Check Point Conversions

Check Point system information

Check Point configuration files are exported from Smart Center or Provider-1, Smart Center contains the configuration of multiple firewalls and policy packages. In the conversion process, FortiConverter requires users to select the target firewall/firewall cluster and the corresponding policy package. Therefore, please find out the name of the target firewall/firewall cluster to be converted, and the name of the policy package installed on the target firewall/firewall cluster to ensure accuracy of the conversion results.

For the Smart Center with version above R80.10, the policy package configurations should be exported via Smart Console. Please navigate to the desired policy package and export into two CSV format files, saved into <firewall rules>.csv and <nat rules>.csv. For the steps to save Check Point configuration files, please see Saving the Check Point source configuration file.

Check Point differences

General

• The FortiGate set allowaccess command for interfaces doesn’t exist on Check Point. Because FortiGate requires this setting, FortiConverter enables all services for interfaces by default.
• The interface Lead to Internet is a default static route on FortiGate.
• FortiConverter supports Traditional Mode and Simplified Mode IPSec.

Schedule configuration

FortiConverter converts "Day in month" time schedules to FortiGate one-time schedules. It converts "Day in week" and "None" schedules to recurring schedules.

You assign a year range for the "Day in month" schedule. If the specified day doesn't exist for a certain month, FortiConverter doesn't generate the one-time schedule for that month.

NAT and policy configuration

FortiConverter supports the conversion of the following NAT types:

• Hide NAT
• Static NAT
• Manual NAT

FortiConverter doesn't convert NAT global properties.

VPN configuration

Both of the Check Point IPSec VPN modes are supported:

- Traditional Mode* (Support only before R80.10)

- Simplified Mode

Check Point doesn't configure VPN within a firewall rule. When FortiConverter converts the configuration to FortiGate, it generates several VPN policies from non-"Lead to Internet" interfaces to the "Lead to Internet" (default route) interface.

After FortiConverter converts the VPN configuration, the VPN policy destination interface refers to the "Lead to Internet" interface. If you changed the default route egress interface, you may need to update the VPN/Policy configuration manually.

FortiConverter can detect and convert meshed and star VPN topologies in Simplified form.

To convert Traditional Mode policies to Simplified Mode policies, use the Check Point Security Policy Converter Wizard. This can be found by clicking Policy > Convert to > Simplified VPN from the Check Point SmartDashboard.

Service objects

Unlike FortiGate service objects, Check Point service objects have a protocol type attribute. FortiGate uses a session helper object to provide the same functionality as the service objects with a protocol type attribute.