topic Re: Replace a firewall in Firewall and Security Management

Replace a firewall

gm446 — Wed, 18 Jan 2023 08:44:11 GMT

Hi ,

there is any step by step procedure o best practice to replace a gateway with a new model?

old gateway is 6600 with R80.40 and the plan is to replace it with 6900 with R80.40 / R81.10
the target is to preserve all the current states and configurations from the old firewall to the new firewall. the SMS is on other VM.
my plan is this procedure:

1. Backup old firewall and restore the backup on the new firewall.
2. Manually backup DHCP configuration file and IP Assignments file.
3. Upgrade new firewall to R81.10
4. Move the cables from the old firewall to the new firewall
5. Re-Establish SIC and edit gateway object propertie
6. Install Policy

what do you think about this plan? i missed any step?

Thank you in advance,

Yossi

Re: Replace a firewall

Chris_Atkinson — Wed, 18 Jan 2023 13:31:06 GMT

For the backup restoration you should also consider the JHF version to be safe, similar with the version upgrade don't just deploy it with the base image rather also apply the latest recommended JHF.

Re: Replace a firewall

the_rock — Wed, 18 Jan 2023 11:54:45 GMT

Chris is right, consider latest recommended jumbo as well.

Re: Replace a firewall

G_W_Albrecht — Wed, 18 Jan 2023 12:28:27 GMT

Between step 1 and 2 you will have to perform FTW on appliance for basic config. Not sure if you need to remake SIC though...

Re: Replace a firewall

gm446 — Wed, 18 Jan 2023 13:14:52 GMT

Thank you very much for the insights. sure i forgot about the first time configuration wizard and the JHF version.

Re: Replace a firewall

the_rock — Wed, 18 Jan 2023 13:36:14 GMT

SIC is needed there, for sure.

Re: Replace a firewall

the_rock — Wed, 18 Jan 2023 13:38:14 GMT

By the way, below link could be helpful to you, though its cluster related, but same method applies.

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/td-p/69216

Also, make sure to NOT backup/restore, as its different hardware. Do clish -c "show confirguration" /var/log/configfile.txt on current fw, make necessary changes to reflect interfaces/routes on new fw and then on the new fw, from clich, run load configuration /var/log/configfile.txt (just make sure its in /var/log dir or wherever you move it to).

Hope that helps.

Andy

Re: Replace a firewall

the_rock — Wed, 18 Jan 2023 15:20:51 GMT

Let us know if any issues. I had done this few times successfully, so can definitely help you out if need be.

Good luck!!

Re: Replace a firewall

gm446 — Wed, 18 Jan 2023 15:22:00 GMT

Thank you all very much for the help.

i will update on the results

Yossi

Re: Replace a firewall

the_rock — Wed, 18 Jan 2023 15:23:45 GMT

Any time. Here comes my corny joke everyone is sick off..."For you, no charge, except iphone charge" ; - )

Andy

Re: Replace a firewall

G_W_Albrecht — Wed, 18 Jan 2023 20:42:19 GMT

For the Also part:

As of https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902:

A Gaia backup, unlike a Gaia snapshot, can be restored on the same or a different appliance running the same Check Point Gaia OS version and hotfixes.

But:

Recommended Steps in Case of Disaster Recovery

Do one of these:
- Revert to a Gaia Snapshot - restores the Check Point version with all the setup details, including type (management/gateway) and installation of hotfixes.
- Restore from a Gaia Backup - restores latest system configuration with all recent network and security configuration.
Compare the output of Gaia Clish command "show configuration" to the saved configuration to verify that Gaia OS configuration was restored properly.

So you are partly right with a very good point indeed !

Re: Replace a firewall

gm446 — Thu, 16 Feb 2023 09:54:17 GMT

thank you everybody,

the replacement was smooth and everything works as planned.

only issue was after the first install policy DHCP and Office Mode was not working, resolved with a reboot.