6.1 Management Database Export & Import (`migrate_server` Tool)

Management Database Export & Import (migrate_server Tool)

Upgrading a Check Point Security Management Server (SMS) to R82 often involves migrating the management database to a new server hardware platform or virtual machine running a clean Gaia R82 installation. The primary tool for extracting, converting, and restoring the Check Point management database is the migrate_server command-line utility (which replaces legacy tools such as upgrade_export and upgrade_import from earlier software generations).

This section covers the technical mechanics of exporting a Security Management database from a legacy source server (such as R80.40, R81, R81.10, or R81.20) and importing it into a target R82 Security Management Server, including pre-migration verification checks, tool version compatibility requirements, and internal certificate preservation.

---

The migrate_server Utility Architecture

The migrate_server utility operates at the application database layer of Check Point Gaia OS. It extracts all logical configurations, policy definitions, network objects, user databases, and certificate authority stores into a single, compressed gzip tar archive (.tgz).

+-------------------------------------------------------------------------+
|                    Source Management Server (e.g., R81.20)              |
|                                                                         |
|  +-------------------+  +-------------------+  +---------------------+  |
|  | Policy Rulebases  |  | Network Objects   |  | Internal CA (ICA)   |  |
|  | ($FWDIR/conf)     |  | ($FWDIR/database) |  | ($CPDIR/conf)       |  |
|  +---------+---------+  +---------+---------+  +----------+----------+  |
|            |                      |                       |             |
|            +----------------------+-----------------------+             |
|                                   |                                     |
|                       [migrate_server export]                           |
|                                   |                                     |
|                                   v                                     |
|                       R82_Export_Archive.tgz                            |
+-----------------------------------+-------------------------------------+
                                    |
                         (Secure Transfer via SCP)
                                    |
                                    v
+-----------------------------------+-------------------------------------+
|                     Target Management Server (Clean R82)                |
|                                                                         |
|                       [migrate_server import]                           |
|                                   |                                     |
|  +-------------------+  +-------------------+  +---------------------+  |
|  | Restored Rulebase |  | Restored Objects  |  | Preserved ICA Trust |  |
|  +-------------------+  +-------------------+  +---------------------+  |
+-------------------------------------------------------------------------+

Crucial Tool Version Requirement

A common mistake on exam questions and in production deployments is attempting to run the source server's native migrate_server executable when exporting a database for an R82 target. You must always use the target version's migration tools on the source machine.

To export a database from an R81.20 server for import into an R82 server:

1. Download the R82 Upgrade Tools for Gaia archive (Check_Point_R82_Upgrade_Tools_Gaia.tgz) from the Check Point Support Center.
2. Transfer the package to a temporary directory on the source server (e.g., /var/log/upgrade_tools/).
3. Extract the tarball: tar -zxvf Check_Point_R82_Upgrade_Tools_Gaia.tgz.
4. Execute the extracted ./migrate_server binary, explicitly passing the target version flag -v R82.

---

Pre-Migration Verification (migrate_server ver)

Before creating an export archive, administrators must execute the pre-upgrade verification tool to validate database integrity and identify potential schema or rule conflicts.

Running Verification Checks

From the directory containing the extracted R82 Upgrade Tools on the source server, execute:

./migrate_server ver -v R82

What the Verification Check Validates

Verification results are logged to both stdout and a detailed HTML report generated in the execution directory (pre_upgrade_verification_report.html). All Errors must be resolved before proceeding with the export. Warnings should be reviewed carefully to prevent post-migration policy compilation failures.

---

Executing Database Export (migrate_server export)

Once pre-migration verification completes without errors, export the management database archive.

Recommended Best Practices Prior to Export

1. Publish All Sessions: In SmartConsole, ensure all administrators have published open sessions. Unpublished changes in open sessions on the source server may cause database locking issues.
2. Close SmartConsole Applications: Disconnect all active SmartConsole GUI clients.
3. Stop Management Services (Optional but Recommended): While migrate_server export can run on a live server, executing cpstop or closing database locks ensures absolute database consistency during read operations.

Export Command Syntax

./migrate_server export -v R82 /var/log/R82_management_db_backup.tgz

Breakdown of Command Flags and Output

• -v R82: Specifies the target software version schema to convert objects into during export.
• /var/log/R82_management_db_backup.tgz: Absolute path where the compressed output archive will be created.

Database Export Contents vs. Exclusions

---

Transferring & Importing Database on Target R82 Server

Step 1: Prepare Target Gaia R82 Security Management Server

Install clean Gaia R82 on the target server (appliance or virtual machine). Complete the First Time Configuration Wizard, selecting Security Management Server as the installation type. Ensure the target Gaia server has matching or higher Jumbo Hotfix Accumulator levels installed.

Step 2: Transfer Archive via SCP

Copy the exported .tgz archive from the source server to the target R82 server using SCP or SFTP:

scp /var/log/R82_management_db_backup.tgz admin@192.168.1.50:/var/log/

Step 3: Execute Import on Target Server

Log into the target R82 Gaia CLI via SSH, enter Expert mode, and run migrate_server import:

cd $FWDIR/bin/
./migrate_server import -v R82 /var/log/R82_management_db_backup.tgz

During execution, the script will prompt for confirmation that existing baseline database objects on the fresh R82 server will be overwritten. Type y to proceed.

Step 4: Post-Import Automatic Restart

Upon successful import, migrate_server automatically reloads Check Point services (cpstart). The Internal Certificate Authority (ICA) structure is restored, preserving all certificate fingerprints and Secure Internal Communication (SIC) relationships established with managed Security Gateways.