topic Re: Exporting Objects/Groups in R77.30 in General Topics

Exporting Objects/Groups in R77.30

Gaurav_Pandya — Wed, 27 Jun 2018 13:27:42 GMT

Hi,

We are moving objects/groups/Networks from one cluster to new cluster. Version is R77.30. We don't want to do migrate export entire database but only objects. Generally I right click on objects/groups/networks, export it and import to new cluster from Smart dashboard.

It is working very well but for some groups, it is not working. It gives error "cannot be exported because of its dependency on 'ambiguous - 385' which is not exportable ".

Anyone have idea about this why it is not allowing to export.

Regards,

Gaurav Pandya

Re: Exporting Objects/Groups in R77.30

Danny — Wed, 27 Jun 2018 14:50:01 GMT

Confwiz does the job for you. See:

Check Point Support Tools - Top 10

Re: Exporting Objects/Groups in R77.30

Gaurav_Pandya — Wed, 27 Jun 2018 15:12:39 GMT

Hi Danny,

Migration of objects are from checkpoint to checkpoint.

Re: Exporting Objects/Groups in R77.30

PhoneBoy — Wed, 27 Jun 2018 15:33:38 GMT

You can still use Confwiz for this.

Re: Exporting Objects/Groups in R77.30

AlekseiShelepov — Wed, 27 Jun 2018 15:58:49 GMT

You want to migrate all objects, right? Then the easiest option in my opinion is cp_merge command. You can copy objects_5_0.C file from the source management server to the new one, not replace but just put to some folder, use command cp_merge merge_objects and that should be it.

Of course there are some limitations for "advanced" deployments. It will not migrate some objects, for example OPSEC servers. But it works with simple hosts, groups and services.

Although it is said that cp_merge doesn't work with CMAs, I remember that I easily copied objects and policy to a test VM. As I remember, there would be issues if you use cp_merge for migrating policies between CMAs.

Anyway, easier just to try if it works in your case.

Re: Exporting Objects/Groups in R77.30

Gaurav_Pandya — Wed, 27 Jun 2018 16:18:26 GMT

Hi Aleksei,

Yeah it is good idea but problem is there is no requirement to migrate entire database nor entire objects. I want to copy only some big object groups to reduce time and avoid manual efforts.

Re: Exporting Objects/Groups in R77.30

Gaurav_Pandya — Wed, 27 Jun 2018 16:28:01 GMT

Hi Dameon/Danny,

I don't want to migrate entire database. only few objects needs to be import.

Re: Exporting Objects/Groups in R77.30

PhoneBoy — Wed, 27 Jun 2018 16:52:24 GMT

Right, when you do the export, remove the objects from the output file that you don't want to import.

Re: Exporting Objects/Groups in R77.30

Wille010 — Wed, 27 Jun 2018 17:51:00 GMT

What groups are we talking about here?

Network groups, groups with exclusions, service groups?

Maybe you can try to clone the exact same group and see if you can export them.

Re: Exporting Objects/Groups in R77.30

Gaurav_Pandya — Thu, 28 Jun 2018 16:53:06 GMT

It is Network group. I have make cloned and tried to export but no luck.

Re: Exporting Objects/Groups in R77.30

Gaurav_Pandya — Thu, 28 Jun 2018 16:54:04 GMT

Ok Dameon. That is good idea.

Re: Exporting Objects/Groups in R77.30

JozkoMrkvicka — Thu, 06 Jun 2019 22:38:03 GMT

Is there any way how to export and import LDAP groups ? cp_merge nor Ofiller (Odumper) are capable of doing such a thing.

Re: Exporting Objects/Groups in R77.30

ikafka — Fri, 16 Jun 2023 06:50:13 GMT

Does this tool work in standalone r77.30?

Re: Exporting Objects/Groups in R77.30

PhoneBoy — Fri, 16 Jun 2023 21:04:54 GMT

Not sure Confwiz will work on R77.30 as it's not listed in the supported versions of the following SK and the internal notes suggest Confwiz wasn't tested in R77.x: https://support.checkpoint.com/results/sk/sk41719
I suggest odump/ofiller, which is available through the community: https://community.checkpoint.com/t5/Scripts/Odumper-and-Ofiller-Exporting-Importing-R5x-R7x-Config/m-p/51536#M1082

Re: Exporting Objects/Groups in R77.30

Blason_R — Sat, 17 Jun 2023 03:52:40 GMT

I remember I had done similar stuff when I was doing something like this long back and I had taken a similar approach suggested. I copied Objects_5_0.c and then few link tricks and tips I was able to get the IP addresses, networks, ranges out and then with API commands again wrote a shell script and manually created those in new server.

But its easy if you have moderate proficiency in linux.