topic Re: How to add new Qumatum gateway on running smart-1 appliance in General Topics

How to add new Qumatum gateway on running smart-1 appliance

TSOL — Tue, 25 Jun 2024 05:06:22 GMT

Hello Team,

We would like to replace the existing Fortigate with a Checkpoint Quantum.

And we would like to add "configured Qunatum Gateway" on running smart-1.

Therefore, we have considered the migration process as follows. Please let us know if anything is incorrect.

1.We counfigure a temporaly Smart-1 environment because the configuration place and running place are in different network.

2.We get the existing Fortigate configuration, and we convert the configuration using the SmartMove tool by Checkpoint.

3.We configure the Quantum Gateway to connect to a temporary Smart-1 environment.

4.We import the configuration, including the policies and objects created by the SmartMove tool, into the temporary Smart-1 environment.

5.We check the policies and objects in the temporary environment.

6.After the check is completed, we export the configuration using the Checkpoint 'migrate export' command from a temporary Smart-1 environment.

7.We move the appliance from the temporary to the running environment, and Then we connect the moved Quantum to the running environment using SIC.

8.We import the configuration to the running Smart-1 environment using the 'migrate import' command.

9.We cut over from the existing Fortigate to the new Quantum and check using the running environment.

Re: How to add new Qumatum gateway on running smart-1 appliance

emmap — Tue, 25 Jun 2024 05:24:48 GMT

When you say 'running Smart-1 environment', you mean an existing management server that is already managing policies and gateways? If so, you can't 'migrate import' (the new command is migrate_server for this) from one server to merge into an existing one, this tool is for moving a complete management database from an existing server to a fresh one. If you try this you may end up losing all the existing configurations from the target server.

I suggest that after you test the procedure with your temporary management server, you will have to then re-run the same import from SmartMove into the existing management server. You don't need the gateway to do this, the objects and policy will import into the management server for review for you do check over before moving to the next step of building up the gateway and installing the policy over to it.

Re: How to add new Qumatum gateway on running smart-1 appliance

TSOL — Tue, 25 Jun 2024 07:12:07 GMT

Dear emmap,

Thank you for the reply.

Yes, 'running Smart-1 environment' is "an existing management server that is already managing policies and gateways."

I understood that the migrate server command is used for restore or complete new setups, so I thought it might not be suitable for this migration, which is why I asked.

In this case, should we import into the running Smart-1 appliance using "(5) How to Complete the Migration" with "sk115416"?

Re: How to add new Qumatum gateway on running smart-1 appliance

emmap — Tue, 25 Jun 2024 07:26:54 GMT

Yes, after testing it in your temporary Smart-1 and taking a snapshot of the running Smart-1.

Re: How to add new Qumatum gateway on running smart-1 appliance

TSOL — Wed, 26 Jun 2024 04:19:51 GMT

Thank you for the reply.

Does this mean using SmartMove to import the config extracted from the temporary Smart-1 after testing into the running Smart-1?

Re: How to add new Qumatum gateway on running smart-1 appliance

emmap — Thu, 27 Jun 2024 02:54:56 GMT

No it means testing the SmartMove import on your temporary Smart-1 and then when you have tested it and it's not causing any issues, run the same thing against the running Smart-1.

Re: How to add new Qumatum gateway on running smart-1 appliance

the_rock — Thu, 27 Jun 2024 03:11:31 GMT

What I did last time I did this for customer was take their Cisco confir, use smart move to convert to CP, import that config into my CP mgmt lab and then use script from smart-1 portal to import lab mgmt config into smart-1 environment. Done 🙂

If you need help, message me directly, we can do remote.

Andy

Re: How to add new Qumatum gateway on running smart-1 appliance

TSOL — Thu, 27 Jun 2024 08:25:05 GMT

Hi the_rock

Thanks you for the reply.

Yes. Which SK should we refer to for that script?

We also want to migrate from temporary Smart-1 to the running smart-1.

Re: How to add new Qumatum gateway on running smart-1 appliance

TSOL — Thu, 27 Jun 2024 08:25:29 GMT

OK. I understood. thanks.

Re: How to add new Qumatum gateway on running smart-1 appliance

the_rock — Thu, 27 Jun 2024 11:46:19 GMT

I dont believe there is script for it, its one from the portal itself once you log in.