topic Re: Changing Mgmt interface on gateway cluster in Firewall and Security Management

Changing Mgmt interface on gateway cluster

AaronCP — Sat, 15 Oct 2022 22:47:17 GMT

Good evening,

I need to move our DMZ network from its current interface to a new one. Whoever configured the cluster initially put our DMZ network on the Mgmt interface, and I'd like to move it to a separate spare interface so that the Mgmt port can be used for its intended purpose.

What is the best way to do this to minimise interruption? My current thinking is to use the Gaia portal to delete the interface from both cluster members, then configure the new interface with the same IPs. Then use the 'Get Interfaces without topology' in SmartConsole to then configure the cluster/VIP/network etc and install policy to the cluster. I've removed the Security Zone assigned to the current Mgmt interface from all rules and replaced with a network object in preparation for the move.

Is this the correct approach? Any help would be much appreciated 🙂.

Thanks,

Aaron.

Re: Changing Mgmt interface on gateway cluster

Chris_Atkinson — Sun, 16 Oct 2022 12:47:00 GMT

Just to clarify are you talking about the physical Management port or has someone assigned the Mgmt interface role to another port?

From CLISH "show management interface" will show the current allocation.

Re: Changing Mgmt interface on gateway cluster

AaronCP — Sun, 16 Oct 2022 13:50:53 GMT

Hi @Chris_Atkinson

It's the physical Mgmt port of the appliance. I'm not sure which interface has the management role. I can check this later.

Re: Changing Mgmt interface on gateway cluster

AaronCP — Sun, 16 Oct 2022 19:24:50 GMT

Hi @Chris_Atkinson

The Mgmt port has the management interface role assigned to it. Does this complicate matters?

Re: Changing Mgmt interface on gateway cluster

Chris_Atkinson — Sun, 16 Oct 2022 23:13:06 GMT

Not really, just wanted to ensure that we had all the information rather than making assumptions.

Be sure to have the correct routes in place and where possible make allowances in your policy for the new Mgmt IP addresses / network prior to preserve communication with the SMS.

Re: Changing Mgmt interface on gateway cluster

just13pro — Mon, 17 Oct 2022 04:39:37 GMT

Hi,

You can refer to https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk40993&partition=Basic&product=Quantum on changing IP on the management