topic Re: python import_export_package.py in API / CLI Discussion

python import_export_package.py

WarpTeam — Tue, 20 Feb 2024 18:12:50 GMT

Hello,

I need to export a policy package from one SMS and import into another with several policies already in place so I´m trying to use the python API import_export_package.py. The problem is that when exporting finishes at least the Network objects, services and time objects are not exported. Initially I thought it was not being imported correctly but then I realised these objects are not on the exported files. The rules are exported and imported correctly.

I´m using python version 3.11.8 and SMS is n R81.10.

Can anyone give me some ideas about this?

Thank you.

Nuno

Re: python import_export_package.py

the_rock — Wed, 21 Feb 2024 02:32:47 GMT

Is this what you used?

Best,

Andy

https://github.com/CheckPointSW/ExportImportPolicyPackage

Re: python import_export_package.py

WarpTeam — Wed, 21 Feb 2024 08:53:29 GMT

Hi Andy,

yes it was. Worked fine for the rules but not for the rest.

Re: python import_export_package.py

the_rock — Wed, 21 Feb 2024 12:50:48 GMT

If you send me the exact process you followed, happy to try it in the lab.

Best,

Andy

Re: python import_export_package.py

the_rock — Wed, 21 Feb 2024 13:13:18 GMT

As a matter of fact, let me test it now. I will build brand new mgmt in eve-ng on R81.20 and let you know what happens.

Andy

Re: python import_export_package.py

WarpTeam — Wed, 21 Feb 2024 13:25:15 GMT

OK. Let me know.

Thank you.

Nuno

Re: python import_export_package.py

the_rock — Wed, 21 Feb 2024 13:26:35 GMT

Will do. BUT, just to keep it consistent, as I like to do everything the right way the first time, can you please send the EXACT steps you did, so I can follow the same?

Best,

Andy

Re: python import_export_package.py

WarpTeam — Wed, 21 Feb 2024 13:34:28 GMT

Sure, please find attached the copy of the script that I run.

Re: python import_export_package.py

the_rock — Wed, 21 Feb 2024 13:45:32 GMT

I think I will just use built in version 3.9 from $FWDIR/Python dir.

Thank you.

Andy

Re: python import_export_package.py

the_rock — Wed, 21 Feb 2024 14:38:32 GMT

Just working on something else now, but will do it later on, for sure.

Andy

Re: python import_export_package.py

the_rock — Wed, 21 Feb 2024 16:21:35 GMT

My colleague and I are having some challenges doing this from ssh, we even tried running it from $FWDIR/Python/bin dir, but no joy. Your screenshot would indicate you did this from windows PC?

Andy

Re: python import_export_package.py

WarpTeam — Wed, 21 Feb 2024 16:59:08 GMT

That´s correct, was done from a win PC.

Nuno.

Re: python import_export_package.py

the_rock — Wed, 21 Feb 2024 17:06:13 GMT

Ok, thats what I thought. Let us see if we can get this going from the actual CP mgmt server, we will try dedicated mgmt and also standalone one.

Best,

Andy

Re: python import_export_package.py

the_rock — Thu, 22 Feb 2024 03:07:44 GMT

K, was able to replicate it, exact same issue as you on R81.10. I tested it on R81.20, jumbo 45.

Best,

Andy

Re: python import_export_package.py

WarpTeam — Fri, 23 Feb 2024 09:33:09 GMT

Hello Andy,

so is there a way to fix this? Did it worked with other versions in the past?

this would be a great solution to import a policy package from one SMS to another one with several policy packages already in place. Migrate_server export and import is not feasible here as it would rewrite contents in destination and doing this manually will consume a lot of hours.

Thank you.

Nuno

Re: python import_export_package.py

the_rock — Fri, 23 Feb 2024 09:56:44 GMT

Agree. Migrate server imports everything. Not sure about older versions, never tried. Might be worth TAC case.

Andy

Re: python import_export_package.py

mscott5002 — Wed, 20 Mar 2024 22:30:32 GMT

Hi Nuno.

I'd like to get involved in this test. Is there a specific version/package of Python you installed on your Win PC? I'd like to minimize the differences in our environments for my testing.

Thanks, Mike

Re: python import_export_package.py

WarpTeam — Mon, 15 Apr 2024 09:26:54 GMT

Hello Mike,

sorry for the late reply. I ended up by using the python tool directly on checkpoint instead of the windows PC.

(https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-package-or-parts-of/td-p/41100/page/4).

It works but around 10 to 15% of the objects are not exported/imported.

Thank you.

Regards,

Nuno

Re: python import_export_package.py

Hugo_vd_Kooij — Tue, 16 Apr 2024 05:50:12 GMT

How about this disclaimer?

In the case you are exporting a policy package from a CMA, please verify that a global policy was NOT assigned to that CMA. The tool doesn't support exporting a policy with global policy assigned!

No one mentioned that one in this thread yet.

Re: python import_export_package.py

WarpTeam — Tue, 16 Apr 2024 08:37:27 GMT

Hi,

actually it was the other way around, the policy was exported from an SMS (full HA) to a CMA.

The checkpoint gateway objects are not exported so we created the objects on the destination before the import but even so the rules with "install on specific gateways" instead of policy targets were not imported and we had to created them manually as well as the NAT rules. I was lucky since most of the rules was set to be installed on the policy targets otherwise I would have to change this setting on all the rules.

Seems this is a point to be improved on the tool.