topic Re: migrate SMS and gateways to new management IP network in General Topics

migrate SMS and gateways to new management IP network

dehaasm — Fri, 21 Mar 2025 18:35:57 GMT

We have an existing SMS with about 12 gateways managed using R81.10. We would like to migrate both SMS, smartevent server and gateways to new management IP network. Currently all gateways are management using the physical management interface and routed to the SMS.

My recommendation would be;

Deploy a new SMS in the new management network
Add a new management vlan to all gateways (same management network as SMS), not the management interface
migrate configuration from old to new SMS
Perform SIC norestart on all gateways and add them to the new SMS following this SK (one by one)

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk86521

I believe this would be the best approach. Perhaps there is an easier way to add an additional IP address to the SMS but i believe ony one would be "known" to the gateways so it is quiet risky to do a big bang.

Please leave your thoughts in the comments.

Re: migrate SMS and gateways to new management IP network

Tal_Paz-Fridman — Fri, 21 Mar 2025 18:59:18 GMT

Create a dummy object with the IP address of the new Security Management Server.
Add the object to a new rule allowing all Security Gateways to accept connections from it.
Install the policy.
Export and import the configuration.
Complete the remaining steps, including updating the Security Management Server object's IP address in SmartConsole + Install Database
Install the policy on Security Gateways
Delete the dummy object.

This will remove the need to reset SIC

Re: migrate SMS and gateways to new management IP network

dehaasm — Mon, 24 Mar 2025 07:59:18 GMT

thanks no SIC reset required, i guess there is no way to use the existing SMS and add the IP address there right?

Re: migrate SMS and gateways to new management IP network

Tal_Paz-Fridman — Mon, 24 Mar 2025 09:26:57 GMT

If you refer to changing the IP address of the Management Server then refer to:

https://support.checkpoint.com/results/sk/sk40993

How to change the IP Address of a Security Management Server?

Re: migrate SMS and gateways to new management IP network

dehaasm — Tue, 25 Mar 2025 09:17:24 GMT

Hi,

I guess the initial plan is still solid, as you mentioned a SIC restart is not required however after performing a policy push from the new SMS with the updated management object using new IP address this is not of concern anymore? Or would a SIC reset still be required for the cert renewal?

If the IP Address of Security Management Server / Domain Management Server is changed, and SIC is never manually reset (between Security Gateway and Management Server), then the AutoRenewal of the Certificate will fail.

Re: migrate SMS and gateways to new management IP network

emmap — Tue, 25 Mar 2025 14:12:52 GMT

https://support.checkpoint.com/results/sk/sk103356

If you do everything up to and including step 5 the automatic SIC renewal will work.

Re: migrate SMS and gateways to new management IP network

dehaasm — Tue, 25 Mar 2025 15:02:09 GMT

Now i am getting confused will this work correctly while deploying a separate SMS and migrating the config or do we also need to follow https://support.checkpoint.com/results/sk/sk103356? This means SIC restart is still required correct?

Re: migrate SMS and gateways to new management IP network

Tal_Paz-Fridman — Tue, 25 Mar 2025 17:32:23 GMT

SIC itself is not based on IP but on certificate. Changing the IP of the Management Server or Migrating to a different IP will not affect SIC.

So an important thing to take care in advance is for your Security Gateways to accept connections from the new IP.

Re: migrate SMS and gateways to new management IP network

CheckPointerXL — Wed, 02 Apr 2025 21:51:25 GMT

it will affect autorenewal like emma said

But to be honest i remember some gw that failed to renew sic after some times i changed ip to sms because of missing services in policies...(sk164255) so it was able to reach new ip...

Anyway i will go for emma sk

Re: migrate SMS and gateways to new management IP network

the_rock — Thu, 03 Apr 2025 01:52:53 GMT

I second that, seems best option to me as well.

Andy