Checkpoint R77.30 Policy Migration Using Expedition

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Checkpoint R77.30 Policy Migration Using Expedition

L2 Linker

Hi All,


I have uploaded the required Checkpoint Config files into Expedition tool. When I looked at the policy, many rules have more than single zone assigned in both source and destination unlike Cisco policy migration. Especially if there are checkpoint firewall objects in either source or destinations I can see many zones assinged. Is it becasue of the networks in the checkpoint objects topology? How to fix this issue? Could you please share your checkpoint migration experience.


Thanks in advance..


Best regards,



L5 Sessionator

The security zones for the policies are calculated using the static routes that were imported from the routes.txt file. If there are multiple address objects that match different static routes then you will see different security zones in the FROM or TO zones. 


Expedition makes the assumption using best practices that network subnet will be segmented into its own security zone if the static routes are configured for different interfaces. If you wish to collapse multiple interfaces/subnets into a similar security zone you can change the zone assignments in the interface or zone configuration. 


After making the change you can run the 'autoZoneAssign' option located in the drop down menu in the upper right hand corner.


Thank you for the response. That helps. The actual problem was when there are checkpoint objects in the source and destination(may be for cluster communications) , all zones are being assigned, this may be the networks in the topology! Are these rules needs to be manually corrected or can they be disabled since they are for checkpoint firewall communications?

my experience has been to remove the policies that were in place for the cluster communications. As you know PanOS uses out of band communications for their HA so the cluster communication policies are no longer needed. 


I would recommend to review but to also review thoroughly before removing and validate those rules are for the cluster communications.

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!