cloud-Management-to-Onpremise/m-p/276338#M105164 <P>The gateway has 3 VPN Tunnel. Two tunnel are with Routed-Based (Working fine) e just one vpn tunnel with Domain Based where phase-1 OK but phase-2 not working (no ipsec sa). Unfortunately during the maintenance window it was necessary a rollback and now all tunnels are up.</P> Thu, 30 Apr 2026 19:44:01 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Rules-Migration-from-Smart-1-Cloud-Management-to-Onpremise/m-p/276338#M105164 jslimma_soloiro 2026-04-30T19:44:01Z