topic Re: Quantum Spark/SMB - Change of central public IP in Mobile

Quantum Spark/SMB - Change of central public IP

Kryten — Tue, 07 Nov 2023 10:51:41 GMT

Hello Mates!

I am currently trying to find out what would need to be changed on centrally managed SMB devices if I need to change the ISP connection on the central Cluster.

I already checked the Web UI of the devices, but cannot find the place where I would change the public IP of the management server.

The VPN community for these devices has the Cluster Object as Gateway, so the new interface/IP is already there. When switching over to the other ISP, we plan to change the Cluster Main IP and the Link selection settings(so it points to the new IP). Would that be enough for the SMB devices to connect to the new IP? Do I need to change anything at all on the SMB device?

Maybe this is less complicated than I think(I never worked much with SMB devices so far), but I have the feeling I am missing something here...so any help is appreciated.

Re: Quantum Spark/SMB - Change of central public IP

G_W_Albrecht — Tue, 07 Nov 2023 11:19:51 GMT

Please explain further - where is the SMS located and how does it connect to the SMBs ? Usually, SMS has a local, internal IP and is NATed behind a GW/Cluster. For central management you do not use the Web UI of the devices but Dashboard to SMS.

Re: Quantum Spark/SMB - Change of central public IP

Kryten — Tue, 07 Nov 2023 12:57:05 GMT

Yes, thats the way its set up here as well. SMS has an internal IP and sits behind the main Cluster with a NAT.

Re: Quantum Spark/SMB - Change of central public IP

G_W_Albrecht — Tue, 07 Nov 2023 14:27:39 GMT

So it is just

sk62024: How to change the External IP address of a Cluster

Re: Quantum Spark/SMB - Change of central public IP

PhoneBoy — Tue, 07 Nov 2023 20:14:01 GMT

A policy installation to the SMB device would likely be required to ensure changes are correctly applied there.

Re: Quantum Spark/SMB - Change of central public IP

Kryten — Wed, 08 Nov 2023 11:43:43 GMT

Oh ok, cool...less hassle than I though, thank you!

Re: Quantum Spark/SMB - Change of central public IP

Kryten — Wed, 08 Nov 2023 11:46:59 GMT

We use two different policies, one for the central cluster and one for the smaller SMB devices. I guess it would make sense to push the policy for the SMBs first then. Otherwise we would change the outgoing NAT IP of the SMS and the peer IP for the tunnel before we would push the policy to the SMBs and probably loose connection?

Re: Quantum Spark/SMB - Change of central public IP

PhoneBoy — Wed, 08 Nov 2023 19:06:35 GMT

You may need to push the cluster policy first in this case because that's what ultimately changes the management IP/NAT.
Assuming you haven't disabled the various implied rules, the SMB gateways should still accept a new policy installation even with a different management IP (SIC authentication is certificate-based, not IP-based).
Worst case, you should be able to force the SMB gateway to fetch a new policy from the new management IP (e.g. with fw fetch mgmt-ip).