Access to the SMC server during updates
When you update your SMC server, we recommend that you prevent other administrators from accessing SMC for the duration of the update. If you do not do so, they will not be informed of updates in progress and any configurations they are working on will not be saved.
If you use a remote server in Syslog format to collect SMC logs, you need to configure again the remote server after updating the SMC server, through the command
smc-syslog-ng. This operation is no longer required from version 2.6 of SMC.
Before upgrading from version 2.0
From version 2.1.0 of the SMC server, changes have been made to the operating system so that a larger amount of data can be managed, especially by the new feature that automatically backs up the configuration of the server and of SN firewalls.
We recommend that you deploy a new .OVA, .VHD or .qcow2 to get the best results from the following modifications:
- more efficient virtual interface,
- increased disk space to support the automatic backup feature.
We also advise you to enable the automatic backup feature only after a new machine has been deployed.
Follow the procedure below to deploy a new .OVA, .VHD or .qcow2:
- Start by upgrading your machine to version 2.1.0 or upwards from an upgrade archive.
- Back up the configuration of the server and of any logs you wish to back up.
- Deploy a new .OVA, .VHD or .qcow2 in version 2.1.0 or higher.
- Through the SMC initialization wizard, restore the backed up configuration on the new machine.
Feel free to look up the SNS knowledge base as well in your MyStormshield area. The knowledge base explains how to manually increase disk size and modify the virtual interface.
Take note of the following information if you wish to associate the SMC server with a pool of SN firewalls already used in production, and which contain global configuration items.
Whenever SMC deploys a configuration on a firewall, all global configuration items found on this firewall will be deleted and replaced with configuration items defined in the SMC configuration, if any.
- global objects defined on the firewall
- global filter rules defined on the firewall,
- global VPN tunnels defined on the firewall
These elements are invisible by default in the SNS web configuration interface. To display them, go to the firewall Preferences, section Application settings and enable the option Display global policies (Filter, NAT, IPsec VPN and Objects).
By attaching an SN firewall to SMC, you therefore accept that these global items, which could have been set up on this firewall, will be overwritten as soon as SMC deploys the configuration.
However, local objects, rules and VPN tunnels (which you handle by default in the firewalls' web administration interface) will never be modified or deleted when SMC deploys a configuration.
We therefore recommend that you recreate these global items in the form of local items on the firewall or rewrite rules in SMC before attaching the firewall to SMC, in order to avoid losing configuration items and disrupting production.
In most cases, in which the firewall to be attached does not have any global configuration items, no particular precautions need to be taken in attaching the firewall to SMC, and doing so will leave no impact on production.
In any case, we advise you to perform a backup of your firewall's configuration before connecting it to SMC.