How to export and import IPS profiles on R81.10

[TamSOL]

Dear ALL,

We want know how to export and import IPS Profiles on R81.10.  Because we need to migrate full HA enviroment to Disributed emvironment.

At first, we tried  to using migrate_sever  command, but the migrate was failed.  we cannot delete HA object.

So we thought of using the API.

Although it did not return as much as 100 objects. We were able to restore objects and policies.

So finally,  we want to migrate IPS profiles, 

We found that R7x can use the API, but we didn't  find that this API can use  R81.10.

Please tell me about how to export and import IPS profiles on R81.10.

Thank you for the advice in advance.

[Blason_R]

You mean IPS signatures which are configured in your profile? Did you try export  to csv option at least that would give you baseline to start with

[TamSOL]

Thank you for the answer.

We are finding  how to export IPS profiles from old  Checkpoint appliances(FULL HA ) and import IPS profiles  to new Checkpoint appliances(Distributed )

[PhoneBoy]

R7x had limited to no API support, what precisely are you referring to here?
In any case, the API should support getting the necessary information, though it will require multiple calls to get all the information due to the amount of the data the API can return in a single call.
Having said that, the default Optimized policy is what we generally recommend for most deployments.

[TamSOL]

Thank you  for reply.

I would like to know the procedure of this URL in the case of R81.10.
How to Import / Export IPS Protection Profiles (checkpoint.com)

Because We cannot fine the procedure.

Thanks.

[PhoneBoy]

https://community.checkpoint.com/t5/API-CLI-Discussion/Python-tool-for-exporting-importing-a-policy-...
This tool can be used to export/import the just the Threat Prevention policy (includes IPS configuration).

Outside of that, you'll have to write something that calls the API directly, getting the information you need.
This is also a task that Check Point Professional Services can assist with.

[Timothy_Hall]

As Phoneboy said you could pull all this IPS config information out through the API but it will take some doing.

One other approach would be to use the relatively new IPS profile comparison tool to determine the differences between the original IPS profile in your Full HA environment and the default Optimized profile in your Distributed environment.  Once those differences (administrator overrides, etc) have been determined, manually implement the differences in your new Distributed environment:

sk178646: IPS Protections - Profiles compare

[TamSOL]

Thank you for the advice.

I tried comparing the profiles but there are too many differences.
After that, manually creating a profile is impractical.
Please let me know if there is a way to register all at once by import or command.

[the_rock]

I believe what @Blason_R said is probably your best approach to start with.

[TamSOL]

Thank you for the answer.

But that ways is only export.  We want to know  how to import IPS profiles  to new Checkpoint appliances(Distributed )

[the_rock]

I dont believe thats sadly available in R81.xx versions, as far as import (not that I know of anyway).

[G_W_Albrecht]

If the step is from R77.30 IPS to R81.10 IPS profiles, note the main deviations from pre-defined Policy and use it to make a cloned copy of R81.10 Optimized Policy.

[the_rock]

I also checked in R81.20 and option to import IPS profile does not exist there either. Little disapoointing, but lets hope it becomes avalable sometime soon. Speaking of that, I know this is slightly different topic, but it would also be nice if there was an option to import the rules in .csv format, the same way they can be exported.