Migrate Checkpoint 80.10

[SCHERRMANN]

Hello,

I try a migration from checkpoint 8R0.10.

I've updated to the last bersion (1.1.12) and I see option "VERSION 80.10" in the checkpoint tab, but this option is grayed out.

I try with R80 option but It does nothing after "upload" is clicked.

Do I miss something ?

Thanks.

[sjanita]

If you have exported the json formatted files using the method:

https://live.paloaltonetworks.com/t5/Expedition-Articles/Migrating-Checkpoint-R80/ta-p/216298

If the file config source is from R80.10 you can use the R80 option and the parser will review the file source and determine which parser to use, either the R80 or R80.10.

Can you post a screenshot of the page after you click "upload"

[dgildelaig]

We have not enabled R80.10 because we have found that original Checkpoint config files are missing a lot of address objects that are refereed within groups.

Until we do not find a way to export from Checkpoint a complete configuration set, we do not want to enable a parser that will led to incorrect migrations

[SCHERRMANN]

,ve tested with r80 and the screen is blocked on "reading config files"

[SCHERRMANN]

I missed a message that appears for a very short time slot.

It seems to look on phase 8 of 10 : Calculating NAT Rules Zones based on Static Routes and interfaces.

I will let it run until tomorrow.

[SCHERRMANN]

[SCHERRMANN · Accepted solution]

I've deleted the project created before the upgrade and redone the whole procedure.

It's fine now.

[doug-elliott]

@dgildelaig , I noticed a new procedure on the Expedition (Exped 1.1.66.2) file import page for Checkpoint R80 or greater.  involves uploading and running a .jar file on the mgmt server.  do you have any documentation for the new procedure or is it that simple?  Also, how do I explain any risks with running the .jar file on a client's mgmt server?

[dgildelaig]

Check the link we provide to download the jar file.

It is a file provided by Checkpoint, and they explain how to place it in their system and how to consume it.

I guess that if they see the source of the file, they can get some comfort as it is Chekpoint's software to patch Checkpoints software.

[doug-elliott]

Thank you @dgildelaig , I thought the .jar file was produced by paloalto.  The client did not recognize the file's origination and I'm not familiar with Checkpoint.  I could not have wished for a better answer. 

[dgildelaig]

Glad to help