SmartMove from Juniper with LSYS

[robertp]

Hey,

I am trying to migrate from a Juniper with logical systems to Check Point VSX. I know I can't count on SmartMove to do everything for me, but I would want it to at least help me move the 1000+ policies 🙂 Any idea how to do it? When I exported the whole xml file off the Juniper and put it into SmartMove I only got the policies from the root logical system. Exporting the logical system itself didn't work either. At this point doesn't even matter if it puts everything in one policy, or does separate ones, as long as I get the rules and objects on the SMS. Any advice would be appreciated.

[the_rock]

I will give it a go later in the lab.

[sjni01]

Perfect, I'm looking forward to any updates.

Regards,

SJ

[Vincent_Bacher]

Just played with google.

interesting?

https://fwmig.readthedocs.io/en/latest/srx.html

[the_rock]

Yea, looks interesting Vince.

[the_rock]

Just tried it in the lab, but exact same result.

[Vincent_Bacher]

Just asked my Copilot and it detects following policy packages and policies in the provided test.xml

1. WAN (WAN_1 ↔ WAN_2)

• WAN_POLICY_1: WAN_1 → WAN_2

  • Source: 192.168.2.150
  • Destination: 192.168.3.150
  • Application: TCP_1234
  • Action: Permit + Log

• WAN_POLICY_2: WAN_2 → WAN_1

  • Source: 192.168.3.150
  • Destination: 192.168.2.150
  • Application: TCP_2345
  • Action: Permit + Log

2. WWW (WWW_1 ↔ WWW_2)

• WWW_POLICY_1: WWW_1 → WWW_2

  • Source: 192.168.20.150
  • Destination: 192.168.30.150
  • Application: TCP_3456
  • Action: Permit + Log

• WWW_POLICY_2: WWW_2 → WWW_1

  • Source: 192.168.30.150
  • Destination: 192.168.20.150
  • Application: TCP_4567
  • Action: Permit + Log

3. MGMT (MGMT_OTHER → MGMT_TOOLING)

• OTHER_TO_TOOLING: MGMT_OTHER → MGMT_TOOLING
  • Source: host1 (10.10.10.155)
  • Destination: host2 (10.10.20.155)
  • Applications: junos-syslog, junos-ping
  • Action: Permit + Log

Those are independend policy packages and later to be assigned to checkpoint virtual systems? 

[robertp]

Hi, correct. The 'logical-systems' in the Juniper config are literally separate virtual firewalls. Once you analyze it the Juniper setup is very similar to a VSX.

[Vincent_Bacher]

Test

[robertp]

That looks exactly how I would expect it to! Is that done with that fwmig tool?

[Vincent_Bacher]

Nope. I played around with visual studio code and Github Copilot and Claude Sonnet Engine. Output is a python script.

[Vincent_Bacher]

Would now be interesting what it would do with your big policies. Will give my Copilot some questions about that.

[Vincent_Bacher]

Copilot says, should be not an issue. 
Fun fact: This action created round about 1700 lines of python coding in just 2h of playing around.

Now the question is if you would risk to test the script 😉

[robertp]

Hey, absolutely, if you can share the script and a short guide how to use I will test it out later once I'm done with a migration, Thanks!

[Vincent_Bacher]

Will do but please don't kill me if the output based on your productive environment will be crap.

[robertp]

Don't worry, I will review it by hand anyway before migrating, but as long as it creates the objects and at least a workable template for the ruleset it's already a huge help 😉 

[Vincent_Bacher · Accepted solution]

Now I'm curious.

[the_rock]

I will test this in my lab soon and update on results.

[Vincent_Bacher]

I’d be really glad if it doesn’t end up throwing too many errors—but, you know, there are plenty of gremlins out there waiting to trip us up!

[the_rock]

I shall know in about 30 mins.

[the_rock]

This is what it gave me when I imported the file with smart move and did the scripts. Let me run this through our fully licensed MS Copilot and see what it comes back with...

 

[Vincent_Bacher]

Would keep SmartMove out of the game. The script is intended to be used alone.

my intention was to help @robertp but not SmartMove

[the_rock]

Fair enough, but I will still try...it just gave me the file, so let me test it quick.

[Vincent_Bacher]

Forgot to mention that I just tested the output for smartconsole

would have to test for mgmt_cli as well.

[the_rock]

Based on all I tried, I have a gut feeling smart move tool is out of question here...simply does not seem to work for this type of config.

[Vincent_Bacher]

Maybe the script will help Robert a little. I would be happy if it did.

[the_rock]

Agree, lets hope so!

[robertp]

Hey, it works! I just tested in prod and it looks kind of ok. I am not able to import the policy packages yet because I need to fix a problem with some services (this is mostly a problem in my Juniper messy config) and with network objects. For network objects the problem is definitely with the script and it's probably a possible fix (would be nice but I can manage manually if not!):

Domain names don't work at all. Instead of converting the DNS address object into "add dns-domain xxxxx" it tries to do "add-host name xxxx" without any IP in it, which gives an error as expected.

Juniper dns objects all look like this (live example):

set logical-systems WAN security address-book global address Microsoft dns-name microsoft.com

I will do some further testing tomorrow once I clean up the services and objects. Thank you for everything, this is already awesome!

@the_rock also big thanks for trying with SmartMove but I also think it will not work with logical systems. Maybe a potential future improvement for the tool 😉

[the_rock]

Great! Sorry I could not make it work with the tool, but yes, lets hope thats fixed in the future as far as virtual systems.

[Vincent_Bacher]

My head explodes so i don't understand. Short question: Was my script a bit helpful for your migration?

edith says:

"Domain names don't work at all. Instead of converting the DNS address object into "add dns-domain xxxxx" it tries to do "add-host name xxxx" without any IP in it, which gives an error as expected."

Do you want me to check this? Maybe you can send another test.xml with a domain name then my copilot will do the work

[robertp]

Very helpful, thank you! I just want to give some additional feedback on it once I finish cleaning up the import files (as mentioned above) so I will get back with some info hopefully tomorrow.