SmartMove - Panorama

[orion_son30]

Hi,

I'm in a middle of a project that consists in migrating a Palo Alto cluster with vsys to Check Point VSX cluster. Regarding the network interfaces and routing it's all set and done, since I'm using the vsx_provisioning_tool to do the work. Regarding the rules, I was trying to use SmartMove, but I'm having a hard time to doing so.

The Palo Alto cluster is managed by a Panorama and the rules for each vsys consists of both shared and template policies. SmartMove is not being able to get the job done on this. I've already tried using an Export Panorama and devices config bundle on Panorama side and also an Export configuration version direct on the Palo Alto devices, but no luck. The first generates an error on the SmartMove. And second just gives an empty output, only with a generic cleanup rule for 2 of the 4 vsys.

Any suggestion or idea on this?

Kind regards,

César Santos

[the_rock]

I always found when it comes to smartmove, its excellent converting from Cisco to CP, never an issue. When it comes to Fortigate and PAN conversion, its a different story. But honestly, most vendors are like that, you wont sadly find a tool that would do everything for you, since formats are totally different.

What my colleagues and I usually do is "dump" the outputs in notepad++ and then convert it according to format accepted by the vendor we are converting to. 

Now, when it comes to Check Point, you cant import .csv file containing all the rules (was possible back in R77 and before, but not since R80 sadly), so I would check if something could be done via API.

https://sc1.checkpoint.com/documents/latest/APIs/

Otherwise, I would contact Professional services to see if they can assist, as TAC would not be able to help with something like this.

Hope that helps.

Andy

[orion_son30]

Hi,

Yup, I've contacted the Professional Services team. Let's see what they say about this.

My alternative approach is to dump the objects and rules from Panorama or directly from the PA cluster to CSV files and then generate the API commands to be able to have the Policy Package for each Virtual System.

Kind Regards,

César Santos

[the_rock]

That approach makes sense to me.

Andy

[the_rock]

I double checked in my labs (both R81.20 and R82) and dont sadly see any options to import any sort of csv files. I really hope that changes in the future, as it would make these things much easier when doing these sorts of conversions. 

Andy

[PhoneBoy]

If you massage a CSV file into the right format, you can use the API to import a CSV file.
See also: https://community.checkpoint.com/t5/API-CLI-Discussion/CLI-API-Example-for-exporting-importing-and-d...