article Migrating Checkpoint R80 [UPDATED on December 2020] in Expedition Articles

Migrating Checkpoint R80 [UPDATED on December 2020]

alestevez — Fri, 11 Dec 2020 09:39:11 GMT

With the new version of Checkpoint Smartcenter R80, the way to obtain the rules has changed.

Exporting Configuration

To export the configuration from a Checkpoint R80 we are gonna need to download a tool from the Checkpoint's Github. We want to be sure we download latest version of the tool since the one it comes installed in your SmartCenter usually is old and may contain bugs.

So first open your preferred web browser and go to:

https://github.com/CheckPointSW/ShowPolicyPackage/releases

Check the latest, at the moment of updating this post latest version was 2.0.6, so in order to download it we have to click on the file named: web_api_show_package-jar-with-dependencies.jar

https://github.com/CheckPointSW/ShowPolicyPackage/releases/download/V2.0.6/web_api_show_package-jar-with-dependencies.jar

After download the file you have to UPLOAD it to your SmartCenter Server where Checkpoint R80 management is running.

Use your SCP preferred tool to do it.

Please read the README.md file shown in https://github.com/CheckPointSW/ShowPolicyPackage to understand how to run the downloaded file properly, pay special attention to the Examples

Before you run the command verify the Checkpoint API is running otherwise this tool will fail to execute. Please read this if you don' t know how to enable/verify if your API is UP and Running

Now you can RUN the tool from CLI as EXPERT

java -jar web_api_show_package-jar-with-dependencies.jar -v

The output from that command will let you know what Packages are available to export

Last command we have to run is the following where PACKAGE_NAME is the name you have chosen from the previous command and in case you are in a MULTI-DOMAIN environment specify the DOMAIN_NAME too (-d is OPTIONAL):

 java -jar web_api_show_package-jar-with-dependencies.jar -k <PACKAGE NAME> -d <DOMAIN NAME>

This will create a new tgz file which you will use as is to import into Expedition Importation page.

Exporting Routing and interfaces

From the Firewall CLI, you can run the following:

netstat -nr > routes.txt

With all this information, we can go to Expedition, Create a new Project, enter the Project, and go to IMPORT > CHECKPOINT > VERSION R80.

Assign a name to your configuration such as "MyInternetGW"
Select the tgz file and attache it to the proper input
Select the routes.txt for the routes
Click UPLOAD

References: Checkpoint Website article about the show package tool

Re: Migrating Checkpoint R80

SezgiDogan — Wed, 25 Jul 2018 14:54:47 GMT

Hello,

I can not migrate sub policies in the security policies. Is there a fix for this?

Regards,

Re: Migrating Checkpoint R80

Gun-Slinger — Tue, 18 Sep 2018 19:00:35 GMT

This isn't working, keep getting the following error:

Running:

SMS01-CKPT> mgmt_cli show access-rulebase name "Test-Policy Security" details-level "full" use-object-dictionary true --format json > Test-Policy.json

Keep getting:

MGMT9000 {
"code" : "generic_err_invalid_parameter_name",
"message" : "Unrecognized parameter [>]"

Re: Migrating Checkpoint R80

alestevez — Tue, 18 Sep 2018 19:50:28 GMT

You have to be "expert" to run the command and redirect the output to a file

Re: Migrating Checkpoint R80

Gun-Slinger — Tue, 18 Sep 2018 20:37:59 GMT

I ran the command in expert mode and the file generated correctly, however I have tried to import into the Expedition tool and each time it states There are not Objects defined. Import Failed!

THis is being completed on a SMS R80.10 VM

Re: Migrating Checkpoint R80

alestevez — Tue, 18 Sep 2018 20:39:58 GMT

https://live.paloaltonetworks.com/t5/Expedition-Discussions/How-to-Upload-configuration-files-bigger-than-2MB/m-p/215689#M14

Re: Migrating Checkpoint R80

Gun-Slinger — Wed, 19 Sep 2018 15:31:00 GMT

Completed all the config associated with that link How to Upload conf files with no luck. I have attempted to complete this instructions in this thread EXACTLY as perscribed with the most progress being the Import progress status flapping between Initializing and Reading Config.... of which it continues this back and forth for quite sometime.

Next I attempted this option outlined in this thread

Issue Getting Checkpoint R80 config to load

No luck there.

I only have 162 rules, no NAT rules, but a bunch of objects since this is an SMS with multiple policies.

Any ideas?

Re: Migrating Checkpoint R80

Gun-Slinger — Wed, 19 Sep 2018 18:20:59 GMT

RESOLVED: The issue was with the .json files and piping the output to a seperate file. The commands above are correct, however the output files were adding the following "Username" at the TOP of the file:

Username:
{
"uid" : "1cxxxx6-3bff-4xxxxxx8-7xxxxxxxxx",
"name" : "blah-blah",
"rulebase" : [ ],
"total" : 111
}

This appears to be an issue/bug within the R80.10 code when doing outputs to a file as this "Username" is coming from the prompt before launching the api call.

