Backup and restore of SMS in Smart-1 cloud

[Wolfgang]

Following the documentation  How frequently do you run backups? 

„Backups of the environments are taken each 12 hours, and are saved for 30 days“

But how about the restore…

TAC case needed for a restore?

What can be restored ? The whole system, all objects, different policies, what else ?

I can‘t found more detailed informations about the restore process.

[Alex-]

It's in the same document, unless you were looking for something else.

How can I revert my management database to an earlier version?

• From version R80.40, customers can use SmartConsole or an API to revert to an earlier revision.

• To revert all the management to an earlier version, it is necessary to open a support ticket with Check Point Support.

  Note - After this procedure is done, you cannot cancel it.

[Wolfgang]

Nothing else then a full revert ?

[Tomer_Noy]

Hi,

The backups that we take in Smart-1 Cloud every 12 hours are full snapshots of the entire state of your tenant. That means that when TAC perform a restore, it restores everything to the previous state.

This option is important for drastic disaster scenarios (which thankfully are very rare).

As a customer, you also have "less extreme" options to restore to previous configuration if something went wrong, or there is a misconfiguration that you are having trouble tracking down. This is called "Revert to Revision".
The management stores each published session as a revision, which you can see and even compare in the "Settings => Revisions" page. If you right click a specific revision, you can choose to revert back to that revision.
This operation happens within the application, so it is aware of the types of changes done, and can make informed decisions on things that should not be reverted. For example, all policies and objects will be reverted, but if you re-initialized a SIC certificate, that would not be reverted, since the gateway obviously relies on the new SIC.

You can perform the revert to revision action from the UI, or if you prefer, via API.

If you have other cases for backup & restore, or require other granular options, I'd be glad to get more info. You (or others) are welcome to share on this post.

[Alex-]

An option to backup appliances directly in the tenant would be welcome.

One of my installations has Spark appliances in multiple countries. One was RMA'd and after initializing the new system and importing the backup, it connected back to Smart-1 cloud and was operational right after policy installation so importing the backup works at the SIC and MaaS token levels which is of course excellent.

Still, I take manual backups every now and then because there's no other way for now. Allowing them to backup in the tenant and downloading the backup from the Infinity Portal would make things a bit easier. The System Backup action in the R81.20 Smart Console does not allow Spark appliances and Quantum appliances show the classical choices to keep it local to the system or SCP them to a manual input.

[_Val_]

@Alex- ,

The original post is about backing up Smart-1 Cloud and not local FWs.

I personally find the idea of the cloud backup for "multiple devices" in your terms quite problematic. It has multiple issues, starting from available bandwidth and ending with running out of limited cloud storage space.

I would strongly recommend considering off-site on-prem backup options, such as SFTP servers, to store GW backups.