Quantum Spark/SMB - Change of central public IP

[Kryten]

Hello Mates!

I am currently trying to find out what would need to be changed on centrally managed SMB devices if I need to change the ISP connection on the central Cluster.

I already checked the Web UI of the devices, but cannot find the place where I would change the public IP of the management server.

The VPN community for these devices has the Cluster Object as Gateway, so the new interface/IP is already there. When switching over to the other ISP, we plan to change the Cluster Main IP and the Link selection settings(so it points to the new IP). Would that be enough for the SMB devices to connect to the new IP? Do I need to change anything at all on the SMB device?

Maybe this is less complicated than I think(I never worked much with SMB devices so far), but I have the feeling I am missing something here...so any help is appreciated.

[G_W_Albrecht]

Please  explain further - where is the SMS located and how does it connect to the SMBs ? Usually, SMS has a local, internal IP and is NATed behind a GW/Cluster. For central management you do not use the Web UI of the devices but Dashboard to SMS.

[Kryten]

Yes, thats the way its set up here as well. SMS has an internal IP and sits behind the main Cluster with a NAT.

[G_W_Albrecht]

So it is just

sk62024: How to change the External IP address of a Cluster

[Kryten]

Oh ok, cool...less hassle than I though, thank you!

[PhoneBoy]

A policy installation to the SMB device would likely be required to ensure changes are correctly applied there.

[Kryten]

We use two different policies, one for the central cluster and one for the smaller SMB devices. I guess it would make sense to push the policy for the SMBs first then. Otherwise we would change the outgoing NAT IP of the SMS and the peer IP for the tunnel before we would push the policy to the SMBs and probably loose connection?

[PhoneBoy]

You may need to push the cluster policy first in this case because that's what ultimately changes the management IP/NAT.
Assuming you haven't disabled the various implied rules, the SMB gateways should still accept a new policy installation even with a different management IP (SIC authentication is certificate-based, not IP-based).
Worst case, you should be able to force the SMB gateway to fetch a new policy from the new management IP (e.g. with fw fetch mgmt-ip).