Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Shay_Levin
Admin
Admin

New -Easy Migration from Azure Firewall to Check Point

Hi All, 

I’m happy to share a small PowerShell script that will save you a ton of time when you decide to switch from Azure Firewall to Check Point CloudGuard Network Security.

The script will export your firewall policies on Azure, including all of its objects, to multiple CSV files.

Then, import the CSV files to your Check Point management machine.

At the end of the process, you will get all the objects and policies created on the Check Point management machine.

Depending on your policy size on Azure, the entire process, end to end, should not take more than 10 minutes.

The PowerShell script is attached to the end of the post.

Here is a quick how-to guide (At the end of this guide, you will also find a tutorial video)

On the Azure Firewall, I have a firewall policy with five collection groups.

Each collection group consists of one or more rule sets (network rule collection and Application Rule collection)

collection groups.jpg

 

2.png

 

 

When you run the PowerShell script, run it against all the collection groups at once.

First, download the attached zip file, and export its content to a temp directory.

Open the PowerShell script in  Notepad++  and replace the values in rows 2, 3, and 4

The $fpname value should be replaced with the policy name.

The $fprg value should be replaced with the policy resource group.

The $fprcgname should be replaced with the collection group names.

coll.jpg

Shay_Levin_5-1704380597101.png

Shay_Levin_6-1704380597103.png

Set your Check Point management username and password on rows 6 & 7.

use.jpg

Create a folder C:\temp\export

Save the file fwexport.txt to the new Folder, and ensure the extension is ps1.

Shay_Levin_7-1704380597104.png

Open PowerShell and log in to your Azure Tenet ( Connect-AzAccount –Tenant ‘tenant-id’ )

Shay_Levin_8-1704380597105.png

Shay_Levin_9-1704380597106.png

Switch the directory to C:\temp\export

Shay_Levin_10-1704380597106.png

Run the PowerShell script

The script will export the policy and create a tar file with multiple CSV files that include all the required objects. (Be patient; it might take a few minutes ….)

Shay_Levin_11-1704380597107.png

export.jpg

Two files will be created, *.tar & *.sh

files.jpg

 

Copy the two files to the home folder of the Check Point management machine.

 

 

Copy the two files to the home folder on the Check Point management.

mng.jpg

 

 

 

 

 

 

 

 

 

Open SSH to the Check Point management machine ( switch to expert mode ) and run the command:  bash import_rules.sh

bas.jpg

 

 

The script will extract the tar file and import each one of the CSV files.

imp.jpg

** If you prefer to import each file manually, you can extract the tar file and run the command below in the following order:

mgmt_cli add host --batch hosts-migrate.csv

mgmt_cli add network --batch subnets-migrate.csv

mgmt_cli add address-range --batch ipranges-migrate.csv

mgmt_cli add dns-domain --batch fqdn-migrate.csv

mgmt_cli add group --batch ipgroups-migrate.csv

mgmt_cli add access-layer --batch layernames-migrate.csv

mgmt_cli set host --batch hosts-with-groups-migrate.csv

mgmt_cli set network --batch subnets-with-groups-migrate.csv

mgmt_cli set address-range --batch ipranges-with-groups-migrate.csv

mgmt_cli add service-tcp --batch services-tcp-migrate.csv

mgmt_cli add service-udp --batch services-udp-migrate.csv

mgmt_cli add access-rule --batch all_rules-transformed.csv

Shay_Levin_15-1704380597113.png

Shay_Levin_16-1704380597114.png

Once all the CSV files have been imported, Open SmartConsole and open Policies & Layers with ‘Ctrl+o’

Click on the Layers tab, and you will see on the right pane the two new layers that have been imported (test1 and appcollection1)

Shay_Levin_17-1704380597115.png

Right-click on each layer and open it in a new tab.

Shay_Levin_18-1704380597117.png

Now, you can use this layer or just copy multiple rules from one layer to a different policy or different layer.

3.png

Limitations:

Feel free to edit the script and adjust this list per your needs.

1. On Azure Policy, The Destination Type: ‘Service Tag’  in the Network Rule   Collection   will not be translated; in this case, the destination in the Check Point policy will be ‘none’

  1. On Azure Policy, Destination Type: ‘FQDN Tag’  and ‘Web Categories’ in the Application Rule Collection will not be translated; in this case, the destination in the Check Point policy will be ‘none.’
  2. On Azure Policy, DNAT Rules – Export is not supported at this stage.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(5)
15 Replies
jmaresky
Employee Alumnus
Employee Alumnus

Great work @Shay_Levin !

