topic Re: FW Migration from Checkpoint R80.40 to FMC 7.0 using Firepower mig in Network Security

FW Migration from Checkpoint R80.40 to FMC 7.0 using Firepower migration tool 2.3.5

Jozef Cmorej — Tue, 13 Jul 2021 20:42:20 GMT

Hi all,

I am trying to migrate Checkpoint FW to FMC using the Firepower migration tool.

It seems that the Checkpoint configuration has been extracted properly from secure gateways and smart console but I get an error message during the parsing phase and the migration process stops suddenly with the message - Blocked Error In Connecting To Device - Please Check The Logs

Environment:

Checkpoint secure gateways - 1100 and 4400, R80.40

Smart Console Management - R80.40

FMC - 7.0.0 (build 94)

Firepower Migration tool - 2.3.5-5464

Error Message in the log from the migration tool:

2021-07-13 13:24:55,613 [ERROR | parser_cp.py] > unable to count the objects due to:[local variable 'route_network_address' referenced before assignment]
2021-07-13 13:24:55,616 [ERROR | connect_cp.py] > local variable 'route_network_address' referenced before assignment

I have tested both security gateways and different security policies but with the same result.

I have not found anything relevant related to this error. Unfortunately, I am not able to process it further without sorting it out.

Attached you can find a log file.

Any hint would be helpful.

Thank you
Jozef

Re: FW Migration from Checkpoint R80.40 to FMC 7.0 using Firepower migration tool 2.3.5

Marvin Rhoads — Wed, 14 Jul 2021 12:22:09 GMT

From the log you provided it looks like a bug in the tool to me. I'd recommend opening a Cisco TAC case to confirm. You should be able to use your FMC support contract to open the case.

Re: FW Migration from Checkpoint R80.40 to FMC 7.0 using Firepower mig

raribeiro — Wed, 01 Sep 2021 18:23:26 GMT

Hello Jozef, how are you?

Please, how did you solve this error? I got the same problem here...

Re: FW Migration from Checkpoint R80.40 to FMC 7.0 using Firepower mig

Chakshu Piplani — Fri, 03 Sep 2021 10:25:30 GMT

The Checkpoint Security Manager should be in expert mode, the Security Gateway needs to be in CLISH mode.
So please make sure you have the correct privileges on each one and run the tool again.

Hope this helps

Regards,

Chakshu

Do rate helpful posts!

Re: FW Migration from Checkpoint R80.40 to FMC 7.0 using Firepower mig

Jozef Cmorej — Fri, 10 Sep 2021 10:08:53 GMT

A Checkpoint gateway 1100 is not supported with the migration tool as it uses a bit different CLI syntax. Some commands are not presented on 1100 which causes an interruption of the migration process.