R80.10 MDS -> R80.10 MDS with new Hostname, new Domain names and new IP addresses (OH MY!)

Discussion created by Leslie Chin

on Feb 1, 2019
Latest reply on Feb 14, 2019 by Manoj Kumar

Like • Show 1 Like1
Comment • 8

Hello,

I am working on documenting a procedure, if even possible, to perform a R80.10 MDS "migration" to R80.10 MDS with a new hostname, new domain names, and new IP addresses for the domains.

Global objects are being used in the Domains added for good measure

In theory, I think the steps would be:

migrate export the MDS from the source
migrate_global_policies on the destination
migrate export each CMA from the source
mgmt_cli to create the new domain on the destination (do not start the domain)
cma_migrate to import each domain

Outcomes

8 Replies

Leslie Chin Feb 1, 2019 9:13 AM
And I've already run into a failure

migrate_global_policies fails on the destination:

[Expert@DESTINATION_R80:0]# ./migrate_global_policies /var/log/tmp/export/SOURCE_R80_MDS.tgz
Welcome to the Global Policies Migration Utility.

If the Multi-Domain Server is started, it should be stopped now.
Do you want to stop the Multi-Domain Server processes (Domain Management Servers will not be stopped) [yes/no] ? yes
Stopping Multi-Domain Server only
Stop SmartLog Server...
cpwd_admin:
Process SMARTLOG_SERVER terminated
cpwd_admin:
Process FWM terminated
cpwd_admin:
Process FWD terminated
cpwd_admin:
Process CPD terminated
Multi-Domain Server stopped
Error: Failed to stop CPWD. It is not responding. Aborting.
Performing verifications on currently installed version
The messages generated by the verification tools will be available in:
/opt/CPmds-R80/system/pre_upgrade/pre_global_policies_migrate.log
======================================================================
>>> Executing Source Version Upgrade Path Checker
Pre-upgrade verification ended successfully, proceeding with migrate
Starting CPM only
cpWatchDog is already running
CPM Server already running.
CPM Server is running.
CPM server started
Making sure Multi-Domain Server is running...
Preparing database...
Execution finished with errors. See log file '/opt/CPshrd-R80/log/migrate-2019.02.01_11.42.54.log' for further details
Migration not completed.

migrate-2019.02.01_11.42.54.log:
[1 Feb 11:43:00] ..--> CanonicalizePath
[1 Feb 11:43:00] [CanonicalizePath] Canonicalizing path 'bash -c "set -o pipefail; /opt/CPsuite-R80/fw1/bin/upgrade_tools//gzip -d -c /opt/CPmds-R80/tmp//export_db//ren_db.gz | /opt/CPsuite-R80/fw1/bin/psql_client postgres -U postgres --set ON_ERROR_STOP=on"'
[1 Feb 11:43:00] [CanonicalizePath] Resulting path: 'bash -c "set -o pipefail; /opt/CPsuite-R80/fw1/bin/upgrade_tools//gzip -d -c /opt/CPmds-R80/tmp//export_db//ren_db.gz | /opt/CPsuite-R80/fw1/bin/psql_client postgres -U postgres --set ON_ERROR_STOP=on"'
[1 Feb 11:43:00] ..<-- CanonicalizePath
[1 Feb 11:43:00] ..--> ExecCommandGetOutput
[1 Feb 11:43:00] [ExecCommandGetOutput] Going to execute command: 'bash -c "set -o pipefail; /opt/CPsuite-R80/fw1/bin/upgrade_tools//gzip -d -c /opt/CPmds-R80/tmp//export_db//ren_db.gz | /opt/CPsuite-R80/fw1/bin/psql_client postgres -U postgres --set ON_ERROR_STOP=on"'
[1 Feb 11:43:05] [ExecCommandGetOutput] ERR: Command completed with error code 3
[1 Feb 11:43:05] ..<-- ExecCommandGetOutput
[1 Feb 11:43:05] [CommandRunner::exec] Command's output:
-------------------------------------
SET
SET
ERROR: database "cpm" is being accessed by other users
DETAIL: There are 4 other sessions using the database.
-------------------------------------
[1 Feb 11:43:05] [CommandRunner::exec] ERR: Command execution had failed
Like • Show 0 Likes0
Actions
Leslie Chin Feb 1, 2019 9:42 AM
Hm. cma_migrate "worked" but none of the local objects or rules that are from the source CMA exist in the destination CMA

