Public IP Migration steps from Check Point to Sophos Firewall VM in Azure

Question

Hello,

I plan to replace the existing Check Point firewall VM in Azure with a new Sophos firewall VM. They are in a different resource group but within same region and subscription.

As part of this migration, I will retain and reuse the existing public IP addresses by dissociating them from the Check Point firewall NIC and reassigning them to the Sophos firewall NIC.

Below are my planned steps for the public IP migration. I’d appreciate your review and any feedback:

1. Stop the Checkpoint firewall VM in Azure portal (Not sure if this step is required)
2. Stop the Sophos firewall VM in Azure portal (Not sure if this step is required)
3. Dissociate the public IP addresses from the Checkpoint firewall NIC
4. Associate the public IP addresses to the Sophos firewall NIC
5. Start the Sophos firewall VM
6. Associated public IP addresses will be available on the Sophos firewall.

Thank you.

Answer 1

Hi Alex H

It looks like you're planning to swap out your Check Point firewall for a Sophos firewall in Azure and want to ensure a smooth transition of your public IP addresses.

Your migration plan is solid and well thought out. Here's a review of your steps along with some feedback and best practices:

1. Stop the Check Point firewall VM: Yes, stopping this VM is a good practice. It's important to ensure there are no active connections or sessions using the public IP when you dissociate it.
2. Stop the Sophos firewall VM: Why: It's best to stop the VM before changing NIC configurations to avoid any runtime issues or IP binding problems.
3. Dissociate the public IP addresses from the Check Point firewall NIC: This is correct. You'll want to do this to free up the IPs for reassignment.
   • You can do this via the Azure Portal or PowerShell:
   • $nic = Get-AzNetworkInterface -Name "<CheckpointNIC>" -ResourceGroupName "<CheckpointRG>"$nic.IpConfigurations[0].PublicIpAddress = $nullSet-AzNetworkInterface -NetworkInterface $nic
4. Associate the public IP addresses to the Sophos firewall NIC: Ensure the IP is in the same region and the target NIC is properly configured to accept the IP.
5. Start the Sophos firewall VM: You can start this after the IP addresses are assigned and verified.
6. Associated public IP addresses will be available on the Sophos firewall: You should verify the IPs are functioning correctly once the Sophos firewall is up.

Overall, your steps look good but remember to check the NSG (Network Security Group) rules to ensure traffic is allowed as per your requirements on the new firewall.

Additional Recommendations:

• Backup Configuration: Always back up your firewall configurations before making changes.
• Testing: After reassociating the public IPs, run some tests to verify connectivity and firewall rules.

---

I hope this has been helpful!

Please don’t forget to close the thread by clicking "Accept the answer" and "Yes" wherever the information provided helps you, as this can be beneficial to other community members.