How to migrate a Standalone 6200 unit to a VM SMS server?

[BlueGrass]

Hi all,

We are trying to migrate a Standalone 6200 unit to a VM SMS server with another TWO new Gateways as cluster for the production.

Might I know the correct step-by-step for this purpose?

Can we just use export_migrate to achieve it? Or, we even need to do more extra work?

Thanks in advance.

[Vincent_Bacher · Accepted solution]

migrate export alone is not enough, because when you move from a standalone appliance to a new management VM with new gateway cluster, the management server’s IP address and often its hostname change.

This breaks the old trust structure:

• The Internal CA on the standalone is tied to the old management IP/hostname.
• All SIC certificates are tied to that Internal CA and therefore become invalid.
• The old gateway object cannot be reused because the standalone gateway no longer exists.

So even though migrate export does successfully migrate the database, you still must:

• Recreate the Internal CA,
• Re-establish all SIC connections,
• Create a new cluster object for the new gateways.

In short: migrate export gives you the management data, but because of the new IP/hostname and the old CA, you must rebuild the trust (CA + SIC) and create new gateway/cluster objects.

There are sk articles about that but as it’s weekend now in Frankfurt/Germany other mates may share.

[Ricky_Wong]

What if we join one new just SMS unit to the current standalone as slave SMS.

Then remove the standalone directly.

Does this way work and like migration done?

[Vincent_Bacher]

Frankly said I don’t know but I would not recommend such a setup and prefer to change the setup to a clean distributed environment with independent management and gateway.

[the_rock]

As Vince said, that might work, though not guaranteed and it would be much better to clean distributed environment.

[the_rock · Accepted solution]

Sadly, as Vince said, migrate export would never work here, Im 100% positive, as that only works sms-sms OR standalone-standalone, NOT standalone-sms

You can try below.

https://support.checkpoint.com/results/sk/sk154033

[Tal_Paz-Fridman · Accepted solution]

Please refer to:

Migration from a Standalone environment to a Distributed environment to versions R81.10 and higher versions

https://support.checkpoint.com/results/sk/sk179444 

[the_rock]

My bad Tal, forgot that sk, as it was referenced in the one I mentioned.