topic Re: How to export and import IPS profiles on R81.10 in General Topics

How to export and import IPS profiles on R81.10

TSOL — Mon, 26 Dec 2022 11:14:24 GMT

Dear ALL,

We want know how to export and import IPS Profiles on R81.10. Because we need to migrate full HA enviroment to Disributed emvironment.

At first, we tried to using migrate_sever command, but the migrate was failed. we cannot delete HA object.

So we thought of using the API.

Although it did not return as much as 100 objects. We were able to restore objects and policies.

So finally, we want to migrate IPS profiles,

We found that R7x can use the API, but we didn't find that this API can use R81.10.

Please tell me about how to export and import IPS profiles on R81.10.

Thank you for the advice in advance.

Re: How to export and import IPS profiles on R81.10

Blason_R — Mon, 26 Dec 2022 13:02:08 GMT

You mean IPS signatures which are configured in your profile? Did you try export to csv option at least that would give you baseline to start with

Re: How to export and import IPS profiles on R81.10

PhoneBoy — Mon, 26 Dec 2022 14:57:58 GMT

R7x had limited to no API support, what precisely are you referring to here?
In any case, the API should support getting the necessary information, though it will require multiple calls to get all the information due to the amount of the data the API can return in a single call.
Having said that, the default Optimized policy is what we generally recommend for most deployments.

Re: How to export and import IPS profiles on R81.10

Timothy_Hall — Mon, 26 Dec 2022 15:23:56 GMT

As Phoneboy said you could pull all this IPS config information out through the API but it will take some doing.

One other approach would be to use the relatively new IPS profile comparison tool to determine the differences between the original IPS profile in your Full HA environment and the default Optimized profile in your Distributed environment. Once those differences (administrator overrides, etc) have been determined, manually implement the differences in your new Distributed environment:

sk178646: IPS Protections - Profiles compare

Re: How to export and import IPS profiles on R81.10

the_rock — Tue, 27 Dec 2022 03:47:09 GMT

I believe what @Blason_R said is probably your best approach to start with.

Re: How to export and import IPS profiles on R81.10

TSOL — Tue, 27 Dec 2022 04:13:32 GMT

Thank you for the answer.

We are finding how to export IPS profiles from old Checkpoint appliances(FULL HA ) and import IPS profiles to new Checkpoint appliances(Distributed )

Re: How to export and import IPS profiles on R81.10

TSOL — Tue, 27 Dec 2022 05:30:48 GMT

Thank you for reply.

I would like to know the procedure of this URL in the case of R81.10.
How to Import / Export IPS Protection Profiles (checkpoint.com)

Because We cannot fine the procedure.

Thanks.

Re: How to export and import IPS profiles on R81.10

TSOL — Tue, 27 Dec 2022 05:42:47 GMT

Thank you for the advice.

I tried comparing the profiles but there are too many differences.
After that, manually creating a profile is impractical.
Please let me know if there is a way to register all at once by import or command.

Re: How to export and import IPS profiles on R81.10

TSOL — Tue, 27 Dec 2022 05:45:29 GMT

Thank you for the answer.

But that ways is only export. We want to know how to import IPS profiles to new Checkpoint appliances(Distributed )

Re: How to export and import IPS profiles on R81.10

PhoneBoy — Tue, 27 Dec 2022 15:40:09 GMT

https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-package-or-parts-of/m-p/41100#M2829
This tool can be used to export/import the just the Threat Prevention policy (includes IPS configuration).

Outside of that, you'll have to write something that calls the API directly, getting the information you need.
This is also a task that Check Point Professional Services can assist with.

Re: How to export and import IPS profiles on R81.10

the_rock — Tue, 27 Dec 2022 23:19:54 GMT

I dont believe thats sadly available in R81.xx versions, as far as import (not that I know of anyway).

Re: How to export and import IPS profiles on R81.10

G_W_Albrecht — Wed, 28 Dec 2022 09:47:07 GMT

If the step is from R77.30 IPS to R81.10 IPS profiles, note the main deviations from pre-defined Policy and use it to make a cloned copy of R81.10 Optimized Policy.

Re: How to export and import IPS profiles on R81.10

the_rock — Wed, 28 Dec 2022 13:02:02 GMT

I also checked in R81.20 and option to import IPS profile does not exist there either. Little disapoointing, but lets hope it becomes avalable sometime soon. Speaking of that, I know this is slightly different topic, but it would also be nice if there was an option to import the rules in .csv format, the same way they can be exported.