 

"I’m happy to share a small PowerShell script that will save you a ton of time when you decide to switch from Azure Firewall to Check Point CloudGuard Network Security."

the_rock
Legend
Legend

@Shay_Levin Just curious, is this officially supported by TAC in case process does not work as expected?

Best,

Andy

(1)
Shay_Levin
Admin
Admin

Hi,

TAC does not support it, but anyone with an issue can post here or message me directly.

(1)
the_rock
Legend
Legend

Great, thats fair, thanks very much.

Best,

Andy

0 Kudos
the_rock
Legend
Legend

Another quick question, sorry...does the script support importing ALL kinds of rules or ONLY security rules?

Any idea?

Andy

Shay_Levin
Admin
Admin

Security rules and application rules are supported.

The above two are heavy-lifting; the DNAT Rules, Threat Intelligence, and IDPS will not require much time to convert manually if needed.

the_rock
Legend
Legend

Got it, thanks a lot. Sorry for all my questions.

Best,

Andy

0 Kudos
Wil_S
Contributor

Great Work !!! Amazing Post 😎

(1)
Nandhakumar_N
Participant

Hi @Shay_Levin 

We are planning to migrate from Azure firewall to Check Point NVA? As part of that, can you please help me pre-requisites for running this script.

We have Check Point MDS running in R81 version with 51 CMA.

 

Is this supported in MDS environment with R81 version? If so, what are the pre-requisites, such as do we need to explicitly enable any feature or option something like that?

Do we need to run this script from MDS context or specific CMA, so that it will create policies on that CMA?

 

 

0 Kudos
Shay_Levin
Admin
Admin

Hi @Nandhakumar_N 

R81 is supported.

For the import, you will need to do the following process :

Export the tar file.

mgmt_cli login user admin password your-password domain "Domain-Name" > id.txt

mgmt_cli add host --batch hosts-migrate.csv -s id.txt

mgmt_cli add network --batch subnets-migrate.csv -s id.txt

mgmt_cli add address-range --batch ipranges-migrate.csv -s id.txt

mgmt_cli add dns-domain --batch fqdns-migrate.csv -s id.txt

mgmt_cli add group --batch ipgroups-migrate.csv -s id.txt

mgmt_cli add access-layer --batch layernames-migrate.csv -s id.txt

mgmt_cli set host --batch hosts-with-groups-migrate.csv -s id.txt

mgmt_cli set network --batch subnets-with-groups-migrate.csv -s id.txt

mgmt_cli set address-range --batch ipranges-with-groups-migrate.csv -s id.txt

mgmt_cli add service-tcp --batch services-tcp-migrate.csv -s id.txt

mgmt_cli add service-udp --batch services-udp-migrate.csv -s id.txt

mgmt_cli add access-rule --batch all_rules-transformed.csv -s id.txt

mgmt_cli publish -s id.txt

Ensure you execute it in the precise sequence provided

*** Per a request of one of our enterprise customers, I have updated the script to support the export of multiple collection groups at once and also migrate the service.

I will update the post by the end of the day tomorrow with the new PowerShell script and its instructions.

If you want to wait another week, I will also add support for importing all the objects to the MDS without running the mgmt_cli against each one of the CSV files.

 

 

0 Kudos
Nandhakumar_N
Participant

Hi @Shay_Levin 

Can we have 5 to 10 minutes call when you free next week? so I can show you and clarify my doubts. We are planning to move out from Azure firewall to Check Point NVA in all regions. Hence, this script will be more helpful for us. As we have multiple Rule Collection Groups (RCG) and multiple rule collection in each RCG.

Please reach out me through my mail id or share your email id whichever is okay for you, so I can contact you.

0 Kudos
rasmuswiegman
Participant

Hey Shay,

Great work 🙂

I might be missing the info, but is this supported for MDS by now?

Thanks for the great work.

Rasmus

0 Kudos
Shay_Levin
Admin
Admin

Hi, 

Import into MDS is supported but you would not be able to do it with the bash script but import each one of the CSV files manually, 

Check my reply above to Nandhakumar_N

0 Kudos
Nandhakumar_N
Participant

This script works in fantastic way and we have successfully completed our migration. This script saves our huge manual efforts and complete migration in timely manner.

I can confirm, it works fine in MDS environment.  Thanks @Shay_Levin for your help with this 🙂

(1)
Shay_Levin
Admin
Admin

Thank you for the feedback 🙂

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.