Problem Statement
During a project, I needed to migrate a Forcepoint policy database to Check Point. However, SmartMove does not support this type of migration. To solve this, I developed this solution.
Since Forcepoint exports its policies and objects in XML format, I created Python scripts that read the Forcepoint XML files and convert them into CSV files compatible with the Check Point Management API.
To help other members of the community facing the same challenge, I am sharing these scripts along with instructions on how to use them.
How to Use
- Copy the XML files exported from Forcepoint into the same directory as the Python scripts.
- Run the required conversion script.
- Provide the XML file name when prompted with extension.
- Provide a name for CSV file that will be generated.
- Import the generated CSV files using the Check Point Management API.
- The generated CSV files will be created in the same directory as the scripts.
- Import the CSV files into the Security Management Server (SMS), then follow the provided instructions to complete the migration.
The image below shows an example of one of the scripts being executed.
The image below shows an example of the files in the folder: the converted CSV file (which is associated with Sublime Text on my computer), the XML file (which is associated with Microsoft Edge), and the Python (.py) script.
The conversion of policies to CSV can be a bit complex when there are many objects and policies. The image below shows an example of what a converted policy file looks like when following the Check Point Management API format.
Disclaimer
These scripts were developed to simplify Forcepoint-to-Check Point migrations. They are provided as-is and should be validated in a lab or test environment before being used in production.
Note
I chose to convert Forcepoint NAT policies differently by recreating them in the Check Point SmartConsole API format.
For Application Control policies, I decided to recreate them manually in SmartConsole, since the way Forcepoint handles these policies and their associated objects is significantly different from Check Point.
*** Some scripts are included to perform specific corrections on the generated policy CSV files. I tried to give each script a descriptive filename that reflects its purpose, and the scripts also contain comments to make them easier to understand and customize if needed.
