Check Point Policy Migration

Migrating firewall policies to Check Point can follow two main paths: Check Point-to-Check Point migration, typically using the Migration Tool outlined in sk180923, which ensures smooth transfer of configuration between versions or appliances. For migrations from other firewall vendors, Check Point offers the SmartMove tool described in sk115416, enabling automated conversion of rules from platforms like Cisco ASA, Fortinet, and Palo Alto into Check Point format.

Between Check Point

First download the 2 required files stated on the SK and copy them to the Management Server.

Here we put them on ‘/home/admin/cp’ directory along with the exported policy files, then configure the environment variables to point to the python sdk

export PYTHONPATH=$PYTHONPATH:/home/admin/cp/cp_mgmt_api_python_sdk-master/

Next we run the tool with additional parameter for the tool to skip all the existing objects, then select import and point it to the exported policy

python3 ExportImportPolicyPackage-master/import_export_package.py --skip-duplicate-objects True

Next all we need to change is the custom name for the imported package, and select run

Now all the objects, policies, and NAT rules have been imported as a new policy package

From Different Firewall

First download the ‘Check Point SmartMove Tool’ file from the SK and place it on our windows machine along with exported policy

Run the tool, select the vendor source, and point it to the exported policy

After running the tool, we will get a bunch of files, some of them are the reports of the convert results

This one shows all the successfully converted objects

This one for NAT rules

This one for the policy rules

And this one, which is also for policy rules but optimized in a way that check point thinks is more organized and tidy

Next copy the xnet1_object.sh and xnet1_policy.sh to the management server, run dos2unix to convert DOS/Windows format to Unix format, and give 777 permssion

dos2unix xnet1_object.sh xnet1_policy.sh
chmod 777 xnet1_object.sh xnet1_policy.sh

And finally, we run the script, starting with the object one

And then the policy one

On SmartConsole, we will see the imported objects, NAT, and policy rules have been imported as a new policy package