topic Re: Do I need to reset SIC if I change my gateway IP address? in Firewall and Security Management

Do I need to reset SIC if I change my gateway IP address?

fjulianom — Wed, 09 Nov 2022 13:17:23 GMT

Hi community,

This is my scenario. Version R80.30, SMS and a cluster of two gateways. The SMS management IP address and the gateways management IP addresses are in the same network. Now I need to change the gateways management IP addresses, and also the cluster VIP address, but they will be still in the same network. Do I need to reset SIC? Some people says SIC is based on certificates and not IP addresses, but at the end of the following post Timothy doesn't believe exactly the same:

https://community.checkpoint.com/t5/Security-Gateways/changing-IP-address-on-security-gateway-and-SIC/td-p/116306

What do you think?

Regards,

Julián

Re: Do I need to reset SIC if I change my gateway IP address?

_Val_ — Wed, 09 Nov 2022 13:57:57 GMT

No, you do not need to reset SIC.

Re: Do I need to reset SIC if I change my gateway IP address?

the_rock — Wed, 09 Nov 2022 13:59:54 GMT

No need to do SIC reset as Val said, you are good to go.

Re: Do I need to reset SIC if I change my gateway IP address?

G_W_Albrecht — Wed, 09 Nov 2022 14:11:43 GMT

No, Timothy does not talk about SIC but implied rules. To follow his suggestion should not hurt...

Re: Do I need to reset SIC if I change my gateway IP address?

fjulianom — Wed, 09 Nov 2022 15:23:32 GMT

Hi,

Yes, Timothy does not talk about SIC but implied rules, but he says SIC can be affected by these implied rules.

"...and be forced to perform a fw unloadlocal on the firewall for SIC to start working after an IP change."

Regards,

Julián

Re: Do I need to reset SIC if I change my gateway IP address?

G_W_Albrecht — Wed, 09 Nov 2022 15:39:30 GMT

This concerns not SIC itself but the management connection - SIC can not work if any connection from this IP is blocked.

Re: Do I need to reset SIC if I change my gateway IP address?

fjulianom — Wed, 09 Nov 2022 15:52:04 GMT

Yes, I understand that doesn't concerns to SIC itself. Then it is a good idea to create the temporary explicit rule that Timothy talk about, otherwise after I change my gateways IP addresses SIC can be down.

Re: Do I need to reset SIC if I change my gateway IP address?

PhoneBoy — Wed, 09 Nov 2022 17:37:32 GMT

SIC uses certificate-based authentication and isn't dependent on IP address.
The implied rules that allow the various SIC connections to work are a different story.
When you change IP addresses, you will likely need to implement the things @Timothy_Hall mentions in that thread or be prepared to do an "fw unloadlocal" from the gateway (which will cause an outage).