SIC re-establishment.

[bvanniekerk]

Howdy.

Q. If I move from old Management station to new, where should I reset the SIC, on Management station and objects in policy or physical enforcement mods?

rgrds
b

[bvanniekerk]

Should have pressed edit.
to add, the IP address and hostname will remain the same. Would I still be required to reset SIC?
rgrds
b

[chillyjim]

If you did an upgrade_export/upgrade_import then you shouldn't need to reset the SIC (The ICA with come with the upgrade).

[bvanniekerk]

only have backup, no chance of doing upgrade_export / import.

[kva.kva]

I think after backup, restore SC you don't need to re-established SIC.

But after moving check SIC status for module. If it isn't trust, reset it in module's properties and on server module (use cpconfig).

[bvanniekerk]

Hi All

NB. If fwm sic_reset on mgmt station does not work, ie. trust established but not communicating, you have a problem. ICA needs to be re-generated because the o="Masters" DN is not the same as masters.
on fw:
cpstop
check masters listed in objects.C
use name specified in masters (A).
on mgmt station:
cpstart
Cert Auth
Create new cert. with nama in masters(A).
open policy.
delete all refernces to previous cert of VPN objects.
save policy.
make sure mgmt station hostname uses name in masters(A)
make sure /etc/hosts has entry with correct IP address.
exit
cpstart on fw.
Policy should load if SIC is communicating.
If not, make sure SIC is same on both fw & mgmt station.

This should save you some time.
Some learn the hard way.

rgrds
b