Migrate an On-Premises secure device connector and secure event connector from a CentOS 7 virtual machine to an ubuntu virtual machine

Migrate Security Cloud Control's on-premises Secure Device Connector (SDC) from end-of-life CentOS 7 virtual machines to supported Ubuntu virtual machines.

Since CentOS 7 is now end-of-life and has been deprecated by Security Cloud Control, this migration process helps you migrate all SDCs from CentOS 7 to an Ubuntu virtual machine.

  • The SDC must have full outbound access to the internet on TCP port 443.

  • The Ubuntu virtual machine running the SDC must have network access to the management interfaces of the devices it communicates with, such as ASAs and Cisco IOS devices.

  • Any networking rules created for the IP address or FQDN of the old SDC VM to reach your devices should be recreated with the IP address or FQDN of the new SDC VM.

  • The migration will take 10 to 15 minutes. During this time, your device will continue to enforce security policy and route network traffic, but you will not be able to communicate with it through the SDC.

Before you begin

Deploy a new host by following the instructions on Deploy a VM for Running the Secure Device Connector and Secure Event Connector.

Follow these steps to migrate the SDC and/or SEC:

Procedure

Step 1

Download the new VM image from here.

Step 2

Unzip the CDO-SDC_VM.zip file.

You should see three VM files named similarly to the following:

  • CDO-SDC-VM-708cd33-2024-05-30-2031-disk1.vmdk

  • CDO-SDC-VM-708cd33-2024-05-30-2031.mf

  • CDO-SDC-VM-708cd33-2024-05-30-2031.ovf

Step 3

Deploy the VM you just downloaded.

Step 4

Note the static IP address or FQDN you assigned to the new VM.

Step 5

Using SSH, log in to the new VM as the CDO user.

Step 6

At the prompt, enter the command:

Example:

sudo sdc host configure
Note

  • Follow the prompts in the migration script closely. The script is well-documented and will guide you through the migration process, explaining each step.

  • At the end of the migration script, you will receive a message indicating that your SDC has been migrated to the new VM. The SDC will retain its name after the migration.

Step 7

Using SSH, log in to the old (CentOS) SDC as the CDO user.

Step 8

Install the CLI using the command:

Example:

curl -O https://s3.us-west-2.amazonaws.com/download.defenseorchestrator.com/sdc-cli/sdc-cli-package-latest.tgz && tar -xvf sdc-cli-package-latest.tgz && chmod +x ./install.sh && ./install.sh

Step 9

Run the following command and follow the prompts:

Example:

sudo sdc migrate now

Step 10

Log in to your Security Cloud Control tenant.

Step 11

Select the SDC you migrated, and in the Actions pane, click Request Heartbeat.

Note

Ensure that the SDC is in the Active state.

Step 12

Install the CLI on the old (CentOS) SDC using the command:

Example:

curl -O https://s3.us-west-2.amazonaws.com/download.defenseorchestrator.com/sdc-cli/sdc-cli-package-latest.tgz && tar -xvf sdc-cli-package-latest.tgz && chmod +x ./install.sh && ./install.sh

Step 13

Run the following command and follow the prompts:

Example:

sudo sdc eventing migrate

Step 14

Configure your devices to point to the new IP address of the SEC or shut down the old host and assign the new host the same IP address that the old host had so that the devices do not need to be updated.

The SDC and SEC are successfully migrated from the CentOS 7 virtual machine to the Ubuntu virtual machine. For information on the state of the SEC, see Use Health Check to Learn the State of your Secure Event Connector.

What to do next

Do Not Restart Your Old SDC

After the migration is complete, do not restart your old SDC on the original virtual machine.

Revert Failed Migration

If the migration fails for any reason, or the result is not what you are expecting and you want to revert to the old SDC, follow the instructions below:

  • Log in to the new VM and switch to the SDC user.

  • Ensure the SDC is not currently running on the new VM using the command: docker ps

  • If the SDC is running, run the command: SDC stop

  • Confirm that the SDC has stopped running by executing docker ps again.

  • Log in to the old VM and run the command: SDC migrate revert

  • When the old SDC is active and visible in the UI, return to the new VM and execute the command: SDC delete <your-tenant-name-here>

  • Refresh the browser completely, click on the SDC, and verify that the IP of the old host appears in the sidebar. If the new IP still appears despite these steps, request a new health check, refresh the browser, and check again.

  • To revert the SEC migration, run the command: SDC eventing revert