topic Re: Using SmartMove to convert competitor Cisco configurations has issues in SmartMove

Using SmartMove to convert competitor Cisco configurations has issues

neiren — Mon, 14 Apr 2025 13:47:09 GMT

1. I recently migrated the Cisco firewall configuration of two areas of a customer to cp, and found that after the migration, the ACL policy of the Cisco firewall in one area was much less.

2. I uploaded screenshots of smartmove and some Cisco policies

3. The difference I found so far is that the Cisco configuration that can be successfully converted is the three-layer routing mode, and the one that cannot be converted is the bridging mode

Re: Using SmartMove to convert competitor Cisco configurations has issues

neiren — Mon, 14 Apr 2025 13:52:08 GMT

Re: Using SmartMove to convert competitor Cisco configurations has issues

Chris_Atkinson — Mon, 14 Apr 2025 14:12:08 GMT

There are limitations described in sk115416.

Please submit feedback on this SK if you feel there are additional gaps than mentioned there.

Re: Using SmartMove to convert competitor Cisco configurations has issues

the_rock — Mon, 14 Apr 2025 23:19:04 GMT

I I did this sort of conversion from Cisco ASA to CP 3 times and never had an issue, it was always able to move all the rules, regular policies, as well as NAT.

Andy

Re: Using SmartMove to convert competitor Cisco configurations has issues

neiren — Tue, 15 Apr 2025 02:23:45 GMT

We have done a lot of projects on Cisco migration configuration to check point, and this is the first time we have encountered this situation.

Re: Using SmartMove to convert competitor Cisco configurations has issues

neiren — Tue, 15 Apr 2025 02:25:03 GMT

I don't know the specific cause of the problem? I suspect that it is because the inside and outside interfaces in the Cisco configuration do not have IP addresses, and the BVI is used to share IP addresses.

Re: Using SmartMove to convert competitor Cisco configurations has issues

the_rock — Tue, 15 Apr 2025 03:01:00 GMT

I always followed the video from the sk and no issues. I also converted Cisco to other vendors before and worked okay as well. I always found Cisco is by far the easiest vendor to convert. Mind you, the reason for that is probably because other vendors' formats are way different.

My colleagues and I usually end up doing regex scripting to do say conversion for cp to fgt or fgt to cp or pan to fortigate, seems to work really well, as long as you make sure format matches with whatever vendor you are converting to.

Hope that helps.

Andy