Running PFMigrate

Note

Prior to running the utility, it is assumed that there exists a ProtectFile client registered on a CipherTrust Manager with some active ProtectFile rules. Also, that you have gone through the Prerequisites for Using the PFMigrate Utility.

The pfmigrate utility is now ready to run.

1. Navigate to the directory that you copied the pfmigrate utility into and run it, type:

   • In Linux, type: ./pfmigrate --productname <product-name> <mode>

   • In Windows, open a command prompt and run the pfmigrate.exe file as:

     pfmigrate.exe --productname <product name> <mode>

2. The utility prompts you for the following information. Provide the answers at each step:

   • Enter IP address of the CipherTrust Manager from which you are importing CTE UserSpace data

   • Enter the port of the CipherTrust Manager from which you are importing CTE UserSpace data (Default 443).

   • Enter Web Server Certificate Fingerprint of the CipherTrust Manager from which you are importing CTE UserSpace data

   

   Note

   Copy the Web Server Certificate Fingerprint from CM, in Access Management > Registration Tokens.e}

   • Enter username of the CipherTrust Manager which is part of ProtectFile Admins and CTE Admins group

   • Enter the password of the CipherTrust Manager

   • Enter the domain of the CipherTrust Manager (optional)

   • Do you wish to migrate Network Shares configured with CTE linux clients? (Y/N)

   

   Note

   If yes then the utility will scan the current working directory for the Mapping.json file. Make sure you have edited the file before proceeding further.

   • Is the source CM, you are importing CTE data, different from the target server CM where you want to create CTE endpoints? (Y/N)
   

   Note

   For CTE-U v10.x, the utility expects the same set of key material on the target CM as that of the source CM.

3. The pfmigrate utility runs.

The utility can take some time to finish. The utility creates a log of its operations in the file Migrations.log in the current directory. After it finishes, examine the log file for any errors. Also login to the CM and go through the configuration elements created by the utility.

The pfmigrate should have created at least one GuardPoint for each ProtectFile encryption rule, it will be in the disabled state. If they don’t exist, check the migration logs, rectify the cause, and run the pfmigrate utility again.

• Production GuardPoint: Created in disabled state and used for applying production policy.

If you are migrating ProtectFile to CTE, there will be an additional GuardPoint created:

• Transformation GuardPoint: Created in disabled state and used for data transformation. Used for applying the production policy.This policy helps encrypt future files as well as decrypting the content of the files based on access privileges.