Checkpoint R77.30 Policy Migration Using Expedition

[nagarjuna.b]

Hi All,

I have uploaded the required Checkpoint Config files into Expedition tool. When I looked at the policy, many rules have more than single zone assigned in both source and destination unlike Cisco policy migration. Especially if there are checkpoint firewall objects in either source or destinations I can see many zones assinged. Is it becasue of the networks in the checkpoint objects topology? How to fix this issue? Could you please share your checkpoint migration experience.

Thanks in advance..

Best regards,

Nagarjuna  

[sjanita]

The security zones for the policies are calculated using the static routes that were imported from the routes.txt file. If there are multiple address objects that match different static routes then you will see different security zones in the FROM or TO zones. 

Expedition makes the assumption using best practices that network subnet will be segmented into its own security zone if the static routes are configured for different interfaces. If you wish to collapse multiple interfaces/subnets into a similar security zone you can change the zone assignments in the interface or zone configuration. 

After making the change you can run the 'autoZoneAssign' option located in the drop down menu in the upper right hand corner.

[nagarjuna.b]

Hi,

Thank you for the response. That helps. The actual problem was when there are checkpoint objects in the source and destination(may be for cluster communications) , all zones are being assigned, this may be the networks in the topology! Are these rules needs to be manually corrected or can they be disabled since they are for checkpoint firewall communications?

[sjanita]

my experience has been to remove the policies that were in place for the cluster communications. As you know PanOS uses out of band communications for their HA so the cluster communication policies are no longer needed. 

I would recommend to review but to also review thoroughly before removing and validate those rules are for the cluster communications.