how to move RED from SG to XG ?

How about just entering the RED ID in XG together with the unlock code you should see in SG?

Is that what you were looking for or is it something else?

the red is always connect to SG, addendum: the fqdn is also to be new

That is no problem, see my previous post. You can just add it in XG if you have the unlock code.

ok, i config the RED in XG and in SG i delete, or ?

what does the red do when the old connection is gone?
How does the red get the new data?

Red is always provisioned from the cloud. Will not automatically be deleted from SG but will also not connect to SG again. After configuring in XG and power off / power on the RED, it will reconfigure from the cloud to the new firewall.

oh, reboot, i,***, is this possible remotely (ssh or otherwise) ?

I don't know, maybe someone else knows.... or maybe you may have someone onsite that can reset the device

or is that possible?

now the RED on fqdn xxx.yy.de are configured with 12.12.12.12 -> SG, if I now change the IP for fqdn xxx.yy.de and this points to XG.

what happens then?

That will not work, since RED really expects to connect to the SG. It must first get a new config. It may work to just turn off the RED in your SG. Maybe it will trigger the RED to reboot but I am not sure about this....

SG/XG have a option to deregister the RED, if deleted or offline.

If SG/XG reaches the RED Server, which should be the case, and you are the owner of the Unlock ID of this RED, you should be able to overwrite the config on the provisioning server by adding a new config on XG. 

If the RED is still connect to the SG, it will eventually never ask for a new config. The config changes are always done via the tunnel between RED and SG/XG. So you need to delete it first form SG. This will trigger a reboot on RED and the RED notice the SG is not pickup up the connection, leading to a config pull from the server. 

SG/XG have a option to deregister the RED, if deleted or offline.

If SG/XG reaches the RED Server, which should be the case, and you are the owner of the Unlock ID of this RED, you should be able to overwrite the config on the provisioning server by adding a new config on XG. 

If the RED is still connect to the SG, it will eventually never ask for a new config. The config changes are always done via the tunnel between RED and SG/XG. So you need to delete it first form SG. This will trigger a reboot on RED and the RED notice the SG is not pickup up the connection, leading to a config pull from the server. 

cool, it works, thx at all

NOTICE:
it only works if the RED WAN has DHCP.
Static WAN configuration does not work