topic Re: migration from on premise endpoint to cloud sandblast agent in Endpoint

migration from on premise endpoint to cloud sandblast agent

Ted_Serreyn — Wed, 02 Dec 2020 01:17:04 GMT

Ok so I was told that there was a procedure to migrate a client from on premise endpoint server to cloud (infinity portal) sandblast agent?

However the person I was talking with has so far failed to deliver.

Does anyone know what the procedure is going to be? I was thinking that there should be a migrate export/migrate import type of migration for this to move all the settings.

Is there a reason with endpoint that we can't define cloud endpoint as a "fake" policy server, so when the other policy servers and on premise mangement go away, the clients just start talking to the new ip of the cloud sandblast agent? Is the reconnect tool really required here to reconnect all the clients to the new endpoint server.

I know that we can take a staged approach to move new clients to the cloud portal, but I am looking to migrate 900 plus clients. I would really like this to be somewhat transparent to the end user if possible.

I am working to come up with a good procedure so I can test with a small depl

Re: migration from on premise endpoint to cloud sandblast agent

Kobie_Bendalak — Wed, 02 Dec 2020 08:32:56 GMT

Please raise a TAC ticket, they can assist.

Share the ticket number w/ me, and I'll help you expedite its resolution.

Re: migration from on premise endpoint to cloud sandblast agent

Ted_Serreyn — Wed, 02 Dec 2020 19:29:33 GMT

Here is the TAC response:

I got reply from the internal team and they said is not possible for you test out migrations from on-Prem to EPMass.

It can only be done by PS and R&D, and i know you said you do not want to pay you will need to reach out to your sales team for that.

Please let us know if you have any other questions or comments for us on Tech support.

Re: migration from on premise endpoint to cloud sandblast agent

Ted_Serreyn — Wed, 02 Dec 2020 19:31:14 GMT

As a long time Checkpoint VAR, I would like to know how exactly I am supposed to recommend moving to the cloud for an existing customer?

These are loyal checkpoint customers who have run endpoint before the cloud management even existed.

It seems that checkpoint does not have a plan for their existing customer base, other than to charge them more money to move to the latest version.

Re: migration from on premise endpoint to cloud sandblast agent

Kobie_Bendalak — Sun, 06 Dec 2020 17:37:00 GMT

@Ted_Serreyn it's on our plate for 2021, if urgent I suggest to proceed by submitting an RFE.

Re: migration from on premise endpoint to cloud sandblast agent

Ted_Serreyn — Sun, 06 Dec 2020 18:50:44 GMT

Yeah I guess I’m not going to be recommending migrating to the cloud until that time for any of my existing customers and would advise other VARs the same.

It’s hard to be put in the middle like this as a VAR. customers want to know how to migrate and what the impact is to them. This is part of the Value Add that we provide as resellers.

Re: migration from on premise endpoint to cloud sandblast agent

Brad_Muller — Fri, 26 Feb 2021 16:06:15 GMT

I was able to work this out with the help of John Morris (Checkpoint) and his team. I'm attaching a word document for instructions. I've also shared with TAC, so hopefully they will write up an SK.

When signing into the new Smartconsole (downloaded from Service Management), you will need to change the server (pull down) to the cloud. The token they are looking for is the Service Identifier, which can be copied from Service Management tab. Then just sign in with admin and the new password you created in step 4.

Another note, the portal does not match 1-1 on all areas of the on-prem server. But if you use the newly download SmartConsole you can do the one-to-one manual copy. Unfortunately, there is no export (at least that I've found) of the blocked application list.

Re: migration from on premise endpoint to cloud sandblast agent

MikeB — Thu, 13 May 2021 22:50:04 GMT

Hello @Kobie_Bendalak / @Ted_Serreyn

Any news or recommendations on the procedure to migrate an on-prem deployment to EPMaaS?

I need to migrate more than 1100 endpoints on a customer that has on-prem R80.40 management to EPMaaS.

Re: migration from on premise endpoint to cloud sandblast agent

Marcus_Halmsjo — Thu, 20 May 2021 13:09:42 GMT

Thought i should share my experience in this thread.

I migrated 300 clients this week with zero problems, the key that made my day was that i looked into the reconnect tool creation more closely.

the maketool.bat has a /silent parameter if you use that the reconnect.exe will not display popup after it is done and just quit, this made it possible to push this tool to every client that was connected to old management. Only issue is that the reconnect.exe exists with 1 and not 0 so if you push with anything that checks response add 1 as successful response.

they way i created the reconnect tool was that i created an export package in cloud management, downloaded the msi and unpacked it with 7-zip, searched the dir for config.dat it was named Binary.CPINSTADDEXT_config.dat.

Copied this file renamed it to config.dat and used it with maketool.bat with parameter /silent

One thing to note is that if the export package is configured to add computer to a virtual group it will do that also when you reconnect with the tool, i used this opportunity to cleanup some virtual groups when migrating.

Since nothing in this was sure to work did i check every client one by one, i was just happy to finally migrate and better it took a few more hours to be sure everything is ok.
Every client connected to cloud the second the reconnect tool was done, new policy was installed without issues.
Users did not notice any interuptions.

Important to state is that i did this on my own this was not initiated by Check Point in any way, i searched and read a few SK and decided to test and my backup plan was always to manually reinstall every client since that was the first migration plan either way.

Re: migration from on premise endpoint to cloud sandblast agent

Ted_Serreyn — Thu, 20 May 2021 13:13:32 GMT

Glad you had great success. I am still having problems even getting a resource involved to work with me on the initial export/import. Answer is always professional services engagement.

IMHO, this is what partners are for and who the client trusts to do this.

As to the why I need this, there are a multitude of tuning and exceptions that we have done over the last few years as part of this endpoint deployment. I do not want to lose this configuration as part of the migration.

