topic Re: Migrate configurations from cisco router to Checkpoint in Spark Firewall (SMB)

Migrate configurations from cisco router to Checkpoint

Renis_Parruca — Thu, 02 Apr 2026 15:17:55 GMT

Hello,

Can anyone help me how to migrate cisco router configurations to Checkpoint Spark 1595.

Re: Migrate configurations from cisco router to Checkpoint

simonemantovani — Thu, 02 Apr 2026 16:03:03 GMT

Hello

could you provide any further information like network diagram, router configuration, access list, etc?

Re: Migrate configurations from cisco router to Checkpoint

Renis_Parruca — Sun, 19 Apr 2026 13:11:08 GMT

Hello Simone,

I'm uploading only the parts of neccesary from the cisco. So the Interfaces, IP addresses,access lists,BGP and IPSEC.The topology from the ISP is like this.They send us to private IP addresses that are used for BGP Session. Upon the BGP is Established I have internet form the public IP that is on the loopback. Then the IPSEC is UP. If you can show me which is the configuration in chekcpoint spark 1595 I will be very grateful. Because we want to switch from cisco router to checkpoint firewall.

Best regards,

Renis

Re: Migrate configurations from cisco router to Checkpoint

the_rock — Thu, 02 Apr 2026 19:34:38 GMT

I had done this with smartmove tool before, though dont believe that would work for smb, unless its centrally managed.

Re: Migrate configurations from cisco router to Checkpoint

simonemantovani — Fri, 03 Apr 2026 06:51:23 GMT

Hello

if I interpreted the configuration correctly, the check point interface would be:

WAN - 172.16.18.78/30
PORT5 - 172.16.18.82/30
PORT1 - TRUNK
PORT1.600 - 192.168.1.1/24
PORT1.700 - 10.20.32.1/24

Am I right? The SMB will locally manged or centrally managed (using a Security Management Server)?

Re: Migrate configurations from cisco router to Checkpoint

Renis_Parruca — Fri, 03 Apr 2026 19:17:46 GMT

Hi Simone,

I have configured WAN-- 172.16.18.78/30 , PORT1.700 - 10.20.32.1/24, and Loopback=79.106.169.137. The wan interface is without static route because in the cisco is configured a BGP with this private addresses 172.16.18.78/30 and 172.16.18.82/30. And the Public IP is advertised after the BGP is established. So the IPSEC knows the public IP. This is what I have undestood from the cisco configurations. The SMB will locally manged or centrally managed (using a Security Management Server)? For the moment I want to configure it locally after the tests with be managed with smart-cloud.

Thanks

Re: Migrate configurations from cisco router to Checkpoint

Renis_Parruca — Fri, 03 Apr 2026 19:18:33 GMT

I have seen the smartmove but is for cisco ASA and firewalls not for routers like my case

Re: Migrate configurations from cisco router to Checkpoint

simonemantovani — Tue, 07 Apr 2026 09:43:30 GMT

Hello

ok,looking at the configuration about the IPSec VPN, this tunnel will be established from your SMB to the remote peer 79.106.64.18, is it right? If yes, the BGP peer will perform a NAT for your SMB to be reachable from Internet to establish VPN, and it will advertise the default route to the SMB. Am I right?

Re: Migrate configurations from cisco router to Checkpoint

Renis_Parruca — Tue, 07 Apr 2026 10:06:52 GMT

this tunnel will be established from your SMB to the remote peer 79.106.64.18, is it right? YES the remote PEER is 79.106.64.18.Yes the BGP will perform NAT to the public IP: 79.106.169.137 and based on this IP the IPSEC VPN will be established.

Re: Migrate configurations from cisco router to Checkpoint

the_rock — Tue, 07 Apr 2026 11:26:53 GMT

Ah, okay...never tested it with Cisco router though, but definitely worked with ASA.