[Expert@DESTINATION_R80:0]# mgmt_cli --root true add domain name NEW_DOMAIN_ONE servers.ip-address 192.168.254.41 servers.name NEW_DOMAIN_ONE_Server servers.multi-domain-server DESTINATION_R80 servers.skip-start-domain-server true

---------------------------------------------
Time: [12:26:19] 1/2/2019
---------------------------------------------
"Create Domain: 'NEW_DOMAIN_ONE'" in progress (5%)

---------------------------------------------
Time: [12:28:40] 1/2/2019
---------------------------------------------
"Create Domain: 'NEW_DOMAIN_ONE'" succeeded (100%)
tasks:
- uid: "99366e05-ee50-4743-9ab4-11485efd0eaa"
type: "task"
domain:
uid: "a0eebc99-afed-4ef8-bb6d-fedfedfedfed"
name: "System Data"
domain-type: "mds"
task-id: "f2ee7112-199a-43bb-8ba3-2eabe3acc0d4"
task-name: "Create Domain: 'NEW_DOMAIN_ONE'"
status: "succeeded"
progress-percentage: 100
start-time:
posix: 1549041977737
iso-8601: "2019-02-01T12:26-0500"
last-update-time:
posix: 1549042116756
iso-8601: "2019-02-01T12:28-0500"
suppressed: true
task-details:
- uid: "1b30a41f-cf19-4aba-baa7-9892f0243f6f"
name: null
domain:
uid: "a0eebc99-afed-4ef8-bb6d-fedfedfedfed"
name: "System Data"
domain-type: "mds"
color: "black"
statusCode: "succeeded"
statusDescription: "Update Domain 'NEW_DOMAIN_ONE' succeeded"
taskNotification: "99366e05-ee50-4743-9ab4-11485efd0eaa"
initiator: "WEB_API"
startTime:
posix: 1549041977737
iso-8601: "2019-02-01T12:26-0500"
active: false
domainName: ""
mdsName: ""
mdsIp: ""
cmaIp: ""
cmaName: ""
meta-info:
validation-state: "ok"
last-modify-time:
posix: 1549042116761
iso-8601: "2019-02-01T12:28-0500"
last-modifier: "WEB_API"
creation-time:
posix: 1549041977806
iso-8601: "2019-02-01T12:26-0500"
creator: "WEB_API"
tags: []
icon: "General/globalsNa"
comments: ""
display-name: ""
customFields: null
comments: "Update Domain 'NEW_DOMAIN_ONE' succeeded"
color: "black"
icon: "General/globalsNa"
tags: []
meta-info:
lock: "unlocked"
validation-state: "ok"
last-modify-time:
posix: 1549042116776
iso-8601: "2019-02-01T12:28-0500"
last-modifier: "WEB_API"
creation-time:
posix: 1549041977771
iso-8601: "2019-02-01T12:26-0500"
creator: "WEB_API"
read-only: false

