Migration from a Distributed Environment to an UTM1 Cluster

1
Migration from a Distributed Environmentto an
UTM-1 Cluster
Tobias Lachmann
2
Agenda

• Scenario
• Motivation / Benefits
• Starting Basis
• Target Environment
• Preparation
• Migration

3
Scenario

• Distributed environment with 3 Open Servers
• 2 Gateways as HA Cluster
• 1 SmartCenter
• Used Licenses
• Check Point UTM - Mgmt and Gateway Bundle for 5
  Sites Unlimited Users for 2 cores
  (CPUTM-CKP-5-U2)
• Secondary Check Point VPN-1 UTM for unlimited
  Users for 2 cores (CPUTM-VUG-HA-U2)

4
Motivation / Benefits

• get license for unlimited IP addresses
• get Management High Availability for free
  (introduced in NGX R65 w/ Messaging Security)
• reduce complexity (2 vs. 3 servers)
• save power and cooling

5
Motivation / Benefits

• Cut costs
• Buy 3 new server with support contract ? 10.500
• Pay for Collaborative Enterprise Support ?
  14.526
• Buy Multi-Core license?
• Total of 25.026
• Buy 2 new UTM-1 570 appliances with CES
• Total of 20.944
• Save extra money through Trade-In of old licenses

6
Starting Basis
192.168.1.2
192.168.1.3
HA Cluster
192.168.1.10
7
Target environment
192.168.1.2
192.168.1.3
FullHA Cluster
8
Preparation

• take a backup of SmartCenter server!
• change SmartCenter configuration before export
• take note of cluster configuration and where the
  cluster object is used
• delete cluster object from VPN communities
• delete cluster object from security rules
• delete cluster object from NAT rules
• delete cluster object / cluster members

9
Preparation

• change SmartCenter configuration before export
• remove licenses from SmartCenter object
• rename SmartCenter object to name of first UTM-1
  cluster node
• change IP address of SmartCenter object to IP
  address of first UTM-1 cluster node
• do upgrade_export on SmartCenter

10
Migration

• install and configure first UTM-1 appliance
• locally managed
• Important do not install it as part of a cluster
• copy configuration to machine
• import the configuration with upgrade_import
• install and configure second UTM-1 appliance
• locally managed
• install as secondary cluster member
• Enter SIC secret
• make first appliance primary cluster member ?
  this is where the magic happens!

11
Migration

• access SmartCenter with GUI clients
• attach new licenses with SmartUpdate
• configure UTM-1 cluster using SmartDashboard
• follow the wizard
• complete cluster configuration
• office mode
• VPN communities
• .
• ? refer to notes taken (old config)
• configure Management HA
• sync SmartCenter

12
Questions?
13
Still got a question?

• Tobias Lachmann
• Technical Consultant
• MCS Moorbek Computer Systeme GmbH
• Essener Bogen 17
• 22419 Hamburg
• tobias.lachmann_at_mcs.de
• Telefon 040 / 53773 - 160