topic Re: SmartMove for Policy Migration and Smart-1 Cloud Management in Spark Firewall (SMB)

SmartMove for Policy Migration and Smart-1 Cloud Management

Attiq786 — Mon, 14 Jun 2021 04:29:00 GMT

I am using Smart Move to migrate Cisco ASA policy to 1590 appliances. Is there a way to directly import the Output scripts to SMB or do I have to use a Central management(Gaia R80.30 above) Import the converted config (Via scripts) and push policy to SMBs?

My second question is that we are planning to use Smart-1 Cloud for management of multiple SMBs deployed in different sites but client do not want to import all configs instead they want to import one config per site at any given time. My understanding is in smart-1 cloud, if you migrate one DB and later on you migrate another one from other site, it will overwrite the existing one. is that correct or is there any way i can bring in multiple policy packages in smart-1 cloud later on after initial Migrate Import?

Thanks

Re: SmartMove for Policy Migration and Smart-1 Cloud Management

PhoneBoy — Mon, 14 Jun 2021 04:35:14 GMT

SmartMove is only for regular Check Point management, not for locally managed SMB appliances.
You can definitely import the output of SmartMove into regular Check Point management, which can push policy to the SMB device.

Smart-1 Cloud still does not support managing SMB appliances running R8x code, as far as I know.
This is on the short term roadmap.
In general, you are correct that a "migrate import" from another site after the initial one won't work.
You can either put it into a different Smart-1 Cloud tenant or use something like the python export/import tool to migrate the configuration into Smart-1 Cloud.

Re: SmartMove for Policy Migration and Smart-1 Cloud Management

Attiq786 — Mon, 14 Jun 2021 08:18:39 GMT

@PhoneBoy Thanks a lot for the clarification.

Re: SmartMove for Policy Migration and Smart-1 Cloud Management

Attiq786 — Wed, 16 Jun 2021 10:40:11 GMT

Hi @PhoneBoy

CP has come back with below regarding Smart-1 Cloud - SMB compatibility.

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Check-Point-SmartCloud-Admin-Guide/Topics-Smart-1-Cloud/Overview.htm

Supported Versions

Management

R81 is the deployed version

Gateways

R80.10 and above
15XX series, R80.20.05 and above

I have another client with smart-1 cloud and I do not see 1500 appliances in the hardware list as per below.

Can you please confirm? as according to Smart-1 Cloud Admin Guide, SMB with R80.20.05 and above are supported.

Re: SmartMove for Policy Migration and Smart-1 Cloud Management

G_W_Albrecht — Wed, 16 Jun 2021 11:17:10 GMT

Try to Connect a new GW and you will see the SMB instructions:

Re: SmartMove for Policy Migration and Smart-1 Cloud Management

Attiq786 — Wed, 16 Jun 2021 12:36:58 GMT

@G_W_Albrecht Thanks a lot for the explanation.

If we use smart-1 cloud, will I be able to import multiple policy packages later on without using any third party scripts? may be with the help of TAC?

Regards

Attiq

Re: SmartMove for Policy Migration and Smart-1 Cloud Management

PhoneBoy — Wed, 16 Jun 2021 15:28:02 GMT

You can do a first-time import using the standard migration tools.
Unfortunately, that overwrites the configuration.
For additional policy packages, you would likely need to use something like: https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-package-or-parts-of/m-p/41100#M2829
This tool is developed by Check Point R&D and you are welcome to ask questions about it on CheckMates, but it does not necessarily have formal TAC support.
It will also require some manual steps since not every object type has API support, however it will work for the bulk of the policy itself.