topic SMS HA Disaster Recovery, Changing IP on the new primary in Firewall & Security Management

SMS HA Disaster Recovery, Changing IP on the new primary

Secret-goblin-5 — Mon, 28 Sep 2026 11:32:52 GMT

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Content/Topics-SECMG/High-Availability-Disaster-Recovery.htm

We have two physical SMS appliances, one has a failed / failing disk.

We have decided to promote the remaining SMS to primary, and then build a fresh secondary inside VMWare, removing the faulty hardware issues from the equation.

The question I have is that the new SMS will have a new IP, not only as it is in a new location, but the failed SMS network is being entirely decommissioned as a separate project. It cannot keep it's old IP.

I know I need to have my licences moved to the current secondaries IP as part of the process listed above (when it is promoted to primary).

My question is can I build a brand new secondary SMS, not change it's IP to the old one, and just keep it as a secondary?

Moving the primary back over again is not necessary as far as I can tell, do I have to do that step?

Re: SMS HA Disaster Recovery, Changing IP on the new primary

PhoneBoy — Mon, 28 Sep 2026 16:25:02 GMT

You should be able to do this, yes.
May be worth confirming with TAC.

Re: SMS HA Disaster Recovery, Changing IP on the new primary

Bob_Zimmerman — Mon, 28 Sep 2026 18:01:19 GMT

After you promote your existing secondary to primary, you would just delete the object for the old, failed management. That will leave you with one primary and no secondary.

From there, you build a new secondary with whatever name and IP you want. It's a whole new box.

You don't need to promote the new box to be primary unless you really want to (for example, if the new box is in your primary datacenter, and you plan to keep it active all the time, it may be worth promoting it).

Re: SMS HA Disaster Recovery, Changing IP on the new primary

Secret-goblin-5 — Tue, 29 Sep 2026 07:55:12 GMT

Thanks. I thought this was the case but I wanted to make sure.