Error with Import/Export script.

[khodgson_bts]

While trying to import a policy package using the Import/Export python script, it gets as far as adding the access sections and then the script just dies.

Imported 275 out of 275 access-rules (100%)

Adding access-sections

Imported 20 out of 55 access-sections (36%)

Imported 40 out of 55 access-sections (72%)

Traceback (most recent call last):
File "import_export_package.py", line 71, in <module>
import_package(client, args)
File "/root/ExportImportPolicyPackage/importing/import_package.py", line 56, in import_package
layers_to_attach = import_objects(args.file, client, {}, package, None, args)
File "/root/ExportImportPolicyPackage/importing/import_objects.py", line 208, in import_objects
import_objects(rulebase_object_file.name, client, changed_layer_names, package, layer_name, args)
File "/root/ExportImportPolicyPackage/importing/import_objects.py", line 196, in import_objects
counter, position_decrement_due_to_rules = add_object(line, counter, position_decrement_due_to_rules,
File "/root/ExportImportPolicyPackage/importing/import_objects.py", line 617, in add_object
return add_object(line, counter, position_decrement_due_to_rule, position_decrement_due_to_section, fields,
File "/root/ExportImportPolicyPackage/importing/import_objects.py", line 617, in add_object
return add_object(line, counter, position_decrement_due_to_rule, position_decrement_due_to_section, fields,
File "/root/ExportImportPolicyPackage/importing/import_objects.py", line 617, in add_object
return add_object(line, counter, position_decrement_due_to_rule, position_decrement_due_to_section, fields,
[Previous line repeated 976 more times]
File "/root/ExportImportPolicyPackage/importing/import_objects.py", line 511, in add_object
if not api_reply.success and "name" in payload and "More than one object" in reply_err_msg:
TypeError: argument of type 'RecursionError' is not iterable

I'm also seeing a lot of the following errors:

Failed to import access-rule with name [SSH/SFTP/RDP Tectrade - TSM]. Error: code: generic_err_object_not_found
message: Requested object [import_error_due_to_missing_fields_import_error_due_to_missing_fields_import_error_due_to_missing_fields_import_error_due_to_missing_fields_MS-TeamServices] not found

Also failed to generate placeholder object: code: err_validation_failed
message: Validation failed with 1 warning and 1 blocking-error
warnings:
- message: The port is already used by another service.
blocking-errors:
- message: Object name can not exceed 100 characters

Any ideas on how to overcome this?

[_Val_]

Can you identify an object on which it fails?

[khodgson_bts]

No not really. It seems to be all of them.

[_Val_]

Please open a support case for this via https://help.checkpoint.com

[khodgson_bts · Accepted solution]

On the advice of a colleague, I used the "--skip-import-sections" flag and that seems to have resolved the issue.

[_Val_]

Interesting. Good to know it works for you now.

[EJ1]

How did you input the --skip-import-sections flags?  First time I am using the script and I am not too familiar with python. but I am getting the same errors in the original post. 

python3 import_export_package.py  

Error message 

Adding access-sections

Traceback (most recent call last):
File "import_export_package.py", line 75, in <module>
import_package(client, args)
File "/home/admin/ExportImportPolicyPackage-master/importing/import_package.py ", line 56, in import_package
layers_to_attach = import_objects(args.file, client, {}, package, None, args )
File "/home/admin/ExportImportPolicyPackage-master/importing/import_objects.py ", line 208, in import_objects
import_objects(rulebase_object_file.name, client, changed_layer_names, packa ge, layer_name, args)
File "/home/admin/ExportImportPolicyPackage-master/importing/import_objects.py ", line 199, in import_objects
changed_layer_names, api_call, num_objects, client, args, package)
File "/home/admin/ExportImportPolicyPackage-master/importing/import_objects.py ", line 620, in add_object
changed_layer_names, api_call, num_objects, client, args, package)
File "/home/admin/ExportImportPolicyPackage-master/importing/import_objects.py ", line 620, in add_object
changed_layer_names, api_call, num_objects, client, args, package)
File "/home/admin/ExportImportPolicyPackage-master/importing/import_objects.py ", line 620, in add_object
changed_layer_names, api_call, num_objects, client, args, package)
[Previous line repeated 976 more times]
File "/home/admin/ExportImportPolicyPackage-master/importing/import_objects.py ", line 511, in add_object
if not api_reply.success and "name" in payload and "More than one object" in reply_err_msg:
TypeError: argument of type 'RecursionError' is not iterable

[khodgson_bts]

Hi.

You literally just add --skip-import-sections to the end of the command.

[iesnoz]

Hi

Thanks for the tip. In my case didn't work, I applied "python3 import_export_package.py -f /home/scpuser/export.tar.gz -n Standard2 --skip-duplicate-objects true --skip-import-sections true" and result was the same, but the errors didn't appear in the log. These are the last lines:

Imported 37 out of 37 access-rules (100%)

Failed to publish import of access-rules from tar file #1.3700000000000001! Access-rules from said file were not imported!. Error: code: err_publish_failed
message: Publish failed because of validation errors
errors:
- message: ICPM doesn't support accounting logs in Rule.

- message: ICPM doesn't support accounting logs in Rule.

Skip import access-section

Attaching layers to package

[PhoneBoy]

Sounds like you should disable Accounting in the relevant rule before running the script.
Then you can change it back after importing.

[iesnoz]

Hi

Thanks for the tip, I already had disabled the accounting in all the rules, but error appeared anyway. I opened a case and support sent me the link to this SK:

https://support.checkpoint.com/results/sk/sk182892

It's necessary not only to disable accounting on ICMP rules, but also to disable icmp-proto. With this SK my problem was solved.

Thanks!