topic Re: Checkpoint to Palo Alto migration in Expedition Discussions

Checkpoint to Palo Alto migration

RAnand — Mon, 13 May 2019 11:51:00 GMT

Hello Expert,

We are planing to migrate our current checkpoint platform R80 to Palo Alto firewall. I have gone through articles indicating the migration and would like to understand will Expedition tool migrates the NAT and VPN configuration too from checkpoint to palo alto.

Your early response will be highly appreciated.

Thanks in advance.

Re: Checkpoint to Palo Alto migration

dgildelaig — Mon, 13 May 2019 18:47:31 GMT

NAT rules are already supported, but not VPN yet.

Notice that for Checkpoint R80.10 in XML format may be missing some address objects if those are not directly referenced in the security rules or NAT rules, but only in other groups. That means that it may not be able to perform a complete migration as objects may not be found.

Re: Checkpoint to Palo Alto migration

doug-elliott — Thu, 30 Apr 2020 19:14:23 GMT

Is there an update?

1. Is there a way to pull the VPN config from Checkpoint R80 (.jar file does not) and

2. Can Expedition migrate the VPN configuration?

Re: Checkpoint to Palo Alto migration

lychiang — Thu, 30 Apr 2020 20:04:44 GMT

Hello Doug-Elliott,

Checkpoint VPN config migration is not supported at current version.

Re: Checkpoint to Palo Alto migration

DarrenVallance — Wed, 19 Jul 2023 17:46:45 GMT

I wanted to see if there was an update to this topic. Looking to move from CP R80.40 to PA 10.4.2-h2. I looked through the release notes, but did not see anything about it. Just wanted to see if I overlooked something.

Re: Checkpoint to Palo Alto migration

lychiang — Wed, 19 Jul 2023 21:49:28 GMT

@DarrenVallance VPN for checkpoint migration is still not supported at this point.

Re: Checkpoint to Palo Alto migration

M.Singh695310 — Wed, 03 Jul 2024 19:49:03 GMT

Can someone explain the process of migrating check-point to palo alto version 81.20..

Re: Checkpoint to Palo Alto migration

dpuigdomenec — Thu, 04 Jul 2024 07:55:00 GMT

Hi @M.Singh695310

Thanks for reaching out.

The steps are the following ones:

1) You export your configuration from your current Checkpoint. See here how to do that: https://pan.dev/expedition/docs/expedition_export/#checkpoint--r80x

2) You login to Expedition UI.

3) You create a new project.

4) You go to import tab, select Checkpoint R80+.

5) You select your downloaded/generated file (*.tar.gz) and click on import.

6) You can monitor the import process by tailing the file (/tmp/error). Execute via CLI "tail -f /tmp/error".

7) After the import process Expedition will show the project Dashboard with a summary of the migrated objects. It is important to check the number of migrated objects and also check the tab Monitor taht contains a checklist of all actions taken by Expedition during the migration.

8 ) At this point you will need to go over your migration workflow removing invalids, duplicates and other issues pointed on the Monitor checklist.

9) After that you will need to merge your Checkpoint configuration with your base config using the drag and drop on the Export tab.

Let me share with you a set of videos explaining the migration workflow using as an example a CISCO configuration.

For your use case the steps will be the same, except the parser that will be Checkpoint:

https://www.youtube.com/playlist?list=PLD6FJ8WNiIqVez8EBeoyRsnQcKTA5FuZ-

Hope this helps,

David