I have uploaded the required Checkpoint Config files into Expedition tool. When I looked at the policy, many rules have more than single zone assigned in both source and destination unlike Cisco policy migration. Especially if there are checkpoint firewall objects in either source or destinations I can see many zones assinged. Is it becasue of the networks in the checkpoint objects topology? How to fix this issue? Could you please share your checkpoint migration experience.
Thanks in advance..
The security zones for the policies are calculated using the static routes that were imported from the routes.txt file. If there are multiple address objects that match different static routes then you will see different security zones in the FROM or TO zones.
Expedition makes the assumption using best practices that network subnet will be segmented into its own security zone if the static routes are configured for different interfaces. If you wish to collapse multiple interfaces/subnets into a similar security zone you can change the zone assignments in the interface or zone configuration.
After making the change you can run the 'autoZoneAssign' option located in the drop down menu in the upper right hand corner.
my experience has been to remove the policies that were in place for the cluster communications. As you know PanOS uses out of band communications for their HA so the cluster communication policies are no longer needed.
I would recommend to review but to also review thoroughly before removing and validate those rules are for the cluster communications.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!