Using SmartMove to convert competitor Cisco configurations has issues

[neiren]

1. I recently migrated the Cisco firewall configuration of two areas of a customer to cp, and found that after the migration, the ACL policy of the Cisco firewall in one area was much less.

2. I uploaded screenshots of smartmove and some Cisco policies

3. The difference I found so far is that the Cisco configuration that can be successfully converted is the three-layer routing mode, and the one that cannot be converted is the bridging mode

[neiren]

[Chris_Atkinson · Accepted solution]

There are limitations described in sk115416.

Please submit feedback on this SK if you feel there are additional gaps than mentioned there.

[neiren]

I don't know the specific cause of the problem? I suspect that it is because the inside and outside interfaces in the Cisco configuration do not have IP addresses, and the BVI is used to share IP addresses.

[the_rock]

I I did this sort of conversion from Cisco ASA to CP 3 times and never had an issue, it was always able to move all the rules, regular policies, as well as NAT. 

Andy

[neiren]

We have done a lot of projects on Cisco migration configuration to check point, and this is the first time we have encountered this situation.

[the_rock]

I always followed the video from the sk and no issues. I also converted Cisco to other vendors before and worked okay as well. I always found Cisco is by far the easiest vendor to convert. Mind you, the reason for that is probably because other vendors' formats are way different.

My colleagues and I usually end up doing regex scripting to do say conversion for cp to fgt or fgt to cp or pan to fortigate, seems to work really well, as long as you make sure format matches with whatever vendor you are converting to.

Hope that helps.

Andy