Changing Mgmt interface on gateway cluster

[AaronCP]

Good evening,

I need to move our DMZ network from its current interface to a new one. Whoever configured the cluster initially put our DMZ network on the Mgmt interface, and I'd like to move it to a separate spare interface so that the Mgmt port can be used for its intended purpose.

What is the best way to do this to minimise interruption? My current thinking is to use the Gaia portal to delete the interface from both cluster members, then configure the new interface with the same IPs. Then use the 'Get Interfaces without topology' in SmartConsole to then configure the cluster/VIP/network etc and install policy to the cluster. I've removed the Security Zone assigned to the current Mgmt interface from all rules and replaced with a network object in preparation for the move.

Is this the correct approach? Any help would be much appreciated 🙂.

Thanks,

Aaron.

[Chris_Atkinson]

Just to clarify are you talking about the physical Management port or has someone assigned the Mgmt interface role to another port?

From CLISH "show management interface" will show the current allocation.

[AaronCP]

Hi @Chris_Atkinson 

It's the physical Mgmt port of the appliance. I'm not sure which interface has the management role. I can check this later.

[AaronCP]

Hi @Chris_Atkinson 

The Mgmt port has the management interface role assigned to it. Does this complicate matters?

[Chris_Atkinson]

Not really, just wanted to ensure that we had all the information rather than making assumptions. 

Be sure to have the correct routes in place and where possible make allowances in your policy for the new Mgmt IP addresses / network prior to preserve communication with the SMS.

[just13pro]

Hi,

You can refer to  https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... on changing IP on the management