Friday, February 21, 2014

Check Point: What Is The Difference In A Snapshot/Backup/Upgrade Export (Migrate Export)/Database Revision Control

I get asked this a lot it seems, and I usually have to look it up to verify the differences.  Check Point offers different ways to backup the system and for different purposes.  So I thought I would cover these different methods and what they do, as described in sk54100 on Check Points site.  So when you read these, Im really doing a 'cut and paste' from what Check Point has described, so as to make sure you get accurate information on the topics.
Here are the differences:
Snapshot:
The snapshot utility backs up everything, including the drivers, and is available only on SecurePlatform.
Snapshot can be used to backup both your firewall and management modules.

The disadvantages of this utility are that the generated file is very big, and can only be restored to the same device, and exactly the same state (same OS, same Check Point version, same patch level).

Backups:
The backup utility backs up your Check Point configuration and your networking/OS system parameters (such as routing), and it is only available on SecurePlatform.
The backup utility can be used to backup both your firewall and management modules.
The resulting file will be smaller than the one generated by snapshot, but still pretty big.
Backup does not include the drivers, and can be restored to different machine (as opposed to snapshot, which cannot). However, it is recommended using the backup for restore to the same machine since it includes information such as MAC addresses of the NIC interfaces. (Note: Since MAC address gets restored as well, customers should be advised prior to restoring to make a note of original MAC on the new box, so it can be changed later on.)  You only can restore it to the same OS, same Check Point version and patch level.

Database Revision Control:
This utility creates a version of your current policies, object database, IPS updates, etc. It is useful for minor changes or edits that you perform in SmartDashboard.  It cannot be used to restore your system in case of failure.

Migrate Export (Upgrade Export):
'upgrade_export' tool backs up all Check Point configurations, independent of hardware, OS or Check Point version, but does not include OS information.
You can use this utility to backup Check Point configuration on the management station.
If you change the Check Point version you can only go up, in other words you can upgrade not downgrade.
The file will be much smaller (depending on the size of your policy), and if the system is not running on a highly loaded CPU, you can do a backup on a live system without interruption of the services.

This utility can be used only on command line and cannot be scheduled.

Routing and interface information:
This information is useful to have on hand as a reference, if you are attempting to restore a configuration especially if your gateway module has a heavy routing table.
To create a copy of your routing and interface information:
# netstat -rn > routes.txt
# ipconfig -a > ipconfig.txt
# ifconfig > ifconfig.txt
Copy of /etc/sysconfig/netconf.C

I think its good information above.  With that said, here below is also what Check Point recommends for a backup schedule.  I personally dont go by their schedule.

Recommended backup schedule:
Snapshot - at least once, or before major change (for example: an upgrade), during a maintenance window.
Backup - every couple of months, depending how frequently you perform changes in your network/policy. Also before every major change, during a maintenance window.
upgrade_export - every month or more often, depending on how frequently you perform changes in your network/policy. Also important before upgrade or migration. Can be run outside a maintenance window.

5 comments:

  1. This info is a little out of date. Gaia can do snapshots and backups.

    ReplyDelete
  2. Point the way previous poster.

    R

    ReplyDelete
  3. Backup and Snapshot Management: See
    https://sc1.checkpoint.com/documents/R77/CP_R77_Gaia_Installation_and_Upgrade_Guide/16436.htm

    ReplyDelete
    Replies
    1. Yeah, I just had a discussion with another engineer (customer) and it looks like Check Point has put this into GAIA at a later time of this writing. Thanks for bringing this up.

      Delete
  4. When you upgrade open server from Secure Platform to Gaia, snapshot is not available as we found out recently. there is not fix for this. Really could use snapshot. Scenario 5 sk103397

    ReplyDelete

Your comment will be reviewed for approval. Thank you for submitting your comments.