Migrate configurations from cisco router to Checkpoint

[Renis_Parruca]

Hello,

Can anyone help me how to migrate cisco router configurations to Checkpoint Spark 1595.

[simonemantovani]

Hello

could you provide any further information like network diagram, router configuration, access list, etc?

[Renis_Parruca]

Hello Simone,

I'm uploading only the parts of neccesary from the cisco. So the Interfaces, IP addresses,access lists,BGP and IPSEC.The topology from the ISP is like this.They send us to private IP addresses that are used for BGP Session. Upon the BGP is Established I have internet form the public IP that is on the loopback. Then the IPSEC is UP. If you can show me which is the configuration in chekcpoint spark 1595 I will be very grateful. Because we want to switch from cisco router to checkpoint firewall.

Best regards,

Renis

[simonemantovani]

Hello

if I interpreted the configuration correctly, the check point interface would be:

• WAN - 172.16.18.78/30
• PORT5 - 172.16.18.82/30
• PORT1 - TRUNK
• PORT1.600 - 192.168.1.1/24
• PORT1.700 - 10.20.32.1/24

Am I right? The SMB will locally manged or centrally managed (using a Security Management Server)?

[Renis_Parruca]

Hi Simone,

I have configured WAN-- 172.16.18.78/30 , PORT1.700 - 10.20.32.1/24, and Loopback=79.106.169.137. The wan interface is without static route because in the cisco is configured a BGP with this private addresses 172.16.18.78/30 and 172.16.18.82/30. And the Public IP is advertised after the BGP is established. So the IPSEC knows the public IP. This is what I have undestood from the cisco configurations. The SMB will locally manged or centrally managed (using a Security Management Server)? For the moment I want to configure it locally after the tests with be managed with smart-cloud.

Thanks

[simonemantovani]

Hello

ok,looking at the configuration about the IPSec VPN, this tunnel will be established from your SMB to the remote peer 79.106.64.18, is it right? If yes, the BGP peer will perform a NAT for your SMB to be reachable from Internet to establish VPN, and it will advertise the default route to the SMB. Am I right?

[Renis_Parruca]

this tunnel will be established from your SMB to the remote peer 79.106.64.18, is it right? YES the remote PEER is 79.106.64.18.Yes the BGP will perform NAT to the public IP: 79.106.169.137 and based on this IP the IPSEC VPN will be established.

[the_rock]

I had done this with smartmove tool before, though dont believe that would work for smb, unless its centrally managed. 

[Renis_Parruca]

I have seen the smartmove but is for cisco ASA and firewalls not for routers like my case

[the_rock]

Ah, okay...never tested it with Cisco router though, but definitely worked with ASA.