migrate SMS and gateways to new management IP network

[dehaasm]

We have an existing SMS with about 12 gateways managed using R81.10. We would like to migrate both SMS, smartevent server and gateways to new management IP network. Currently all gateways are management using the physical management interface and routed to the SMS. 

My recommendation would be;

• Deploy a new SMS in the new management network 
• Add a new management vlan to all gateways (same management network as SMS), not the management interface
• migrate configuration from old to new SMS
• Perform SIC norestart on all gateways and add them to the new SMS following this SK (one by one)

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

I believe this would be the best approach. Perhaps there is an easier way to add an additional IP address to the SMS but i believe ony one would be "known" to the gateways so it is quiet risky to do a big bang.

Please leave your thoughts in the comments.

[Tal_Paz-Fridman]

1. Create a dummy object with the IP address of the new Security Management Server.
2. Add the object to a new rule allowing all Security Gateways to accept connections from it.
3. Install the policy.
4. Export and import the configuration.
5. Complete the remaining steps, including updating the Security Management Server object's IP address in SmartConsole + Install Database
6. Install the policy on Security Gateways
7. Delete the dummy object.

This will remove the need to reset SIC

[dehaasm]

thanks no SIC reset required, i guess there is no way to use the existing SMS and add the IP address there right?

[Tal_Paz-Fridman]

If you refer to changing the IP address of the Management Server then refer to:

https://support.checkpoint.com/results/sk/sk40993

How to change the IP Address of a Security Management Server?

[dehaasm]

Hi,

I guess the initial plan is still solid, as you mentioned a SIC restart is not required however after performing a policy push from the new SMS with the updated management object using new IP address this is not of concern anymore? Or would a SIC reset still be required for the cert renewal?

If the IP Address of Security Management Server / Domain Management Server is changed, and SIC is never manually reset (between Security Gateway and Management Server), then the AutoRenewal of the Certificate will fail.

[emmap]

https://support.checkpoint.com/results/sk/sk103356

If you do everything up to and including step 5 the automatic SIC renewal will work.

[dehaasm]

Now i am getting confused will this work correctly while deploying a separate SMS and migrating the config or do we also need to follow https://support.checkpoint.com/results/sk/sk103356? This means SIC restart is still required correct?

[Tal_Paz-Fridman]

SIC itself is not based on IP but on certificate. Changing the IP of the Management Server or Migrating to a different IP will not affect SIC.

So an important thing to take care in advance is for your Security Gateways to accept connections from the new IP.

[CheckPointerXL]

it will affect autorenewal like emma said

But to be honest i remember some gw that failed to renew sic after some times i changed ip to sms because of missing services in policies...(sk164255) so it was able to reach new ip...

Anyway i will go for emma sk

[the_rock]

I second that, seems best option to me as well.

Andy