SmartMove from Juniper with LSYS

[robertp]

Hey,

I am trying to migrate from a Juniper with logical systems to Check Point VSX. I know I can't count on SmartMove to do everything for me, but I would want it to at least help me move the 1000+ policies 🙂 Any idea how to do it? When I exported the whole xml file off the Juniper and put it into SmartMove I only got the policies from the root logical system. Exporting the logical system itself didn't work either. At this point doesn't even matter if it puts everything in one policy, or does separate ones, as long as I get the rules and objects on the SMS. Any advice would be appreciated.

[Vincent_Bacher]

2morrow will be my last day.








b4 going on vacation 4 three weeks 🙂

[robertp]

Same here, though I already feel I will have to work a bit over the weekend to wrap up some topic. If I can't make it by tomorrow you will at least have an interesting read once you are back. Also happy holidays!

[Vincent_Bacher]

I am glad that I was able to help constructively. See you soon!

[the_rock]

Have a nice holiday!

[Vincent_Bacher]

can you attach a test.xml with mentioned domain name objects to see the syntax in the xml?

[Vincent_Bacher]

Just played around. Dunno if copilot used the correct format for dns objects but now i see it's better:

            <address-book>
                <name>global</name>
                <address>
                    <name>ntp_server</name>
                    <dns-name>
                        <name>time.cloudflare.com</name>
                    </dns-name>
                </address>
                <address>
                    <name>admin_workstation</name>
                    <ip-prefix>172.16.0.100/32</ip-prefix>
                </address>
                <address>
                    <name>mgmt_subnet</name>
                    <ip-prefix>172.16.0.0/24</ip-prefix>
                </address>
            </address-book>

[the_rock]

That looks pretty good.

[Vincent_Bacher]

Thanks.
Now i am playing around and testing the mgmt_cli outout and this is challenging as we have MDM and its bit more complex thant to create everything without domains 🙂

[the_rock]

I still have not given up on smartmove though.

[Vincent_Bacher]

Would be fine when it works correctly

[the_rock]

Well, never failed for me with Cisco. With Fortigate, more less is okay. With PAN, so so, you have to make some modifications, but it does work.

[Vincent_Bacher]

Tbh I never used SmartMove as i did not many migrations from one vendor to a different one. 
And for those I did there were no tools.

eg from pfSense to 40net or so.

[robertp]

That looks good, would be so kind to send over the updated script? I will see hot it handles around 50-100 very various dns names I have in prod.

[Vincent_Bacher]

unfortunately i already am off and on vacation now, I am sorry. 

[robertp]

No worries, have a nice vacation!

[_Val_]

@Vincent_Bacher, I think this will be a good ToolBox item. Prepare a post describing the script and how to use it. Send me an email with the link to that post for review. I will then guide you through the process to make it a Tookbox thing

[Vincent_Bacher]

Hi @_Val_ 
Please keep in mind that the tool is very rudimentary and written for roberts special use case. There are quite a few things that I may not have taken into account. Such as the aforementioned publishing after every 100 policies.

[_Val_]

I see. Up to you, only if you think it is ready for prome time

[Vincent_Bacher]

Not (yet) at present, and if no one except in this thread has any use for it, it's just an avoidable dead weight.

[sjni01]

Nice Info, I saw this key topic:

• For Policies:

  • Set username and password inside the policies.txt.

  • Login to the decvice and go to expert mode. Then paste output policy.

  • This method is using sid for authentication.

  • Because of the platform limitations, you must paste rules by grouping 3 or 4 rules for each copy.

  • Please note that about per 100 lines there is a publish action.

  The API server option should be enabled.

  Regards

  SJ

[Vincent_Bacher]

Thank you for the reply. I never said that there weren’t a large number of issues and opportunities for improvement.

[Vincent_Bacher]

But if i have some time today or after vacation i can enhance the script. If anybody would use the script. Not just for fun.

[sjni01]

Excellent Vincent, I'm look forward to any updates.

[the_rock]

Same here!