topic Re: 1 firewall to 2 vsys? in Expedition Discussions

1 firewall to 2 vsys?

timedout — Wed, 19 Jun 2019 08:49:15 GMT

Hi Guys

Does anyone have a method to migrate from a single firewall (specifically checkpoint) to two or more vsys?

Thanks

Re: 1 firewall to 2 vsys?

sjanita — Wed, 19 Jun 2019 15:46:51 GMT

you'll have to decide on your desried design goal - are you planning to use VSYS or are you ok with using multiple virtual routers to isolate traffic? if you will be using panorama you'll have to decide if the vsys will be in the same or different device groups (DG).

Is your plan to split some policies and objects between the 2 vsys? If you will be using Panorama are your plans to have both vsys in the same or different device groups?

if the VSYS will be members of different DG you can import all policies and objects into shared at first then add VSYS specific policies and objects afterwards.

Re: 1 firewall to 2 vsys?

timedout — Thu, 20 Jun 2019 00:52:26 GMT

Thanks for your reply sjanita.

I am planning on going from a single checkpoint to 2 vsys which reside in 2 seperate device groups.

I imaine that the process will be to injest 2 route tables and CSV's into MT then maybe use auto assign to re-assign zones, then possibly use the filtering to remove the irrellevant rules for each new firewall.

Or is there a simpler way as you mentioned?

Thanks

Re: 1 firewall to 2 vsys?

sjanita — Fri, 21 Jun 2019 20:48:32 GMT

your workflow is correct - import 2 separate route files into 2 separate VR's.

When you initiate the autozoneassign, you will be prompted to choose which VR to use as the routing reference. prior to running the autozoneassign you will need to assign the interfaces to the appropriate VR's as well as those IP's assigned to the interfaces will be used as local routes and will also be used in the autozoneassign calculations.

Re: 1 firewall to 2 vsys?

timedout — Wed, 26 Jun 2019 01:55:57 GMT

Thank you @sjanita