To test this feature, visit your live site.

FWs Migration - from Checkpoint to Palo Alto

FWs - Migration from Checkpoint to Palo Alto

Good afternoon PANgurus, as always, thank you for your time, good vibes and collaboration.

Soon we have a mission to migrate some Firewall Checkpoints to Palo Alto.

Well I plan to use Expedition to perform the migration processes.

Now according to your experiences what or which aspects to consider for these processes, to have a double check, requirements, etc.

Thanks for your time, I remain attentive to all your comments, advices, contributions, details, considerations, etc.

Regards

4 comments

Comments (4)

Reaper

Feb 17, 2023

I think both are on/from the firewall

Reaper

Feb 17, 2023

...cont'd.: use the replace tool and "remove" to get the Palo default "any" (mind capital vs lowercase a)

Reaper

Feb 17, 2023

Checkpoint to Palo is actually quite easy

Collect and import the CP config files, add a Palo plain config file, remove any bad and unused object

Doublecheck rules and NAT

done

I've had one case where CP poisoned the transition by having an object called "Any", if you encounter this, simply

MetgatzGR

Feb 17, 2023

Replying to

Excellent @Reaper, thank you for your comments and for your prompt response, I will take into consideration all those details and points you mention.

-Reviewing this link, which allows to extract the necessary files to be able to upload to Expedition. I have a doubt. The first process, the "Exporting Configuration" "SmartCenter Server where Checkpoint R80 management is running" This refers example, in an environment where they have the Smart1 Appliance and the FW in HA Cluster, this step should be taken from the Firewalls or from the Smart1 console? -And the second second point, the one of :Exporting Routing and interfaces, from the Firewall CLI, you can run the following: netstat -nr > routes.txt. I would understand that this step should be taken from the Firewall not from the Smart1 console, please correct me if I am wrong.

https://live.paloaltonetworks.com/t5/expedition-articles/migrating-checkpoint-r80-updated-on-december-2020/ta-p/216298

Thank you very much for your time, your comments and your collaboration.

Best regards

Forum: Forum