topic Remote gateways connecting to SMS over internet in Firewall and Security Management

Remote gateways connecting to SMS over internet

J_7584 — Sun, 16 Feb 2025 17:52:05 GMT

I have a pair of Check Point 5800 appliances setup in a HA cluster and a SMS on the same network. All running R81.20. The SMS is being moved to a different location (physically relocating the hardware it is running on) and will be behind a new set of 6800 appliances in a data center. Once the SMS has been relocated and is up and running again, can I just reestablish SIC so that the now remote 5800s can communicate to the SMS on its new network over the internet? I assume I just need to setup NAT? How do the remote gateways know to go over the internet to connect to the SMS?

Re: Remote gateways connecting to SMS over internet

emmap — Mon, 17 Feb 2025 05:15:06 GMT

Have a check at the admin guide for your version and see how you go. Make sure the IP defined on each of the 5800 gateway cluster members is its external IP.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Security_Management_behind_NAT.htm

Re: Remote gateways connecting to SMS over internet

Machine_Head — Mon, 17 Feb 2025 09:12:32 GMT

Yep, you just need to setup NAT in the MGMT object, according to sk66381

And as Emma mentioned, make sure to change the cluster member IP to its external one in smartconsole.

After the policy is pushed from the new site thorugh the NAT IP the masters file will be over written with the new IP information