Checkpoint to ASA migration

[sarabjeet99]

Hello Experts,

I tried the command mentioned in step 2 on WVT at the mentioned link:

https://supportforums.cisco.com/blog/12049491/conversion-tool-checkpoint-fw-cisco-asa

However it generated only one output file for security policies.

How do I get other files like communities, index , nat-policy netwok-object and services.

[sarabjeet99]

What sort of support forum Cisco is running where no one responds !!!!!!!!!!!!

[Akshay Rastogi]

Hi Sarabjeet,

As per i could see from the tool, you need to collect data as mentioned in Config's gathering steps.

CheckPoint Firewall Data Collection Steps

Download the Web Visualization Tool (WVT) from the website of CheckPoint appropriate for your version of CheckPoint Firewall Run the command (EXACTLY IN THE SAME FORMAT) from the workstation authorized to access the SmartCenter Server "cpdb2web -s <smartcentername/ip> -u <adminusername> -p <adminpassword> -o <outputfolder> -m <gatewayname>" where gatewayname is the name of the gateway whose policies are to be converted. In Provider-1, use the virtual IP address associated with the CMA in place of the SmartCenter IP. The output of this command will be a set of XML files Now collect the interfaces and routing information. Login to the gateway whose policies are to be converted. Change to the Expert Mode. Run the commands"ifconfig -a" and "netstat -rnv" in order and save the output in a text file named "networking.txt" in the folder created above. In case of Provider-1, this is slightly different, here is the example Alternatively, for the above step, if you cannot provide the networking.txt file due to some reasons like say you want to do manual modifications to interfaces & routes, or say if your CheckPoint platform is not generating the compatible networking.txt file, then in that case, you can manually create a file named as"routes.txt". The sample format of the routes.txt file is provided here Now Create a ZIP file out of this Config file (For Windows Users: Select the File, Right-Click, 'Send to → Compressed Zip Folder') Note 1 - A Firewall configuration will not get converted if the default route is not found. Add a temporary dummy default route for the conversion purpose, if needed. Note 2 - To summarize, the input ZIP file should have the following 8 files in total. Ensure that there are no other files or folders in the ZIP file. communities.xml index.xml NAT_Policy.xml network_objects.xml Security_Policy.xml services.xml users.xml networking.txt OR routes.txt Note 3 - The name of the Security Policy and NAT Policy files should be "Security_Policy.xml" and "NAT_Policy.xml" respectively. Manually rename them if this is not the case. Note 4 - In case if there are multiple Security and NAT Policy files, keep only the ones which is to be converted and rename them with the above-mentioned names.

i think it is more of things related to checkpoint tool.  Please try the below steps.

Hope it helps.

Regards,

Akshay Rastogi

Remember to rate helpful posts.

[Marvin Rhoads]

This is a community forum supported primarily by the freely given volunteer time of your networking peers. There is no guaranteed response.

Even the Cisco folks contributing here are doing so on a bast effort basis above and beyond their "day jobs".

If you require guaranteed service level support, then Cisco offers a whole range of paid support options, primarily via the Smartnet support contract vehicles.