Check Point Migrate Utility to Export and import Management Server Database - R80.20

Migrate utility can be used to export and import configuration database between Check Point Security Management servers. The utility backup does not include OS information. It's hardware independent and covers all Check Point configurations.

The migrate utility can be found in $FWDIR/bin/upgrade_tools/ directory
Syntax:
./migrate [OPTIONS]
Usage:
ACTION (required parameter):
export - exports database.
import - imports database.
OPTIONS (optional parameters):
-l - Export/import SmartView Tracker logs.
Note: only closed logs are exported/imported
-n - Run non-interactively.

Migrate Export:

unset TMOUT

Check the services of management server

cpwd_admin list

It is recommected to stop all management services before database export

cpstop

Once the services are stpped go to migrate utility path

cd $FWDIR/bin/upgrade_tools/

Now run the export command

./migrate export /var/tmp/MGMT_Migrate_Export

Once the database export is completed check the md5 value

md5sum /var/tmp/MGMT_Migrate_Export.tgz

Now start the all services

cpstart

Check whether all services sarted or not

cpwd_admin list

Now copy the exported file into local system or ftp server

Migrate Import:

Copy the exported database file into new management server

Always copy exported file into /opt/CPsuite-R81.10/fw1/bin/upgrade_tools/ or $FWDIR/bin/upgrade_tools/directory both are same

unset TMOUT

verify the md5 value befor import

md5sum $FWDIR/bin/upgrade_tools/MGMT_Migrate_Export.tgz

once the md5 is verified stop the all services

cpstop

Now run the Import command

./migrate import $FWDIR/bin/upgrade_tools/MGMT_Migrate_Export.tgz

Once the database is imported successfully start the checkpoint services

cpstart

Check whether all services are started or not

cpwd_admin list

This is an example of migrate export and import operation. It's a best practice to execute cpstop. Once the export or import operation is completed, execute cpstart to start Security Management Server services.

[Expert@MGMT:0]# fw ver
This is Check Point's software version R80.20 - Build 255
[Expert@MGMT:0]#
[Expert@MGMT:0]# unset TMOUT
[Expert@MGMT:0]#
[Expert@MGMT:0]# cpwd_admin list
APP        PID    STAT  #START  START_TIME             MON  COMMAND
CPVIEWD    9145   E     1       [23:11:42] 13/8/2022   N    cpviewd
HISTORYD   9148   E     1       [23:11:42] 13/8/2022   N    cpview_historyd
CPD        9163   E     1       [23:11:43] 13/8/2022   Y    cpd
FWD        9230   E     1       [23:11:44] 13/8/2022   N    fwd -n
FWM        9234   E     1       [23:11:44] 13/8/2022   N    fwm
STPR       9237   E     1       [23:11:44] 13/8/2022   N    status_proxy
CPM        9589   E     1       [23:11:49] 13/8/2022   N    /opt/CPsuite-R80.20/fw1/scripts/cpm.sh -s
SOLR       9709   E     1       [23:11:51] 13/8/2022   N    java_solr /opt/CPrt-R80.20/conf/jetty.xml
RFL        9742   E     1       [23:11:51] 13/8/2022   N    LogCore
SMARTVIEW  9835   E     1       [23:11:52] 13/8/2022   N    SmartView
INDEXER    9905   E     1       [23:11:52] 13/8/2022   N    /opt/CPrt-R80.20/log_indexer/log_indexer
SMARTLOG_SERVER 9942   E     1       [23:11:53] 13/8/2022   N    /opt/CPSmartLog-R80.20/smartlog_server
DASERVICE  10345  E     1       [23:12:00] 13/8/2022   N    DAService_script
[Expert@MGMT:0]#
[Expert@MGMT:0]# cpstop
cpwd_admin:
Process DASERVICE terminated
UEPM: Endpoint Security Management isn't activated
Stop Search Infrastructure...
Stopping RFL ...
cpwd_admin:
successful Detach operation
Stopping Solr ...
cpwd_admin:
successful Detach operation
Stop SmartView ...
Stopping SmartView ...
cpwd_admin:
successful Detach operation
Stop Log Indexer...
cpwd_admin:
Process INDEXER (pid=9905) stopped with command "kill 9905". Exit code 0.
Stop SmartLog Server...
cpwd_admin:
Process SMARTLOG_SERVER terminated
dbsync is not running
evstop: Stopping product - SmartEvent Server
evstop: Stopping product - SmartEvent Correlation Unit
Check Point SmartEvent Correlation Unit is not running
SmartView Monitor: Management stopped
FireWall-1: cpm stopped
FireWall-1: fwm stopped
VPN-1/FW-1 stopped
Stopping Critical Alerts Sensor
SVN Foundation: cpd stopped
Stopping cpviewd
cpwd_admin:
Process HISTORYD terminated
SVN Foundation: cpWatchDog stopped
SVN Foundation stopped
[Expert@MGMT:0]#
[Expert@MGMT:0]# cpwd_admin list
 cpwd_admin: Failed to submit request to cpWatchDog
[Expert@MGMT:0]#
[Expert@MGMT:0]# cd $FWDIR/bin/upgrade_tools/
[Expert@MGMT:0]#
[Expert@MGMT:0]# ./migrate export /var/tmp/MGMT_Migrate_Export


You are required to close all clients to Security Management Server
or execute 'cpstop' before the Export operation begins.

