Matt, There is an article in the KnowledgeBase from CheckPoint that describes exactly what you want to do. As you state that you want to backup/move from one Firewall to another, I suppose the Mgmt is on the same box, otherwise you don't need all this (just install the new box, establish the SIC and push a policy), the article states the following :
Which files to backup in order to restore the NG Management Server To restore the FireWall-1 NG Management Server with backup files: 1. Backup the following files: $FWDIR/conf/Objects_5_0.C $FWDIR/conf/rulebases_5_0.fws $FWDIR/conf/fwauth.NDB (on Windows machines this file is only the pointer to the real user database file, for example, fwauth.NDB522. In this case take the real database file -fwauth.NDB522, and rename it to fwauth.NDB) The ICA and SIC related files that should be copied to the new management are: $FWDIR/conf/InternalCA.* $FWDIR/conf/ICA*.* $CPDIR/conf/sic_cert.p12 In addition to the above files, you also need to backup and import the following: Unix: /opt/CPshared/registry/HKLM_registry.data (copy everything under 'SIC'). Win32: HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\SIC (export this key and then import it on the target machine) >From NG FP2, you should also copy all the files from: $FWDIR/conf/crls Copying the above files will save you the need to issue a new root certificate and new modules certificates. 2. Uninstall the Management Server. 3. Reinstall FireWall-1 NG Management Server. 4. Reset SIC on the enforcement module/s through cpconfig. 5. Stop the FireWall-1 NG Management Server (cpstop). 6. Copy the backup files to the $FWDIR/conf $CPDIR/conf directories respectively. 7. Start the FireWall-1 management machine.(cpstart). Please note that this will work only if both management servers are on the same OS Met vriendelijke groeten - Bien � vous - Kind regards Guy ROELANDTS EMEA GS Internet Expertise Centre - CCSE-NG Hewlett-Packard Belgium B.V.B.A./S.P.R.L. E-mail : [EMAIL PROTECTED] Tel: +32(02)729.77.44 (options 3 - 3 - 1) Fax: +32(02)729.77.65 ========================================================== This message may contain confidential and/or proprietary information, and is intended only for the person/entity to whom it was originally addressed. The content of this message may contain private views and opinions which do not constitute a formal disclosure or commitment unless specifically stated. Should you receive this message by mistake please inform the sender immediately. ========================================================== -----Original Message----- From: Matt Ryanczak [mailto:[EMAIL PROTECTED] Sent: 06 March 2003 22:57 To: [EMAIL PROTECTED] Subject: [FW-1] transfer rules / policy from one firewall to another Hi all, I need to replace on firewall with another and I am hoping to find a way to just copy the necessary rules /policies over to the new one from the old. Both FWs are FW-1 NG FP2. Is there a way to easily transfer the policies from one FW to the other? Thanks in advance... -- Matt Ryanczak <[EMAIL PROTECTED]> American Registry for Internet Numbers ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
