Migration from CISCO ASA to Check Point using SmartMove

[Di_Junior]

Dear Mates

One of my clients wishes to migrate from CISCO ASA to Check Point, and I will be working with them in this process.
I have tested smartMove, and the migration in the lab environment worked just fine. However, I noticed that when running the policy scritpt, it created in-line layers in the Access Control Policy.
I would like to know if this is a normal behaviour, or if there is anything that could be done in order to avoid that.
Additionally, I would like to know what are precautions I should be aware of in order to have a successful move.

Thanks in advance

[Benedikt_Weissl]

I've used SmartMove to migrate a customer from Juniper to Check Point and the policy script created the same in-line layers, so that should be normal. Since your customer is currently using an ASA there is likely more cisco equipment present, so check out sk44898.

[Di_Junior]

Hi Benedikt

Thank you.

Just a question, after migrating the rules to Check Point Management Server, assuming you had a Distributed Environment (SMS + SGW) what did you have to do on the Security Gateway side?

Thanks in advance

[Benedikt_Weissl]

You have to do everything on the gateway side if memory serves me right. SmartMove will only migrate the policy. You have to create the interfaces, routing, zones....

We've installed a modified version of the converted policy. Check the policy SmartMove created before installing. Almost every time we migrate from a different vendor to Check Point there is something in the original policy we can optimize.

[Di_Junior]

Additionaly, when pushing the policy for the first time into the security gateways, which policy package did you push: Converted Policy or Converted Optimized Policy?

[FedericoMeiners]

Junior,

Hope you are doing fine, currently we are undertaking a migration of 60 ASA gateways to Check Point using SmartMove. Here are my two cents:

Inline policies is used to emulate in a certain ways the interface approach to create rules from ASA gateways, after importing rules you will probably see that you have certain rules with zones for sources an destination.

Depending on the criticity level of the gateway we use the standar rulebase or the optimized rulebase. For critical systems we use the standar rulebase generated by SmartMove since it's easier to analize over the optimized rulebase. Our experience showed that they both work fine.

One MAJOR drawback on importing an ASA rulebase is that you don't have outgoing ACLs on the showrun, this limitation is noted on the SmartMove SK. Most of the time this will not cause you a traffic outage but it will decrease your rulebase security since you will not have implied drops.

Last but not last, be sure to fix all the shadowed, duplicated or overlapping rules in ASA before importing them to Check Point.

Hope it helps 🙂

___

[Di_Junior]

Thank you very much Frederico

[Di_Junior]

Hi Frederico

On the migrations you have done, did it also migrate the VPN communities?

Thanks in advance

[FedericoMeiners]

Yes, but you will have to do it manually. I guess that you can script it somehow using the mgmt_cli, personally I had a few tunnels so I did not bothered.

It should be somewhat transparent if you have the correct secret and configurations.

[Di_Junior]

Thanks a lot.