VSX boot and management server

[DR_74]

Hi

We are going to move one vsx gateway from one datacenter to another with all the it infra.(the other vsx gw is on another site)..

The management server may be down when the Gateway will be powered on because on a vm that will also be moved with the vsx

I was wondering if at boot time the vsx Gateway needs the management server to retrieve its policies or if it will boot with no policy at all as it can not reach the management.

Thanks

[genisis__]

It should attempt to connect to the manager, then use local policies.

[CheckPointerXL]

Did you take a look here? https://community.checkpoint.com/t5/General-Topics/How-a-recovered-VSX-cluster-member-obtains-the-Se...

[DR_74]

Hi

thanks for the link.

This means that the gateway will boot with its previous policies if the Managment server is not up when the vsx starts? correct?

[Bob_Zimmerman]

To confirm, what is this VSX gateway? A VM, a physical server, several VMs, several physical servers, or something else?

When you say you intend to move the VSX gateway, please describe that process in greater detail. Are we talking a forklift move where the existing VM(s) or physical server(s) will be shut down in one place, moved somewhere else, then powered on there?

"Moving" as in building new VSs on an existing VSX gateway at the new site and deleting them from the old site requires the management server be up.

[DR_74]

Hi Bob,

For me a VSX gateway is a Checkpoint hardware appliance on which we run Virstual System. In our case, we have 4 VS

So, we have 2 VSX gateways in a cluster xl with VSLS.

We need to stop one of the gateway and phisically move it to another datacenter. With this gateway we will also move all the IT infra (ESX, storage...) and the Checkpoint Management server (on a VM) will be moved as well.

What I am not sure at the moment, is if the ESX infra will be up when the VSX gateway will be powered on.

[Bob_Zimmerman · Accepted solution]

Alright. With a physical move of a set of servers, it's possible for drives to be damaged in transit, and it's possible for servers to not power back up after a while powered off (certain motherboard parts can fail progressively, so they may be fine continuing to run, but may not be able to handle the increased stress of booting from cold). As long as it powers on in the new location, and as long as the drives physically survived the trip, it will have all of its local files, including its local copy of all policies for all VSs. It can boot and run all policies without any connectivity to the management.

A lot of people also use the verb "move" to describe building a new VS on a completely different VSX cluster and deleting a corresponding VS on an old VSX cluster. I wanted to be absolutely sure that wasn't what you were planning. That's a dramatically more complicated process, and it absolutely requires the management server for the destination cluster to be up. If the destination cluster was managed by the management server VM you are moving to the new location, you wouldn't be able to build the new VSs until after the management was moved and working.

[DR_74]

Hello Bob,

Thanks a lot for clarification. That really makes sense for me now. Thank you

[Lesley]

Keep this one in mind if you think MGMT will stay longer offline then 24 hours:

https://support.checkpoint.com/results/sk/sk100731

CRL check will fail, that could impact tunnels.