topic Re: export policy package in Firewall and Security Management

export policy package

Carlos_Mendez — Mon, 16 Apr 2018 16:49:52 GMT

Deseo saber si existe un procedimiento para exportar las políticas de R77.30 a R80.10

Re: export policy package

PhoneBoy — Tue, 17 Apr 2018 01:40:27 GMT

Just so you know, you will probably get better response on most of the communities if you ask the question in English.

Are you trying to export policies from R77.30 into a newly installed R80.10 management?

You would use the migration tools for this from here: Check Point R80.10

Are you trying to export policies from R77.30 into an existing R80.10 management that already has policies configured?

Then you probably have to do something like:

Export the entire R77.30 management using the migration tools for R80.10 as above
Create a new R80.10 manager in a VM or similar and migrate import the R77.30 configuration into it
Use the Python tool for exporting/importing a policy package or parts of it tool to export the relevant policy and import it to the R80.10 management.

Re: export policy package

Luis_Miguel_Mig — Sat, 20 Feb 2021 12:54:41 GMT

Will this script support R81?

Re: export policy package

PhoneBoy — Sat, 20 Feb 2021 17:56:31 GMT

TL:DR; yes.

The nice thing about the API is that it’s versioned.
So, if you call the API with an older version, it will act the same way it did in that previous version.

Obviously, the script will have to be updated to support all the new APIs and such of newer versions (and it generally is), but it should still work even without that.

Re: export policy package

Luis_Miguel_Mig — Mon, 22 Feb 2021 09:33:28 GMT

Wouldn't it make sense if the script capability was part of the migrate tools and supported by Checkpoint?

Re: export policy package

Luis_Miguel_Mig — Mon, 22 Feb 2021 18:37:14 GMT

Does anybody has experience with the script? What happens if the new package you are importing uses an identical object already present in the manager where it is imported?
And if the object only has the same name but different value?

Re: export policy package

PhoneBoy — Tue, 23 Feb 2021 02:59:59 GMT

The tool is maintained by Check Point R&D and is Open Source.
While it doesn't receive formal support (e.g through TAC), we do address reported issues where appropriate and periodically update it.
It is limited by what the API allows and very different from what a migrate export/import does.

Re: export policy package

PhoneBoy — Tue, 23 Feb 2021 03:05:03 GMT

I believe it will create a placeholder object in both cases similar to what it will do for object types it cannot create.

Re: export policy package

Luis_Miguel_Mig — Tue, 23 Feb 2021 10:21:09 GMT

Thanks Phoneboy.
Regarding the cases I mentioned I guess that it makes all sense to create a new placeholder when the object has the same name but different values.
However if the objects are exactly the same it would be great if the import could just use the object without creating a new placeholder.

The user case is migrating several clusters from one management to a new management. The clusters share and use the same objects and the policy-package are big, so it would be quite a bit of work to review the imported policy-package and delete all the duplicated objects.

It would be great if R&D could look at it.