topic Re: Panorama to CheckPoint in SmartMove

Panorama to CheckPoint

Sann — Mon, 13 Jun 2022 09:29:20 GMT

Hello everyone,

recently I have a customer who wants to use Smart Move to convert Palo Alto's configuration to CheckPoint.

I have obtained the customer's Panorama configuration file (.tgz), and an error occurs when using smart move.

Thank you

Re: Panorama to CheckPoint

Ofir_Shikolski — Mon, 13 Jun 2022 13:25:38 GMT

Hi,

Which version do you use? can you see debug.log file?

Are you using TAP mode?

Re: Panorama to CheckPoint

the_rock — Mon, 13 Jun 2022 13:44:59 GMT

I did this with Cisco 3 times and never had a problem. Not much of PAN guy (though I do know some basic things about it), but if you want to email me the file directly, happy to give it a go.

Re: Panorama to CheckPoint

Sann — Wed, 15 Jun 2022 07:56:12 GMT

The Panorama version I am using is 10.0. The gateway version is 8.1.

I also tried to use the gateway's xml file directly to convert through SmartMove. The conversion did not report any errors, but there was no result output.

Re: Panorama to CheckPoint

Sann — Wed, 15 Jun 2022 07:57:02 GMT

I'm really sorry, because there is customer's network information on the configuration. I can't provide it to you

thank you very much!

Re: Panorama to CheckPoint

Ofir_Shikolski — Wed, 15 Jun 2022 08:07:48 GMT

@Sann ,

Using XML form GW will not work while using Panorama.

Which version of SmartMove do you use? can you see debug.log file?

Are you using TAP interfaces?

Re: Panorama to CheckPoint

Sann — Fri, 17 Jun 2022 02:49:43 GMT

Sorry, can you tell me what the TAP interface is?

Re: Panorama to CheckPoint

the_rock — Fri, 17 Jun 2022 02:52:55 GMT

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/network/network-interfaces/tap-interface

Re: Panorama to CheckPoint

Sann — Fri, 17 Jun 2022 03:02:00 GMT

Hello, there is no TAP interface in the customer's configuration at present. They are all ordinary physical interfaces

Re: Panorama to CheckPoint

Ofir_Shikolski — Fri, 17 Jun 2022 05:10:09 GMT

@the_rock - thanks 🙂

@Sann ,

Thanks , can you extract the files and send me the structure of it? you can email me privately : ofirs@checkpoint.com

I saw cases that export file was incorrect and due to it SmartMove did not able to pare the files.

if there is any way to send me the files, 100% that we will fix it much quicker .

BR,

Ofir S

Re: Panorama to CheckPoint

Ofir_Shikolski — Tue, 28 Jun 2022 08:40:49 GMT

Update-

We worked offline and we found that the (PAN) Panorama outputs format was different, we updated SmartMove to support it.

Re: Panorama to CheckPoint

the_rock — Tue, 28 Jun 2022 12:44:02 GMT

Thanks for sharing a solution to this.

Re: Panorama to CheckPoint

To_B — Tue, 22 Nov 2022 09:57:17 GMT

I assume the corresponding fix is this one: https://github.com/CheckPointSW/SmartMove/commit/58d249452c5ba1dcb109582dc1b9ca5aaa6e4465

Unfortunately this breaks SmartMove for a PaloAlto (8.1) config export where panorama isn't the first device in alphabetical order.

Example contents of a no longer working export file:
devfw01_111111111111.xml
devfw02_222222222222.xml
panorama_333333333333.xml
prodfw02_444444444444.xml
prodfw02_555555555555.xml

Before the code change, every file would be checked for existence of a node "panorama" until there is a match.
After the code change, the first file is assumed do be the panorama config without checking anything.