topic Re: Do you take regular backups of your management server? in General Topics

Do you take regular backups of your management server?

Lari_Luoma — Sun, 22 Jan 2023 01:36:38 GMT

If not, configure them today! We in Professional Services have been involved in several cases during the last 12 months or so where our customer has lost their management server and had no backups. While we do have some recovery tools, getting everything back as it was using files from a gateway is never 100% guaranteed. It's also very time consuming task.

Having daily or weekly backups of your management server is the best thing you can do to keep your security infrastructure functioning even in the events of catastrophic events.

Re: Do you take regular backups of your management server?

the_rock — Sun, 22 Jan 2023 02:32:24 GMT

Agree 100%. We do at least weekly, but for few customers even daily fw/mgmt backups.

Re: Do you take regular backups of your management server?

Chiko_Phiri — Mon, 23 Jan 2023 17:40:50 GMT

Does the scheduled backup in Maintainance > System Backup contain the management database?

Re: Do you take regular backups of your management server?

the_rock — Mon, 23 Jan 2023 17:47:34 GMT

Im pretty positive it does and here is reason I say that...2 years ago, dont ask me why and how this happened and we even had TAC case, went to escalations and no one could figure it out...we had customer and one day out of the blue, they cant log into smart console. We did bunch of troubleshooting, did cpstop/start, reboot, nothing...cpm would simply never come up. After some time, TAC discovered that some database files were "missing", but no one knows why that happened...thank God we had backup and after restoring, we reinstalled same jumbo and bam, back in business.

Re: Do you take regular backups of your management server?

Scottc98 — Mon, 23 Jan 2023 17:48:01 GMT

same question as @Chiko_Phiri

- for a single management system, is that applicable backup to rebuild a Smart-1 appliance?

- for a single management system virtual machine (vMWare ESXI), what would be the recommended backup or schedule cadence with the considerations of VM snapshots being possible?

- For HA management (two Smart-1 appliances in different geo-locations), what would be the recommendations and schedule cadence knowing the odds of failure of both appliances is lessen?

Really glad this subject came up as I was literally discussing with some co-workers last week about what are some best practices for management.

Re: Do you take regular backups of your management server?

Lari_Luoma — Mon, 23 Jan 2023 18:10:21 GMT

It does. Refer to the following sk for comparison between different backup methods.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902#Snapshot%20Management

Re: Do you take regular backups of your management server?

Lari_Luoma — Mon, 23 Jan 2023 18:19:44 GMT

Check the SK I pasted above for details.

System backup is enough to restore the applicable server. However, you would still need to install Gaia OS to the same Jumbo Hotfix level as previously. Snapshot also backs up the binaries, but system backup does not.

What comes backing up the secondary management server, you can always synchronize it with the primary. Even if you have older snapshot or just a clean installation of the secondary server you can sync it with the primary. However, in large environments I would back up both with the same cadence as having up-to-date backups from both would speed up the restoration process.

Re: Do you take regular backups of your management server?

the_rock — Mon, 23 Jan 2023 18:46:26 GMT

JUST in case (knock on wood), if need be, below is procedure to get mgmt up and going if its totally hosed.

Re: Do you take regular backups of your management server?

Lari_Luoma — Tue, 24 Jan 2023 04:14:34 GMT

This procedure assumes that you have the files. Many of my customers I have worked with had nothing else than a gateway. 🙂

Re: Do you take regular backups of your management server?

the_rock — Tue, 24 Jan 2023 04:18:40 GMT

Tell me about it lol

Re: Do you take regular backups of your management server?

Alex- — Tue, 24 Jan 2023 08:01:43 GMT

Actually, I sometimes use the gateway as SCP recipient of SMS backups. They have plenty of space in /var/log, are often in the same management space than the gateways and are more reliable than an external file server shared with other services. Just remove older backups every now and then.

Re: Do you take regular backups of your management server?

Blason_R — Tue, 24 Jan 2023 09:32:22 GMT

Undoubtedly - We prefer once a weekly and even migrate export once a month just to doubly sure.

Re: Do you take regular backups of your management server?

Blason_R — Tue, 24 Jan 2023 09:33:37 GMT

Yeah - but I am keen to know on that advanced part about getting rules back from just a files. I mean that would be interesting.

Re: Do you take regular backups of your management server?

_Val_ — Tue, 24 Jan 2023 10:48:02 GMT

Not just that, I am afraid. This procedure is for R77.x and below.

Re: Do you take regular backups of your management server?

EnriqueGB — Mon, 30 Jan 2023 14:14:00 GMT

Does CheckPoint recommends or supports any cloud native(Azure backup and/or AWS backup) method for the management servers? Restoring a MDS backup in Azure has been... an experience.

Re: Do you take regular backups of your management server?

Alan_Long — Mon, 30 Jan 2023 14:36:08 GMT

I have 2 mgmt servers in AWS, I manually do a migrate_server export twice a week on both of mine and copy them out to a server.

When we migrated from R80.30 to R81.10, that is how we moved the db from one version to another.

Re: Do you take regular backups of your management server?

the_rock — Mon, 30 Jan 2023 14:37:18 GMT

That is indeed supported method CP recommends for Azure/AWS as well.

Re: Do you take regular backups of your management server?

EnriqueGB — Mon, 30 Jan 2023 14:58:36 GMT

My experience has not been so pleasant. Our MDS is heavy and due different "events" we had to restore a new VM, import the backup, move the public IPs... and a long etc. (THANKS CheckPoint support team!).

But I wonder if we have simple VMs with the MDS (primary and secondary), would be possible to perform snapshots with the native services?

Re: Do you take regular backups of your management server?

PhoneBoy — Mon, 30 Jan 2023 20:04:13 GMT

The problem with using these backups is that you may end up with a backup in an inconsistent state.
Which is why they are only recommended to use when the VM is powered down.
Otherwise, it's better to use one of the official Check Point methods for backup.

Re: Do you take regular backups of your management server?

Vladimir — Tue, 31 Jan 2023 06:00:55 GMT

@Lari_Luoma , I will make a bold suggestion for Check Point to introduce a built-in flash drives in their management server appliances, to which the backups will be performed automatically, by default, without any user input.

Who knows, the ROI may just justify it:)