topic Re: How to Decouple Manager from Firewall in Firewall & Security Management

How to Decouple Manager from Firewall

Simon_Taylor — Wed, 12 Aug 2020 08:34:44 GMT

Hi,

I've inherited an R77.30 manager that runs off an actual firewall.

I've migrated the config to a standalone R80.40 VM and created a new management object and can install database but the old manager object (now a firewall object) is still lurking in the config - Smartdashboard think its involved in the mgmt ha and the tracker says there is no log server.

I edited the management/primary_management fields on the old object in guidbedit to false and after cpstop/cpstart fwm now dies so I cant get back in. fwm.elg says "fwm_cmain: error: cant initialize cpmi server: Address already in use".

I expect some entries from the registry need to be removed but dont know which (old manager object is install-on item for numerous NAT objects so its not so simple to grep).

I have a TAC case but I'm not confident there.

Any ideas?

Cheers,

Simon

Re: How to Decouple Manager from Firewall

_Val_ — Wed, 12 Aug 2020 08:48:20 GMT

Several notes:

1. R77.30 is out of support for quite a few years.

2. You should not edit manually the properties.

3. Migrate export / import procedure is the way to move management to a new platform. As part of it, you can also move SMS to a new IP address. The latter requires changing the licenses. The least effort procedure is to keep the same IP address of the management on the new machine.

4. If you decide to keep the IP address, make sure you are migrating from an open server and not a Smart-1 appliance. If latter is the case, you will have to provision new license for your management server anyway.

Re: How to Decouple Manager from Firewall

Simon_Taylor — Wed, 12 Aug 2020 09:01:23 GMT

thanks @_Val_ although I don't think you understood the issue. I need to keep the firewall object but delete any evidence that it used to be a smart centre as well. What I've created is a new smart centre object. Its 99% working I just need to remove the ghost HA peer.

Re: How to Decouple Manager from Firewall

_Val_ — Wed, 12 Aug 2020 09:31:38 GMT

One can only understand what's being explained 🙂
Ok, so what you are trying to do is to move Standalone to distributed configuration. Did you follow sk44201? Specifically, look at step 22. FW module will have to be re-installed.

Re: How to Decouple Manager from Firewall

Simon_Taylor — Wed, 12 Aug 2020 11:43:31 GMT

Fair enough and I do appreciate the help.

I did not know of that sk but what I have done is not too dissimilar. My condition now appears to be the same as this https://community.checkpoint.com/t5/General-Management-Topics/Removing-orphaned-Management-HA-dependencies/m-p/93896#M12440 (well at least the first screenshot) with the exception that my ghost mgmt ha peer is actually a firewall object I need. I'm in two minds to try deleting it and recreating as a new firewall object but it is used 200+ times in the policy/objects.

Re: How to Decouple Manager from Firewall

Sigbjorn — Wed, 12 Aug 2020 12:51:17 GMT

The where-used and replace function works quite well.

You could replace the gw object with a dummy object, delete it and import/add the new gateway, then do a new where-used->replace from the dummy to the new gateway.

Re: How to Decouple Manager from Firewall

_Val_ — Wed, 12 Aug 2020 13:27:27 GMT

If you still have the original standalone machine available (or its backup/migrate export file), follow the SK. It will yield clean results you are looking for. Otherwise, do what @Sigbjorn is recommending.

Quoted discussion is irrelevant, situation with R80.x standalone procedures is quite more complex.