Can a Temporary SMS VM Be Migrated to a Production Smart-1 700S?

[yeruel]

Hi Check Point Community,

I would appreciate your advice on the following deployment scenario and whether it aligns with Check Point best practices.

Proposed Production Architecture

Site A (Headquarters)

• Quantum Force 9300

• Smart-1 700S (Central Security Management)

Site B (Remote Branch)

• Quantum 2000

• No permanent local Security Management Server

Implementation Challenge

During the initial deployment, there will be no WAN/MPLS connectivity between Site A and Site B. As a result, the Quantum 2000 at Site B cannot initially communicate with the Smart-1 700S located at Site A.

To overcome this, I am considering the following implementation approach:

1. Deploy a temporary Security Management Server (SMS) as a virtual machine at Site B.

2. Establish SIC with the Quantum 2000 gateway.

3. Configure network objects, security policies, NAT, VPNs, and complete implementation and acceptance testing.

4. Once the WAN/MPLS connection between Site A and Site B is established, deploy the production Smart-1 700S at Site A

5. Migrate the complete management database from the temporary SMS VM to the Smart-1 700S using the Check Point Migration Tools.

6. Manage both the Quantum Force 9300 at Site A and the Quantum 2000 at Site B from the centralized Smart-1 700S.

Questions

1. Is this implementation and migration approach fully supported by Check Point?

2. Can the gateway's SIC trust be preserved after migrating the management database to the Smart-1 700S, or will SIC need to be re-established?

3. Are there any licensing considerations when using a temporary SMS VM for staging before migrating to the production Smart-1 appliance?

4. Would you recommend this approach, or is there a better practice for implementing a remote gateway before WAN connectivity to the central management server becomes available?

The objective is to avoid deploying a permanent Smart-1 appliance at the remote site while still completing implementation, testing, and commissioning before the WAN connection to the headquarters is established.

I appreciate any recommendations or best practices from those who have implemented a similar scenario.

[Hugo_vd_Kooij]

As you put a SMB device on the remote site I would run it localy managed untill you are ready to connect.

It will be a much cleaner result.

[yeruel]

Thank you for your recommendation.

Just to confirm, are you suggesting that we should initially deploy the Quantum 2000 at the remote site as a locally managed SMB gateway, complete the local configuration and testing, and then later convert or onboard it to the central Smart-1 700S at HQ once WAN/MPLS connectivity is available?

If yes, could you please advise whether the locally managed configuration can be migrated/imported into the central Smart-1, or whether the gateway should be reset/reconfigured when moving to centralized management without losing configuration or interruption of gateway?

Thank you.

[emmap]

You can't easily migrate in the local policy to the Smart-1, there will be complications doing it this way.

[emmap]

1. Yes

2. SIC is preserved when migrating your management database

3: Yes, your appliance license will not work with your temporary VM. If you are not planning on running it for very long you could look at evals, else please contact your local CP office for advice here.

4: This sounds like a good idea to me. Make sure that you name your VM the same hostname as you want to apply to your Smart-1 server, you don't want to be changing the name. If your IP address will change in the migration, make sure there is already a rule pushed to the gateway that allows communication in from what will be the Smart-1's IP address.