topic Re: Remove CMA from an MDS in Firewall & Security Management

Remove CMA from an MDS

Matlu — Thu, 08 May 2025 03:48:27 GMT

Hello, Mates

Is it possible to remove a particular CMA from my MLM?
I have MLM redundancy, but there is a problem with a particular CMA, and we need to delete it and recreate it.

Is this possible? Either by the SmartConsole itself or by the MLM CLI.

Does deleting a CMA impact the main box at all? Is there any special consideration to take into account?

Thanks for your comments.

Re: Remove CMA from an MDS

PhoneBoy — Thu, 08 May 2025 13:21:21 GMT

A CMA contains all data for a specific domain (objects, rules, SIC for all managed objects, etc).
Deleting it is a rather destructive action.
Also, you don't delete it from the MLM, you delete it from the MDS side.
When you create the new CMA, you can associate it to the MLM.

Re: Remove CMA from an MDS

Matlu — Thu, 08 May 2025 14:13:37 GMT

Hello

In my case, it is not a CMA that is “managing” GW or Cluster.
It is a CMA but it is inside a MLM box ...
The CMA is intended only as a “Virtual Log Server”, to collect the logs of several VS's.
We are having problems with a single CMA of our MLM, so, would it be possible to delete it, and recreate it?
Or would this still cause service interruption in some way?

Thanks.

Re: Remove CMA from an MDS

PhoneBoy — Thu, 08 May 2025 15:18:33 GMT

In terms of gateway traffic, there should be no impact.
If a gateway can't reach its log server, it will either log to a different server (if configured) or store logs locally until the log server is available.
It will likely require a policy install for logging to flow to the MLM again.

Re: Remove CMA from an MDS

Amir_Senn — Thu, 08 May 2025 15:34:25 GMT

For MLM we're using a different term not to confuse.

Yes, you can remove it and create a fresh one instead. I would move the logs if existing first to the other log server you have on the domain.

You can stop/start just a specific server in the CLI using "mdsstop_customer <IP/name>"

Re: Remove CMA from an MDS

the_rock — Thu, 08 May 2025 15:55:55 GMT

There are the steps I noted down while ago when I had to do this with someone.

mdsstop_customer <CMA_Name>
mdsenv <CMA_Name>
fwm sic_reset
fwm unloadlocal
mdsenv
mdsstop
mds_cma_delete <CMA_Name>
mdsstart

Andy

Re: Remove CMA from an MDS

Matlu — Fri, 09 May 2025 11:20:22 GMT

Hello,
We have already run the command repeatedly, we have also restarted the MLM box, and the problem continues.
The TAC does not find the root-cause of the problem.
The MLM has several CMA and the problem is only with 1, that is not receiving logs from the VSX Cluster that corresponds to it, and that is causing that one of the members of the VSX CLUSTER is filling daily its var/log path because it is storing locally.
It is a very strange case.

Re: Remove CMA from an MDS

the_rock — Fri, 09 May 2025 11:27:02 GMT

Very odd...maybe have them escalate the case?

Andy

Re: Remove CMA from an MDS

the_rock — Mon, 12 May 2025 01:33:46 GMT

@Matlu

Hey mate, did you try steps I mentioned to see if that works?

Andy