About chnaging the Ip address of the management server, it's not that easy,
just changing it in the smartdashboard, here's how checkpoint advises you to
do it.
Procedure:
1. From SmartDashboard, change the IP address for your SmartCenter server
object to reflect the new IP address. Save the policy and exit
SmartDashboard.
2. Change the IP address to the new one on the operating system of the
SmartCenter server (use the sysconfig command to change network settings in
SecurePlatform).
3. From command line interface of the SmartCenter server run the cpstop
command.
4. Backup the $FWDIR/conf/objects_5_0.Cfile.
5. Edit the objects_5_0.C file and search for the original (external or
internal) IP address of theSmartCenter server and change it to the new IP
address. Make sure that you are changing the IP address for the correct
object.
Example:
:1 (
:AdminInfo (
:chkpf_uid ("{11111111-11AA-11BB-CCCC-1A11DD111111}")
:ClassName (interface)
)
:edges ()
:bandwidth ()
:comments ()
:description ()
:dynamic_ip (false)
:ifindex (1)
:ipaddr (10.20.30.40)
:netmask (255.255.255.0)
:officialname (eth1)
:antispoof (true)
Note:
We suggest not using notepad or wordpad to make this change as they
tend to mangle the file. Use the guiDBEdit utility, VI, or UltraEdit to make
this change.
6. Save the new/edited objects_5_0.C file keeping its original name.
7. Run the cpstart command.
8. At this point you will not have a valid license to be able to login
with SmartDashboard, so you will need to login to the new management
server's IP address with SmartUpdate to attach the new license.
9. Once the new license is installed, you should be able to now login
with SmartDashboard to verify that the IP address for the management server
object shows the correct IP address, and install policy.
After you changed the IP, just as Segio said, disable the Firewall product,
and add the firewall module
Best Regards,
Lino
-----Original Message-----
From: Mailing list for discussion of Firewall-1
[mailto:[EMAIL PROTECTED] On Behalf Of Sergio
Alvarez
Sent: Jueves, 10 de Agosto de 2006 10:23 a.m.
To: [email protected]
Subject: Re: [FW-1] Firewall System Upgrade
Hello George,
I think you are confusing things a lot and to be honest I don't undertand
Jeff's point on the certificates either, but I have moved a single stand
alone CheckPoint installation to a distributed environment in the past with
success, so I'm going to give you a few pointers.
First thing you should do is go to the UserCenter and upgrade your licenses
to NGX, then download the files and add them to your current R55
SmartCenter, it will eventually say they are for a different version (or
something like that), but still will take them and you will have the old and
new liceneses together and already resolved the license problem when this
config is moved to NGX. I have seen the automatic license upgrade procedure
doesn't work well all the time.
Second, have your Windows 2003 server ready with the same host name as your
production Nokia and at least the same IP currently assigned to licenses on
one of its interfaces. I understand you are thinking to change that IP, but
we will go to that later.Do a fresh installation of NGX on that machine only
as SmartCenter (do not include the VPN-1 product) and leave it with no
CheckPoint configuration.
As a next step, do an upgrade_export on your production Nokia and get the
tgz file to the Windows machine, most likely you will have to get it out to
a third machine and from there using a USB flash or something to the Windows
machine as oviously the Windows machine will be out of the network as it has
the same IP as your production firewall.
Next, be sure that interface with the licenses IP on the Windows machine has
link up connecting it to a hub or using a loop connector on it and do an
upgrade_import.
Now you can start making all the changes you want to the configuration, such
as modifying the current CheckPoint object and removing VPN-1 from the list
of installed products and create a new gateway object that will have that
product installed. But first you must think what to do next about all this
IP address change mess.
1) If the IP address assigned to the licenses is the internal one, the
easiest way to go is keeping that IP for the new management server and avoid
changing the licenses, that means you must change your internal network
default gateway, or any routes currently pointing to that IP, so now they
point to the new IP you will need to setup on the new gateway
2) If the IP address assigned to the licenses is the internal one, BUT
making changes to the routes and default gateway is a complete headache,
then change the IP address of the new Management server, but that means you
must go to the Usercenter again and edit the configuration of the licenses
to point to the new IP and get the lic files dowloaded again. Change the IP
of the machine at the platform level, and then get the new assigned IP
licenses files loaded via CLI using the CPconfig menu. Once done that, open
the Smartdashboard, go to the current CheckPoint object and change the IP
address there also.
3) Now that you have your SmartCenter config ready, get you spare Nokia,
install NGX on it including only the VPN-1 product (do not include
smartcenter), get it connected to the new smartcenter using a hub or
something similar and then on the Dashboard create an object for the new
gateway, selecting the correct installed products and establish SIC with the
activation key. You are now ready to put all this in production with
upgrading you current IP380, which you will do in a similar manner as the
spare Nokia.
About your doubts, the license you have must be shown as 2 separate licenses
on the SmartUpdate, one for the gateway and a second one for the management
server, right now you have both on the same machine, just remove the gateway
one and assign it to your new gateway, if the lics were created as "central"
and not "local", you will have no problems with the IP of the gateway being
different.
