Auto Zone Assign for directly connected networks

mb_equate — Thu, 06 Jan 2022 02:29:51 GMT

Expedition Version: 1.2.3

Today I learned Expedition needs interfaces assigned to routes for auto zone assign to work. This makes sense as the code uses the interface to find the zone for a specific route rather than doing a [virtual] route lookup.

I have however been unable to get the right zone assigned for a directly connected network unless I add an interface route for that network to the VR, and remove it before I migrate.

This is another Check Point R80 migration, I've imported the policy package and manually imported interfaces/zones/routes as CSV as I have not been able to use the output of a "show route all" reliably.

Surely I'm doing it wrong 😕

Re: Auto Zone Assign for directly connected networks

lychiang — Thu, 06 Jan 2022 17:42:07 GMT

Hi @mb_equate When you import checkpoint config and route file at the same time, expedition should auto calculate the zone based on route file. The route file needs to show directly connected interfaces like below:

C 10.10.10.0/24 is directly connected, eth2

topic Auto Zone Assign for directly connected networks in Expedition Discussions

Auto Zone Assign for directly connected networks

Re: Auto Zone Assign for directly connected networks