Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Carlos_Augusto_
Explorer

How to restore a deleted policy package after published?

Hello everyone,

 

I've seen several posts about restoring data in the R80.10 and newest versions of Gaia, but none of them about restoring a policy package(not an old policy, but a whole policy package).

 

I did a lab to test this and it seems impossible to restore it without restoring a backup. What I did was create 2 policy packages. Filled them with rules, published, installed. After that, deleted one of them and published again.

Here a some points about what I found:

Installation History didn't work in this case: there wasn't one, as the whole policy package doesn't exist anymore. Only the one that I haven't deleted was available, which, of course, didn't help.

Revisions(Manage&Settings) was useless: when you click the "view" button and the SmartConsole opens as read-only session, the deleted Policy Package did not appear in "manage policies and layers".

 

The only thing that I found reasonable possible is checking the audit logs in the same Revisions page and see what was deleted, but it seems unpractical depending on the volume of rules that were in policy package. Also, here is a intersting thing: the revision states that only 1 change was made(the action of deleting the policy package), but the audit logs shows a whole of delete actions(the number varies, again, depending on the volume of rules you had in the policy package).

Anyway, am I missing anything? Is there any other possible solution(again, not considering restoring backups)?

 

 

Thanks!

0 Kudos
1 Reply
PhoneBoy
Admin
Admin

At the moment, there is no rollback facility to change what’s in the management server to what was there before short of restoring a backup.
However; this might help in your manual recovery efforts: https://community.checkpoint.com/t5/Policy-Management/R80-Change-Control-A-Visual-Guide/td-p/39702
I believe we are addressing this as part of R80.40.
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events