How to migrate global domain objects and policy to a new MDS server?

[Abeja_huhuhu]

Hi Team,

sorry if this is noob question. i'm looking for the correct way for me to migrate global domain policy and objects to a new MDS server. Currently we have R81 MDS server and would like to copy its global domain objects and policy to a new MDS server which also running R81.  i notice that inside R81 there is a command migrate_global_policy which required a .tgz file from MDS server.  Can anyone point out to me on the correct step to prepare the tgz file and any other possible steps that we can use to meet the purpose.

[Danny · Accepted solution]

Correct, migrate_global_policy is your tool of choice. For full MDS migration the commands are: mds_backup / mds_restore

[Abeja_huhuhu]

Thanks @Danny 

[Martijn]

Danny,

Can I use this procedure for migrating a R80.40 Global database to an new R81.20 MDM server?
The documentation says:
Important - You cannot export an R80.X global configuration database and then use this utility on an R80.X Multi-Domain Server.

Nothing about R80.x to a R81.x version.

Tried migrate server to export the database but it won't import because the export was not created with the migrate export tool.

If supported, what is the correct procedure to export a R80.40 Global database so the generated file can be imported with migrate_global_policies

Regards,
Martijn

[Danny]

@Martijn : The link for R81.20 is here and jes, upgrading from R80.40 is supported.
The referenced limitation means that you need to export the configuration on the R80.40 MDS via the R81.20 migrate server tools and import the global config database via migrate_global_policies on the new R81.20 MDS.

[Martijn]

Danny,

I used the latest R81.20 migrate_server tools and performed a migrate_server export. This was succesfull.
Two files where created. The export file I created using the tool, but also a file called upgrade-export.13Sep2023-154337.tgz

Tried both files with the migrate_global_policies tool but both have the same error:

Welcome to the Global Policies Migration Utility.
Error: /opt/CPmds-R81.20/tmp/export_db/fwdir/conf does not include conf directory

So not sure what the correct procedure is to migrate the Global Domain from the R80.40 server.

Regards,
Martijn

[Hugo_vd_Kooij]

I assume you read https://support.checkpoint.com/results/sk/sk135172 carefully. However showing the exact commands use for each step might help. Also be very specific how you installed the new machine.

On various installation over the past week we found issues where an upgrade failed on Blink images. So at the moment the Blink images have llost their shine and I would avoid them.

[Martijn]

Danny,

TAC told me the migrate_global_policies tool is for migrating R77.x only. It is not supported for anything above R77.x. Why the tool is still available in R81.20 is not clear to me.

Can you explain?

Regards,
Martijn