python import_export_package.py

[WarpTeam]

Hello,

I need to export a policy package from one SMS and import into another with several policies already in place so I´m trying to use the python API import_export_package.py. The problem is that when exporting finishes at least the Network objects, services and time objects are not exported. Initially I thought it was not being imported correctly but then I realised these objects are not on the exported files. The rules are exported and imported correctly. 

I´m using python version  3.11.8 and SMS is n R81.10.

Can anyone give me some ideas about this?

Thank you.

Nuno

[the_rock]

Is this what you used?

Best,

Andy

https://github.com/CheckPointSW/ExportImportPolicyPackage

[WarpTeam]

Hi Andy,

yes it was. Worked fine for the rules but not for the rest.

[the_rock]

If you send me the exact process you followed, happy to try it in the lab.

Best,

Andy

[the_rock]

As a matter of fact, let me test it now. I will build brand new mgmt in eve-ng on R81.20 and let you know what happens.

Andy

[WarpTeam]

OK. Let me know.

Thank you.

Nuno

[the_rock]

Will do. BUT, just to keep it consistent, as I like to do everything the right way the first time, can you please send the EXACT steps you did, so I can follow the same?

Best,

Andy

[WarpTeam]

Sure, please find attached the copy of the script that I run.

[the_rock]

I think I will just use built in version 3.9 from $FWDIR/Python dir.

Thank you.

Andy

[the_rock]

Just working on something else now, but will do it later on, for sure.

Andy

[the_rock]

My colleague and I are having some challenges doing this from ssh, we even tried running it from $FWDIR/Python/bin dir, but no joy. Your screenshot would indicate you did this from windows PC?

Andy

[WarpTeam]

That´s correct, was done from a win PC.

Nuno.

[the_rock]

Ok, thats what I thought. Let us see if we can get this going from the actual CP mgmt server, we will try dedicated mgmt and also standalone one.

Best,

Andy

[the_rock]

K, was able to replicate it, exact same issue as you on R81.10. I tested it on R81.20, jumbo 45.

Best,

Andy

[WarpTeam]

Hello Andy,

so is there a way to fix this? Did it worked with other versions in the past?

this would be a great solution to import a policy package from one SMS to another one with several policy packages already in place. Migrate_server export and import is not feasible here as it would rewrite contents in destination and doing this manually will consume a lot of hours.

Thank you.

Nuno

[the_rock]

Agree. Migrate server imports everything. Not sure about older versions, never tried. Might be worth TAC case.

Andy

[mscott5002]

Hi Nuno.

I'd like to get involved in this test.  Is there a specific version/package of Python you installed on your Win PC?  I'd like to minimize the differences in our environments for my testing.

Thanks, Mike

[WarpTeam]

Hello Mike,

sorry for the late reply. I ended up by using the python tool directly on checkpoint instead of the windows PC.

(https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-....

It works but around 10 to 15% of the objects are not exported/imported.

Thank you.

Regards,

Nuno

[Hugo_vd_Kooij]

How about this disclaimer?

In the case you are exporting a policy package from a CMA, please verify that a global policy was NOT assigned to that CMA. The tool doesn't support exporting a policy with global policy assigned!

No one mentioned that one in this thread yet.

[WarpTeam]

Hi,

actually it was the other way around, the policy was exported from an SMS (full HA) to a CMA.

The checkpoint gateway objects are not exported so we created the objects on the destination before the import but even so the rules with "install on specific gateways" instead of policy targets were not imported and we had to created them manually as well as the NAT rules. I was lucky since most of the rules was set to be installed on the policy targets otherwise I would have to change this setting on all the rules.

Seems this is a point to be improved on the tool.