topic Re: VSX Migration to physical Gateways in Firewall and Security Management

VSX Migration to physical Gateways

Hllrdm — Mon, 06 Jun 2022 07:56:22 GMT

I have a VSX device deployed on physical devices.
I had a need to get rid of the VSX solution and deploy separate clusters on VSX instead.
I am completely unfamiliar with the VSX solution, so I would appreciate any information on how to correctly transfer the configurations of virtual security gateways to dedicated security gateways.
I cannot connect to the virtual gateway via ssh, so I have a question how can I save the configurations to a file in order to transfer them to dedicated physical security gateways in the future? Maybe someone has a plan on how to correctly "disassemble" VSX and migrate the settings?

Re: VSX Migration to physical Gateways

Chris_Atkinson — Mon, 06 Jun 2022 12:38:41 GMT

For VSX a significant portion of the configuration is in the management, for the GAiA configuration on the gateway you could review using the following logic.

set virtual-system <ID>

show configuration

(Things like Bonds & Dynamic routing is configured via CLI)

Re: VSX Migration to physical Gateways

Hllrdm — Mon, 06 Jun 2022 12:32:46 GMT

I have different routes in show configuration which are not in smartconsole and I also have different ip addresses assigned to the interfaces (not the same as in the contexts). Is this behavior correct and do I need to edit the save configuration file according to the settings in the smartConsole?

If I plan to migrate devices to dedicated gateways, what should I do with the virtual switches? And what about the settings on the physical device where the virtual gateways are deployed?

Re: VSX Migration to physical Gateways

the_rock — Mon, 06 Jun 2022 17:19:00 GMT

Im afraid that is more something suited for CP professional services, as it sounds it would require lots of work/planning. But, I do agree with @Chris_Atkinson , you can definitely get lots of useful info from show config. Not sure if backup might be so helpful in this instance.

Re: VSX Migration to physical Gateways

Magnus-Holmberg — Mon, 06 Jun 2022 19:04:42 GMT

Look at this one 🙂
https://community.checkpoint.com/t5/Scripts/vsxexport-sh-Export-VSX-settings-and-configuration-files/m-p/131510#M874

And i would also use vsx provisioning to get out the information.

Re: VSX Migration to physical Gateways

genisis__ — Mon, 06 Jun 2022 21:09:42 GMT

Ive used this script in the past to do something similiar, but do note that you may also need to review the specific VS's local.arp file, if proxy arp is in use.