Migrating a physical DataPower appliance to a virtual edition

Steps

1. Prepare the source system by completing the following steps.
   1. If not already obfuscating passwords in the persisted configuration, prepare the source systems to export the password associated with objects in each domain. You must set the same treatment and passphrase on the target system.
      1. Access the Domain Settings configuration.
      2. From the Password treatment list, select Masked.
      3. In the Passphrase field, enter and confirm the passphrase that obfuscates passwords.
   2. When exporting local user accounts to avoid re-creating them on the target system, you must use the CLI to edit each local user when you do not want the account owner to change the account password on the initial log in. For illustrative purposes, providing the command sequence for the test user account when already in Global configuration mode – entered with the configure terminal command.

      (config)# user test
      Modify User configuration
      (config user test)# suppress-password-change on
      (config user test)# exit
      (config)#

      Repeat this edit for each local account. After you edit all local account, ensure that you persist the configuration with the write memory command.
2. Prepare the target system by completing the following steps.
   1. In the default domain, upload the cryptographic files for certificates and keys that the management interfaces need. If you created export packages for certificates, import them.
   2. In the default domain, define the network and the management interfaces. Although you can export these objects from the source system and import them to the target system, you might need to edit these objects after the import operation to have a working system.
      • The network consists of the following objects that you should not import from the export package.
        • System Settings
        • Network Settings
        • Ethernet Interface
        • VLAN Interface
        • Link Aggregation Interface
        • DNS Settings
        • Host Alias for network interfaces
        • NTP Service
        • Time Settings
        • NFS Client Settings
        • NFS Static Mounts
        • NFS Dynamic Mounts
        • SMTP Server Connection
        • SNMP Settings
      • Management consists of the following objects that you should not import from the export package. Remember to define your own SSL profile to secure connections to the DataPower Gateway.
        • Telnet Service
        • SSH Service and the ssh Access Control List
        • Web Management Service and the web-mgmt Access Control List
        • XML Management Interface and the xml-mgmt Access Control List
        • REST Management Interface and the rest-mgmt Access Control List
        • Web B2B Viewer Management and the web-b2b-viewer Access Control List
   3. In the default domain, create the application domains. After creating an application domain, access it and complete the following steps as appropriate.
      • Upload the cryptographic files for certificates and keys that the services need. If you created export packages for certificates, import them.
      • Define the Domain Settings configuration to use the same treatment and passphrase as the source system.
      • Define the SMTP Server Connection configuration for the domain.
      • Define the Web Services Management Agent configuration to ensure that the following settings are proportional to the allocated memory of the target system.
        • Maximum records to buffer
        • Maximum buffer memory
3. Create export packages for each domain on the source DataPower Gateway.
   1. Create an export package that includes only the necessary objects in the default domain. In other words, ensure that you exclude any of the previously listed items that you already explicitly defined as well as the Tenant object.
   2. Create an export package for each application domain.
4. Import the export packages to the target system. These packages were created on the source system.
   1. Import the export package for the default domain. Do not select Restore. For object that report as new or existing, you might need to deselect those that are for objects that are not appropriate for the default domain. These are object configuration associated with services; for example, processing policies, processing rules, and processing actions. The following object classes should report as new and are for configuration that can be defined in only the default domain or referenced by objects that you should define in only the default domain.
      • B2B Persistence
      • Domain Availability
      • Host Alias
      • Identification Credentials
      • Interoperability Test Service
      • Failure Notification
      • Language
      • Log Category
      • Log Target
      • ODR Connector Group
      • On Demand Router
      • Password Map Alias
      • Quota Enforcement Server
      • RADIUS Settings
      • SSH Client Profile
      • SSL Server Profile
      • SSL Proxy Profile (deprecated)
      • SSL Server Profile
      • SSL SNI Server Profile
      • Throttle Settings
      • User Account
      • User Group
      • Validation Credentials

      Other objects that report as new or existing probably are not appropriate in the default domain and should be considered for import into an application domain that contains the appropriate service.

   2. Import the export package for each application domain.
5. As needed, make configuration adjustments.