Once this "Username:" line was removed from the json file, the import worked as expected.

Re: Migrating Checkpoint R80

Gun-Slinger — Tue, 09 Oct 2018 14:58:25 GMT

I have confirmed there is a limitation on the Checkpoints of 500 rules when exporting through the API. With our environment, I had to break it up into groups of 200 due to time out and RAM issues.

I have yet to get the zip file with the orders.txt file to work as perscribed above. I am on the latest version of the expedition tool and when I upload it, it will transistion from initilizing to reading config files, but stalls from there.

Anyone else ran into issues like this or did something change with the new version?

Re: Migrating Checkpoint R80

AR00473455 — Wed, 10 Oct 2018 06:35:21 GMT

Just want to ask you one question that suppose security and NAT policies count around 1500 rules then what is the best way to export policy in one file. Otherwise. I have to export the security policy in 400 rules count like below and zip it one folder.

mgmt_cli show access-rulebase offset 0 limit 400 name "Internet Security" details-level "full" use-object-dictionary true --format json > RuleSet_0_400.json

mgmt_cli show access-rulebase offset 401 limit 800 name "Internet Security" details-level "full" use-object-dictionary true --format json > RuleSet_401_800.json

mgmt_cli show access-rulebase offset 801 limit 1200 name "Internet Security" details-level "full" use-object-dictionary true --format json > RuleSet_801_1200.json

mgmt_cli show access-rulebase offset 1201 limit 1500 name "Internet Security" details-level "full" use-object-dictionary true --format json > RuleSet_1201_1500.json

Re: Migrating Checkpoint R80

Gun-Slinger — Wed, 10 Oct 2018 13:16:17 GMT

@AR00473455

It is my understanding that the limitations are 500 for any of the rule sets according to Checkpoint. NAT and Security are treated as 2 SEPERATE groups. For example if you have 1000 security rules and 200 NATs; you will need 2 seperate security rules files of 500 each and 1 NAT rule file.

This being said I have yet to get the zip file proceedure to work and actually had to export out my security policies in seperate files as perscribed, but then manually merge the files into 1 .json file using notepad++.

Won't lie, it would be great if the zip proceedure worked

Re: Migrating Checkpoint R80

alestevez — Fri, 19 Oct 2018 14:06:38 GMT

To let the ZIP procedure work you have to be sure at the time to create the zip there are no Folders inside it, so create the zip like

cd wherealljsonfiles_plus_order_are
zip checkpoint.zip *

Re: Migrating Checkpoint R80

cpsantos — Fri, 23 Nov 2018 18:54:01 GMT

Hi all,

There are a few misconceptions of what each command does in your procedure, first of all "limit" is the number of results after the specified offset, for instance you set offset to 0 and limit to 400 you get rules 1 to 400.

Now the next set of rules you should consider offset 400 instead of 401, if 0=1 then 400=401 in the offset counting.

Also it's a pain to always have to request the customer for username and password and the command you wrote "hides" username request, my suggestion to update and works like a charm, do has you like:

Step1

#mgmt_cli login (when asked the customer should type his username and password here)

Step2

Copy output of the result login to a file, for the sake of my example I used id.txt

This id lets you reuse the logged in session id, with an idle timeout of 10 minutes, more then enough to run all queries, even for quite big rulebases like in my test scenario 2569 rules (don't ask...)

Step 3 run your instructions with slit differences...limit as I explained should be set to 400, you are right 400 is good number, although it allows up to 500, in rulebase it normally crashes the api or it times out, so:

Also it's good idea to set limit and the default value is 50 so you don't want to think you have it all, but the end file will tell you a tip.

Myscript:

mgmt_cli show access-rulebase offset 0 limit 400 name "ASecurityPolicy Security" details-level "full" use-object-dictionary true --format json -s id.txt > RuleSet_`date +%y%m%d%H%M%S`.json
mgmt_cli show access-rulebase offset 400 limit 400 name "ASecurityPolicy Security" details-level "full" use-object-dictionary true --format json -s id.txt > RuleSet_`date +%y%m%d%H%M%S`.json
mgmt_cli show access-rulebase offset 800 limit 400 name "ASecurityPolicy Security" details-level "full" use-object-dictionary true --format json -s id.txt > RuleSet_`date +%y%m%d%H%M%S`.json
mgmt_cli show access-rulebase offset 1200 limit 400 name "ASecurityPolicy Security" details-level "full" use-object-dictionary true --format json -s id.txt > RuleSet_`date +%y%m%d%H%M%S`.json
mgmt_cli show access-rulebase offset 1600 limit 400 name "ASecurityPolicy Security" details-level "full" use-object-dictionary true --format json -s id.txt > RuleSet_`date +%y%m%d%H%M%S`.json
mgmt_cli show access-rulebase offset 2000 limit 400 name "ASecurityPolicy Security" details-level "full" use-object-dictionary true --format json -s id.txt > RuleSet_`date +%y%m%d%H%M%S`.json
mgmt_cli show access-rulebase offset 2400 limit 400 name "ASecurityPolicy Security" details-level "full" use-object-dictionary true --format json -s id.txt > RuleSet_`date +%y%m%d%H%M%S`.json

tail each result:

[Expert@gw-83919d:0]# tail RuleSet_181123160805.json
"from" : 1,
"to" : 400,
"total" : 2569
}
[Expert@gw-83919d:0]# tail RuleSet_181123161507.json
"from" : 401,
"to" : 800,
"total" : 2569
}
[Expert@gw-83919d:0]# tail RuleSet_181123180927.json
"from" : 801,
"to" : 1200,
"total" : 2569
}
[Expert@gw-83919d:0]# tail RuleSet_181123181125.json
"from" : 1201,
"to" : 1600,
"total" : 2569
}
[Expert@gw-83919d:0]# tail RuleSet_181123181317.json
"from" : 1601,
"to" : 2000,
"total" : 2569
}
[Expert@gw-83919d:0]# tail RuleSet_181123181509.json
"from" : 2001,
"to" : 2400,
"total" : 2569
}
[Expert@gw-83919d:0]# tail RuleSet_181123181635.json
"from" : 2401,
"to" : 2569,
"total" : 2569
}

NOTE: See "total" in the end of file? 2569 is the total number of rules, so has a tip you will know if you have reached "to" the last rule when "total" and "to" matches.

The rest is just fine.

Hope this helps,

Regards

Re: Migrating Checkpoint R80

AR00473455 — Wed, 12 Dec 2018 11:19:50 GMT

Hello All.

I am trying to run below command on checkpoint management center for security policy contains around 1500 security policies. So I am runing the below command to fecth the policy in 400 offset limit however i have not received output in the file and size 1KB size.

mgmt_cli show access-rulebase offset 0 limit 400 name "Internet Security" details-level "full" use-object-dictionary true -u username --format -json > RuleSet_0_400.json.

When I opend the 1 KB size file. The content shows timeout reached.

Re: Migrating Checkpoint R80

alestevez — Wed, 12 Dec 2018 11:24:20 GMT

Probably is Checkpoint API problem, try to reduce to 100 instead of 400 and see...

Re: Migrating Checkpoint R80

cpsantos — Wed, 12 Dec 2018 11:58:29 GMT

Hi AR00473455,

Check Point api can expire during your query hence the timeout, reducing the limit might help, but there are other issues to look at.

details-level "full" calls in new queries, like listing "hosts, networks, groups, services tcp/udp/other, and again service-groups, etc" unfortunately there are also limits to this new queries, and in some cases only running rule by rule will do, or even worse big rule can even crash the api, I noticed that a rule with a big list of hosts will crash the api, grouping them in a group however helps it get fixed, but other issues show up, like unexported objects within the show rulebase command, producing UID network objects with 1.1.1.1, I do have to say it's a nice trick from Albert's team at PaloAlto, but never the less this needs to get fixed by exporting smaller and smaller data through the api and compile this for Expedition.

Best regards, I hope reducing the limit like Albert says works for you, it's not working for me with some rules anyway, but I hope I'll get it fixed using the api and will share it here once I figure it out.

Regards,

Carlos Santos

Re: Migrating Checkpoint R80

AR00473455 — Sun, 16 Dec 2018 04:24:19 GMT

Hi Albert/Carlos,

It worked,. Started to get output when I set limit to 100 so each file contains 100 rules. The same limit applied for NAT rules as well.

However I would like to know that how to combine all files into one file to process on Expedition tool . As I have done the same way what mentioned in the above article but not worked.

After we created all the json files we will need to create a new file and we will name it "order" to put inside the filenames in the order they need to be read, like in this example:

Edit "order" file

NATRuleSet_0_500.json
NATRuleSet_501_600.json

After that we have to ZIP it, to do it right all these 3 files needs to be under the same folder and from within the folder we can run the command from the CLI:

zip NatRules.zip *

Re: Migrating Checkpoint R80

cpsantos — Thu, 16 May 2019 12:05:47 GMT

@AR00473455

Sorry for not replying, you cannot combine the files, just add them to a the zip, along with "order" file, the content of the order file should be the list of the rules by order top down, that's it.

Re: Migrating Checkpoint R80

rkalinowski — Fri, 02 Aug 2019 15:14:47 GMT

This thread has been helpful, however when I go to import the created zip files into expedition it hangs on "Reading config files" with no error or indication as to what's happening. Any insight into system generated logs or ways to determine what's causing this problem?

Re: Migrating Checkpoint R80

cpsantos — Tue, 03 Sep 2019 15:03:00 GMT

You can search for something /tmp/error, from my side it wasn't very helpful, maybe you get luck here.