---------------------------------------------
Time: [12:28:42] 1/2/2019
---------------------------------------------
"Publish operation" succeeded (100%)
[Expert@DESTINATION_R80:0]# cma_migrate /var/log/tmp/export/SOURCE_R80_DOMAIN_ONE.tgz /opt/CPmds-R80/customers/NEW_DOMAIN_ONE_Server/CPsuite-R80/fw1/
Starting Multi-Domain Server only
cpWatchDog is already running
CPM Server already running.
CPM Server is running.
Start Search Infrastructure...
index mode was set to true
startsearch: dbsync does not run on Multi-Domain Security Management
cpwd_admin:
Process SOLR is alive, process won't be started again
Starting RFL ...
cpwd_admin:
Process RFL is alive, process won't be started again
Starting SmartView ...
cpwd_admin:
Process SMARTVIEW is alive, process won't be started again
Start Log Indexer...
cpwd_admin:
Process INDEXER is alive, process won't be started again
Start SmartLog Server...
cpwd_admin:
Process SMARTLOG_SERVER is alive, process won't be started again
Multi-Domain Server Started
CPM server started
Are you sure you want to migrate the management at /var/log/tmp/export/SOURCE_R80_DOMAIN_ONE.tgz
into the Domain Management Server /opt/CPmds-R80/customers/NEW_DOMAIN_ONE_Server/CPsuite-R80/fw1/ [yes/no] ? yes
Verifying data before importing. Please wait ...
Source management version detected:
R80.10
======================================================================
>>> Executing Source Version Upgrade Path Checker
======================================================================
>>> Executing Domains Without Management Servers Test
======================================================================
>>> Executing Domains With No Hosting Multi Domain Servers Test
======================================================================
>>> Executing Global Policy on Source Database Detector
======================================================================
>>> Executing Multiple Domain Management Servers with the same ICA Keys Detector
======================================================================
>>> Executing Firmware References Detector
======================================================================
>>> Executing VSX Objects Detector
======================================================================
>>> Executing Domain Servers Missing From Database
======================================================================
>>> Executing Missing Domain Server Directories
Pre-migrate verification ended successfully.
A log file was created: /opt/CPmds-R80/customers/NEW_DOMAIN_ONE_Server/CPsuite-R80/fw1//log/pre_migrate.log
Proceeding with migration.

Migration completed.
Like • Show 0 Likes0
Actions
- Stuart Green @ Leslie Chin on Feb 1, 2019 2:48 PM
  It must be the day for it!
  
  I've just posted about this issue too - Importing from SMS into MDS.
  
  You might not be alone in your pain!
  Like • Show 1 Like1
  Actions
  - Dameon Welch-Abernathy @ Stuart Green on Feb 1, 2019 3:36 PM
    To be fair, what Leslie's doing is not necessarily supported
    Like • Show 1 Like1
    Actions
    - Stuart Green @ Dameon Welch-Abernathy on Feb 1, 2019 3:53 PM
      Can see a need for it, though. HA would be a better option!
      Like • Show 0 Likes0
      Actions
Maarten Sjouw Feb 3, 2019 5:50 AM
Leslie,
You could try a different approach:
1. create a new secondary MDS in your current environment, with the new name
2. create Backup CMA's on that new MDS with new names
3. promote all secondaries to primary and remove the originals
1 person found this helpful
Like • Show 1 Like1
Actions
Eran Habad Feb 12, 2019 1:14 AM
Hi Leslie Chin,

My name is Eran and I'm the manager in Check Point R&D responsible for the core infrastructure of the Management server. Indeed in R80.x we're not yet supporting migration of a Domain Server into another Multi Domain server. My team and I are working to complete this gap these days, and we target to reach EA few months from now. We would be happy to provide you an EA build on top of R80.20 as soon as we're ready so you could install and test it. You're also very welcome to provide your feedback and influence on the usability. Our plan is to integrate the code to an official version later this year. Note that this EA version will probably not include yet the option to change the name of the Domain Server and its IP address, but we'll address it as part of the development.

This is a call for any customer who's waiting for the ability to migrate a Domain Server into another Multi Domain server over R80.20 and above! You're welcome to reply to my comment and register, R&D will approach you in the next few months to provide an EA build on top of R80.20.

cma_migrate
migrate_domai
domain_migratoin
1 person found this helpful
Like • Show 1 Like1
Actions
- Manoj Kumar @ Eran Habad on Feb 14, 2019 11:02 AM
  Hello Eran,
  I am running into the situation where cma migrate would only be the solution reason being lots of policy packages threat and application policies, VSX environent etc managed under same CMA. I was desperate about the cma migrate in r80.x but your comment really made my day. Hopefully expecting the solution with in next couple of month.
  1 person found this helpful
  Like • Show 1 Like1
  Actions

R80.10 MDS -> R80.10 MDS with new Hostname, new Domain names and new IP addresses (OH MY!)

Outcomes

Related Content

Recommended Content