topic Re: Howto migrate export - R80.10 in API / CLI Discussion

Howto migrate export - R80.10

Ivo_Marques — Wed, 28 Nov 2018 11:40:43 GMT

Hi guys,

We recently migrate to R80.10 and now we need to export the policy. I read somewhere in the forum that you could do that with the RestAPI, I think something using "show access rulebase" (I will find it later).

So, my question is it's a full export like "./migrate export"? This method also export the IP SEC Communities whit the pre-shared secret? I'm able to import the file to create a similar environment?

Can I see this method like a backup of my SMS?

Thanks in advanced,

Ivo

Re: Howto migrate export - R80.10

Joshua_Hatter — Wed, 28 Nov 2018 13:56:14 GMT

You can export a policy and the majority of it's objects. I wouldn't think of it as a replacement to existing procedures as there are still limitations on some objects the API cannot handle.

Re: Howto migrate export - R80.10

PhoneBoy — Wed, 28 Nov 2018 20:17:37 GMT

See this script and read the comments:

Python tool for exporting/importing a policy package or parts of it‌

Re: Howto migrate export - R80.10

Egor_Cherkasov — Thu, 29 Nov 2018 12:10:08 GMT

A little time ago I did that operation, I used migration tool to transfer secury policy.
Migration tool can not export (and certainly import) logging settings, nat settings and rules, logs.
Also might be a problem with internal certificates, when you will import a policy.

But migration tool will import all objects, security policy and rules, blade settings and global properties.

There are a lot of obstacles, because the Check Point hasn't such operation as I've understood.

Re: Howto migrate export - R80.10

_Val_ — Thu, 29 Nov 2018 12:13:24 GMT

>>Can I see this method like a backup of my SMS?

Yes, migrate export is actually one of the recommended ways to backup your management. If you need to export not jsut the DB and ICA, but the logs, there is a flag to do so.

Re: Howto migrate export - R80.10

_Val_ — Thu, 29 Nov 2018 12:17:28 GMT

I am not sure I fully understand what you are trying to say. However, if you are saying that migrate tool cannot be used to export a single policy package, that is true. It is designed and advised to be used for migrating to a different HW, IP address, etc, for the whole SMS or a Security Domain.

As Dameon mentioned above, there is a script for policy migration that you could use.

Re: Howto migrate export - R80.10

HeikoAnkenbrand — Sun, 19 Apr 2020 14:34:45 GMT

Hi @Ivo_Marques

You can also use the following script from me:

Easy Backup Tool - (migrate export + all GAIA configs)

This tool creates a backup of all GAIA gateway configurations with one CLI command "ebackup"

- Only one CLI command "ebackup"
- Backup of all Gaia gateway configurations (Check Point appliances, Open Server, SMB appliances 11xx, 14xx)
- Migrate export on SMS
- Migrate-server on MDS
- Backup all files to one TGZ file
- FTP upload support backup file
- CP upload support for backup file via cprid_util