Database Migration in VSX environment

[Vishnu_Kumar]

Hi All,

We have following two checkpoint servers

1. MGMT-SERVER-1:

• OS: Gaia R80.20
• VSX Environment (On 2 HA appliances)
• Managing 6 Virtual Systems.
• Each VS-Gateway policy package having around 200 policies.

1. MGMT-SERVER-2:

• OS: Gaia R80.10
• Only two firewall in HA Mode.
• 2000 + Polices into single Policy package.

Now we are planning to merge the database of both these management servers using Python toll

“Python tool for exporting/importing a policy package or parts of it “

I need your help for following queries:

• Can we run this python tool into VSX environment?
• As OS version are different (R80.10 and R80.20). So is possible to export policy package from R80.10 management server and then import it directly to R80.20 OS
• As we need to merge the policy package which having 2000+ policies, so is there any limitation on the basis of policy package size or number of policies.

[Maik]

Hello Vishnu,

Can we run this python tool into VSX environment?

This script (as well as the management API in general) performs operations on the management site. This means it does not matter if the gateway which is related to a given policy is based on VSX or not.

As OS version are different (R80.10 and R80.20). So is possible to export policy package from R80.10 management server and then import it directly to R80.20 OS

This script works on R80.10 and R80.20 - the export from R80.10 and import to R80.20 should work. I have not tested this so far, but as the API calls did not change between these versions I do not see any problem with that.

As we need to merge the policy package which having 2000+ policies, so is there any limitation on the basis of policy package size or number of policies.

There is no specific limit, but you could run into a timeout while exporting that amount of rules (if you mean rules by mentioning policies in this case). The script will tell you once a timeout is reached as it does not finish the rocess correctly. This can be circumvented by adjusting the timeout itself. In the first place I would try to run it without changing something; if it does not work you can manually adjust the timeout.

Regards,

Maik