topic Re: SmartMove error - converting ASA to CheckPoint in SmartMove

SmartMove error - converting ASA to CheckPoint

Rambod_Fard — Thu, 23 Nov 2017 21:16:39 GMT

I am trying to convert my ASA config to CheckPoint by SmartMove and receive following error message:

"Object reference not set to an instance of an object"

Does anyone have any suggestion? Thanks,

Re: SmartMove error - converting ASA to CheckPoint

PhoneBoy — Fri, 24 Nov 2017 00:35:50 GMT

Moving this into the Developers (Code Hub)‌ section.

Does it only print that error message or give you any other information that might help?

Re: SmartMove error - converting ASA to CheckPoint

Rambod_Fard — Fri, 24 Nov 2017 01:30:14 GMT

The message includes following information:

Module: CiscoMigration

Class: CiscoConverter

Method: Acl_To_CPRule

Re: SmartMove error - converting ASA to CheckPoint

Robert_Decker — Fri, 24 Nov 2017 14:56:34 GMT

It seems that the code crashes due to unsupported/invalid ACL configuration.

Which version of ASA are you migrating? Which version of tool are you using?

Robert.

Re: SmartMove error - converting ASA to CheckPoint

Rambod_Fard — Fri, 24 Nov 2017 15:27:03 GMT

I believe the reason of error is not ASA version or tool... I have another ASA config file with same version which is converted successfully... There is no major difference between these two ASA... both have objects, interfaces, object-group, ACLs and so on... BTW I use new version of SmartMove (2_1_6520_26222) to convert both ASAs...

Re: SmartMove error - converting ASA to CheckPoint

Robert_Decker — Fri, 24 Nov 2017 22:15:54 GMT

According to your error information, this is due to one of the ACL's settings.

Anyway, I'll fix the suspicious code that probably fails to parse that ACL and reports the error.

Please monitor the download center during next week for a newer version.

Re: SmartMove error - converting ASA to CheckPoint

Robert_Decker — Wed, 29 Nov 2017 15:20:09 GMT

Hi,

A fixed version (SmartMove_2_1_6539_25884.zip) was just uploaded to sk115416.

Please download it and see if it works for you.

Robert.

Re: SmartMove error - converting ASA to CheckPoint

Moe_89 — Sat, 19 May 2018 10:02:25 GMT

Hi Robert,

I am using the latest SmartMove tool and i get below error when converting ASA configuration.

Could not parse configuration file

Message: Object reference not set to an instance of an object

Module: CiscoMigration

Class: Cisco_AccessList

Method: Parse

Re: SmartMove error - converting ASA to CheckPoint

Robert_Decker — Sat, 19 May 2018 17:14:07 GMT

Hi,

It seems that the tool fails to parse one of ACL commands and throws an exception in code.

I cannot tell which of the lines fails to parse without examining your ASA configuration file.

If you are ok to send me your file, I'll ask Dameon to provide you our FTP address.

Please let me know.

Robert.

Re: SmartMove error - converting ASA to CheckPoint

Moe_89 — Sat, 19 May 2018 20:56:48 GMT

Hi Robert,

Sure I can provide you the file. Please PM the ftp details.

Re: SmartMove error - converting ASA to CheckPoint

Robert_Decker — Sun, 20 May 2018 09:25:41 GMT

Dameon Welch Abernathy‌, please provide our ftp details, so he can send me his ASA configuration file.

thanks, robert.

Re: SmartMove error - converting ASA to CheckPoint

PhoneBoy — Sun, 20 May 2018 17:10:03 GMT

Details have been PMed to you.

Re: SmartMove error - converting ASA to CheckPoint

Moe_89 — Mon, 21 May 2018 10:40:41 GMT

Thanks Dameon, I have uploaded the config file Robert Decker‌

Re: SmartMove error - converting ASA to CheckPoint

PhoneBoy — Mon, 21 May 2018 15:50:13 GMT

OK will move it where Robert Decker‌ can retrieve

Re: SmartMove error - converting ASA to CheckPoint

Robert_Decker — Thu, 24 May 2018 08:19:52 GMT

Hi,

I've received and examined your ASA configuration file.

Starting from line 4404 in the file, there are access-list commands, that I've never seen or read in Cisco ASA docs that the tool supports.

For example -

access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)

access-list 101; 1 elements; name hash: 0xe7d586b5

Or access-list commands having child access-list commands )indented commands).

The tool didn't recognize such format and therefore reported parsing failure.

If you remove the content starting from this line, the tool works fine and parses the file.

Just for the curiosity, what kind of configuration such access-list commands represent? Which ASA version?

I saw that on top of your file the ASA version is 8.4(7)...

Robert.

Re: SmartMove error - converting ASA to CheckPoint

Moe_89 — Sun, 27 May 2018 21:02:51 GMT

Hi,

Sorry for the late response. The configuration I provided is from Cisco FWSM apparently, but I was told that the ios image on FWSM is the same as the ASA's.

Re: SmartMove error - converting ASA to CheckPoint

Robert_Decker — Mon, 28 May 2018 12:50:23 GMT

No, they are not the same. SmartMove tool doesn't support Cisco FWSM format.

Robert.

Re: SmartMove error - converting ASA to CheckPoint

Moe_89 — Mon, 28 May 2018 13:00:11 GMT

Thanks. We are planning to migrate the FWSM config to ASA so we can convert it in SmartMove.

Re: SmartMove error - converting ASA to CheckPoint

Moe_89 — Sun, 02 Sep 2018 08:21:56 GMT

Robert Decker‌ FYI. After tweaking the FWSM config file, I was able to convert the configuration using SmartMove. As you mentioned earlier SmartMove does not support FWSM due to which the tool was not recognizing some FWSM commands like "names command" which maps names to IP addresses. I replaced the host names with their corresponding IP addresses after which the tool was able to give an output.

Re: SmartMove error - converting ASA to CheckPoint

Christopher_To — Wed, 13 Nov 2019 16:29:44 GMT

Hi,

I am also trying to convert an ASA to CheckPoint but I am getting this error.

Message: access to path <path> is denied

Module: mscorlib

Class: _Error

Method:WinIOError

Can you assist?

Thank you,

Chris