topic Re: Export Policy name: Standard of the gateway in General Topics

Export Policy name: Standard of the gateway

MardoqueoRob — Fri, 28 Jun 2024 17:42:27 GMT

Hello Boys,

Do you know if it is possible to obtain these policies to apply them to other backup equipment in stock?

I can't find information about where it is hosted.

[Expert@GW:0]# cpstat -f policy fw

Product name: Firewall
Policy name: Standard

I am looking for this so that I am not restarting the SIC again when a device fails or there is no technical equipment and it will only be changing cables, thank you very much!

Re: Export Policy name: Standard of the gateway

the_rock — Fri, 28 Jun 2024 18:23:11 GMT

Just to make sure, are you trying to export one policy and then import it into another management server?

If so, then you need to follow below process.

https://support.checkpoint.com/results/sk/sk135172

Btw, its NOT just boys, lots of ladies here too, all very smart ones 🙂

Best,

Andy

Re: Export Policy name: Standard of the gateway

MardoqueoRob — Fri, 28 Jun 2024 18:31:10 GMT

I am referring to the policy loaded in the firewall:
[Expert@GW:0]# cpstat -f policy fw

Product name: Firewall
Policy name: Standard

Re: Export Policy name: Standard of the gateway

the_rock — Fri, 28 Jun 2024 18:35:13 GMT

Right, but Im still unclear on what exactly you are trying to do here. Are you tryng to export the policy, so it can be imported into another mgmt server or something totally different?

Andy

Re: Export Policy name: Standard of the gateway

PhoneBoy — Fri, 28 Jun 2024 20:04:52 GMT

Installing policy to a gateway generally requires SIC with management.

The currently installed policy is in $FWDIR/state (in its compiled form).
I'm fairly certain copying this directory from one system to another is NOT supported, especially across different hardware/software versions.

Note in R82, we will have the ability to configure a policy without management.
However, I believe even that requires establishing SIC with management first.

Re: Export Policy name: Standard of the gateway

Lesley — Fri, 28 Jun 2024 21:06:20 GMT

So you want a cold spare unit on the shelf?

If the hardware is the same as the unit it will replace you can use gaia snapshot:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_AdminGuide/Content/Topics-GAG/Snapshot-Management.htm

Or backup, this is less complete backup and also needs policy push.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_AdminGuide/Content/Topics-GAG/Backing-Up-and-Restoring-the-System.htm?TocPath=Maintenance%7CSystem%20Backup%7C_____1

A firewall has way more config then only the policy. Putting only the policy on a box will not make it functional. So in general this is not a good idea.

Re: Export Policy name: Standard of the gateway

the_rock — Sat, 29 Jun 2024 02:16:11 GMT

Another option might be copy bits and pieces from show configuration, since I assume it would be different hardware, so interfaces wont match, but if its the same hardware, then it might be best option.

Andy

Re: Export Policy name: Standard of the gateway

MardoqueoRob — Sat, 29 Jun 2024 04:32:41 GMT

If I was referring to that, but I was also not sure if you could import the policy loaded from the firewall to other hardware with the same configurations, it is best to follow the recommendations of snapshots and backup to have the policies loaded on both computers in case one fails.