Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Rosenkrantz
Participant
Jump to solution

migrating VSX to other domain on same MDS

Hello.

I need some help here, but maybe there is no easy solution for this.

We have a Checkpoint SMC that we need to migrate to MDS. at the same time we need to split of the VSX clusters on several domains. Now, I hoped that I could just import same SMC to MDS several times and then cleanup what is not needed, and change IPs and names where needed, but it seems that is not supported: 

k156072
Domain Migration in versions R80.20 and higher
limitations:
Migration of the same security management server twice into an MDS (or to two different MDS machines in the same HA environment) is not supported.

 

Does anybody have an idea to how we can split the VSX clusters out to several domains?

all VSX clusters share the same policy package with a lot of objects so we really hoped the same smartcenter could be imported several times, but now I am out of ideas.

Best regards

René Rosenkrantz

0 Kudos
2 Solutions

Accepted Solutions
PhoneBoy
Admin
Admin

Domain/SMS exports also include the Internal Certificate Authority.
The same ICA database cannot be used in multiple domains.

Which means…you’ll probably need to use something like: https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-...

View solution in original post

_Val_
Admin
Admin

Not easy at all. You will have to re-create VSX objects manually. I would use vsx provisioning tool for individual VSs. In the process, you will have to scratch your existing VSX config and perform reset gw, or you can "move" your clusters to a new HW. 

View solution in original post

4 Replies
G_W_Albrecht
Legend
Legend

I would ask TAC for a procedure to make this possible !

CCSE CCTE CCSM SMB Specialist
PhoneBoy
Admin
Admin

Domain/SMS exports also include the Internal Certificate Authority.
The same ICA database cannot be used in multiple domains.

Which means…you’ll probably need to use something like: https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-...

Rosenkrantz
Participant

Thank you.

I think I can conclude that its not that easy. but exporting policies and objects is still a big help. to recreate the VSX is possible.

would be nice with export /import on the VSX clusters tho. 🙂

0 Kudos
_Val_
Admin
Admin

Not easy at all. You will have to re-create VSX objects manually. I would use vsx provisioning tool for individual VSs. In the process, you will have to scratch your existing VSX config and perform reset gw, or you can "move" your clusters to a new HW. 

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events