migrating VSX to other domain on same MDS

[Rosenkrantz]

Hello.

I need some help here, but maybe there is no easy solution for this.

We have a Checkpoint SMC that we need to migrate to MDS. at the same time we need to split of the VSX clusters on several domains. Now, I hoped that I could just import same SMC to MDS several times and then cleanup what is not needed, and change IPs and names where needed, but it seems that is not supported: 

k156072
Domain Migration in versions R80.20 and higher
limitations:
Migration of the same security management server twice into an MDS (or to two different MDS machines in the same HA environment) is not supported.

Does anybody have an idea to how we can split the VSX clusters out to several domains?

all VSX clusters share the same policy package with a lot of objects so we really hoped the same smartcenter could be imported several times, but now I am out of ideas.

Best regards

René Rosenkrantz

[G_W_Albrecht]

I would ask TAC for a procedure to make this possible !

[PhoneBoy · Accepted solution]

Domain/SMS exports also include the Internal Certificate Authority.
The same ICA database cannot be used in multiple domains.

Which means…you’ll probably need to use something like: https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-...

[Rosenkrantz]

Thank you.

I think I can conclude that its not that easy. but exporting policies and objects is still a big help. to recreate the VSX is possible.

would be nice with export /import on the VSX clusters tho. 🙂

[_Val_ · Accepted solution]

Not easy at all. You will have to re-create VSX objects manually. I would use vsx provisioning tool for individual VSs. In the process, you will have to scratch your existing VSX config and perform reset gw, or you can "move" your clusters to a new HW.