Backup of SMS policy package

[Matlu]

Hello, Team.

Could you tell me, what is the syntax of the command, to generate a "BACKUP of the policy package" of my Security Management Server?

Currently, I have an Open Server, running a SMS in version R81.10, and we only need a Backup of the policies (it is not an option now, to take a Snapshot).

We understand that the ./ migrate export is no longer "recommended".

We only need to have the BACKUP, in case of any "eventuality" for a pending work window.

Please, could you tell me what would be the correct command that can help us to get the Backup?

Greetings.

[Alex-]

You can run a backup with the backup command and download it and restore on the same server if needs be.

For an export that you can restore a freshly installed SMS you can run in Expert mode $FWDIR/scripts/migrate_server export -v R81.10 absolute_path/yourserver.tgz

Depending on your situation there are flags to ignore errors, skip upgrade tools verification, include logs and so on.

You find all this in the R81.10 SMS administration guide.

Download the file and run the same command with import instead of export on a test SMS VM to check if everything gets restored correctly.

[Matlu]

Hello, Alex.

Thanks for your reply.

If I want to take the Backup, and that it is saved, maybe, in the directory /var/tmp ....

The syntax would be something like this:
"$FWDIR/scripts/migrate_server export -v R81.10 /var/temp/BKPSMS.tgz"

Is my syntax correct?

[Alex-]

That's correct, the system will ask you to cpstop or ensure all sessions are closed also.

[Matlu]

Alex,

Is it an "expected behavior" the fact that, when trying to get a Backup of the SMS policy package, the system, if or if it "restarts"?

Is this normal?

Is there a way to generate the same Backup, but avoiding the MGMT "restart"?

[Alex-]

If by restart you mean reboot, I haven't seen backups and exports causing this behaviour.

I generally do a cpstop when exporting for security but backups should run live without interrupting the system.

[the_rock]

Agree, good point.

[Matlu]

So, I just run the syntax I explained above?

By "reboot" I mean the "fear" that by executing the command in the SMS CLI, the device as such, reboots, i.e. reboots.

This is not the case, is it?

Anyway, I understand that there would not be any service impact, as it is simply MGMT.

[the_rock]

Thats is bro, no need to worry, as @PhoneBoy said, it will perform cpstop anyway, not a reboot.

Andy

[Matlu]

Hello, Alex.

This package that you manage to export with the command you mentioned, can it be "imported" into a new VM?

I want to replicate the "policy package" in a new VM that I am going to raise.

An additional doubt, when we "export" the policy package, how is the SMS licensing issue handled?
Is the licensing something that is "exported" with the policy package?

[PhoneBoy]

To be exceptionally clear: you are exporting the entire management configuration database with migrate_server export.
This includes everything you can configure in SmartConsole (including licenses), but does NOT include the Gaia OS host/interface configuration.

And yes, this can be imported into a new VM, provided it is the same version specified as part of the export.

[CJINES]

Hello, good morning.

The command $FWDIR/scripts/migrate_server export -v R81.10 /var/temp/BKPSMS.tgz helped me export the SMS configuration from a virtual machine that is giving me problems.

Please, I need to know the command to be able to import the backup that I previously exported (I want to import this backup to a new virtual machine that I already have deployed)

I also need to know the path to where this backup should point.

[the_rock]

Just check import section command at the bottom of the sk.

Andy

https://support.checkpoint.com/results/sk/sk135172

[the_rock]

What @PhoneBoy told you is how it works. Licenses are also imported to a new server, but IP/hostname are unchanged.

Andy

[PhoneBoy]

A cpstop is generally performed when using the migration tools, yes.
If this is a standalone box (gateway and management on same system), then this will cause an outage.

[the_rock]

You got it. 

Andy