Vous êtes sur la page 1sur 53

Firewall Configuration Migration Tool

Technical Training for OS v 1.6.1

Albert Estevez Polo


aestevez@paloaltonetworks.com

Webinar Agenda

Migration Tool Overview

Demo of an Check Point configuration


migration

Q&A

Page 2 |

Firewall Configuration Migration Training - June 2011

Migration Tool Introduction

Palo Alto Networks migration toolkit offered free of charge to


qualified partners to assist with migration projects

Migration
Features
Migration
Tool Features
Configuration
Migration

o Migrates Security
policies
o Migrates NAT
policies
(Check Point only)
o Address objects
(including groups)
o Service objects
(including groups)
o Route table entries

Page 3 |

Configuration
Editor

Configuration
Consolidation

o Offline security policy


editor
o Edit address objects
o Edit service objects
o Edit Zones

o Useful tool when


consolidating multiple
firewall configurations
o Merges a new
configuration into a
production firewall
configuration

Firewall Configuration Migration Training - June 2011

Migration Tool Benefits

A standard migration flow:


Firewall Migration Process
1.

Network design and requirements analysis

2. Migrate the existing firewall rules and objects


3.

Review the migrated rules and objects

4.

Finalize the firewall configuration

5.

Functional testing and validation

6.

Cutover to the new firewall

7.

Post cutover monitoring and policy tuning

Page 4 |

Automation saves
time

Firewall Configuration Migration Training - June 2011

Reduces migration
errors

Supported Vendors
Supported Firewall configuration migrations
Vendor

OS Versions supported

Cisco ASA/PIX/FWSM
Cisco IOS

PIX OS: 6.0.x, 7.x, 8.x, ASA OS: 7.x, 8.0-8.1


IOS 11.x and newer, extended ACLs only

Juniper/NetScreen

ScreenOS ver 5.x for NetScreen and SSG platforms


(SRX Jun-OS configs are not supported)

Check Point

FW-1 R65, R70, R71, R75 are supported

Fortinet

FortiOS 3.x 4.x

Note: configurations will be converted to PAN-OS .xml format that


can be directly imported into a Palo Alto Networks firewall

Page 7 |

Firewall Configuration Migration Training - June 2011

Migration Features List


Cisco IOS

Cisco PIX/ASA

Juniper/
NetScreen

Check Point

Fortinet

NAT Rule Migration

TBD

TBD

TBD

TBD

VPN Configuration

TBD

TBD

TBD

TBD

TBD

Rule Conversion

Topics
Security Zone
Migration
Security Policy
Migration

Object Conversion
Static Routes
Address Objects
Address Groups
Address Ranges
Services
Service Groups

Services Ranges
Page 8 |

Firewall Configuration Migration Training - June 2011

Migration Walk-Through

Page 9 |

Firewall Configuration Migration Training - June 2011

Migration Steps
1. Obtain the production firewall configuration files

2. Import the firewall configuration into the migration tool


3. Review the migration logs and migrated rules and objects
4. Review and the migrated security policies
5. Correct any configuration incompatibilities and generate a
PAN-OS XML configuration file
6. Import and Load the generated configuration
7. Finalize the configuration on the Palo Alto Networks firewall

Page 10 |

Firewall Configuration Migration Training - June 2011

1. Obtain the Production Firewall Configuration Files


See Appendix B on the steps to export and format Cisco, CheckPoint

and Juniper/NetScreen configuration files


Prior to importing, the respective configuration files must be named

using the following conventions


(note: file names are case sensitive)
Configuration

Required files

CheckPoint

objects_5_0.C
routes.txt
PolicyName.W
rulebases_5_0.fws (optional - for migrating comments)

Cisco

config_cisco.txt

Juniper/NetScreen

config_screenos.txt

Page 11 |

Firewall Configuration Migration Training - June 2011

2. Import the production firewall configuration file


Open the Web interface and upload the configuration
HTTP://<IP Address of Migration Server>

Page 12 |

Firewall Configuration Migration Training - June 2011

2. Import the production firewall configuration file


Choose the source of the configuration file and a pop-up window will

appear to import the config files

Page 13 |

Firewall Configuration Migration Training - June 2011

3. Review the migrated logs and objects

Review and edit


objects

Page 14 |

Warning messages
and policy editor

Firewall Configuration Migration Training - June 2011

3. Review the migrated logs and objects (Contd)


The objects to review window

allows for viewing and editing of


the address and service objects
and route entries
The route entries are used for

Zone assignments in the


security policies
For Check Point configs the

Zones must be manually entered


For NetScreen, Fortinet and

Cisco ASA configs the Zones


will be learned from the
configuration
Zones can be renamed as

needed

Page 15 |

Firewall Configuration Migration Training - June 2011

3. Review the migrated logs and objects (Contd)


Review the address and service

objects
Note: All migrated objects are

not displayed. Only objects that


need to be reviewed are listed
Object values can be manually

edited in the review pane by


clicking on the value

Page 16 |

Firewall Configuration Migration Training - June 2011

3. Review the migration logs and warnings


Pay particular attention to

warning messages
These message are

pointing so some implicit


NAT rules not migrated
Also warning messages

pointing to non-TCP/UDP
service objects that need to
be reviewed and corrected
prior to generating the XML
config file

