topic Re: How to migrate a policy package between Security Management servers in General Topics

How to migrate a policy package between Security Management servers

RemoteUser — Tue, 25 Feb 2025 16:49:53 GMT

Hi all,

i have one question regarding this sk:
https://support.checkpoint.com/results/sk/sk180923

It's possible to migrate a policy package from real environment to LAB even if the management it's in smart1cloud?
Cause the point c

Download cp_mgmt_api_python_sdk from Check Point's GitHub.

This package is Check Point API Python Development Kit simplifies the use of Check Point Management APIs.

The kit contains the API library files and sample files demonstrating the library's capabilities.

Go to https://github.com/CheckPointSW/cp_mgmt_api_python_sdk
As the "pip" command is not available in GAIA, download the folder in a Zip file.
Extract the folder from the Zip file and upload it to the Management server.

How can i upload it to the mgmt if it's in cloud?

Thank

Re: How to migrate a policy package between Security Management servers

the_rock — Tue, 25 Feb 2025 17:35:42 GMT

Last time I did this and apologies if my memory is little fuzzy, but I recall doing migrate server to import all in the lab first, then using script from S1C to get correct format to re-import the right file from lab into S1C again.

Andy

Re: How to migrate a policy package between Security Management servers

the_rock — Tue, 25 Feb 2025 17:38:37 GMT

This is what Im referring to (attached)

Andy

Re: How to migrate a policy package between Security Management servers

RemoteUser — Tue, 25 Feb 2025 17:58:49 GMT

I don't think I understand correctly
Once I do the download what should I do?

(it is recommended to run the command below from within /var/log directory) I don't have access to management in ssh or anything.
How can I do that?

Thank u Andy

Re: How to migrate a policy package between Security Management servers

the_rock — Tue, 25 Feb 2025 18:01:18 GMT

Here is how I did it last time.

1) Followed below to export customer's config and then import in my lab:

https://support.checkpoint.com/results/sk/sk135172

2) Then, I downloaded script from S1C I showed in my screenshot

3) Ran it in the lab and when file was generated, got the file from the lab and imported in S1C

Hope that helps.

Andy

Re: How to migrate a policy package between Security Management servers

G_W_Albrecht — Wed, 26 Feb 2025 08:36:17 GMT

You did not export it from Smart-1 Cloud Management - i think you talk about exporting from On-Prem SMS then upload it to SMart-1 Cloud, and that is not the question here !

Re: How to migrate a policy package between Security Management servers

G_W_Albrecht — Wed, 26 Feb 2025 08:35:27 GMT

You can not - it is not possible to export from Smart-1 Cloud Management and import it in On-Prem SMS. You could open a SR# with CP TAC to check if it is possible with their help, but i fear it is not...

Re: How to migrate a policy package between Security Management servers

RemoteUser — Wed, 26 Feb 2025 08:41:20 GMT

That’s what I was afraid of because, in the SK mentioned by Andy, I have no way to access Management.
My question was is it possible to export Management S1C to a lab environment?

Re: How to migrate a policy package between Security Management servers

G_W_Albrecht — Wed, 26 Feb 2025 08:44:35 GMT

No, this is not possible, as i wrote above - You could open a SR# with CP TAC to check if it is possible with their help, but i fear it is not...

Andy got it the other way round, how to export from Lab and import in Smart-1 Cloud...

Re: How to migrate a policy package between Security Management servers

RemoteUser — Wed, 26 Feb 2025 08:47:15 GMT

I understood thank you

Re: How to migrate a policy package between Security Management servers

the_rock — Wed, 26 Feb 2025 12:02:44 GMT

Ah yes, sorry, you are absolutely right, I misunderstood.

Re: How to migrate a policy package between Security Management servers

the_rock — Wed, 26 Feb 2025 12:05:02 GMT

@G_W_Albrecht is right, you can contact TAC aboit it, since there is no regular ssh access available to customers in S1C. Sorry, when I read your post, I understood you were doing regular mgmt/lab to S1C, not the other way around. If you ask them to get you upgrade export .tgz file, then thats literally all you would need.

Andy

Re: How to migrate a policy package between Security Management servers

PhoneBoy — Wed, 26 Feb 2025 18:13:32 GMT

Just to clarify, you're trying to migrate a policy defined in Smart-1 Cloud to on-premise management for lab purposes?
Yes, the aforementioned script should work for this purpose as the APIs are the same.