Moving a Cluster Between CMAs

[RemoteUser]

Hi Mates,

I have a question regarding CMA.

Let's say I have a cluster currently assigned to CMA-X. Is it possible to move the entire cluster from CMA-X to CMA-Y, assuming it's S1C?

Thanks!

[Bob_Zimmerman]

It's possible, but annoying. You have to migrate the policy including relevant objects, then use the process in sk86521 to reset SIC on the firewall and establish trust with the new management.

I'm currently prepping a change like this with an on-prem MDS. Not yet sure if there will be an outage when policy is first pushed from the new management (it's a whole new policy with new rules, even though the rules say to do the same thing).

[PhoneBoy]

ReSICing following sk86521 should allow this to occur without an outage.

[Bob_Zimmerman]

I expect it to flush the connections table, since it's technically a different policy. Rematching should let simple connections pick back up, but anything going through NAT would break. Anything with dynamic data ports (like VoIP calls, FTP, etc.) would break. Anything with HTTPS Inspection would break. Probably more, since my firewalls are mostly set to drop connections on failover if IPS can't be guaranteed.

[emmap]

Yea there's not a seamless way to do it, domains have their own CAs and SIC setups independently of each other, so it's basically a manual thing. You need to migrate the policy and basically recreate everything in the new domain and reset SIC.