topic Re: Domain migration with VSX in Firewall and Security Management

Domain migration with VSX

guesstimation — Sun, 23 Feb 2020 18:23:16 GMT

Hello,

We are running R80.20 MDM HA. We are looking to onboard several domains from different MDM (R77.30) . On R77.30 we have 1 domain with VS0 and another 2 Domains with couple dozen production VS'es.

Do we need to bring over management domain with VS0 first?
With R77.30 to R80.20 we should be able to migrate export/import all domains 1by1?
Should we expect to re-SIC all VS'es?
Any other gotchas or considerations?

Hope somebody can throw some hints or even share some practical experience with such type of change:)

Thanks!

Re: Domain migration with VSX

Maarten_Sjouw — Mon, 24 Feb 2020 06:52:16 GMT

The only caveat is when you change the name and the IP of the DMS (CMA), otherwise there is no problem in doing so, however I would strongly advise to upgrade the MDS to R80.30 first. Migration from R77.30 to R80.30 works a lot better than any previous version.
For importing the VSX Domain you will need to issue a command to make sure it will allow the import on the MDS, before each domain import, in expert run:
touch /AllowVsxMigration
Then run your import all domains 1 by 1.

Only start the domains when you are done importing and start with the VS0 domain, this is a recommendation, not a need.

There should be no need to reset any SIC.

Re: Domain migration with VSX

guesstimation — Mon, 24 Feb 2020 18:44:04 GMT

Thanks Maarten,

Can you elaborate on a caveat when changing IP addresses? We will try to maintain DMS(CMA) naming, but we will need to change IPs.

Also any particular reason why R80.30 is better?

Re: Domain migration with VSX

Lari_Luoma — Mon, 24 Feb 2020 20:07:12 GMT

If you change domain names or IP-address you will have to modify vs_slot_objects. This is a file containing links between the main CMA and target CMAs. I will try to find more specific instructions.

Re: Domain migration with VSX

Lari_Luoma — Mon, 24 Feb 2020 20:13:28 GMT

This is a few years old document, but the idea is still the same.

https://dl3.checkpoint.com/paid/8f/8fcb56b00792fac2b184fec88de319fa/How_to_VSX_Migration_for_Multi-Domain_Management.pdf?HashKey=1582582115_3fd40f93424f6d5e0fc8bceb54ec59dd&xtn=.pdf

Re: Domain migration with VSX

Maarten_Sjouw — Tue, 25 Feb 2020 06:00:58 GMT

@Lari_Luoma That is probably a internal document as I cannot access it.
TARGET DOMAIN SERVER IP ADDRESS CHANGE
The modification should be done as follows:
1. Enter the Main Domain environment using mdsenv (type: mdsenv DomainServer).
2. Start the dbedit utility by typing dbedit.
3. For each virtual object, whose Target DomainServer IP has been changed, proceed as follows:
 rmelement vs_slot_objects <object_name> masters_addresses <old_target_domainserver_IP>
 addelement vs_slot_objects <object_name> masters_addresses <new_target_DomainServer_IP>
 update_all
4. Exit from dbedit utility by typing quit.

Which come down to collect info from all domains with the VSs in it and issue the above commands per domain with the old IP and new IP, where the object name is the name of each VS, including switches.
You need to do this in the domain where your VS0 resides.
That should do the trick.

Re: Domain migration with VSX

Maarten_Sjouw — Tue, 25 Feb 2020 06:04:00 GMT

To your question why R80.30 is better, experience.

Re: Domain migration with VSX

guesstimation — Tue, 25 Feb 2020 18:25:02 GMT

Thanks Lari, Maarten! This helps:)

I assume this was the document suggested by Lari: http://downloads.checkpoint.com/dc/download.htm?ID=35084

Re: Domain migration with VSX

Lari_Luoma — Wed, 26 Feb 2020 22:24:48 GMT

@guesstimation Yep. That's the one. 🙂