FireWall-1 FAQ: Moving your 4.1 Management Console to a Different System
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
This does not apply to NG and above, which is significantly more complex, and Check Point provides migration tools on newer releases.
You should install your new system to be the same patch level as the old system and license it accordingly. Verify the new management console works by using the Security Policy editor to connect. Then, copy the appropriate files from the other management module. The files you will need include:
- $FWDIR/conf/objects.C: This contains all of your network objects, services, resources, servers, and so on.
- $FWDIR/conf/rulebases.fws: This contains all of your rulebases you have used recently. You can reconstruct this from $FWDIR/conf/*.W, if you have to.
- $FWDIR/conf/fwauth.NDB*: This contains all of your users and user groups.
- $FWDIR/conf/xlate.conf: Needed if you still use xlate.conf to manage your address translation. Most people use the GUI, but a few people still use this deprecated method.
- $FWDIR/conf/snmp.C: Needed if you changed the SNMP Community Strings for FireWall-1’s SNMP Agent.
- $FWDIR/lib/setup.C: Needed if you’ve modified this file for any reason. See below for a reason you might.
- $FWDIR/lib/control.map: Needed if you’ve modified this file for any reason.
- Any other files you may have modified in $FWDIR/lib for changes to INSPECT code.
Next, you will have to establish the authenticated control connection between your firewalls and new management console. See: Authentication for command fetch/load failed.
