topic Re: Migrate to New Management Server - Migrate Export - Does this include any Management IP info? in General Topics

Migrate to New Management Server - Migrate Export - Does this include any Management IP info?

Networks_Team_B — Wed, 21 Feb 2024 08:18:46 GMT

Hello,

We are using a new Management Server (R81.20), and I want to export the database and policies from the existing server to the new one.

Does the 'migrate export' contain any management IP info?

I wanted to ensure that it doesn't, as if it did, this may cause us problems.

Does it just contain the objects, policies etc.....

Many thanks

Re: Migrate to New Management Server - Migrate Export - Does this include any Management IP info?

Tal_Paz-Fridman — Wed, 21 Feb 2024 08:28:57 GMT

The export includes the entire database including all the policies and objects.

The Security Management Server objects is exported with the old IP address but it can be changed after the import into the new machine. Please refer to:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Guide/Content/Topics-IUG/Migrating-Database-Between-SecMmgt-Servers.htm?tocpath=Special%20Scenarios%20for%20Management%20Servers%7C_____3

How to change the IP Address of a Security Management Server?

https://support.checkpoint.com/results/sk/sk40993

Re: Migrate to New Management Server - Migrate Export - Does this include any Management IP info?

Networks_Team_B — Wed, 21 Feb 2024 09:20:14 GMT

Thanks for your help - the guide sk40993 is very helpful

Re: Migrate to New Management Server - Migrate Export - Does this include any Management IP info?

RamGuy239 — Wed, 21 Feb 2024 12:12:54 GMT

It's also important to note that migrate export ($FWDIR/bin/upgrade_tools/migrate) has been replaced with $FWDIR/scripts/migrate_server on R80.20+. You can still utilise the old way of doing things (I believe?), but it's recommended and better to utilise the new way of migrating a management server.

The process itself is pretty much identical, but the size of the export, how verbose it is during the process, the report before and after, etc is greatly improved using migrate_server.

Re: Migrate to New Management Server - Migrate Export - Does this include any Management IP info?

the_rock — Wed, 21 Feb 2024 12:52:34 GMT

Just remember to confirm the route is correct, besides all the other things mentioned.

Best,

Andy

Re: Migrate to New Management Server - Migrate Export - Does this include any Management IP info?

Networks_Team_B — Thu, 22 Feb 2024 10:39:54 GMT

Thanks for your help

We are seeing an issue with the import, getting the following error message:

'Failed to import. See /opt/Cpsuite-R81/fw1/log/upgrade_client.elg or /opt/CPsuite-R81.20/fw1/log/cpm.elg for more details'

I've looked at these files but can't find anything helpful.

I've ran hcp -r all and that has said that we cannot connect to the User Centre - Oddly enough we can sync to the UC when on SmartConsole

Have you seen this before?

Re: Migrate to New Management Server - Migrate Export - Does this include any Management IP info?

RamGuy239 — Thu, 22 Feb 2024 10:53:03 GMT

I would almost always run the export and import like this:

$FWDIR/scripts/migrate_server export -v R81.20 -ivw /path/filename.tgz
$FWDIR/scripts/migrate_server import -v R81.20 -ivw /path/filename.tgz

-ivw Will ignore warnings. Most of the time the warnings are for stuff that doesn't really matter, and it's really annoying to have it cancel the entire process just because of some non-important warnings.

Could you show the complete command you ran for both the export and import? Just to verify if you are running it correctly. You can also do a $FWDIR/scripts/migrate_server verify -v R81.20 on the existing management server before hand to get a full report before doing any actual export.

On the new management server, it's important to make sure you already have the correct IP addressing, routing, hostname and DNS configured before starting the import. Ideally you should make it so it can communicate with updates.checkpoint.com for it to automatically update the migrate_server script to the latest version, or update it manually from sk135172:

https://support.checkpoint.com/results/sk/sk135172

I will normally install the latest recommended JHF before doing the import, just to have all latest bugfixes installed.

Re: Migrate to New Management Server - Migrate Export - Does this include any Management IP info?

Networks_Team_B — Thu, 22 Feb 2024 13:36:00 GMT

Thanks for your help

We ran the commands you suggested there, and it exported and imported successfully 😁

Re: Migrate to New Management Server - Migrate Export - Does this include any Management IP info?

the_rock — Thu, 22 Feb 2024 13:53:37 GMT

Glad it worked. For the reference, this is the best sk.

https://support.checkpoint.com/results/sk/sk135172

Also, keep in mind, when you do this, does NOT change the IP or the hostname, but, it does import the license.

Best,

Andy