Guidelines for migrating Check Point firewall configurations

General guidelines

• Live Connect is supported only for Check Point R80+ versions.

• During migration, Firewall Migration Manager creates a one-to-one mapping for all supported objects and rules, whether they are used in a rule or policy. However, Firewall Migration Manager provides an optimization feature that allows you to exclude migration of unused objects (objects that are not referenced in any ACLs).

  • Unsupported objects and routes are not migrated.

  • Unsupported ACL rules are migrated as disabled rules to the Firewall Management Center.

• For Check Point versions r80-r82 and later in a multi-domain deployment, the extracted configuration might not include the complete rule order for access control entry (ACE) rules when a Customer Management Add-on (CMA) policy uses a Domain Layer action.

  If the source configuration has a Global policy attached to a specific CMA policy, review the rule number index in the extracted configuration and verify that the rules are in the correct order.

• The log option for a rule is enabled or disabled based on the source Check Point firewall configuration.

  For rules with drop or reject action, Firewall Migration Manager configures logging at the beginning of the connection. If the action is permit, Firewall Migration Manager configures logging at the end of the connection.

• Firewall Migration Manager splits the service objects or groups with source and destination ports that are configured within the same object. References to such access control rules are converted into Firewall Management Center rules with the exact same meaning.

Object migration guidelines

Review these guidelines for service objects, which are called port objects in a Firewall Threat Defense device.

In Check Point firewall configurations, service object names can differ only by case. For example, one object name can use lowercase letters and another can use uppercase letters. In Firewall Threat Defense devices, each port object name must be unique, regardless of letter case.

Firewall Migration Manager analyzes all Check Point firewall objects and handles their migration to the Firewall Threat Defense device in one of these ways:

• If each Check Point firewall object has a unique name and configuration, Firewall Migration Manager migrates the objects successfully without changes.

• If the name of a Check Point firewall service object includes one or more special characters that are not supported by Firewall Management Center, Firewall Migration Manager renames the special characters in the object name with a "_" character to meet the Firewall Management Center object naming criteria.

• If a Check Point firewall service object has the same name and configuration as an existing object in Firewall Management Center, Firewall Migration Manager reuses the Firewall Management Center object for the Firewall Threat Defense device configuration and does not migrate the Check Point object.

• If a Check Point firewall service object has the same name but a different configuration than an existing object in the Firewall Management Center, Firewall Migration Manager reports object conflict and allows you to resolve the conflict by adding a unique suffix to the name of the Check Point firewall service object for migration purposes.

• If multiple Check Point firewall service objects have the same name but in different cases, Firewall Migration Manager renames such objects to meet the Firewall Threat Defense device object naming criteria.

Firewall Threat Defense guidelines

• If there are any existing device-specific configurations on the Firewall Threat Defense such as routes, interfaces, and so on, during the push migration, Firewall Migration Manager cleans the device automatically and overwrites from the Check Point firewall configuration.

  Note

  To prevent any undesirable loss of device configuration data from the Firewall Threat Defense device, we recommend you to manually clean the device before migration.

  During migration, Firewall Migration Manager resets the interface configuration. If you use these interfaces in policies, Firewall Migration Manager cannot reset them and the migration will fail.

• Firewall Migration Manager can create subinterfaces on the native instance of the Firewall Threat Defense device based on the Check Point firewall configuration. Manually create interfaces and port channel interfaces in the target Firewall Threat Defense device before starting migration.

  For example, if your Check Point firewall configuration is assigned with these interfaces and port channels, you must create them in the target Firewall Threat Defense device before migration:

  • Five physical interfaces

  • Five port channels

  • Two management-only interfaces

  Note

  For container instances of Firewall Threat Defense devices, subinterfaces are not created by the Firewall Migration Manager, only interface mapping is allowed.