- Products
- Learn
- Local User Groups
- Partners
- More
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
Join our TechTalk: Malware 2021 to Present Day
Building a Preventative Cyber Program
Be a CloudMate!
Check out our cloud security exclusive space!
Check Point's Cyber Park is Now Open
Let the Games Begin!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hi,
For some reasons we may need to change the name of a Security Gateway.
I was wondering how to do exactly and what type of outage we could face on each steps.
Lets say that we have 100+ firewalls around the world, members of some VPN Communities (not based on PSK but certificates) ; their names are based on a site code as other local IT devices and because occasionally equipment are moved to another building : we need to change their names.
Changing the IP address is not a problem ; but changing the name, that's another thing.
I see six places in which we must change the name :
For SmartConsole : I don't know how to change it except creating a new firewall object as the previous one.
=> Q : is there an alternative ?
For certificates:
Does anybody know exactly how to do or has experienced the process ?
Thanks all in advance,
As I understand it there is no way to change the gateway name as the SIC certificate is tied to the object (clicking on the object shows you the SIC name). I think you are correct, you will need to recreate the gateway objects and reset SIC. As you mentioned VPN tunnels there is another layer of complexity here: let's say you have 2 gateways, A and B that use certificates for tunnel establishment. You go through and rename A in Dashboard and reset SIC. If you then only install policy to gateway A, the VPN tunnel to B will go down as A is now using a different certificate than B expects. You will need to also install policy to B and any other gateways in that community or else the tunnels will not come up. As they need to renegotiate you may also observe some sort of outage.
If you did this gateway by gateway you would need to install policy to all gateways participating in VPN tunnels each time you reset SIC. I'd probably segment by community. Create the new gateway objects without establishing SIC, add them into relevant rules and communities and remove references to the old names from said communities. Then reset SIC to all of them and install policy to that group. Complexity is increased if you have gateways in multiple communities.
Just my 2 cents as that's how I'd probably do it.
Well, another thing, about CA:
Old certificate must be removed: sk89100 / sk115394.
OK ; so we have sk89100 and sk115394 for changing IPSec VPN certificate which is used for and for some other blades.
Impacts if we change hostname and not defaultCert are:
Wouldn't it be easier to throw an ISO at the gateway and refresh it? Sounds like a lot of work to change on the gateway instead of rebuilding it from a clean state and modifying policy.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY