cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

MDS Migration

MDS Migration from R80.10 to R80.20Hello guys,I’m doing a migration of an MDS from r80.10 to R80.20 with 2 CMAs.What is the best approach?

File system encrypted?

Is the file system encrypted?I know that SIC comms between gateways <->Mgmt, and Mgmt Clients <->Mgmt is encrypted... but was wanting to know if the actual file system is.
Martin_Valenta
Martin_Valenta inside Multi-Domain Management Wednesday
views 691 10

Concurrent policy install on r80.x

Are there any plans to enable option to push multiple policies at same time and not sequeantually?
Gertjan_Arling
Gertjan_Arling inside Multi-Domain Management Wednesday
views 2407 3

What is SMARTLSM (Large Scale Management)?

This seems to be a new product? What is Large Scale Management?

vsx_util vsls stopped working in JHF_take_189

After upgrading our MDS and then the VSX Gateways to JHF 189 (from take 91) I am unable to run vsx_util vsls to move the active VS's to the GW that has take 189. I manually failed over the VS's and proceeded on applying the hotfix on the other GW. Now both GW are not responding when I try to redistribute the VS's for load balancing. We have a 13800 appliance in ClusterXL. Has anybody encountered this issue with take 189 in VSX environment?
Ravindra_Katrag
Ravindra_Katrag inside Multi-Domain Management 2 weeks ago
views 2944 13

Upgrade to R80.20

HiI have to upgrade my Production MDS from R 77.30 to R 80.20. So I am running a Test Upgrade in a Lab Environment so that I can replicate it to my Production Environment.I took a Back-Up from my R77.30 Production MDS and restored it in an R77.30 VM in my Lab. I Changed the MDS IP, CMA IP, and Lead Interface. I attached an Eval License, then I logged in to the R77.30 (VM) Smart Dashboard, disabled the automatic IPS updates and installed the database. I copied the R80.20 Security Management Clean Install ISO File into the R77.30 VM and ran the Pre Upgrade Verifier.The Pre Upgrade gave me the below three warnings but it said I can upgrade it.1. Legacy DHCP Relay Services - Change in Behavior in R80 and Higher2. Deactivate IPS Protections by type (Client/Server)3. OPSEC was modified in R80Since the verification report said I can upgrade it, I took the export from my LAB MDS and copied that file to another R80.20 VM. When I try to import this to my LAB R80.20 VM, the MDS Database upgrade is Succesful but the CMA Database upgrade failed. I see the below error in the log file and the FWM Process of the CMA in the R80.20 VM doesn't come up. I am stuck here.Anyhelp here would be much appreciated.[23 May 12:02:44] [DbUpgrader::ExecuteCpdb] Executing cpdb using the following arguments: "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/bin/cpdb" up --no-ngm-db-drop --no-ngm-stop --src_version 6.0.4.0 --src_hfa_level 30 --src_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/tmp/migrate/main_db/" --db_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/conf/" --default_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/conf/defaultDatabase" --db_type cma --db-migration[23 May 12:02:44] [runShellCommand] Executing command: '"/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/bin/cpdb" up --no-ngm-db-drop --no-ngm-stop --src_version 6.0.4.0 --src_hfa_level 30 --src_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/tmp/migrate/main_db/" --db_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/conf/" --default_path "/opt/CPmds-R80.20/customers/Santander_US_Pri_Mgmnt/CPsuite-R80.20/fw1/conf/defaultDatabase" --db_type cma --db-migration'[23 May 12:25:44] [runShellCommand] Execution result: 1, exit code: -1[23 May 12:25:44] [DbUpgrader::ExecuteCpdb] ERR: cpdb completed with error code '-1'[23 May 12:25:44] ...<-- DbUpgrader::ExecuteCpdb[23 May 12:25:44] ..<-- DbUpgrader::UpgradeMainDatabase[23 May 12:25:44] [DbUpgrader::exec] ERR: Failed to upgrade main database[23 May 12:25:44] .<-- DbUpgrader::exec[23 May 12:25:44] <-- ConditionalExecutor::exec[23 May 12:25:44] [ActivitiesManager::exec] ERR: Activity 'ConditionalExecutor' failed[23 May 12:25:44] [ProgressUpdater::UpdateProgressToGaia] Progress Updated to '70.2128[23 May 12:25:44] [ActivitiesManager::exec] WRN: Activities execution finished with errors[23 May 12:25:44] [ActivitiesManager::exec] WRN: Activities 'ConditionalExecutor' have failed[23 May 12:25:44] [ActivitiesManager::exec] Designated exit code is 1[23 May 12:25:44] --> CleanupManager::Instance[23 May 12:25:44] <-- CleanupManager::Instance[23 May 12:25:44] --> CleanupManager::DoCleanup[23 May 12:25:44] [CleanupManager::DoCleanup] Starting to perform cleanup
Roy_Smith
Roy_Smith inside Multi-Domain Management 2 weeks ago
views 603

