MDS to Mgmt Server

[Sanjay_S]

Hi Team,

We are planning to decommission our Multi-Domain Server as we have only 4 domains. We are planning to migrate it to the individual Management server and decom MDS. 

We are running on R81.10, please let me know what is the best way to start the planning with. I don't really find any document related to this.

Regards,

Sanjay S

[PhoneBoy]

Looks like you need to use the management API to export a single domain.
See: https://support.checkpoint.com/results/sk/sk156072 

[Sanjay_S]

Thanks @PhoneBoy 

I tried this i think this is what i wanted, but looks like i am facing issues while exporting.

Database Export Failed

Failed to compress data from var/log//migrate-01.08.2024.115207/ directory into var/log/Test_Management_Server_exported.tgz file: 'other' is different type of Path

Any Idea what it could be?

[the_rock]

Maybe / instead of //?

[Sanjay_S]

This is what i tried. I did not give any path other than saving the database.

[Expert@LAB:0]# mgmt_cli export-management version R81.10 domain-name "Test_Management_Server" file-path "var/log/Test_Management_Server_exported.tgz" --domain 'System Data' --format json
Username: admin
Password:

[the_rock]

Just to make sure, from your mgmt, that command worked but then import failed on mds?

[the_rock]

K, since I want to do my best to hel you out properly, I will build MDS lab again and test this. Please share EXACT commands you used to export the config from mgmt and then import into MDS's cma. I will try it and let you know what happens.

Andy

[Sanjay_S]

@the_rock  you are awesome. Thanks a lot.

Below is what i tried.

I used below connd to export from MDS:
[Expert@LAB:0]# $MDS_FWDIR/scripts/migrate_server export -skip_upgrade_tools_check --ignore_warnings -v R81.10 /var/log/Export_for_Migration.tgz

To Import on SMS: Tried a couple of things.
[Expert@MGMT:0]# cd $FWDIR/scripts/

[Expert@MGMT:0]# ./migrate_server migrate_import_domain -v R81.20 [-skip_upgrade_tools_check] [-l | -x] [/var/log/mdss.json] [--include-uepm-msi-files] [--exclude-uepm-postgres-db] /<Full Path>/<Name of Exported File>.tgz

[Expert@MGMT:0]#./migrate_server migrate_import_domain Test_Management_Server -skip_upgrade_tools_check --ignore_warnings -v R81.10 /var/log/Export_for_Domain_Migration.tgz

[Expert@MGMT:0]# ./migrate_server migrate_import_domain -sn Test_Management_Server -skip_logs -o /var/log/Export_for_Domain_Migration.tgz

Tried exporting single CMA using migrate_server:
[Expert@LAB:0]# mdsenv Test_Management_Server

[Expert@LAB:0]# $MDS_FWDIR/scripts/migrate_server export -skip_upgrade_tools_check --ignore_warnings -v R81.10 /var/log/Export_for_Test.tgz

[Expert@LAB:0]#/opt/CPmds-R81.10/customers/Test_Management_Server/CPsuite-R81.10/fw1/scripts/migrate_server export -skip_upgrade_tools_check --ignore_warnings -v R81.10 /var/log/Export_for_Migration_Sothebys.tgz

Now Tried the APIs to export Single Domain as below:
[Expert@LAB:0]# mgmt_cli export-management version R81.10 domain-name "Test_Management_Server" file-path "var/log/Test_Management_Server_exported.tgz" --domain 'System Data' --format json

Even this failed.

[PhoneBoy]

Let me say it again @Sanjay_S: your file-path argument needs to START with a / (e.g. /var/...)
That is most likely why this is failing.

[the_rock]

I agree 100%

[the_rock]

@Sanjay_S I actually did it in the lab EXACTLY how sk showed, exported and imported into mgmt server fine. Again, due to another large project Im doing, had to delete that lab, as need space/memory in eve-ng for other things, but worked fine. If you cant get it done, happy to do remote.

Andy

[the_rock]

I see what you were saying yesterday, I just tested it and got below, but either way, even when you export it, does NOT sadly import into mgmt server.

Andy

[Expert@Provider-1:0]# $MDS_FWDIR/scripts/migrate_server export -skip_upgrade_tools_check -v R81.20 /var/log/Export_for_Upgrade_from_R8020_to_R8120.tgz
Error: /opt/CPsuite-R81.20/fw1/scripts/migrate_server utility can be executed only in a Multi-Domain environment. Run 'mdsenv' first.
[Expert@Provider-1:0]# mdsenv
[Expert@Provider-1:0]#

[PhoneBoy]

Path should begin with a /

[Sanjay_S]

I will try this and update.

Thanks both @the_rock @PhoneBoy you guys are awesome 🙂

[the_rock]

we try bro, we try 🙂

[Sanjay_S]

This worked 🙂

I am now trying to importing it to the new Mgmt Server. Will update the outcome.

[Sanjay_S]

Running Migrate Import Domain
Operation started at Fri Aug 2 10:57:35 BST 2024

2Aug2024-110750: Failed to migrate_import_domain: Failed: Import of a domain that is assigned to the global into SMC is not supported

Operation finished at Fri Aug 2 11:08:52 BST 2024

I think i need to remove the Global Policy objects first and then migrate it, is my understanding right?

[the_rock]

Yes, thats EXACTLY what you need to do, correct.

Andy

[Sanjay_S]

[Expert@CP-Test-Mgmt-Server:0]# $MDS_FWDIR/scripts/migrate_server migrate_import_domain -l /var/log/Sotheby_Management_Server_exported.tgz
Running Migrate Import Domain
Operation started at Fri Aug 2 15:58:40 BST 2024

2Aug2024-160901: Failed to migrate_import_domain: Failed: Import of a domain that is assigned to the global into SMC is not supported

Operation finished at Fri Aug 2 16:10:02 BST 2024

Even after deleting all teh Global objects and pushing the policy i still see the same issue 😞

[the_rock]

I never ran it with domain flag and worked fine. Again, sorry, had to delete that lab, as I have another large project thats super important where I needed eve-ng resources for, but it definitely worked.

Andy

[Sanjay_S]

@the_rock and @PhoneBoy May i know what the SMC is?

What is the difference between?

Migrate of a Domain Management Server to a Security Management Server, in the SMC use:

and

this Migrate from a Security Management Server to a Security Management Server, on the target Security Management Server use:

[the_rock]

Its exactly what it says, just "jumbled". 

[Sanjay_S]

@the_rock i think i made some progress today. But after 70% of import ssh session closed. So not sure what happened after that.

Now geeting "CRLs failed to be downloaded" error while logging into dashboard.

I stopped all cp services, cpstop and cpstart even then no help.

is there any cli command sheet to check all the services are running or not, did it import correctly or not.

Do you mind help me with this please?

[the_rock]

Where are you located? Lets do remote, I can try help.

Andy