Do you want to continue? (y/n) [n]? y


Copying required files...
Compressing files...

The operation completed successfully.

Location of archive with exported database: /var/tmp/MGMT_Migrate_Export

[Expert@MGMT:0]# md5sum /var/tmp/MGMT_Migrate_Export
9966ebee8aea4752d8540a05b9306766  /var/tmp/MGMT_Migrate_Export
[Expert@MGMT:0]#
[Expert@MGMT:0]# cpstart
SVN Foundation: Starting cpWatchDog
Starting cpviewd
starting the history daemon
cpwd_admin:
Process HISTORYD started successfully (pid=16433)
Starting Critical Alerts Sensor...
SVN Foundation: Starting cpd
SVN Foundation started
FireWall-1: Starting fwd
FireWall-1: Starting cpm. Please wait...
[1] 16526
FireWall-1: Finished starting cpm successfully
FireWall-1: Starting fwm (Security Management Server)

FireWall-1: This is a Security Management server. No security policy will be loaded
FireWall-1 started
SmartView Monitor: Not active
Start Search Infrastructure...
pg_ctl: another server might be running; trying to start server anyway
cpwd_admin:
Process SOLR started successfully (pid=16966)
Starting RFL ...
cpwd_admin:
Process RFL started successfully (pid=17000)
Starting SmartView ...
cpwd_admin:
Process SMARTVIEW started successfully (pid=17069)
Start Log Indexer...
cpwd_admin:
Process INDEXER started successfully (pid=17136)
Start SmartLog Server...
cpwd_admin:
Process SMARTLOG_SERVER started successfully (pid=17184)


pg_ctl: this data directory appears to be running a pre-existing postmaster
pg_ctl: could not start server
Examine the log output.
UEPM: Endpoint Security Management isn't activated and will not be started
cpwd_admin:
Process DASERVICE started successfully (pid=17629)
cpstart: Power-Up self tests passed successfully

cpstart: Starting product - SVN Foundation


cpstart: Starting product - VPN-1


cpstart: Starting product - SmartView Monitor


cpstart: Starting product - Eventia Suite


cpstart: Starting product - UEPM


cpstart: Starting product - Deployment Agent

[Expert@MGMT:0]# cpwd_admin list
APP        PID    STAT  #START  START_TIME             MON  COMMAND
CPVIEWD    16430  E     1       [23:23:37] 13/8/2022   N    cpviewd
HISTORYD   16433  E     1       [23:23:37] 13/8/2022   N    cpview_historyd
CPD        16450  E     1       [23:23:37] 13/8/2022   N    cpd
FWD        16525  E     1       [23:23:39] 13/8/2022   N    fwd -n
FWM        16531  E     1       [23:23:39] 13/8/2022   N    fwm
STPR       16538  E     1       [23:23:39] 13/8/2022   N    status_proxy
CPM        16891  E     1       [23:23:41] 13/8/2022   N    /opt/CPsuite-R80.20/fw1/scripts/cpm.sh -s
SOLR       16966  E     1       [23:23:42] 13/8/2022   N    java_solr /opt/CPrt-R80.20/conf/jetty.xml
RFL        17000  E     1       [23:23:42] 13/8/2022   N    LogCore
SMARTVIEW  17069  E     1       [23:23:42] 13/8/2022   N    SmartView
INDEXER    17136  E     1       [23:23:42] 13/8/2022   N    /opt/CPrt-R80.20/log_indexer/log_indexer
SMARTLOG_SERVER 17184  E     1       [23:23:43] 13/8/2022   N    /opt/CPSmartLog-R80.20/smartlog_server
DASERVICE  17629  E     1       [23:23:46] 13/8/2022   N    DAService_script
[Expert@MGMT:0]#

