Change the IP address of combined Management Servers and Log Servers

When the Management Server and the Log Server are installed on the same system, you can change the IP address for both Servers in one procedure.

When you change the Log Server’s IP address, the traffic between the Log Server and the engines is interrupted and the logs are spooled on the engines. Changing the IP address might also mean that the transfer of engine status and statistics information is temporarily interrupted.

Before changing the IP addresses, we recommend making a backup of the Management Server and the Log Server.

Note: If any Firewalls between the Management Server and other components do not use a policy based on the Firewall Template, check that they allow all necessary connections.

  For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Request a license binding change to the new IP address for the Management Server license, and also the Log Server if the license is bound to an IP address.
    Make the request at https://⁠stonesoftlicenses.forcepoint.com.
  2. (Multiple Management Servers only) Open the Control Management Servers dialog box and temporarily exclude the Management Servers for which you are changing the IP address from database replication.
    For more information, see the topic that explains how to synchronize Management databases manually.
  3. Add Firewall IPv4 Access rules (and possibly NAT rules) that allow policy upload connections from the new IP addresses to the Firewall.
    The services needed for the communications between the different components are explained in the topic that lists SMC ports.
  4. (NGFW Engines with Node-Initiated contact to Management Server only) Open the Management Server Properties and add the new Management Server IP address as a Contact Address.
    The NGFW Engines must be able to contact the Management Server at both the current Management Server IP address and the new Management Server IP address.
  5. Refresh the Firewall Policies.
  6. Stop the Management Server and Log Server services.
  7. Change the IP address of the host server in the operating system.
  8. Run the sgChangeMgtIPOnMgtSrv script on the Management Server.
    For more information, see the topic that explains SMC commands.
  9. Run the sgChangeMgtIPOnLogSrv script on the Log Server.
  10. Edit the <installation directory>/data/LogServerConfiguration.txt file on the Log Server and update the Log Server IP address.
    For more information, see the topic that explains changing Log Server configuration parameters.
  11. Start the Management Server service and log on using the Management Client.
  12. Install the new licenses when prompted.
  13. Open the Log Server properties and update the IP address.
  14. Start the Log Server service.
  15. Remove the Firewall IPv4 Access rules that you created in Step 3 and refresh the Firewall Policies.
    After running the IP address change scripts, the Alias elements in the inherited rules translate to the right IP addresses.
  16. If the replication status in the Info pane indicates a problem with database replication, synchronize the management databases manually.