How to Convert Juniper PBR to Check Point PBR?

KeonNg — Sun, 03 Mar 2024 15:24:00 GMT

Hi All,

When migrating the Juniper SRX firewall(Junos) to Check Point firewall, SmartMove are only available to convert the policy and objects. However, some configurations are not able to convert example like the PBR.

After I studies on Juniper Documation also struggling how I gonna to convert based on Check Point architecture. When look the Juniper configuration somehow consists of several parameter/section regarding the PBR example like interface circumstances, routing options, etc. But in Check Point config is so straight forward. I believe the way to configure and how the packet flows its totally different between these 2 vendors.

Hence its anyone has experienced on converting Juniper PBR to Check Point PBR? please give some advice.

Example Juniper PBR config:

<redundant-ether-options>

<redundancy-group>1</redundancy-group>

</redundant-ether-options>

<unit>

<inet>

<input>

<filter-name>PBR-Conf</filter-name>

</input>

</filter>

</address>

</inet>

</family>

</unit>

</interface>

<routing-options>

<interface-routes>

<rib-group>

</rib-group>

</interface-routes>

<rib-groups>

<import-rib>inet.0</import-rib>

<import-rib>PBR-Server.inet.0</import-rib>

</rib-groups>

</routing-options>

<term>

<from>

<source-address>

</source-address>

<destination-address>

</destination-address>

<destination-port>https</destination-port>

</from>

<then>

<routing-instance>

<routing-instance-name>PBR-Server</routing-instance-name>

</routing-instance>

</then>

</term>

<term>

<from>

<source-address>

</source-address>

<destination-address>

</destination-address>

<destination-port>9443</destination-port>

</from>

<then>

<routing-instance>

<routing-instance-name>PBR-Server</routing-instance-name>

</routing-instance>

</then>

</term>

<term>

<name>AcceptAll</name>

<then>

</then>

</term>

</filter>

<routing-instances>

<name>PBR-Server</name>

<instance-type>forwarding</instance-type>

<routing-options>

<route>

<next-hop>10.10.10.82</next-hop>

</route>

<route>

<next-hop>10.10.10.82</next-hop>

</route>

</static>

</routing-options>

</instance>

</routing-instances>

Note: Static NAT involved. Please refer NAT rules as below:

Original dst: 192.168.253.219/32 -> Translated Dst:10.10.10.78/32

Original dst: 192.168.253.20/32 -> Translated Dst:192.168.248.161/32

Best Regards,
Keon

Re: How to Convert Juniper PBR to Check Point PBR?

elishoov — Thu, 07 Mar 2024 08:52:26 GMT

Hi @KeonNg.

PBR conversion is not supported.

Check Point offers a service through Professional Services for an end-to-end migration process, with/without SmartMove

You are welcome to contact ps@checkpoint.com

Best Regards,
Nir.

Re: How to Convert Juniper PBR to Check Point PBR?

the_rock — Thu, 07 Mar 2024 14:25:12 GMT

What @elishoov is 100% true. I had same situation few years ago when converting a different vendor to CP (believe it was Cisco) and was informed the same.

Best,

Andy

topic Re: How to Convert Juniper PBR to Check Point PBR? in Firewall and Security Management

How to Convert Juniper PBR to Check Point PBR?

Re: How to Convert Juniper PBR to Check Point PBR?

Re: How to Convert Juniper PBR to Check Point PBR?