Nebula [MSP portal] - Cross-org Synchronization and how to move a Site and its devices to another organization

This step-by-step guide shows how to use, the "Cross-Org setting sync" and "Cross-Org site clone" functions.

Prerequisites: The account must have full administrator access (Org-Full or Owner privileges) to the source and destination organizations, and an activated MSP Portal license

Cross-Org setting sync

• Organization-wide settings
• Administrators
• Cloud Authentication accounts (Users and MAC)
• Configuration templates

• Organization-wide > Organization-wide manage > Organization settings > Country
• Organization-wide > Organization-wide manage > Organization settings > Login IP ranges
• Administrators privileges (when source and destination organizations have the same admin account)
• Cloud Authentication account privileges (when source and destination organizations have the same Cloud Authentication account)

• No sites are bound to the new template site.
• If the destination organization has a template with the same name, then the new template will have a number appended to the end of its name.

Note: The Nebula account owned by these organizations must have an active MSP License

• On Nebula Control Center

Go to MSP cross-org manage > Cross-org synchronization

• Select "source organization" and specify "Org. setting" namely which settings you want to synchronize.
• Select "dest. organization"
• Click "Sync"

When copying organization-wide settings, NCC does not overwrite:

• Destination organization’s name and country
• Destination organization’s toggle state for Login IP ranges

NCC appends administrators to destination organizations

NCC does not overwrite privileges of email accounts that were already added to the destination organization

Cross-Org site clone

• When to make use of a Cross-Org site clone?

This tool is particularly useful when the original MSP's customer allocation was not designed correctly and a re-structuration is needed. Nebula strives to have each "Customer" as one Organization. As an example, a customer would be "Zyxel EU". The customer can then have many different Sites, as there are many branches across different locations, for instance, "Germany", "France", "Italy".

• Having this structure might help to organize the customer in regards to licensing, provide an easy auto-VPN, and the capability to have unified user accounts (admins and cloud server database) that have access to all sites:

However, it might have happened that this design was not well known at the deployment time and one Organization was created which includes all the customers. This deployment, although doable, it's not recommended. One of the reasons is due to Licenses being Org-based, so you might not be able to mix customers with the Based pack and customers with Pro-Pack.  If this was the case, you might want to move the site of an existing customer to their own independent organization so they can enjoy the licensing they want. 

Another example is when an end customer is now being supported by another MSP. Then the existing deployment from the end customer needs to be moved to another organization. Here is when the Cross-Org site clone with device movement comes in handy.

• Steps to move the site to another organization

Before explaining the steps, it's worth noting that the movement of the site and the devices actually implies the creation of a new site in the second organization, and this site will actually have the exact same configuration as the original one. Then an option in Nebula allows moving the devices to this new site while keeping the management interface intact so the device can always be connected to Nebula.

Here are the steps to follow:

• On Nebula Control Center

Go to MSP cross-org manage > Cross-org synchronization

Note: MSP portal license is required to see the MSP level

• The Cross-Org site clone with the device movement section provides the tools to do the movement

1) "From source organization" - select the Organization where the Site is currently set up. Once the organization is selected, use the Site list to check the Site which settings are needed to be cloned. You might select more than one site if needed

Tick "Move site devices to the cloned site in destination organization" to transfer the devices in the selected Site(s) to the new organization and new site.  Make sure to toggle ON the option "Keep Management WAN interface" so this ensures the device will keep the existing settings and will not get disconnected from Nebula

2) "To dest. organization" -  In the destination organization, you might select an existing organization or create a new one that will represent the new customer organization. This field is only shown if a new organization is created. Use this to give a new organization a name.

Note: the list will only display organizations to which the MSP account is also the owner. If a new organization is created, the Organization Owner will be the MSP account

The "Org. name" field is only shown if a new organization is created. Use this to give a new organization a name.The field "Copy settings" - you might copy some settings from the original organization into the new organization. These settings include:

• Organization settings (such as Country, certificates, Login IP ranges)
• Administrators (admin accounts). Use this if you want the same administrator accounts to have access to the new organization.
• Cloud authentication (MAC, Users, DPPSK). Use this if you want to clone the same accounts in the cloud authentication into the new organization.
• Configuration templates. This is only available if the original organization and the destination organization have a PRO pack license. 

• Once the options have been selected you can proceed to click the button "Clone"

A warning pop-up will appear informing that the devices might stop providing networking service for around 5-10 minutes. This is due to the transfer between the original site into the clone site.

The downtime time will vary according to the size of the network. In a simple test topology, the devices were affected for about 1 minute each. Once the changes are saved successfully, the destination organization will contain a Site with the same name and settings and the devices will also be registered into this new cloned site! The new organization and Site are ready to work once the devices are back online