VSX Migration to physical Gateways

[Hllrdm]

I have a VSX device deployed on physical devices.
I had a need to get rid of the VSX solution and deploy separate clusters on VSX instead.
I am completely unfamiliar with the VSX solution, so I would appreciate any information on how to correctly transfer the configurations of virtual security gateways to dedicated security gateways.
I cannot connect to the virtual gateway via ssh, so I have a question how can I save the configurations to a file in order to transfer them to dedicated physical security gateways in the future? Maybe someone has a plan on how to correctly "disassemble" VSX and migrate the settings?

[Chris_Atkinson]

For VSX a significant portion of the configuration is in the management, for the GAiA configuration on the gateway you could review using the following logic.

set virtual-system <ID>

show configuration 

(Things like Bonds & Dynamic routing is configured via CLI)

[Hllrdm]

I have different routes in show configuration which are not in smartconsole and I also have different ip addresses assigned to the interfaces (not the same as in the contexts). Is this behavior correct and do I need to edit the save configuration file according to the settings in the smartConsole?

If I plan to migrate devices to dedicated gateways, what should I do with the virtual switches? And what about the settings on the physical device where the virtual gateways are deployed?

[the_rock]

Im afraid that is more something suited for CP professional services, as it sounds it would require lots of work/planning. But, I do agree with @Chris_Atkinson , you can definitely get lots of useful info from show config. Not sure if backup might be so helpful in this instance.

[Magnus-Holmberg]

Look at this one 🙂
https://community.checkpoint.com/t5/Scripts/vsxexport-sh-Export-VSX-settings-and-configuration-files...

And i would also use vsx provisioning to get out the information.

[genisis__]

Ive used this script in the past to do something similiar, but do note that you may also need to review the specific VS's local.arp file, if proxy arp is in use.