topic Smartmove not optimizing cisco asa policy in SmartMove

Smartmove not optimizing cisco asa policy

idc — Wed, 20 Sep 2023 05:16:56 GMT

We are moving from cisco ASA to checkpoint. We are using checkpoint smartmove tool to convert existing cisco asa configuration to checkpoint. But the smartmove does not optimize the the rules. Kindly see attached pic for more details.

Re: Smartmove not optimizing cisco asa policy

_Val_ — Wed, 20 Sep 2023 06:29:47 GMT

SmartMove is not policy optimization tool, it is a migration tool.

Re: Smartmove not optimizing cisco asa policy

Ofir_Shikolski — Wed, 20 Sep 2023 07:37:06 GMT

SmartMove does optimize the policy 🙂

you can review the comments on the code:

https://raw.githubusercontent.com/CheckPointSW/SmartMove/master/CheckPointObjects/RuleBaseOptimizer.cs

 /// <summary>
    /// Optimizes the security policy rulebase by merging several rules from the same sub-policy into a single rule.
    /// Two rules can be merged into one rule if:
    ///    1. both rules have the same action, and
    ///    2. both rules are enabled or disabled, and
    ///    3. both rules have source and destination columns negated or not, and
    ///    4. both rules have the same time objects, and
    ///    5. either one of the following is true:
    ///       5.1. both the source and destination columns match
    ///       5.2. both the source and service columns match
    ///       5.3. both the destination and service columns match
    /// for CiscoASA and FirePower vendors there is an option to optimize by comments -
    /// two rules can be merged if they have the same comments and in addition they up to the above criteria.
    /// </summary>

you will need to uncheck the optimized by comments in your case .

Re: Smartmove not optimizing cisco asa policy

_Val_ — Wed, 20 Sep 2023 07:42:36 GMT

Oookay, I stand corrected. You can also see that it made 15k rules out of over 28k original records. Let's say, it can consolidate the original policy, but only to some extent.

Re: Smartmove not optimizing cisco asa policy

Ofir_Shikolski — Wed, 20 Sep 2023 07:49:24 GMT

The policy is always optimized for Check Point products.

There are two steps:

Convert the policy.
Optimize the policy - this can result in up to a 70%+ improvement in efficiency compared to the converted policy (The logic is based on Check Point's Smart Optimized utility).

There are scenarios where the converted policy cannot be further optimized.