Page 17 |

Firewall Configuration Migration Training - June 2011

4. Review the migrated Security Policies

Security Policy Editor menu options


Description
Refresh

Refreshes the Security Policy page to reflect any changes made to address and service
objects and zone assignments made to route entries

Auto Assign Zone

Assigns the source and destination zone by referencing the route entries

Enable

Enables a security policy

Disable

Disables a security policy

Delete

Deletes a security policy

Merge

Merges security policies

Save

Saves the changes (after enabling, disabling and merging policies)

Search windows can be used to search for specific address and service
objects used in the security policies

Page 18 |

Firewall Configuration Migration Training - June 2011

4. Review the migrated Security Policies


Review and edit the

migrated security
policies
Pay attention to the

Click a field in the


security policy to
open the security
policy editing window

Zone assignments

Edit the objects in the security policy


and click Save
The window must be manually closed
after editing and saving.

Page 19 |

Firewall Configuration Migration Training - June 2011

4. Review the migrated Security Policies


Security policy zone assignments
Zones are learned from the Route entries

The IPs and IP subnets are read in the security policies and

compared against the route table entries to assign the Source and
Destination zones in the policies
The default is to assign any for the Zone

Edit the Zone option in the Interfaces and zones window


A red hash indicates the setting has not been saved

Edit the Zone

Page 20 |

Firewall Configuration Migration Training - June 2011

4. Review the migrated Security Policies


Security policy zone assignments (contd)
After editing the Zone settings, click Save

In the Security Policy Editor choose Auto Assign Zone to re-assign

the source and destination zone in the security policy configurations


The migration software will make a best effort to assign the zones in

the security policy

Edit the Zone

Page 21 |

Firewall Configuration Migration Training - June 2011

Choose Auto
Assign Zone
to transfer the
Zones to the
security
policies

5. Generating a PAN-OS configuration file


Configure the management

settings using the Device Config


tab

Note: If importing a PAN-OS

config to use the Config Editor or


Config Consolidator options, the
management settings will be
copied from the imported PANOS config file
Objects to review
Device Config

Page 22 |

Firewall Configuration Migration Training - June 2011

5. Generating a PAN-OS configuration file


Generate a configuration file after reviewing and correcting

the objects listed in the warning logs


Any errors will be displayed when generating the XML file
Use the Reload Data option to correct errors related to the

address objects
Service and address objects can be edited to correct any

errors

Page 23 |

Firewall Configuration Migration Training - June 2011

5. Generating a PAN-OS configuration file


Create XML will generate a PAN-OS configuration file using the

migrated objects and policies


Note: the version 3.x setting generates a config file that is compatible

with PAN-OS 3.x and 4.0.x.

Create XML version 3.x

Page 24 |

Firewall Configuration Migration Training - June 2011

5. Generating a PAN-OS configuration file


Review and correct any errors displayed when creating the configuration

file
Common errors are address objects migrated with invalid addressed or

netmasks
Corrections can be made by issuing the Reload Data function

manually editing the object

Page 25 |

Firewall Configuration Migration Training - June 2011

or

5. Generating a PAN-OS configuration file


After correcting the errors, start the Create XML function
Choose L3 to maintain the Zone assignments in the security policies

The L2 option is used primarily when migrating Transparent firewall

configurations from NetScreen and Cisco FWSM


The L2 configuration will replace the source and destination zones in the

security policies to a default Trust

Page 26 |

Firewall Configuration Migration Training - June 2011

5. Generating a PAN-OS configuration file


The config file is saved as a zip file
Unzip and import the XML configuration file into your Palo Alto Networks

firewall

Page 27 |

Firewall Configuration Migration Training - June 2011

6. Import and Load the configuration file


Import the migrated config file into your Palo Alto Firewall
This step assumes you have previously assigned a management IP and

can access the management console via HTTPS or SSH


(this example will use HTTPS)

Page 28 |

Firewall Configuration Migration Training - June 2011

6. Import and Load the configuration file


Load the migrated config

file into your Palo Alto


Firewall

----Do not Commit until you


have thoroughly reviewed
and finalized the
configuration
-----

Page 29 |

Firewall Configuration Migration Training - June 2011

7. Finalizing the Configuration


Configuration review checklist:
Configuration Review
1) Network

Configure the Interfaces:


