topic Re: Move one CMA from a SDM to another SDM in Firewall & Security Management

Move one CMA from a SDM to another SDM

Herold — Tue, 03 Apr 2018 13:48:31 GMT

Hi,

Is there a tool or existing procedure to migrate one specific CMA from a Provider-1 A to another Provider-1 B that has different IP different IP address?

Thanks,

Re: Move one CMA from a SDM to another SDM

Ivo_Marques — Tue, 03 Apr 2018 15:11:16 GMT

Hi,

./migrate export -> backup the domain

cma_migrate -> to import

The new CMA can have another IP.

If you have VSX you must worry about some issues

Bye,

Ivo

Re: Move one CMA from a SDM to another SDM

Alex_Tooze — Tue, 24 Jul 2018 14:59:53 GMT

This sounds straightforward enough.

We're looking to move one of our CMAs onto a brand new MDS. So do you simply you import the CMA into the new MDS? Does this rely on not using Global Objects in the policies?

Would it be possible to:

- take the entire MDS backup

- restore it to a new device

- Change MDS IP

- Change CMA IP

- Delete any unwanted CMAs from the new MDS, just leaving the one we want

- Create new MLM/Secondary MDS and sync up

This would then preserve the Global Objects/Policies which may be used in the existing Security policies on that CMA.

Does anybody have any advice on the best way to do this?

Re: Move one CMA from a SDM to another SDM

Ivo_Marques — Tue, 24 Jul 2018 15:46:17 GMT

Hi Alex,

I think the best way is:

create the new MDS (New IP)
Detach GLOBAL POLICY from the CMA you want to move
Migrate GLOBAL POLICY
Migrate CMA (to a new IP)
Attach the GLOBAL POLICY again.

(I'm assuming that you aren't using VSX)

Refer to sk66225 - Recreating a global policy on MDS for migrated CMAs

I never migrated the MDS like your are suggesting but if you want to try that you have to be careful with the leading interface and the new IPs. Please read:

sk43378 - Changing the IP address of Multi-Domain Server when restoring MDS Backup

sk74020 - How to change the IP address of a Multi Domain Management Server

Re: Move one CMA from a SDM to another SDM

Ivo_Marques — Tue, 24 Jul 2018 16:01:26 GMT

For my answer I'm assuming R77.xx

Re: Move one CMA from a SDM to another SDM

Maarten_Sjouw — Tue, 24 Jul 2018 21:37:12 GMT

For the Global objects, when you first migrate the Global policy to the new MDS using migrate_export and migrate_global_policies, then there is no need to remove the Global policy, just leave it there and migrate the CMA.

For the info on how to do the Global migration see Gaia R77 Versions Installation and Upgrade Guide

One of the main reasons not to duplicate the existing MDS by doing the backup path is that you also copy the CA which will give you problems in later stages when you might need to move another CMA to the new MDS.

Re: Move one CMA from a SDM to another SDM

Alex_Tooze — Wed, 25 Jul 2018 08:18:08 GMT

Thanks for the responses - I should have stated that this will be R80.10, not R77 - will the same apply?