Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Restore a backup after replacing hardware

Introduction

The basis of this article is to assist in restoring your configuration from a backup in the event of an appliance replacement or new VM installation.

The major hurdle for restoring a backup onto a new/replacement appliance is the use of a UUID (universally unique identifier) as an identifier for the system. The Web Gateway backup contains all configurations and policies for your entire central management cluster. The UUID identifies the configuration part (IP, DNS, routing and so on) for each individual machine.

If an appliance gets replaced (due to hardware issues or model upgrades), the UUID changes and the backup cannot be restored with default methods. This article will describe how you can manually restore the backup and enforce the configuration of the old UUID to the new/replacement appliance (new UUID).

Important information about restoring your configuration in case it includes settings for ensuring High Availability (HA) is also provided.

Prerequisites

In order to restore the configuration, we will need a backup from the old appliance along with its UUID. It is very important to have a record of the old UUID in case the appliance gets damaged or you are otherwise unable to obtain the UUID in the future.

Backup

GUI

After logging into the GUI, go to Troubleshooting > Backup/Restore > select Backup.
resize1.png

NOTE: Backups can also be encrypted, once you choose the destination, you will be prompted to enter a password if you wish to encrypt your backup. Leave it blank if you do not want encryption.

CLI

To take a backup from the CLI, the following mwg-coordinator commands can be used:

  • Generate backup with specific filename/path:

/opt/mwg/bin/mwg-coordinator -B

"file:in=ACTIVE,out=/opt/mwg/storage/backup_cache/default/

temp.backup"

  • Generate backup and let script generate filename automatically:

/opt/mwg/bin/mwg-coordinator -B "file:in=ACTIVE""

clipboard_e624a75c827abdf0befad9be30de912d1.png

UUID

GUI

To get the UUID from the UI navigate to Configuration > Appliances, then it is available under Appliances Information:

resize2.png

CLI

To get the UUID from the CLI, use mwg-info:

mwg-info uuid

clipboard_e9bdaa03948ac800df70bf6911e0ff100.png

From a Backup File

If your appliance has died, and you're not sure what the UUID is, but you have a backup file, you can use the to get the UUID from the backup file.
resize3.png

Restore Configuration Scenarios

We are covering scenarios for both standalone and clustered appliances in this section. For both scenarios you need to have command line access as "root" to the appliances.

Standalone Environment

If you only have one appliance or your appliance is not part of a central management cluster, proceed with these steps:

  1. The backup will need to be copied to the new/replacement Web Gateway using a tool like WinSCP. In the example below, the backup file is named 'backup.old' and was copied to /var. It does not need to be placed there if there are any disk space concerns.
  2. The command to restore the backup is shown below:
    /opt/mwg/bin/mwg-coordinator -u mwgc:mwg -R "file:in=/var/backup.old;options:forcedetachgui=yes,uuid=XXXX XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"

Notes about the command:

  1. /opt/mwg/bin/mwg-coordinator -u mwgc:mwg -R This portion should always remain unchanged.
  2. file:in= This is the path on the file system to the backup file.
  3. options: There are two options set in the standalone version of the command; 'forcedetachgui' which forces the GUI to be closed and 'uuid' which is the UUID gathered above from the old appliance, not the UUID of the new/replacement machine.

3. It is recommended that you reboot the appliance after the restore has finished to ensure all settings are applied correctly.

NOTE: If the IP address of the appliance changes during the restore procedure, you will lose your SSH connection and it might appear as if the restore is not successful. Rest assured, it actually finished and your SSH client lost it's connection due to the changed Web Gateway IP address.

Cluster Environment

In case you have multiple appliances in a central management cluster, it is very important to do the restore steps in the correct order to ensure that there will be no conflicts in your cluster (the cluster also relies on UUIDs):

  1. The backup will need to be copied to the new/replacement Web Gateway using a tool like WinSCP. In the example below, the backup file is named 'backup.old' and was copied to /var. It does not need to be placed there if there are any disk space concerns.
  2. Before restoring a backup, ensure to remove the old Web Gateway appliance from the current cluster as seen below.  This will ensure no issues are encountered when adding the new/replacement Web Gateway appliance back into the cluster after the configuration has been restored.
    resize4.png
  3. On the command line of the new/replacement appliance you can now restore the backup and at the same time force it to be a standalone machine:
    /opt/mwg/bin/mwg-coordinator -u mwgc:mwg -R "file:in=/var/backup.old;options:forcedetachgui=yes,cluster=s tandalone,uuid=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"

Notes about the command:

  1. /opt/mwg/bin/mwg-coordinator -u mwgc:mwg -R  This portion should always remain unchanged.
  2. file:in= This is the path on the file system to the backup file.
  3. options: There are three options set in this section; 'forcedetachgui' which forces the GUI to be closed, 'cluster' which configures the cluster settings which in this case is forced to standalone, and 'uuid' which is the UUID gathered above from the old appliance, not the UUID of the new/replacement machine.

4. It is recommended that you reboot the appliance after the restore has finished to ensure all settings are applied correctly.

NOTE: If the IP address of the appliance changes during the restore procedure, you will lose your SSH connection and it might appear as if the restore is not successful.  Rest assured, it actually finished and your SSH client lost it's connection due to the changed Web Gateway IP address.

  1. After the reboot, log into the GUI and verify that the settings under the Configuration page are what is expected, then log out. Then, log into a current cluster member and add the newly restored appliance back into the cluster as seen below, adjust the network group as needed:
    resize5.png
     

Restoring a Configuration with High Availability Settings

When you are restoring the configuration you had on your old appliance to a new appliance using a backup file, you need to proceed as follows if your configuration includes settings for ensuring High Availability (HA).

  1. Configure the High Availability (HA) settings on your new appliance, then restart it. Complete these activities before using your backup file to restore the configuration to this appliance.
  2. Use your backup file to restore the remainder of the configuration to the new appliance.

  • Was this article helpful?