Checkpoint R77.30 Policy Migration Using Expedition

Reply
L2 Linker

Checkpoint R77.30 Policy Migration Using Expedition

Hi All,

 

I have uploaded the required Checkpoint Config files into Expedition tool. When I looked at the policy, many rules have more than single zone assigned in both source and destination unlike Cisco policy migration. Especially if there are checkpoint firewall objects in either source or destinations I can see many zones assinged. Is it becasue of the networks in the checkpoint objects topology? How to fix this issue? Could you please share your checkpoint migration experience.

 

Thanks in advance..

 

Best regards,

Nagarjuna  

L4 Transporter

Re: Checkpoint R77.30 Policy Migration Using Expedition

The security zones for the policies are calculated using the static routes that were imported from the routes.txt file. If there are multiple address objects that match different static routes then you will see different security zones in the FROM or TO zones. 

 

Expedition makes the assumption using best practices that network subnet will be segmented into its own security zone if the static routes are configured for different interfaces. If you wish to collapse multiple interfaces/subnets into a similar security zone you can change the zone assignments in the interface or zone configuration. 

 

After making the change you can run the 'autoZoneAssign' option located in the drop down menu in the upper right hand corner.

L2 Linker

Re: Checkpoint R77.30 Policy Migration Using Expedition

Hi,

Thank you for the response. That helps. The actual problem was when there are checkpoint objects in the source and destination(may be for cluster communications) , all zones are being assigned, this may be the networks in the topology! Are these rules needs to be manually corrected or can they be disabled since they are for checkpoint firewall communications?
L4 Transporter

Re: Checkpoint R77.30 Policy Migration Using Expedition

my experience has been to remove the policies that were in place for the cluster communications. As you know PanOS uses out of band communications for their HA so the cluster communication policies are no longer needed. 

 

I would recommend to review but to also review thoroughly before removing and validate those rules are for the cluster communications.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!