Split one Security Management Server with SmartCenter, SmartEvent Server and SmartEvent correlation

[constant69]

Hi Team,

We have a new customer with the following environment in R81.10:

• 5 cluster of gateways
• The Security Management Server is a dedicated virtual machine with SmartCenter, SmartEvent Server and SmartEvent correlation unit

Now I have task to split the Security Management Server as following:

• Keep the current virtual management machine as SmartCenter
• And migrate to a new virtual machine the blade SmartEvent Server and SmartEvent correlation unit

Where should I start? Is there any Guide?

Regards

[PhoneBoy]

You will install a new SmartEvent server per the relevant product documentation.
In your existing management, you would establish SIC and disable the SmartEvent blades
On your existing SMS, you would disable (uncheck) the SmartEvent blades.

Not sure it's more complicated than this.

[Tal_Paz-Fridman]

I think you meant that in your existing management you would establish SIC and enable the SmartEvent blades.

Also, do not forget to Install Database on all eligible objects.

[Gsoupramanien]

Thank you all for your feedback
PhoneBoyx, I will test the solution in the lab, and I will keep you informed

Regards

[G_W_Albrecht]

It is more a question of moving old logs or not: https://community.checkpoint.com/t5/Management/R77-30-to-R80-10-Migrating-logs/td-p/4041