[Expert@MGMT:0]# fw ver
This is Check Point's software version R80.20 - Build 255
[Expert@MGMT:0]#
[Expert@MGMT:0]# unset TMOUT
[Expert@MGMT:0]#
[Expert@MGMT:0]# cpwd_admin list
APP        PID    STAT  #START  START_TIME             MON  COMMAND
CPVIEWD    26825  E     1       [23:40:28] 13/8/2022   N    cpviewd
HISTORYD   26828  E     1       [23:40:28] 13/8/2022   N    cpview_historyd
CPD        26845  E     1       [23:40:28] 13/8/2022   Y    cpd
FWD        26920  E     1       [23:40:30] 13/8/2022   N    fwd -n
FWM        26924  E     1       [23:40:30] 13/8/2022   N    fwm
STPR       26941  E     1       [23:40:30] 13/8/2022   N    status_proxy
CPM        27327  E     1       [23:40:33] 13/8/2022   N    /opt/CPsuite-R80.20/fw1/scripts/cpm.sh -s
SOLR       27396  E     1       [23:40:33] 13/8/2022   N    java_solr /opt/CPrt-R80.20/conf/jetty.xml
RFL        27439  E     1       [23:40:33] 13/8/2022   N    LogCore
SMARTVIEW  27497  E     1       [23:40:34] 13/8/2022   N    SmartView
INDEXER    27558  E     1       [23:40:34] 13/8/2022   N    /opt/CPrt-R80.20/log_indexer/log_indexer
SMARTLOG_SERVER 27600  E     1       [23:40:34] 13/8/2022   N    /opt/CPSmartLog-R80.20/smartlog_server
DASERVICE  28093  E     1       [23:40:38] 13/8/2022   N    DAService_script
[Expert@MGMT:0]#
[Expert@MGMT:0]#
[Expert@MGMT:0]# md5sum $FWDIR/bin/upgrade_tools/MGMT_Migrate_Export
9966ebee8aea4752d8540a05b9306766  /opt/CPsuite-R80.20/fw1/bin/upgrade_tools/MGMT_Migrate_Export
[Expert@MGMT:0]#
[Expert@MGMT:0]# cpstop
cpwd_admin:
Process DASERVICE terminated
UEPM: Endpoint Security Management isn't activated
Stop Search Infrastructure...
Stopping RFL ...
cpwd_admin:
successful Detach operation
Stopping Solr ...
cpwd_admin:
successful Detach operation
Stop SmartView ...
Stopping SmartView ...
cpwd_admin:
successful Detach operation
Stop Log Indexer...
cpwd_admin:
Process INDEXER (pid=27558) stopped with command "kill 27558". Exit code 0.
Stop SmartLog Server...
cpwd_admin:
Process SMARTLOG_SERVER terminated
dbsync is not running
evstop: Stopping product - SmartEvent Server
evstop: Stopping product - SmartEvent Correlation Unit
Check Point SmartEvent Correlation Unit is not running
SmartView Monitor: Management stopped
FireWall-1: cpm stopped
FireWall-1: fwm stopped
VPN-1/FW-1 stopped
Stopping Critical Alerts Sensor
SVN Foundation: cpd stopped
Stopping cpviewd
cpwd_admin:
Process HISTORYD terminated
SVN Foundation: cpWatchDog stopped
SVN Foundation stopped
[Expert@MGMT:0]#
[Expert@MGMT:0]# cpwd_admin list
 cpwd_admin: Failed to submit request to cpWatchDog
[Expert@MGMT:0]#
[Expert@MGMT:0]# ./migrate import $FWDIR/bin/upgrade_tools/MGMT_Migrate_Export
The import operation will eventually stop all Check Point services (cpstop).
Do you want to continue? (y/n) [n]? y


Extracting the database...
Stopping all Check Point services (cpstop)...
 cpwd_admin: Failed to submit request to cpWatchDog
UEPM: Endpoint Security Management isn't activated
Stop Search Infrastructure...
Stopping RFL ...
Stopping Solr ...
Stop SmartView ...
Stopping SmartView ...
Stop Log Indexer...
Stop SmartLog Server...
dbsync is not running
evstop: Stopping product - SmartEvent Server
evstop: Stopping product - SmartEvent Correlation Unit
Check Point SmartEvent Correlation Unit is not running
SmartView Monitor: Management stopped
FireWall-1: cpm stopped
FireWall-1: fwm stopped
VPN-1/FW-1 stopped
Stopping Critical Alerts Sensor
SVN Foundation: cpd is not running
Stopping cpviewd
 cpwd_admin: Failed to submit request to cpWatchDog
SVN Foundation: cpWatchDog is not running
SVN Foundation stopped
Importing files...

The import operation completed successfully.
Do you wish to start Check Point services? (y/n) [y]? y

[Expert@MGMT:0]# cpwd_admin list
APP        PID    STAT  #START  START_TIME             MON  COMMAND
CPVIEWD    40391  E     1       [00:01:32] 14/8/2022   N    cpviewd
HISTORYD   40396  E     1       [00:01:32] 14/8/2022   N    cpview_historyd
CPD        40413  E     1       [00:01:32] 14/8/2022   N    cpd
FWD        40493  E     1       [00:01:33] 14/8/2022   N    fwd -n
FWM        40498  E     1       [00:01:33] 14/8/2022   N    fwm
STPR       40513  E     1       [00:01:33] 14/8/2022   N    status_proxy
CPM        40877  E     1       [00:01:36] 14/8/2022   N    /opt/CPsuite-R80.20/fw1/scripts/cpm.sh -s
SOLR       41004  E     1       [00:01:37] 14/8/2022   N    java_solr /opt/CPrt-R80.20/conf/jetty.xml
RFL        41039  E     1       [00:01:37] 14/8/2022   N    LogCore
SMARTVIEW  41129  E     1       [00:01:38] 14/8/2022   N    SmartView
INDEXER    41183  E     1       [00:01:38] 14/8/2022   N    /opt/CPrt-R80.20/log_indexer/log_indexer
SMARTLOG_SERVER 41242  E     1       [00:01:39] 14/8/2022   N    /opt/CPSmartLog-R80.20/smartlog_server
DASERVICE  41663  E     1       [00:01:42] 14/8/2022   N    DAService_script
[Expert@MGMT:0]#