> Source: [sk180631](https://support.checkpoint.com/results/sk/sk180631) # sk180631 - How to clone a Domain on a Multi-Domain Security Management Server | Property | Value | |----------|-------| | Solution ID | sk180631 | | Date Created | 2023-03-16 | | Last Modified | 2026-02-04 | | Technical Level | General | | Products | Multi-Domain Security Management Server | | Versions | R81.10 (EOS), R81.20, R82 | | OS | Gaia | ## Solution ### Overview It is possible to clone an existing Domain on the same Multi-Domain Security Management Server. ### Requirements |----------------|--------------------------------------------------------------------------------------------------------------| | Version | Requirement | | R82 and higher | The feature is integrated | | R81.20 | Upgrade Tools build 997000670 or higher from [sk135172](https://support.checkpoint.com/results/sk/sk135172). | | R81.10 | Upgrade Tools build 996000503 or higher from [sk135172](https://support.checkpoint.com/results/sk/sk135172). | ### Important Notes * When you use the API v2 call "clone domain" (on R82 or higher versions), you can specify an optional parameter `omit-sensitive-info` to remove sensitive information from the management database on the new cloned Domain (such as internal passwords, shared secrets, and private keys). * The cloning operation copies the **entire management database** (with all configured objects) of an existing Active Domain Server to the new Domain, except for the Internal CA database. On the new cloned Domain, the ICA database is "clean". In the new Domain, all managed objects from the source Domain appear without an IP address and without SIC. * The cloning operation adds the suffix "**_\**" to each object it copies from the source Domain to the cloned Domain. * After you clone a Domain, you must perform a full synchronization between all involved Multi-Domain Security Management Servers and Multi-Domain Log Servers in the environment. ### Procedure |----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Version | SmartConsole | Management API Calls | | R82 and higher | 1. Connect with SmartConsole to the Multi-Domain Security Management Server. 2. Select the **MDS** context. 3. From the left navigation panel, click the **Multi Domain** view. 4. In the top middle section, click **Domains**. 5. In the left column **Domains** , right-click the existing Domain \> in the menu, click **Clone**. 6. In the informational popup, click **Continue**. 7. Configure the new Domain, including the Trusted Clients. 8. Click **OK**. 9. The cloning progress appears in the bottom left corner of SmartConsole. | Use this Management API call v2: `mgmt_cli clone domain name "" new-domain-name "" new-domain-server-name "" new-domain-server-ip "" --domain 'System Data'` | | R81.20 | Not Available | Use these Management API calls v1.9: 1. [Export the database from an existing Domain](https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/export-management~v1.9): `mgmt_cli export-management domain-name "" file-path "" --domain 'System Data'` 2. [Import the database on a new Domain](https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/import-management~v1.9): `mgmt_cli import-management file-path domain-name "" domain-ip-address "" domain-server-name "" --domain 'System Data'` 3. [Add trusted clients](https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/add-trusted-client~v1.9): `mgmt_cli add trusted-client ` | | R81.10 | Not Available | Use these Management API calls v1.8 / v1.8.1: 1. [Export the database from an existing Domain](https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/export-management~v1.8): `mgmt_cli export-management domain-name "" file-path "" --domain 'System Data'` 2. [Import the database on a new Domain](https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/import-management~v1.8): `mgmt_cli import-management file-path domain-name "" domain-ip-address "" domain-server-name "" --domain 'System Data'` 3. [Add trusted clients](https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/add-trusted-client~v1.8): `mgmt_cli add trusted-client ` | ### Known Limitations * After cloning a Domain, in the new Domain all managed objects from the source Domain appear without an IP address and without SIC. As a result, when you connect with SmartConsole to the cloned Domain Management Server, the "**Validations**" panel shows this error about the cloned objects: ``` One of the following must be defined: IP Address IPv6 Address ``` On the cloned Domain, you must: 1. Open the object. 2. Enter the applicable IP address. 3. In the applicable object (Security Gateway / Cluster Member / Check Point Host), establish the SIC Trust. **Note** - In SmartConsole, the Check Point object does not show the green "V" icon until you restart the Domain with the commands "`mdsstop_customer ; mdsstart_customer `". This is only a cosmetic issue. 4. In the Security Gateway / Cluster objects: 1. Get interfaces. 2. Enable the applicable Software Blades. 3. Configure all other applicable settings. 5. Install the applicable policy. * After cloning a Domain, you must manually add Administrators and Trusted Clients on the new cloned Domain Server to give them access to the new Domain Server. * In a Management High Availability configuration, you **can create and export** a Domain for cloning only on a Multi-Domain Security Management Server, on which the Domain Management Server of the Domain is **Primary and Active**. * In a Management High Availability configuration, you **must perform the import** of a cloning operation on the Multi-Domain Security Management Server, on which the **Global Domain is Active** . In case the cloned domain should have the Primary and Active Domain Management Server on another Multi-Domain Security Management Server, refer to [sk184637](https://support.checkpoint.com/results/sk/sk184637 "sk184637 - How to switch roles of DMS in a Multi-Domain HA setup"). * The cloning of a Domain is blocked if the Domain contains objects related to VSX. * The Hit Count data is not cloned. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content