Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
WarpTeam
Participant

python import_export_package.py

Hello,

I need to export a policy package from one SMS and import into another with several policies already in place so I´m trying to use the python API import_export_package.py. The problem is that when exporting finishes at least the Network objects, services and time objects are not exported. Initially I thought it was not being imported correctly but then I realised these objects are not on the exported files. The rules are exported and imported correctly. 

I´m using python version  3.11.8 and SMS is n R81.10.

Can anyone give me some ideas about this?

Thank you.

Nuno

0 Kudos
19 Replies
the_rock
Legend
Legend

0 Kudos
WarpTeam
Participant

Hi Andy,

yes it was. Worked fine for the rules but not for the rest.

the_rock
Legend
Legend

If you send me the exact process you followed, happy to try it in the lab.

Best,

Andy

0 Kudos
the_rock
Legend
Legend

As a matter of fact, let me test it now. I will build brand new mgmt in eve-ng on R81.20 and let you know what happens.

Andy

0 Kudos
WarpTeam
Participant

OK. Let me know.

Thank you.

Nuno

the_rock
Legend
Legend

Will do. BUT, just to keep it consistent, as I like to do everything the right way the first time, can you please send the EXACT steps you did, so I can follow the same?

Best,

Andy

0 Kudos
WarpTeam
Participant

Sure, please find attached the copy of the script that I run.

0 Kudos
the_rock
Legend
Legend

I think I will just use built in version 3.9 from $FWDIR/Python dir.

Thank you.

Andy

0 Kudos
the_rock
Legend
Legend

Just working on something else now, but will do it later on, for sure.

Andy

0 Kudos
the_rock
Legend
Legend

My colleague and I are having some challenges doing this from ssh, we even tried running it from $FWDIR/Python/bin dir, but no joy. Your screenshot would indicate you did this from windows PC?

Andy

0 Kudos
WarpTeam
Participant

That´s correct, was done from a win PC.

Nuno.

0 Kudos
the_rock
Legend
Legend

Ok, thats what I thought. Let us see if we can get this going from the actual CP mgmt server, we will try dedicated mgmt and also standalone one.

Best,

Andy

0 Kudos
the_rock
Legend
Legend

K, was able to replicate it, exact same issue as you on R81.10. I tested it on R81.20, jumbo 45.

Best,

Andy

0 Kudos
WarpTeam
Participant

Hello Andy,

so is there a way to fix this? Did it worked with other versions in the past?

this would be a great solution to import a policy package from one SMS to another one with several policy packages already in place. Migrate_server export and import is not feasible here as it would rewrite contents in destination and doing this manually will consume a lot of hours.

Thank you.

Nuno

 

0 Kudos
the_rock
Legend
Legend

Agree. Migrate server imports everything. Not sure about older versions, never tried. Might be worth TAC case.

Andy

0 Kudos
mscott5002
Explorer

Hi Nuno.

I'd like to get involved in this test.  Is there a specific version/package of Python you installed on your Win PC?  I'd like to minimize the differences in our environments for my testing.

Thanks, Mike

0 Kudos
WarpTeam
Participant

Hello Mike,

sorry for the late reply. I ended up by using the python tool directly on checkpoint instead of the windows PC.

(https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-....

It works but around 10 to 15% of the objects are not exported/imported.

Thank you.

Regards,

Nuno

0 Kudos
Hugo_vd_Kooij
Advisor

How about this disclaimer?

In the case you are exporting a policy package from a CMA, please verify that a global policy was NOT assigned to that CMA. The tool doesn't support exporting a policy with global policy assigned!

No one mentioned that one in this thread yet.

<< We make miracles happen while you wait. The impossible jobs take just a wee bit longer. >>
0 Kudos
WarpTeam
Participant

Hi,

actually it was the other way around, the policy was exported from an SMS (full HA) to a CMA.

The checkpoint gateway objects are not exported so we created the objects on the destination before the import but even so the rules with "install on specific gateways" instead of policy targets were not imported and we had to created them manually as well as the NAT rules. I was lucky since most of the rules was set to be installed on the policy targets otherwise I would have to change this setting on all the rules.

Seems this is a point to be improved on the tool.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events