Huawei Firewall to Check Point MIgration Script

[israelfds95]

Hi CheckMates,

I recently migrated a Huawei firewall cluster to a Check Point 9700 cluster, with the security policy going into an MDS domain. Based on a similar script I had built for a Forcepoint migration, I created a Python script that reads the Huawei .cfg file and converts it into Check Point formats, because smartmove dont convert this types. It converted more than 120 rules and all network and service objects accurately, which sped up the migration a lot. I only needed to review the result. I expect that helps someone in future: 

What it generates

• CSV files for mgmt_cli: hosts, networks, ranges, DNS domains, groups, services, service groups and access rules
• nat-rules.txt: NAT rules in SmartConsole CLI format
• gaia_clish_preconfig.txt: Gaia clish draft (hostname, DNS, NTP, SNMP, interfaces, bonds, proxy ARP, static routes), to apply manually on the gateway via serial or SSH
• import_commands.txt: the mgmt_cli commands in the correct order, for SMS and MDS
• pending_review.txt: items that need manual review

How to use

1. Run python huawei_to_checkpoint.py (Python 3.6+, no external libraries). Use --help for full instructions.
2. Copy the files with WinSCP to the SMS, or to the MDS itself for a domain.
3. In Expert mode, inside the files folder, run the commands from import_commands.txt:
   
   # SMS
mgmt_cli add host --ignore-errors true -b host.csv

# MDS domain
mgmt_cli -r true add host --ignore-errors true -b host.csv -d <DOMAIN-IP>

4. Paste nat-rules.txt in SmartConsole > Scripting and publish. On MDS, use the domain's policy package name.

Notes

• Rules marked [REVIEW] are imported disabled for checking.
• Move the default Cleanup rule to the end of the layer after the import.
• VPN, TACACS, admin users and ClusterXL must be configured manually.
• Test in a lab first and review everything before installing on production.

Best Regards



Example of generated files: 

[PhoneBoy]

Nicely done!