Smart-1 Cloud Management to On-Prem Security Management Server Migration

[chethan_m]

Hi,

Are there any SK articles or official documentation related to the migration of Check Point Smart-1 Cloud Management to an On-Premises SMS — either on a hardware appliance or virtual machine?

So far, I’ve only come across this community post: Migration Smart-1 to On-Premise | Management Serve... - Check Point CheckMates , but it addresses a slightly different query.

https://support.checkpoint.com/results/sk/sk179698 - is removed.

Regards,

Chethan

[G_W_Albrecht]

I would ask CP TAC for help here !

[PhoneBoy · Accepted solution]

sk179698 is an internal SK.
A TAC case is required to get the relevant export output.

Optionally, or in cases where you might need to import the configuration to a lower version (R81.20, for instance, whereas Smart-1 Cloud is currently on R82), you can use this: https://github.com/CheckPointSW/ExportImportPolicyPackage 
This will require some manual steps afterwords as not all object types are available via API.
However, it also doesn't require a TAC case.

[the_rock]

Just my personal opinion, but if I were you, I would NOT do that and here is why. First off, literally everything these days is moving to the cloud and 2nd, which to me, is such an important point, think about this situation.

Lets say someone is logged into smart console remotely making a change and actual server is 500 miles (or for us measuring in kilometres, 800 kms give or take) and something goes down) and no one can access anything, and only way to get things back to normal is to have console into the management server and revert the changes...you think anyone would feel like driving 8 hours for that? I dont think so : - )

With S1C, thats NEVER an issue, because its accessible from any computer that has Internet access and reverting change is super simple.

Anyway, just something to think about...at least thats one thing I ALWAYS say to people when discussing this and they totally get it. Yes, there is no ssh access to it, but truth be told, you need it once a year, even if that and when you do, you just ask TAC to log in and do whats needed.

Andy

[chethan_m]

Totally understand your point — but this request is based on a specific customer requirement. We’ve flagged the concern for future discussions.

[the_rock]

What is the request, if you dont mind me asking? Obviously, you dont have to say, Im just curious.

Andy

[genisis__]

There is a major design flaw in Smart-1 Cloud.  You cannot have more then one person login to Smart-1 Cloud using traditional SmartConsole from the the same src IP ie. a terminal server.    This in my option is extremely counter productive.  I would hope that Checkpoint resolves this in R82.10.

[the_rock]

Personally, to me anyway, thats a minor thing. But, thats just me : - )

I still stand by the argument I brought up.

Andy

[genisis__]

I agree; with everything weighed up there are more reasons to adopt Checkpoint SaaS solution, but in the short term there are limitations that stop/slow down adoption, which Checkpoint need to resolve.

[the_rock]

Personally, I still find those things minor, but again, thats just me. Im sure those will be fixed.

Andy

[PhoneBoy]

I suspect this will be addressed by way of moving more functionality to Web SmartConsole so the traditional SmartConsole isn't needed.

[the_rock]

excellent