topic Re: Moving a Cluster Between CMAs in General Topics

Moving a Cluster Between CMAs

RemoteUser — Fri, 14 Aug 2026 13:01:11 GMT

Hi Mates,

I have a question regarding CMA.

Let's say I have a cluster currently assigned to CMA-X. Is it possible to move the entire cluster from CMA-X to CMA-Y, assuming it's S1C?

Thanks!

Re: Moving a Cluster Between CMAs

Bob_Zimmerman — Fri, 14 Aug 2026 15:05:15 GMT

It's possible, but annoying. You have to migrate the policy including relevant objects, then use the process in sk86521 to reset SIC on the firewall and establish trust with the new management.

I'm currently prepping a change like this with an on-prem MDS. Not yet sure if there will be an outage when policy is first pushed from the new management (it's a whole new policy with new rules, even though the rules say to do the same thing).

Re: Moving a Cluster Between CMAs

emmap — Mon, 17 Aug 2026 03:51:37 GMT

Yea there's not a seamless way to do it, domains have their own CAs and SIC setups independently of each other, so it's basically a manual thing. You need to migrate the policy and basically recreate everything in the new domain and reset SIC.

Re: Moving a Cluster Between CMAs

PhoneBoy — Mon, 17 Aug 2026 13:41:31 GMT

ReSICing following sk86521 should allow this to occur without an outage.

Re: Moving a Cluster Between CMAs

Bob_Zimmerman — Mon, 17 Aug 2026 14:23:21 GMT

I expect it to flush the connections table, since it's technically a different policy. Rematching should let simple connections pick back up, but anything going through NAT would break. Anything with dynamic data ports (like VoIP calls, FTP, etc.) would break. Anything with HTTPS Inspection would break. Probably more, since my firewalls are mostly set to drop connections on failover if IPS can't be guaranteed.