Streamlining Local to Global Object Transition in Multi Domain Management

[Vincent_Bacher]

Hello CheckMates Community,

I am reaching out to seek advice and share a challenge we are facing with our Check Point Multi Domain Management setup. We have a large number of CMAs, and over time, due to various administrators working independently, we have accumulated a significant number of local objects. Many of these local objects, such as a network like 10.10.10.0/24, exist across multiple CMAs, sometimes with different names, instead of using the global objects. This redundancy likely contributes to unnecessary database inflation.

We are looking for a way to streamline this by replacing local objects with their corresponding global objects wherever possible. Initially, we aim to identify and replace all local objects that have existing global counterparts. As a next step, it would be beneficial to analyze objects that exist across multiple CMAs but do not yet have a global equivalent, and potentially create global objects for these, replacing the local ones.

Has anyone in the community tackled this task before? Additionally, has anyone developed or used API-based solutions to automate this process? Any insights, experiences, or recommendations would be greatly appreciated.

If this hasn't been done before, I will consider planning to start exploring solutions using artificial intelligence and see how far I can get with it and how successful it might be. 🙂

Thank you in advance for your help!

Best regards,
Vince

[Henrik_Noerr1]

We went the opposite way - scraping off all global assignments from local domains.

I have only seen pain when global objects are used in local policies. If you are able to enforce that global objects are only used in the global policy - fine... If not it will cause pain when having to migrate a domain or generally upgrading. Global policies come with the added pain of remembering to update the IPS policy when upgrading, or it will fail.

/Henrik

[Vincent_Bacher]

Interesting. We did not face any issues like that when upgrading. Last week our management was upgraded to R82 and no issues as well.