topic Re: How to perform Advanced Upgrade for CloudGuard Management version in Azure with a name and IP ch in Firewall and Security Management

How to perform Advanced Upgrade for CloudGuard Management version in Azure with a name and IP change

Jones — Sun, 23 Jun 2024 08:51:22 GMT

I have a SmartCenter on R81.20 on-premise and like to go to a CloudGuard Azure SmartCenter. The name and ip-address of the SmartCenter must change. The current name includes a character "-" that is not supported when creating a CloudGuard Azure SmartCenter and also the customer likes a new name for his new SmartCenter.

There is sk155632: How to perform Advanced Upgrade for CloudGuard Management version in AWS, Azure, or GCP (Side-by-Side upgrade) (checkpoint.com)

This SK does not describe how to deal with an hostname change.

Then there is sk42071: Changing a Security Management (SmartCenter) Name (checkpoint.com)

So what is the recommend and supported path to go from on-premise SmartCenter to Azure CloudGuard SmartCenter with a new hostname and ip-address?

Re: How to perform Advanced Upgrade for CloudGuard Management version in Azure with a name and IP ch

PhoneBoy — Mon, 24 Jun 2024 18:52:39 GMT

Changing the IP of the management isn't an issue as the gateways will re-establish connectivity with the new management after a policy installation from the migrated management server.
Changing the hostname on your management will require resetting SIC as all the relevant certificates will need to be regenerated with the new name: https://support.checkpoint.com/results/sk/sk164055
You can minimize the potential outage by employing this SK when resetting SIC on the individual gateways: https://support.checkpoint.com/results/sk/sk86521

Re: How to perform Advanced Upgrade for CloudGuard Management version in Azure with a name and IP ch

the_rock — Mon, 24 Jun 2024 18:55:17 GMT

You got the right answer from Phoneboy.

Andy

Re: How to perform Advanced Upgrade for CloudGuard Management version in Azure with a name and IP ch

Jones — Tue, 25 Jun 2024 06:39:16 GMT

Thank guys. I was thinking about how to bypass the reSIC because there are a lot of gateways to reSIC, and there there are client VPN's and S2S VPN's in play.

In the R81.20 Installation and Upgrade Guide, it is described how to migrate an SMS to a DMS, and also from a DMS to SMS. When executing these two steps in order, a reSIC is not needed. The main CA will of course show the old name of the SmartCenter.

Re: How to perform Advanced Upgrade for CloudGuard Management version in Azure with a name and IP ch

PhoneBoy — Tue, 25 Jun 2024 15:21:20 GMT

You could theoretically perform the steps I suggested without reSICing and end up in the same basic place as that process.
Not entirely sure what issues result from the SIC name being different from the management hostname.