topic Re: Migration from Check Point to PAN in General Topics

Migration from Check Point to PAN

gafrol — Mon, 24 Jan 2011 15:04:16 GMT

Hi all,

is there a "Tool" to convert a Check Point Config (security policies etc.) to a PAN Firewall ?

kind rgds

Roland

Re: Migration from Check Point to PAN

holmesw — Mon, 24 Jan 2011 15:59:01 GMT

I had the same questions when we converted from PIX to PAN in April 2009. No such tool existed then. We wrote our own Perl scripts to convert the PIX names, port-objects, and object-groups into equivalent PANOS statements. That eliminated a lot of grunt work.

PAN security policies that take advantage of PAN capabilities are substantially different from what our PIX firewall had. No effort was made to auto-convert the PIX ACLs, but we did use tools to optimize and pretty-print the PIX ACLs prior to creating PAN security policies.

Re: Migration from Check Point to PAN

pkruse — Mon, 24 Jan 2011 15:59:49 GMT

Roland,

Such a tool does exist but you will need to contact your local SE for access to it.

~Phil

Re: Migration from Check Point to PAN

gafrol — Tue, 25 Jan 2011 13:32:37 GMT

Hi Phil,

indeed I have already received the tool from the SE in Germany.

rgds

Roland

Re: Migration from Check Point to PAN

jhill — Wed, 26 Jan 2011 15:29:37 GMT

I've been working on a couple of projects with the migration tool for CP-to-PAN and find it an interesting challenge. If you have both the time and inclination to share your experience, please do tell.

Kind regards,

Jeff

Re: Migration from Check Point to PAN

holmesw — Wed, 26 Jan 2011 15:55:30 GMT

I don't have CP experience and am only familiar with PIX and Juniper.

Our PAN migration from PIX greatly benefited from having a pair of PIX installed in a failover setup. That made it much easier wire in the new PAN firewalls without any interruption. And, the ability to easily switch back to a functional PIX firewall provided a nice contingency plan. After the migration and cleanup, our high-availability PAN setup was done without any service interruptions.

Make sure that your new security policies have an explicity default-deny stance. Otherwise, the denies will not be logged, and it will be more difficult to see why traffic is not flowing.

Re: Migration from Check Point to PAN

blacksan — Wed, 26 Jan 2011 16:43:50 GMT

if you like XML format, then use the Checkpoint Config Wizard (CPConfigWiz). This will take your SmartCenter config and make a XML version. Now the data (Objects, FW Rules, NAT Rules) are easy to move around.

Just remember to create NAT rules in the PA for all of the objects with Automatic NAT in the Checkpoint.

You can grab the Config Wizard from support.checkpoint.com

Re: Migration from Check Point to PAN

camkim_MDEA — Thu, 27 Jan 2011 01:31:20 GMT

I wished Palo Alto would have published the existence of said tool and/or posted it in the community for use.

Would have saved time in recreating all the objects.

Re: Migration from Check Point to PAN

gafrol — Fri, 28 Jan 2011 15:30:29 GMT

Hello all,

I have received the migration tool. It's a vmware image and you can fire it up VMware Player for example. It supports converting Firewall configs from Check Point , Cisco (PIX,ASA,FWSM) and Netscreen.

I haven't tested it until now, but it looks promising.

rgds

Roland

Re: Migration from Check Point to PAN

jleung — Sat, 29 Jan 2011 06:49:03 GMT

Hi all,

We do have a migration tools which we support config migration from PIX/IOS, Junos/ScreenOS and Checkpoint < R70 migration. Howev er, as there is no 100% migration (don't think there is any perfect migration tool no matter what vendor you are migration to) and you also need to verify or revise the policy by experienced PAN certified SE, we don't publish it for general use. But you can always contact your SI as many of them already have knowledge on this tool and probably it is better for you to work with them to migrate your policy.

Regards,

Jones

Re: Migration from Check Point to PAN

gafrol — Sat, 29 Jan 2011 08:00:31 GMT

Hi Jones,

thanks for the info. I wasn't aware this tool supports only CP <R70. But this should be fine at the moment although R75 has just been released. I am not an enduser, we are a business partner, that's why we got the tool.

Is there a user manual for this migration utility ?

Since we have have a Check Point Firewall in the Lab I have the possibilty to test the migration tool without risk.

rgds

Roland

Re: Migration from Check Point to PAN

jleung — Sat, 29 Jan 2011 09:04:41 GMT

Hi Roland,

Yes we have a simple doc but I would recommend you to request for a briefing from the local SE or distributor before you use it.

Re: Migration from Check Point to PAN

migration — Mon, 31 Jan 2011 16:35:55 GMT

Does "Migration Tool" support also migration of Cisco Router ACL?

I think not but I try anyway to ask you 🙂

Thanks

Re: Migration from Check Point to PAN

spolo — Mon, 31 Jan 2011 17:53:10 GMT

The tool doesn't do conversion for Cisco Router ACL's as it's primary focus is firewall conversions. However, if you're good with scripting or script manipulations, it probably wouldn't be too hard to convert these to an xml format that you could import into PAN. Router ACL's don't have a lot of fields to manipulate so that may make the task a little simpler.

Re: Migration from Check Point to PAN

migration — Mon, 31 Jan 2011 18:18:20 GMT

Thanks, but I was reading "Firewall Configuration Migration Tool Datasheet" when there's written:

Cisco PIX (6.x, 7.x, 8.x)

Cisco ASA (7.x, 8.0, 8.1)

Cisco IOS (11.x and newer, extended ACL's only)

So, I thought that Cisco router's ACL (Cisco IOS) could be supported when configured in "extended format".

Am I wrong?

Thanks

Re: Migration from Check Point to PAN

spolo — Mon, 31 Jan 2011 18:41:24 GMT

Ha! No you are not wrong. I stand very corrected. Apparently I need to update my version of the configuration tool. In fact, I think I'll upgrade right now!

As of the December release of the migration tool, and I'm looking at the release notes for 1.5.2, the migration tool DOES support IOS 11.X and newer, extended ACL's only. From the release notes, you should know that VPN and NAT configuration is not converted.

Hope this helps!

Re: Migration from Check Point to PAN

gafrol — Fri, 04 Feb 2011 15:14:55 GMT

I am trying to convert a Check Point (R71) config. I have been feeding all the required files to the migration tool except the routes.txt. I am not clear how the content of this file has to look like (syntax) in order to be migrated successfully.

rgds Roland

Re: Migration from Check Point to PAN

aestevez — Wed, 09 Feb 2011 22:57:16 GMT

Hi Roland,

What do you need to know? The Checkpoint files format or the Output from the Migration Tool.

Regards

Re: Migration from Check Point to PAN

gafrol — Thu, 10 Feb 2011 09:56:26 GMT

Hi,

actually I need to know how the content of the CP routes.txt file has to look like in order to get converted correctly into the xml.

rgds

Roland

Re: Migration from Check Point to PAN

rapoint_person — Thu, 10 Feb 2011 12:25:54 GMT

You don't need to put in any Interface IP's. Only put int the networks:

Destination Gateway Genmask Flags MSS Window irtt Iface

192.160.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

196.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

192.168.20.0 192.168.10.10 255.255.255.0 U 0 0 0 eth1