If you want to replace an old outdated TSCM with a newer version (usually if there are major distribution version upgrades), an easy method is to you the Backup and Restore option.
Here the goal is to place the new Vms on the same VLANs as the ones you are replacing.
For each of the new Vms,
- Download the newest version of the VM from ftp.threatstop.com
- Spin up the VM with DHCP on the proper VLAN
- SSH to the VM, verify outbound connectivity (dig @8.8.8.8 yahoo.com)
- Set the user threatstop password to the same password as the VM being replaced (not necessary, but makes things less confusing)
- Update the ThreatSTOP and OS packages (sudo apt-get update && sudo apt-get dist-upgrade) Answer yes to all upgrade prompts.
That will make everything ready for the cutover.
During the cutover, we will follow the TSCM backup/restore process: https://docs.threatstop.com/tscm_backup_restore.html
We recommend that you have Vmware console access to the Vms as we are cutting over.
For testing/validation of the new VM after cutover:
- Do tsadmin list to ensure the device configs (IP and DNS) transferred
- Do tsadmin update for each of the listed device. Confirm that they successfully update from the CLI output.
- For TSCM DNS servers, verify resolution of internal and external hosts (e.g. dig @localhost <internal_name.local> and dig @localhost <external_domain>)
The old TSCM VM is powered off during the backup/restore process. If the new VM is not behaving correctly, the rollback plan is to power off the new VM and power on the old VM to restore service.
Comments