Re: migration from on premise endpoint to cloud sandblast agent

Marcus_Halmsjo — Thu, 20 May 2021 13:27:32 GMT

Yeah i can understand that, was not so much for us, just viewed cloud as a "new" installation intead of a move.

Migrating rules and exceptions etc is a whole other level that i did not think of.

Re: migration from on premise endpoint to cloud sandblast agent

Dan_Cannon — Tue, 06 Jul 2021 08:29:28 GMT

just an FYI regarding this document - they have now updated the files to a .exe from .msi, so config.dat can be exported using 7zip from this. And for R81 the path for make tool will be something like C:\Program Files (x86)\CheckPoint\SmartConsole\R81\81.0.9500.556\util\RepWorkFolder\INVOKE (the 81.0.9500.556 represents the build of smart console)

Dan

Re: migration from on premise endpoint to cloud sandblast agent

Ted_Serreyn — Wed, 26 Jan 2022 17:48:31 GMT

1+ year later, same issue still exists. Try to get PS involved, they don't quote less than a week. TAC says PS has to do it. Customer still hasn't migrated endpoint management to cloud and at this point is beyond frustrated.

Re: migration from on premise endpoint to cloud sandblast agent

Chris_Atkinson — Thu, 27 Jan 2022 00:04:08 GMT

@jcortez Have you heard anything in this space?

Re: migration from on premise endpoint to cloud sandblast agent

jcortez — Thu, 27 Jan 2022 13:51:49 GMT

@Chris_Atkinson

This still requires PS. This from what I understand is an ongoing project and will not be completed anytime soon. If customers are looking for a quick migration and easiest route that would be to migrate without their existing database/migrate export and to just migrate the clients using our Reconnect Tool.

Now if a customer looking to migrate from Harmony Endpoint On-Premise to Harmony Endpoint Cloud (EPMaaS) and they are using FDE and MEPP, this makes the migration very complicated and it is suggested to migrate your database/migrate export. But again, it still remains that PS is needed for this migration and this is something TAC does not handle.

The only migration TAC can handle is if a customer is just migrating the client using the Reconnect Tool and there are no plans to bring over the database/migrate export.

Hope this helps.

Re: migration from on premise endpoint to cloud sandblast agent

Ted_Serreyn — Thu, 27 Jan 2022 14:18:24 GMT

Yeah no FDE, no MEPP. It’s a simple export/import, then use reconnect tool.

PS won’t do less than a week of time, and this shouldn’t take that amount. In addition customer has an issue with paying for this service.

IMHO, This is a case of checkpoint not considering their loyal existing clientele and how to keep them moving into the newer technologies.

We need to be able to take our new technologies and ask the question how do we get our existing checkpoint customers to migrate to this.

I understand the lack of back end access, but this is extremely frustrating as a partner to see and experience this.

to quote Gil: “we deserve the best security solutions”.

Re: migration from on premise endpoint to cloud sandblast agent

Dan_Cannon — Fri, 11 Feb 2022 10:13:53 GMT

@jcortez

I work for a partner also and second Ted's comments here. We are already seeing customers rejecting deals as there is no formal migration path. I think this is very short-sighted and should be addressed urgently as we cannot recommend an "upgrade" to cloud for the customer. This is particularly bad for customers using MEPP where they have extensive definitions already created.

Even with the workarounds I have any migration to cloud has its pitfalls and isn't a workable solution. Given Smart-1 cloud has the ability to allow a migrate import it should be the same for Endpoint.

Re: migration from on premise endpoint to cloud sandblast agent

John_Richards — Mon, 14 Feb 2022 22:41:07 GMT

I was curious if anyone had an issue using maketool.bat with the /silent switch? If we run maketool.bat config.dat and then run the created reconnect.exe on a workstation it prompts us for the uninstall password and it migrates from on-prem to Harmony successfully. If we run again with maketool.bat /silent config.dat password we get the reconnect.exe but nothing happens when we try run on the client machine. We are doing more testing but wondering if we're missing something. Thanks

Re: migration from on premise endpoint to cloud sandblast agent

jcortez — Wed, 16 Feb 2022 15:43:43 GMT

@John_Richards

CORRECTION! I apparently found my brain today...

When you make a reconnect tool that includes the password and the /silent flag/switch, you will not get any indication at all that the reconnect tool is running and has also completed. That is the point when combining the two, password and /silent flag/switch, so no one on the client side is aware of anything running at all.

However, you can look at current processes/services running and you will see tools used by the reconnect tool running when looking at Task Manager in Windows.

I said here to view the 'EP_CDTDll.log', but this is incorrect.

You can also collect and analyze the C:\Windows\Internet Logs\EP_CDTDll.log to see if the reconnect tool completed and ran successfully or if it failed.

The Reconnect Tool log, ReRegister.log, would be located here...

C:\Users\<user_name>\AppData\Local\Temp\CPReconnect<date stamp>\

Are you checking the Harmony Endpoint Client to see if it is pointing to the new server or not? You can see this in the Harmony Endpoint Clients GUI/Display Overview or in it's cpda.log located here to see which server is is connecting to and all servers it is aware of.
C:\ProgramData\CheckPoint\Logs\

Re: migration from on premise endpoint to cloud sandblast agent

John_Richards — Tue, 15 Feb 2022 17:47:15 GMT

Thanks for the information. We changed the uninstall password on the on-prem, updated the client and made sure same uninstall password in Harmony. We run the reconnect.exe and get the popup "Please enter administrative password in order to change/remove Endpoint Security configuration". We did download a new client and extracted the config.dat and tried a new reconnect.exe and same issue. We run maketool.bat /silent config.dat password and it does create the reconnect.exe. Is there something in the syntax we are missing?