topic Re: MDS, separate one dms into two dms. in Firewall and Security Management

MDS, separate one dms into two dms.

ERTK — Wed, 10 Nov 2021 12:52:17 GMT

someone knows any way to separate one DMS into two dms? i will try to explain in depth

i have one MDS with three dms. One of them, customer wants to separate into two. i think to do exporting mds to sms and importing again into another dms, but it doesnt work. any help will be apreciate

Re: MDS, separate one dms into two dms.

PhoneBoy — Wed, 10 Nov 2021 15:10:53 GMT

What was the precise procedure you followed on what precise version?
Because as far as I know; this should be possible using the newest migration tools.

Re: MDS, separate one dms into two dms.

ERTK — Wed, 10 Nov 2021 15:14:36 GMT

version R80.40 jha 125.

Procedure describe on sk 156072

cma to sms

mgmt_cli -d "System Data" migrate-export-domain domain <Domain Name> file-path <Full Path to File>.tgz

sms to cma

$MDS_FWDIR/scripts/migrate_import_domain.sh -sn "new name" -dsi "new ip" -o "path"

Final result, i cannot access to original CMA....new CMA was accesible but original, not.

Re: MDS, separate one dms into two dms.

PhoneBoy — Thu, 11 Nov 2021 00:24:47 GMT

When you say "cannot access to original CMA" what precisely does that mean?

Re: MDS, separate one dms into two dms.

ERTK — Thu, 11 Nov 2021 07:02:32 GMT

i openned smart consol without mds.....ok. But trying to connect to old cma (cma that i migrate to sms) and it gave an error. I am trying again the procedure in case i did something wrong.

Re: MDS, separate one dms into two dms.

PhoneBoy — Thu, 11 Nov 2021 07:27:39 GMT

And...what is the precise error?
On what precise version/JHF level?

Re: MDS, separate one dms into two dms.

ERTK — Thu, 11 Nov 2021 07:57:12 GMT

cannot connect to domain....i dont remember ezactly. Version R80.40 jha 125. Let me finish again the procedure. I keep you post

Re: MDS, separate one dms into two dms.

ERTK — Thu, 11 Nov 2021 10:45:24 GMT

The same behaviour. I resume:

customer wants to move some gateway/policy/objects to another new CMA.

we tryed to made cma to temporaly sms, clean objects on this temporaly sms, and made and sms to new cma.

When the procedure was complete, the result was original CMA was impossible to connect through smart consol it gave an error "Failed to connect to the server"..

It should be that on migration procedure the same uid is preserved and when import again colision with the olders uids.

Any ideas about how to get it will be apreciated.

Re: MDS, separate one dms into two dms.

PhoneBoy — Thu, 11 Nov 2021 19:46:39 GMT

The original CMA is the one you perform the export from.
Are you saying that CMA is not accessible?
Or are you saying the SMS onto which you imported the CMA contents is not connecting?

Some basic stuff to check:

Network connectivity (can you ping the new SMS, is there communicating being received on ports 443/18190/19009 from the SmartConsole machine)
$MDS_FWDIR/scripts/cpm_status.sh
Also ensure valid licenses are applied to the SMS (apply an eval AFTER you perform the import)

Re: MDS, separate one dms into two dms.

ERTK — Fri, 12 Nov 2021 07:09:11 GMT

Original CMA after we made the procedure was not accessible from MDS domain(open smartconsole agains global, goto domains, rigth click on domain X, connect..) but if i open a smart console agains ip cma address it opens.

and more details, on this environment (MDS), if i check the domain server list over old domain, it shows like new imported domain server is below thid domain but if i open a console agains this domian, not. It is very strange

mdsstat shows all domains up and run...and all ip address running....

Re: MDS, separate one dms into two dms.

ERTK — Fri, 12 Nov 2021 07:10:04 GMT

about licenses....it is lab environment, i uploaded an evaluation license

Re: MDS, separate one dms into two dms.

PhoneBoy — Fri, 12 Nov 2021 07:13:22 GMT

Recommend a TAC case.

Re: MDS, separate one dms into two dms.

ERTK — Fri, 12 Nov 2021 07:15:19 GMT

yes, i think so...... But i want to check if exist any kind of official procedure for doing that. It seems that over R80.x not. Thanks for your time

Re: MDS, separate one dms into two dms.

PhoneBoy — Fri, 12 Nov 2021 07:17:14 GMT

That is the procedure to the best of my knowledge.
Which is why TAC should be engaged.