Leading Interface for MDS and CMA

HiWe currently have a MDS cluster on R80.10 and now looking at upgrading to R80.30. In looking through the upgrade guide, I came across this in prerequisite section: On Smart-1 appliances with Multi-Domain Server or Multi-Domain Log Server installed, if you configured an interface other than Mgmt as the Leading interface, the upgrade process or clean install process (with CPUSE) configures the interface Mgmt to be the Leading interface. To configure another interface as the Leading interface after the upgrade, see sk107336 When I checked both management devices, I discover that the standby member has the leading interface configured as eth1. Therefore, I thought it would be straightforward to change this to Mgmt, prior to upgrading to R80.30, as this device is in our DR server room at a remote location. So, I changed the IP address on eth1, disabled the interface, added the management IP to Mgmt, enabled the interface and moved the network cable. I also changed the entry in $MDSDIR/conf/external.if from eth1 to Mgmt.After MDSSTOP/MDSSTART, in Smartconsole, I get the message "no active server is present" under the standby server for each domain. SK107336 refers to changing the IP address but I am not changing the IP address and do not want to change it. Is there another setting somewhere to tell the CMA which interface to use? Has anyone tried to do this?ThanksRoy
Ashish_Ekka
Ashish_Ekka inside Multi-Domain Management 3 weeks ago
views 356 1

SSHv2

Hi Team, What is the command to check the sshv2 on firewall ?If we need to enable only shv2 for accessing firewall then how to do it?
shaq
shaq inside Multi-Domain Management 3 weeks ago
views 1403 8 1

Copy rules and objects from one CMA to another CMA on the same MDS in R77.30

Hi Guys,Just wondering is there a tool that can be used to copy rules and objects from one CMA to another CMA within the same MDS on R77.30. I've seen some blogs on cp_merge utility but it doesn't support MDS.Any help is much appreciated. CheersShaq
Hamid_Harrar
Hamid_Harrar inside Multi-Domain Management 4 weeks ago
views 1530 7

MDS licensing

Hi everyone. Need some guidance on licensing and MDS I have a client running a Multi-Domain Server with 5 CMAs, The MDS has a set of licenses attached to it and each CMA has another number of licenses against it. Amongst these licenses is the CPSB-DMN-x software blade described as "Security Management for x GWs", These are distributed as follows:CMA1 - CPSB-DMN-UCMA2 - CPSB-DMN-10CMA3 - CPSB-DMN-2CMA4 - CPSB-DMN-10CMA5 - CPSB-DMN-U My question is:Would it be possible to attach a single MDS central license (CPSB-DMN-U) so that all CMA's inherit this license (without attaching it to a specific CMA). if that is the case, would this mean the client no longer needs to buy the individual licenses per CMA.Thanks
Kaspars_Zibarts
Kaspars_Zibarts inside Multi-Domain Management a month ago
views 881 1

