topic Re: Changing IP on management server - How long do I have before I have to redo SIC in Firewall & Security Management

Changing IP on management server - How long do I have before I have to redo SIC

cdooer — Wed, 19 Jul 2023 14:46:42 GMT

Hey everyone, We need to change the IP on our management server, and had initially been told by TAC that reestablishing SIC wouldn't be required, since the certificate was based on DNS name, which wasn't changing. Now I'm reading that SIC does need to be reestablished, since the management server IP is stored in the $CPDIR/registry/HKLM_registry.data file. BUT...the documentation also says this;

Symptoms
- SIC establishment is lost between gateway and mgmt server over time.
- No SIC connectivity to gateway

Since it says "over time", does anyone know what the trigger is that will cause SIC to start failing? Trying to plan this out, want to make sure I know exactly what's going to happen, and when.

Thx,
dp

Re: Changing IP on management server - How long do I have before I have to redo SIC

PhoneBoy — Wed, 19 Jul 2023 17:28:37 GMT

Where precisely are you seeing this "over time" statement?

You should be able to re-establish SIC with the relevant gateways after changing the IP on the management by performing an Install Policy action to all gateways.
This will update the management IP on all the relevant gateways and re-establish connectivity.

Remember that the management is also the Internal Certificate Authority.
Part of that functionality is gateways checking on the validity of certificates issued by the ICA.
If the IP is different, then the Certificate Revocation List is not available.
At least for VPN, this will cause VPNs to start failing after 24 hours or so.

Re: Changing IP on management server - How long do I have before I have to redo SIC

Jim_Holmes — Wed, 19 Jul 2023 19:11:35 GMT

I have personally never seen this happen, not that it means it doesn't happen. I just always make sure to do an install database before I push the policy. It was my understanding that the Masters was all it was checking, and that is object-based. @PhoneBoy isn't the CRL pulled from the VPN certificate and not the SIC certificate?

Re: Changing IP on management server - How long do I have before I have to redo SIC

the_rock — Wed, 19 Jul 2023 19:44:24 GMT

You are referring to below:

https://support.checkpoint.com/results/sk/sk103356

In my experience, last time I did this, worked fine, no SIC reset, but then 3 times before that, it was needed...so, I have no clue in the world why its inconsistent : - )

Re: Changing IP on management server - How long do I have before I have to redo SIC

cdooer — Wed, 19 Jul 2023 19:53:09 GMT

They state this in this article, https://support.checkpoint.com/results/sk/sk103356.

So are we all in agreement that SIC will automatically happen after I change the management IP, install database, then push a policy? Wondering if that file on the gateway automatically updates itself with the new IP?

Re: Changing IP on management server - How long do I have before I have to redo SIC

the_rock — Wed, 19 Jul 2023 19:55:43 GMT

Thats my experience, BUT, that does not always guarantee SIC wont need to be reset.

Re: Changing IP on management server - How long do I have before I have to redo SIC

cdooer — Thu, 20 Jul 2023 14:02:29 GMT

I did just have a look on one of my VPN gateways, and that HKLM_registry.data file shows that it was updated 20 mins ago, even though no policy was pushed to it. Wonder if that file automatically updates on a certain interval, as the gateway is communicating with the management server?

Re: Changing IP on management server - How long do I have before I have to redo SIC

the_rock — Thu, 20 Jul 2023 14:04:20 GMT

Thats most likely true...I will let someone else confirm, but it would make logical sense.

Andy

Re: Changing IP on management server - How long do I have before I have to redo SIC

the_rock — Thu, 20 Jul 2023 14:07:14 GMT

Just checked my lab and though I never modified this file, shows today's date, so Im 100% sure its all automatic. Never knew that was the case, so thank you for bringing that point up 👍

Andy

[Expert@quantum-firewall:0]# cd /opt/CPshrd-R81.20/registry/
[Expert@quantum-firewall:0]# stat HKLM_registry.data
File: 'HKLM_registry.data'
Size: 143613 Blocks: 288 IO Block: 4096 regular file
Device: fc01h/64513d Inode: 35062378 Links: 1
Access: (0660/-rw-rw----) Uid: ( 0/ admin) Gid: ( 0/ root)
Access: 2023-07-20 10:06:59.652972485 -0400
Modify: 2023-07-20 10:06:59.482972476 -0400
Change: 2023-07-20 10:06:59.503972477 -0400
Birth: -
[Expert@quantum-firewall:0]#

Re: Changing IP on management server - How long do I have before I have to redo SIC

the_rock — Thu, 20 Jul 2023 14:58:37 GMT

I verified 100% based on test on 4 different VMs and 4 different CP versions *R80.30, R80.40, R81.10 and R81.20) that HKLm_registry.data file gets "refreshed" every 60 seconds...thats what it shows when I ran watch -d stat command on the file

Not sure if TAC would have any other official answer, but thats result I get.

Andy

Re: Changing IP on management server - How long do I have before I have to redo SIC

Bob_Zimmerman — Thu, 20 Jul 2023 17:55:36 GMT

I suspect the "over time" might be talking about automatic renewal of the SIC certificates. Eventually, the cert will get close to expiring and will try to renew itself. Not sure which method it uses to get the management's IP to try to renew the cert, but if it doesn't try the new IP, the SIC cert will eventually expire. Doesn't disrupt traffic, but it does prevent policy installation and other things which depend on SIC.

Re: Changing IP on management server - How long do I have before I have to redo SIC

JozkoMrkvicka — Thu, 20 Jul 2023 22:04:47 GMT

can you try to cut the connection between gateway and management? Wondering if that file is refreshed only in case there is communication between GW and management.

Do you also see if there is some difference in regards to content of the file ? Is the content always the same, or some timestamps are updated within the file itself ? You can use "diff" command to compare the file before refresh (make a copy) and after refresh.

Re: Changing IP on management server - How long do I have before I have to redo SIC

the_rock — Thu, 20 Jul 2023 22:32:09 GMT

Content is exactly the same every time I check it.

Andy

Re: Changing IP on management server - How long do I have before I have to redo SIC

cdooer — Thu, 20 Jul 2023 23:38:47 GMT

Hmm...what happens when you change the IP on your management server? Hehehe

Re: Changing IP on management server - How long do I have before I have to redo SIC

the_rock — Thu, 20 Jul 2023 23:43:18 GMT

I did that test today in my lab and all worked fine, no need to even do SIC reset. File content was the same.

Re: Changing IP on management server - How long do I have before I have to redo SIC

cdooer — Thu, 20 Jul 2023 23:50:46 GMT

That file contains the IP of the management server though, so I assume that this entry at least changed?

Re: Changing IP on management server - How long do I have before I have to redo SIC

the_rock — Fri, 21 Jul 2023 00:12:28 GMT

Yes...I changed it back since and its updated accordingly

Andy

[Expert@quantum-firewall:0]# grep -i 172.16.10.203 /opt/CPshrd-R81.20/registry/HKLM_registry.data
:ICAip (172.16.10.203)
[Expert@quantum-firewall:0]#