And about "SPLAT", Jeff was talking about Secure Platform, a Linux based
platform Check Point developed and you can install booting up any Intel
architecture machine from the original CheckPoint installtion disk and has
no extra charge. It is very stable and secure as it was specifically
designed to run a firewall and off course considered a lot better for these
tasks than Windows. Anyway you will not be handling production traffic with
the Manager, so my personal opinion is that it is not such a big deal having
the manager on Windows, now talking about the gateways, that's a completely
different story.
Hope all this helps.
Regards
Sergio
On 8/10/06, Brooks, George CTR <[EMAIL PROTECTED]> wrote:
>
> Thanks for the quick response. However, I do not understand your
> point about the certificates. I am currently using the one Nokia box
> and a Log Server. After the change to the distributed system, the Log
> box will go away. Is there something else that I am overlooking?
>
>
>
> Once this box works, I will be adding other Nokia appliances to the
> fold, but not before.
>
>
>
> The reason that the IP address of the management station is changing
> is because the IP address that is assigned to the Nokia appliance has
> to remain there for the enforcement object.
>
>
>
> I am not sure what SPLAT is, but I can't consider a change until I get
> this system upgraded.
>
>
>
> I want to do an install of the management station by choosing the
> option to an installation upgrade of another system. If I do this,
> will the management station attempt to modify my current enforcement
> module? I don't want to do that. The first thing that the upgrade
> process wants to do is to upgrade the licenses. This is fine because,
> I can back up the old licenses.
>
>
>
> If the upgrade option is not viable, I don't mind re-entering all of
> the rules. However, I have a few hundred objects that I don't want to
> re-type into the firewall. Is there another way of copying the
> objects from one system to another? Can I set up the new box as an
> externally managed system and "push" the objects by doing an "Install
Database".
>
>
>
> Any advice would be appreciated,
>
> George
>
>
>
>
>
>
>
> -----Original Message-----
>
> From: Jeff Krintila [mailto:[EMAIL PROTECTED]
>
> Sent: Wednesday, August 09, 2006 2:07 PM
>
> To: Brooks, George CTR
>
> Subject: RE: [FW-1] Firewall System Upgrade
>
>
>
> Hi George,
>
>
>
> I just went through this pain myself about a week ago.
>
>
>
> If you are changing the IP of the management object, you need to redo
>
> your ruleset. You can spend DAYS combing through the firewall configs
>
> looking for instances of certificate-sensitve info for the new cert
>
> server, but it's far easier to just re-enter your ruleset. If the IP
> of
>
> the MS can stay the same, the upgrade_export works very slick!
>
>
>
> You should really very seriously (is that strong enough? heh) consider
>
> moving to SPLAT.
>
>
>
> Cheers!
>
> J
>
>
>
> -----Original Message-----
>
> From: Mailing list for discussion of Firewall-1
>
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Brooks,
>
> George CTR
>
> Sent: Wednesday, August 09, 2006 10:38 AM
>
> To: [email protected]
>
> Subject: [FW-1] Firewall System Upgrade
>
>
>
>
>
>
>
> Right now, I am running a Nokia IP380 box with IPSO 3.8 and Checkpoint
>
> R55. The Nokia box is both the management box and the enforcement
>
> module.
>
>
>
>
>
>
>
> I would like to convert this system to a distributed system where the
>
> Nokia box is running an enforcement module and a windows box is
> running
>
> the management software. In order to do this, I would like to load
> the
>
> management box with Windows 2003 SP1 and take an IP350 that I have on
>
> the shelf and upgrade it to IPSO 4.0. I would load R60 HFA03 on both
>
> boxes. I would put this system into production temporarily while I
>
> upgrade the IP380 and then put it into production.
>
>
>
>
>
>
>
> Currently, I am using CPMP-VFE-U-NG to run the standalone Nokia box.
>
> Would I be able to use CPMP-VFF-U-NG to build this temporary system
>
> until I can get my final system together? The IP address of the new
>
> management station would be different than the IP address that is
>
> licensed for my current Nokia box.
>
>
>
>
>
>
>
> I guess I am wondering if this will work. Can I take the
> upgrade_export
>
> from a Nokia box and load it into my windows box? Or would I have to
>
> build my new system from scratch?
>
>
>
>
>
>
>
> Does this make sense?
>
>
>
>
>
>
>
>
>
> =================================================
>
> To set vacation, Out-Of-Office, or away messages, send an email to
>
> [EMAIL PROTECTED]
>
> in the BODY of the email add:
>
> set fw-1-mailinglist nomail
>
> =================================================
>
> To unsubscribe from this mailing list,
>
> please see the instructions at
>
> http://www.checkpoint.com/services/mailing.html
>
> =================================================
>
> If you have any questions on how to change your subscription options,
>
> email [EMAIL PROTECTED]
>
> =================================================
>
>
>
>
> =================================================
> To set vacation, Out-Of-Office, or away messages, send an email to
> [EMAIL PROTECTED]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list, please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your subscription options,
> email [EMAIL PROTECTED]
> =================================================
>
--
Sergio Alvarez
(506)8301342
=================================================
To set vacation, Out-Of-Office, or away messages, send an email to
[EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your subscription options, email
[EMAIL PROTECTED]
=================================================
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