MDS root partition nearly full stopping mgmt HA sync in R80.10

Hi, been a long time since I have posted here, too busy 🙂 just stumbled across interesting thing with R80.10 take 142 MDS - we have a HA solution and couple of days ago sync suddenly stopped working with the yellow warning in the SmartConsole When I tried to sync it manually FWM process died on primary MDS. Analyses showed that root partition reached 100% during the sync I did a manual check and saw a lot of diskspace used in $MDSDIR/tmp/mgha, so I cleaned it up manually and after reboot MDS was functioning again. At this point we had 10GB free in 100GB root partition. Another attempt to sync MDS resulted in the same - partition was filled up with huge files in $MDSDIR/tmp/mgha. So obviously sync required more than 10GB but there was nothing too obvious to clean up. Went into our lab and noticed that the same MDS in lab environment had 40GB free of 100GB. Which felt strange as lab is 100% replica of the production. So i had two options -. try to build a new VM and make root partition bigger or try to salvage existing VM that MDS run on with the same 100GB root partition. Since I had similar disk usage on the secondary MDS, I thought to try to take full backup and restore on the same VM to see if it does any difference. And voila! After backup restore root partition usage went down from 90% to 60%! That would mean that MDS would store a lot of temp data in all CMA directories that backup restore seems to clean up. Did the same then on primary MDS (take backup and then restore it on the same VM) and we were back in business - root partition usage reduced to 61%. Here's disk usage before and after restore: [Expert@mds01:0]# df -hFilesystem Size Used Avail Use% Mounted on/dev/mapper/vg_splat-lv_current 97G 83G 9.2G 90% //dev/sda1 289M 24M 251M 9% /boottmpfs 63G 4.0K 63G 1% /dev/shm/dev/mapper/vg_splat-lv_log 238G 91G 135G 41% /var/log [Expert@mds01:0]# df -hFilesystem Size Used Avail Use% Mounted on/dev/mapper/vg_splat-lv_current 97G 57G 36G 61% //dev/sda1 289M 24M 251M 9% /boottmpfs 63G 4.0K 63G 1% /dev/shm/dev/mapper/vg_splat-lv_log 238G 109G 117G 49% /var/log After this HA sync worked like a clock and I measured that it consumed 18GB of temp disk space in the root partition during the process! That seems to match our backup size roughly Just wondering if anyone else has noticed anything like that? And a bit of warning if you run MDS HA - have a look at the root partition usage and make sure you have enough disk space to do full sync.. And those running R80.20 - I wonder if it is a bit more efficient regarding temp disk space during full HA sync?
Jenni_Guerrica
Jenni_Guerrica inside Multi-Domain Management 2019-05-08
views 828 1

MDS unable to login

We have been locked out of our R80.10 MDS since yesterday around noon PST due to a known issue with Smart Update breaking the internal automatic Sync jobs. We were installing a hotfix for another cloud guard licensing issue which required a reboot. We have been waiting for Israel R&D to join our remote session for a couple of hours now and instead they have just requested logs from our MDS. All this has done is prolong the time to a solution, and in turn keep us locked out. Time of lock out now 20 + hours. We have the process to disable the internal auto sync and want to avoid this but is not looking like we can much longer. Does anyone know of a fix for this issue, that is apparently fixed in R80.20 but not in R80.10 besides a hotfix or disabling the internal HA auto sync functions?
nicolas_figaro
nicolas_figaro inside Multi-Domain Management 2019-05-08
views 1552 4

migrate provider-1 r77.30 to smartcenter r80.20

Hello,Did anyone already migrate from provider1 r77.30 to a regular smartcenter running r80.20 ?I have to migrate a provider-1 with various CMAs to a single smartcenter. The goal is to create one policy per CMA, as each CMA manages only one policy for one firewall.Does anyone know if it is possible to "change/batch convert" global objects to local objects ?Thanks.
Valeri_Loukine
inside Multi-Domain Management 2019-05-03
views 1435 1
Admin

White Paper - Restoring a large enterprise MDM environment in VMware from MDS backup

Author: @Tom_Hartig Objective: Replicate a large enterprise MDM environment in VMware without wasting disk space forsnapshots and backup partitions. Challenge: When you create a virtual machine to replicate a large MDM environment the Gaia installerwill reserve a large amount of space for the snapshot and backups partition which is notnecessary when replicating a customer environment. Solution: This document will show you how to create a virtual machine with a small initial virtual disk andlater add a second larger virtual disk that will be used for replicating the customer MDMenvironment. This greatly reduces the wasted space of the large backup and snapshot partition.
Maurice_Conway
inside Multi-Domain Management 2019-04-22
views 1148 2 1
Employee

runcrossdomainquery + R80.10

Hi, We have a customer who's requirement is to search across all domains for network objects and return their "where used" information. In R77.x you had runcrossdomainquery to search for this information. This is not available in R80.10. Is there any option R80.10 that might cover a similar request? Thanks, Maurice