Mode (L2, Vwire, L3)
IP Address
Zone assignment

2) Virtual-Router

Default gateway
Static Routes

3) Security Policies

Security Policies:
Destination Zone assignments
Convert service port to appID policies where needed

4) NAT policies

NAT Policies:
Create source and destination NAT policies (as needed)

5) Custom Services

Consolidate services where possible to remove duplicate and


overlapping objects
Review any custom services to verify the port assignments

Page 30 |

Firewall Configuration Migration Training - June 2011

7. Finalizing the Configuration


After reviewing and finalizing the migrated configuration, commit
the changes
At this stage the firewall will have a base configuration including
the migrated objects and policies. Once the base configuration
committed, you can now configure advanced settings such as SSLVPN, IPSec VPN, UserID, etc Please see the PAN-OS
Administrator guide or the Palo Alto Networks Knowledgebase
for documentation on how to configure specific features.

Page 31 |

Firewall Configuration Migration Training - June 2011

TOOLS
Beyond Migrations

Tools
The new Tools section is created to help in some

migrations when is not necessary to migrate all from the


legacy device to your new Palo Alto Networks NextGen
Device, and you want to perform some changes in the
configuration or maybe delete a lot of unused Objects
before to clean some rules for example.

Page 33 |

2011 Palo Alto Networks. Proprietary and Confidential.

Migration Translator
The translator process can help you to migrate a policy

where some address objects will change their name and


the address, in this case you have and OLD object (based
in the IP address) and needs to be changed by optionaly a
new IP address or a new Name or BOTH.
Another feature that includes is automaticaly if you want to

change the OLD IP address 1.1.1.1 and the OLD name is


like asdf-1.1.1.1-host the tool will change the OLD IP
address by the new one without to write the new name into
the CSV file required to do that (translate.csv).
The CSV file must be filled with this field order (; separated)
-

Page 34 |

OLD_IP;NEW_NAME;NEW_IP

2011 Palo Alto Networks. Proprietary and Confidential.

Migration Zone Translator


In Big migrations is necessary to change the names in the

new platforms by design requirements.


If the zone name is auto retrieved from the configuration

like in Cisco, Juniper or Fortinet we can use this feature to


say which OLD Zone name will be translated by a NEW
one. And for instance change all the rules afected too.
The file must be create with the name (translate-zones.csv)

and the internal config will be


-

Page 35 |

OLD_ZONE_NAME;NEW_ZONE_NAME

2011 Palo Alto Networks. Proprietary and Confidential.

Migration Split Config


In some situations when we import a configuration to the

Migration Tool we get all the security policies and all the
interface and zone information but we want to migrate only
some zones and only the rules afected by this zones
We must to create a CSV file called (translate-zones.csv) the

same if we want to use the Zone Translator and only write


inside the Zones that we want to use in our migration, the
rest of the zones in the configuration will be erased and all
the rules afected too.
If you dont want to change the name of the zones you

must fill the CSV file like this


-

Page 36 |

OLD_ZONE_NAME;OLD_ZONE_NAME

2011 Palo Alto Networks. Proprietary and Confidential.

Calculate Unused Objects


The system perform an initial check for used or not objects
But if you make changes, add / delete rules, uses another

Tools like the Config Splitter the most common is that


exists lots of objects that in the begining were used but not
now.
Using this feature the system recheck all the objects based

in the policies to know if is used or not and updates the


Statistics in the Generate Report option.

Page 37 |

2011 Palo Alto Networks. Proprietary and Confidential.

Demo Prctica
Al Turrn

Appendix A:
Downloading and Installing the Migration
Server software

Obtaining the Migration Tool Software


The software is offered free of charge to Palo Alto Networks ACE

partners. Contact your local Palo Alto Networks SE for access or


request to be added to the Firewall Migration community on our
Live website.
https://live.paloaltonetworks.com/index.jspa
Support is provided on a best effort basis via the following

methods:
-

Contacting your local Palo Alto Networks SE

Sending an email to fwmigrate@paloaltonetworks.com

Note: Please do not contact the general Palo Alto Networks support hotline for
questions related to the use or installation of the Migration software. The standard
Palo Alto Networks support is not available for assistance with this software.

