Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
MardoqueoRob
Contributor
Jump to solution

Export Policy name: Standard of the gateway

 

Hello Boys,


Do you know if it is possible to obtain these policies to apply them to other backup equipment in stock?

I can't find information about where it is hosted.

[Expert@GW:0]# cpstat -f policy fw

Product name: Firewall
Policy name: Standard

 

I am looking for this so that I am not restarting the SIC again when a device fails or there is no technical equipment and it will only be changing cables, thank you very much!

0 Kudos
4 Solutions

Accepted Solutions
PhoneBoy
Admin
Admin

Installing policy to a gateway generally requires SIC with management.

The currently installed policy is in $FWDIR/state (in its compiled form).
I'm fairly certain copying this directory from one system to another is NOT supported, especially across different hardware/software versions.

Note in R82, we will have the ability to configure a policy without management.
However, I believe even that requires establishing SIC with management first.

View solution in original post

Lesley
Leader Leader
Leader

So you want a cold spare unit on the shelf?

If the hardware is the same as the unit it will replace you can use gaia snapshot:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_AdminGuide/Content/Topi...

Or backup, this is less complete backup and also needs policy push. 

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_AdminGuide/Content/Topi...

A firewall has way more config then only the policy. Putting only the policy on a box will not make it functional. So in general this is not a good idea. 

-------
If you like this post please give a thumbs up(kudo)! 🙂

View solution in original post

the_rock
Legend
Legend

Another option might be copy bits and pieces from show configuration, since I assume it would be different hardware, so interfaces wont match, but if its the same hardware, then it might be best option.

Andy

View solution in original post

MardoqueoRob
Contributor

If I was referring to that, but I was also not sure if you could import the policy loaded from the firewall to other hardware with the same configurations, it is best to follow the recommendations of snapshots and backup to have the policies loaded on both computers in case one fails.

View solution in original post

0 Kudos
7 Replies
the_rock
Legend
Legend

Just to make sure, are you trying to export one policy and then import it into another management server?

If so, then you need to follow below process.

https://support.checkpoint.com/results/sk/sk135172

Btw, its NOT just boys, lots of ladies here too, all very smart ones 🙂

Best,

Andy

0 Kudos
MardoqueoRob
Contributor

I am referring to the policy loaded in the firewall:
[Expert@GW:0]# cpstat -f policy fw

Product name: Firewall
Policy name: Standard

0 Kudos
the_rock
Legend
Legend

Right, but Im still unclear on what exactly you are trying to do here. Are you tryng to export the policy, so it can be imported into another mgmt server or something totally different?

Andy

PhoneBoy
Admin
Admin

Installing policy to a gateway generally requires SIC with management.

The currently installed policy is in $FWDIR/state (in its compiled form).
I'm fairly certain copying this directory from one system to another is NOT supported, especially across different hardware/software versions.

Note in R82, we will have the ability to configure a policy without management.
However, I believe even that requires establishing SIC with management first.

MardoqueoRob
Contributor

If I was referring to that, but I was also not sure if you could import the policy loaded from the firewall to other hardware with the same configurations, it is best to follow the recommendations of snapshots and backup to have the policies loaded on both computers in case one fails.

0 Kudos
Lesley
Leader Leader
Leader

So you want a cold spare unit on the shelf?

If the hardware is the same as the unit it will replace you can use gaia snapshot:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_AdminGuide/Content/Topi...

Or backup, this is less complete backup and also needs policy push. 

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_AdminGuide/Content/Topi...

A firewall has way more config then only the policy. Putting only the policy on a box will not make it functional. So in general this is not a good idea. 

-------
If you like this post please give a thumbs up(kudo)! 🙂
the_rock
Legend
Legend

Another option might be copy bits and pieces from show configuration, since I assume it would be different hardware, so interfaces wont match, but if its the same hardware, then it might be best option.

Andy

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events