Confwiz or other tools for Cisco to Check Point migration

[diantas]

Hello,

I am looking to update a Cisco firewall (version 9.1) to the latest version of Check Point (77.20 or above). Any tips or useful tools are greatly appreciated.

I have looked into potentially using confiz but I don't believe it has been tested on any newer versions. Has anyone tried migrating Cisco to a version of Check Point R77 or greater?

Thank you.

[abusharif]

Make sure you get the latest version av confwiz through the propper channels (your SE).
Those publicly available are far from latest ones.

[jdmoore0883]

While confwiz can sometimes work, it is completely unsupported by Check Point, and it won't make a perfect conversion of the rules; it'll make a decent conversion, at best, and a completely useless conversion at worst. In my experience, the better method would be to simply re-create the rulebase, as this ensures that the rules are created in accordance with Check Point best practices, rather than trying to convert a policy from another vendor with a completely different approach to network security.

[abusharif]

Its far from perfect yes (any tools are). I've tested competitors migrations tools and while some of them are waaay more advanced and fancier than confwiz none of them can do 100% job. Its always something with NAT, VPN tunnels etc.

Anyway, if the ruleset is huge it will definitely save you some time. If nothing else to create objects etc.
Also I would like to give thumbs up for Check Point policy optimization service which worked really well for me on gigantic policies!


But yeah, if you have possibility / time to do it from scratch, by all means do that as you can filter out bunch of crap not used and adapt the policy "the Check point way" right from the beginning.

[diantas]

It isn't an an overly large rulebase so it sounds like it may just be best if I just rebuild it without the use of confwiz. Thanks for your help!

[nkcedwin]

Hi guys,

Please advise me where I can download the above tools beside going to checkpoint website.
As I really need to convert the Cisco ASA into checkpoint power-1 5070 which is currently on R75.45.
Please also advise me where I can download the R80 firmware and can I directly upgrade it from R75.45 to R80?

thank you

New guy on the block and still green
Edwin Ng

[ShadowPeak.com]

Hi guys,

Please advise me where I can download the above tools beside going to checkpoint website.
As I really need to convert the Cisco ASA into checkpoint power-1 5070 which is currently on R75.45.
Please also advise me where I can download the R80 firmware and can I directly upgrade it from R75.45 to R80?

thank you

New guy on the block and still green
Edwin Ng

First off, R75.45 is no longer supported. R77.30 is the oldest actively supported release.

Check out the new SmartMove tool for easily converting Cisco configs to Check Point: sk115416: How to migrate a competitor's database to Check Point with SmartMove

Yes you can upgrade directly from R75.45 to R80.10, although if you are on SecurePlatform instead of Gaia it might be a bit more complicated.

Download of R80.10 is here at usercenter.checkpoint.com: sk111841: Check Point R80.10

If you do not have a support contract for access to download the code, talk to your Check Point SE. Please do not request someone here at CPUG to get it for you.

[cciesec2006]

First off, R75.45 is no longer supported. R77.30 is the oldest actively supported release.

Check out the new SmartMove tool for easily converting Cisco configs to Check Point: sk115416: How to migrate a competitor's database to Check Point with SmartMove

Yes you can upgrade directly from R75.45 to R80.10, although if you are on SecurePlatform instead of Gaia it might be a bit more complicated.

Download of R80.10 is here at usercenter.checkpoint.com: sk111841: Check Point R80.10

If you do not have a support contract for access to download the code, talk to your Check Point SE. Please do not request someone here at CPUG to get it for you.

I've played a bit with Cisco to Checkpoint migration using that sk mentiioned above. It will help with primitive stuffs but for complex NAT in CiscoASA, it is pretty worthless :-(

Btw, Cisco has pushed people away from ASA code and into Firepower code. The SK will not be able to help with this conversion, FYI

[ShadowPeak.com]

I've played a bit with Cisco to Checkpoint migration using that sk mentiioned above. It will help with primitive stuffs but for complex NAT in CiscoASA

Converting the NAT policy going from Cisco to Check Point has always been the hardest part about the conversion process. Hopefully at some point Security Zones will be supported for use in Check Point NAT policies as that would have helped out a lot.

[PhoneBoy]

First off, R75.45 is no longer supported. R77.30 is the oldest actively supported release.

Check out the new SmartMove tool for easily converting Cisco configs to Check Point: sk115416: How to migrate a competitor's database to Check Point with SmartMove

Yes you can upgrade directly from R75.45 to R80.10, although if you are on SecurePlatform instead of Gaia it might be a bit more complicated.

Download of R80.10 is here at usercenter.checkpoint.com: sk111841: Check Point R80.10

If you do not have a support contract for access to download the code, talk to your Check Point SE. Please do not request someone here at CPUG to get it for you.

Earlier releases definitely require a support contract, but R80.10 does not.

Sent from my SM-G955U1 using Tapatalk

[ShadowPeak.com]

Earlier releases definitely require a support contract, but R80.10 does not.

Sent from my SM-G955U1 using Tapatalk

Didn't believe it at first, but I just downloaded the R80.10 iso while being signed out from the Check Point User Center and it worked. Nice tip!

[PhoneBoy]

Didn't believe it at first, but I just downloaded the R80.10 iso while being signed out from the Check Point User Center and it worked. Nice tip!

It's a fairly recent development that I may or may not have something to do with :)