Page 40 |

Firewall Configuration Migration Training - June 2011

Running the Migration Tool Software


The Migration Tool is packaged as a virtual machine

image that runs on VMware:


Platform

OS Versions supported

VMware Player

Version 3.1.1 and newer

VMware ESX

Version 3.0 and newer

Hardware requirements are dependent on the VMware

platform chosen (Player or ESX)


Recommended hardware

CPU

P4 or newer

RAM

1 GB

HDD

2 GB

Interface

NAT and Bridged modes are supported

Page 41 |

Firewall Configuration Migration Training - June 2011

Running the Migration Server Virtual Machine


1. Unzip the Migration Tool
virtual machine onto the host
machine
2. Start your VMware player and
choose:
Open a Virtual Machine
3. Browse to the directory
where the Migration Server
files were unzipped and open
the file
MigrationToolVM.vmx
4. After installation, choose Play
virtual machine to boot the
VM

Page 42 |

Firewall Configuration Migration Training - June 2011

Running the Migration Server (contd)


5. When prompted for the
virtual machine information,
choose: I copied it

6. Upon booting, the Migration


Server will acquire an IP
address that can be accessed
locally. The IP address that is
configured will be displayed
in the VMWare console
Note: The default Network
Adapter setting in VMware
Player is to use NAT and
acquire an IP address
dynamically

Page 43 |

Firewall Configuration Migration Training - June 2011

Accessing the Migration Server


7. The Migration Tool server interface can be accessed locally by opening a
browser to: http://<assigned IP address>

After accessing the management console upgrade the migration software to the
latest version. The upgrade process uses SSH to contact the update server, if the
upgrade process fails verify your network firewall is allowing outbound SSH
connections from the virtual machine.

Page 44 |

Firewall Configuration Migration Training - June 2011

Menu Tools
FROM: Choose the firewall config
to migrate (Fortinet migration support
will be added in an upcoming release)

SYSTEM: Management options


for log management and
software reboot

SETTINGS: Used to set the


environment prior to starting
a migration. Options include
migrating just the objects or
objects+rules. Can also set the
extended mode to support
longer object names
UPGRADE: Initiates the upgrade
of the migration software.
Internet access is required to
upgrade the Migration
Software OS
Page 45 |

Firewall Configuration Migration Training - June 2011

Appendix B: Exporting Existing Firewall


Configurations

NetScreen/Juniper Migration
The file you upload must be called config_screenos.txt
You can obtain the configuration file from the WebUI:
Configuration Update Config File,
From the CLI capture and save to a text file the output from get
conf

Page 47 |

Firewall Configuration Migration Training - June 2011

Cisco PIX/ASA/FWSM Migration


The file you upload must be called config_cisco.txt
Capture and save to a text file the output from show run

Page 48 |

Firewall Configuration Migration Training - June 2011

Check Point Migration


Check Point migrations require three files:

1. objects_5_0.C
2. PolicyName.W
3. routes.txt
The name of the policy file (referred to here as PolicyName.W)

will have whatever name you assigned it, but look for a .W
extension associated with it in the SmartCenter/management
console.
The rulebases_5_0.fws is not required but is recommended to

be included for migration as it includes the object comments


There are multiple methods to find and export the files. Some

options will be listed in the following slides.


Page 49 |

Firewall Configuration Migration Training - June 2011

Check Point Migration (contd)


Export the objects_5_0.C, PolicyName.W and rulebases_5_0.fws
files from the SmartCenter management console:
1.

Close all SmartDashboard connections to SmartCenter

2.

As a recommended precaution issue cpstop.exe to stop all


Check Point services.

3.

Log in to the CLI with administrator privileges or open Windows


explorer for Windows installations

4.

Navigate to the directory $FWDIR/conf to find the necessary


files.

5.

The objects_5_0.C and rulebases_5_0.fws will be named


exactly. The Policy file will have the name assigned by the
administrator, with a .W file extension

Page 50 |

Firewall Configuration Migration Training - June 2011

Check Point Migration (contd)


A second option to find the necessary files is to use the find
command to search.

Preferably you will want to issue the command from the


Smartcenter server.
>find / -name *.W
Find the files that match the following:

-The .W file matches the policy file configured by the firewall


administrator
-Export the objects and rulebases files found in the same directory
where the policy file (.W) was found
Page 51 |

Firewall Configuration Migration Training - June 2011

Check Point Migration (contd)


Generating the routes.txt file:
1. Log in to the firewall CLI
2. Run the command netstat nr > routes.txt
3. Export the routes.txt file

Page 52 |

Firewall Configuration Migration Training - June 2011

Appendix C: Assigning an IP to the


Migration Server

Assigning an IP Address to the Migration server


The default Vmware Player setting is to enable DHCP
Static IP assignment can also be configured using the steps below
Log into the VM console using the admin account:
Username: admin Password: paloalto

Run the setup or ifconfig utility from the CLI and follow the menu
to assign an IP address to be used by the Migration software for
access
Note: when using the ifconfig option the IP addresses is not saved
and will be lost after a reboot. IP assignment using the setup
utility is saved.

Page 54 |

Firewall Configuration Migration Training - June 2011

Assigning an IP Address to the Migration server

Page 55 |

Firewall Configuration Migration Training - June 2011

Vous aimerez peut-être aussi