topic Re: How to migrate Juniper configuration to Check Point R80 Management Server database? in SmartMove

How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Sun, 19 Nov 2017 09:34:49 GMT

How to migrate Juniper JunoOS / ScreenOS configuration to Check Point R80 Management Server database?

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Sun, 19 Nov 2017 09:41:07 GMT

Check Point SmartMove tool enables you to convert 3rd party database with firewall security policy and NAT to Check Point database.

At the moment, the tool parses Cisco ASA, Juniper JunosOS and ScreenOS configurations and converts its objects, NAT and firewall policy to a Check Point R80.10 compliant policy. The tool is planned to support additional vendors and security configurations in the future.

The tool generates bash scripts by utilizing Check Point Management API's command line interface, to migrate the converted policy into a R80.10 Management (or Multi-Domain) server.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Sun, 19 Nov 2017 09:47:43 GMT

Currently, the following Juniper configurations can be migrated:

Supported Gateway	Supported OS
Juniper SRX Series	JunosOS version 12.1 and above
Juniper SSG Series	ScreenOS version 6.3 (R19B/R22) and above

Enjoy.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Ronen_Zel — Mon, 27 Nov 2017 12:12:43 GMT

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Moe_89 — Sat, 05 May 2018 06:35:18 GMT

Hi,

The tool works great and has saved a lot of time for us. I just wanted to know since DIP configuration is not converted by smartmove. What NAT configuration will be appropriate to manually do this in Checkpoint?

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Sat, 05 May 2018 07:06:10 GMT

Hi,

I'll check this with our security experts and get back to you.

Robert.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Mon, 07 May 2018 13:08:40 GMT

Hi,

In the case of interface with dynamic IP configuration, which is not supported by the tool, you need to perform a pre-migration task - Replace DAIP interfaces with static IP addresses.

Later, post-migration, you can manually modify the generated NAT rules.

This is also mentioned in the accompanied SK -

Robert.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Moe_89 — Mon, 07 May 2018 13:20:17 GMT

Thanks for the reply. I did have to create the NAT rules manually after migration. But if there was DIP NAT in juniper, do I have to create an ip pool NAT in Checkpoint.

Basically a comparison of NAT methods in juniper and their equivalent in checkpoint would be really helpful.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Mon, 07 May 2018 13:52:57 GMT

IP pool NAT can be an option, but I'll give you an authorized answer from our NAT team members tomorrow.

Regarding the NAT comparison, please take a look at this -

https://www.51sec.org/2015/07/checkpoint-nat-concepts-and-server-side-nat-explanation/

Robert.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Wed, 09 May 2018 13:57:59 GMT

Hi,

I've checked with our NAT experts, and they suggest using dynamic objects as a source/destination in your NAT rule.

Then, go to your gateway and run "dynamic_objects" command to configure the IP addresses.

Robert.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Moe_89 — Sun, 13 May 2018 13:24:11 GMT

Thanks for the update Robert.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Sun, 13 May 2018 13:27:27 GMT

No problem. Does it make sense for your configuration?

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Moe_89 — Mon, 14 May 2018 09:16:39 GMT

It does make sense. But I have noticed in the current juniper configuration that although DIP is configured it just has one one IP in the pool.

Eg. set interface ethernet1/1 ext ip 10.10.xx.xx 255.255.255.224 dip 9 192.168.1.1 192.168.1.1

In this case i dont have to use Dynamic Object in NAT rule but just a manual Hide NAT Rule.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Mon, 14 May 2018 09:28:34 GMT

yes, you are correct.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

yoram_baruchian — Sun, 24 Jun 2018 20:47:48 GMT

i am trying to migrate from juniper cluster of 2 srx 650 ver 12.1x46-d35 .

i export the configuration with: show configuration | display xml | no-more

when i run the utility i get this error:

Could not parse configuration file.

Message:Data at the root level is invalid line 11640 position 1

Module: System.Xml

Class:XmlTextReaderlmpl

Methode:Throw

any help will be appreciate

Thanks

Yoram

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Sun, 24 Jun 2018 20:58:03 GMT

Hi,

It seems that the XML file is invalid.

Try to open it in Internet Explorer or any other XML viewer/editor.

Robert.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

yoram_baruchian — Tue, 26 Jun 2018 18:37:46 GMT

thanks for your help

it was a problem with the xml file

now it work fine except of the nat translation

will try to fiure out way

thanks

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Decker — Tue, 26 Jun 2018 19:03:21 GMT

If you can explain what doesn't work with NAT, I'll try to assist.

robert.

Re: How to migrate Juniper configuration to Check Point R80 Management Server database?

Robert_Canis — Mon, 28 Dec 2020 18:07:30 GMT

I'm getting the same error. What exactly was the issue? I"ve never seen the xml file before so I don't know how to fix this error.