How to change Security Gateway name ?

[XBensemhoun]

Hi,

For some reasons we may need to change the name of a Security Gateway.

I was wondering how to do exactly and what type of outage we could face on each steps.

Lets say that we have 100+ firewalls around the world, members of some VPN Communities (not based on PSK but certificates) ; their names are based on a site code as other local IT devices and because occasionally equipment are moved to another building : we need to change their names.

Changing the IP address is not a problem ; but changing the name, that's another thing.

I see six places in which we must change the name :

• SmartConsole (the firewall object itself)
• Operating System
  • hostname (no outage at all, using "set hostname ****" clish command)
  • host name entry : we must take care of it as Check Point process cannot start if they are not able to understand the corresponding IP of the firewall name ; use "show host names" clish command)
• And for three certificates : WebUI portal, IPSec and SIC

For SmartConsole : I don't know how to change it except creating a new firewall object as the previous one.

=> Q : is there an alternative ?

For certificates:

• WebUI do not cause a real traffic outage but we have to take care of RemoteAccess users if the Security Gateway is used as VPN EndPoint Gateway ;
• For IPSec : the certificate will be created at the creation of the firewall object or can be created again on the "Repository of Certificates Available to the Gateway" but during the time the new certificate is not pushed on other firewalls IPSec tunnels based on certificate are down
• Thanks to the Best of CheckMates CLI I know now that we can reset a SIC even without restarting firewall process (sk86521) ;

Does anybody know exactly how to do or has experienced the process ?

Thanks all in advance,

[Alejandro_Mont1]

As I understand it there is no way to change the gateway name as the SIC certificate is tied to the object (clicking on the object shows you the SIC name). I think you are correct, you will need to recreate the gateway objects and reset SIC. As you mentioned VPN tunnels there is another layer of complexity here: let's say you have 2 gateways, A and B that use certificates for tunnel establishment. You go through and rename A in Dashboard and reset SIC. If you then only install policy to gateway A, the VPN tunnel to B will go down as A is now using a different certificate than B expects. You will need to also install policy to B and any other gateways in that community or else the tunnels will not come up. As they need to renegotiate you may also observe some sort of outage.

If you did this gateway by gateway you would need to install policy to all gateways participating in VPN tunnels each time you reset SIC. I'd probably segment by community. Create the new gateway objects without establishing SIC, add them into relevant rules and communities and remove references to the old names from said communities. Then reset SIC to all of them and install policy to that group. Complexity is increased if you have gateways in multiple communities.

Just my 2 cents as that's how I'd probably do it. 

[XBensemhoun]

Well, another thing, about CA:

• do other VPN Gateways are able to establish VPN tunnels with the renamed Gateway because they share the same CA ?
• or is it really impossible to establish before installing policies on all other members of VPN Community ?

[G_W_Albrecht]

Old certificate must be removed: sk89100 / sk115394.

[XBensemhoun]

OK ; so we have sk89100 and sk115394‌ for changing IPSec VPN certificate which is used for ‌ and for some other blades.

Impacts if we change hostname and not defaultCert are:

• for admin access (CLI is theBestWay )
• Browser-Authentication TS Agent and blades as they could use the ‌

[JasonDC]

Wouldn't it be easier to throw an ISO at the gateway and refresh it?  Sounds like a lot of work to change on the gateway instead of rebuilding it from a clean state and modifying policy.

[Maarten_Sjouw · Accepted solution]

When you want to change the name of the gateway in SmartConsole and for the VPN certificate, you need to do a SIC reset, NOT initialize the SIC yet, first remove the gateway from the IP-SEC community, disable IP-SEC blade click OK, then rename the gateway object and now initialize the SIC. Then you can enable IP-SEC blade again and the new VPN certificate is created, then add the gateway to the VPN community again.