For some reasons we may need to change the name of a Security Gateway.
I was wondering how to do exactly and what type of outage we could face on each steps.
Lets say that we have 100+ firewalls around the world, members of some VPN Communities (not based on PSK but certificates) ; their names are based on a site code as other local IT devices and because occasionally equipment are moved to another building : we need to change their names.
Changing the IP address is not a problem ; but changing the name, that's another thing.
I see six places in which we must change the name :
- SmartConsole (the firewall object itself)
- Operating System
- hostname (no outage at all, using "set hostname ****" clish command)
- host name entry : we must take care of it as Check Point process cannot start if they are not able to understand the corresponding IP of the firewall name ; use "show host names" clish command)
- And for three certificates : WebUI portal, IPSec and SIC
For SmartConsole : I don't know how to change it except creating a new firewall object as the previous one.
=> Q : is there an alternative ?
- WebUI do not cause a real traffic outage but we have to take care of RemoteAccess users if the Security Gateway is used as VPN EndPoint Gateway ;
- For IPSec : the certificate will be created at the creation of the firewall object or can be created again on the "Repository of Certificates Available to the Gateway" but during the time the new certificate is not pushed on other firewalls IPSec tunnels based on certificate are down
- Thanks to the Best of CheckMates CLI I know now that we can reset a SIC even without restarting firewall process (sk86521) ;
Does anybody know exactly how to do or has experienced the process ?
Thanks all in advance,
Information Security enthusiast, CISSP, CCSP