Releases: CheckPointSW/SmartMove
optimization for Juniper SRX
What's Changed
- Added optimization for Juniper SRX by @ShibalovRoman in #33
- Updated cp_mgmt_api_python_sdk https://github.com/CheckPointSW/cp_mgmt_api_python_sdk/tree/master/cpapi
Full Changelog: v9.1...v9.2
SmartAnalyze support for Frotinet and quality
What's Changed
- ScreenOS parsing bug by @parkerpatel in #21
- SmartMove updates by @ShibalovRoman in #23
- Network Object mapping fix by @simonmeadows in #25
- FortiGate, SmartConnector impovements by @ShibalovRoman in #26
- Fixes for SmartConnector and SmartMove by @simonmeadows in #27
- SmartMove improvements, UI changes, added Smart Analyze by @ShibalovRoman in #28
- Enabling SmartAnalyze, improves for PAN-OS and Panorama by @ShibalovRoman in #30
- Only map network objects matching subnet and mask by @simonmeadows in #29
- Added support of ipv6 for Panorama and PAN-OS by @ShibalovRoman in #31
- Added support for ipv6 addresses in smartconnector and conditions for max name length in Pan-OS by @ShibalovRoman in #32
New Contributors
- @parkerpatel made their first contribution in #21
- @simonmeadows made their first contribution in #25
Full Changelog: 6.2.3...V8.1
SmartAnalyze
- Added SmartAnalyze as disabled
Cisco:
- Added option for skip unused objects
- Added flag for console for CiscoASA for skip unused objects
Added a new output file - cp_objects_opt.json with objects and rules from optimized policies
Fixes for SmartConnector and SmartMove
-
Domain objects that already exist are imported with '_1' suffix
Domain objects 'Name' is the fqdn that is meaningful for dns etc.
I have changed it to forcibly not rename and skip any domains that already exist
This means any rules with the fqdn will use the already existing object -
GroupWithExclusion does not have any ['Members']
The GroupWithExclusion has an ['Include'] and ['Except'] but no ['Members']
added a check for when the code reached the processGroupWithMembers function to skip it if it is a GroupWithExclusion -
any not accepted as an object for rules
on multiple occasions I get 'WARN: Requested object [any] not found'
to fix I must replace all instances of "any" with "Any" in the cp_objects.json file
The change changes the default any object from "any" to "Any"
Common updates
- Added deprecated words for naming
- improved functionality for FortiGate vendor:
- Fixes for comparing types of objects
- Fixed incorrect work of option "Do not import unused objects"
Smartconnector networking fixes
- Smartconnector:
- Changed indent of break to re-instate inaccessible code block for mapping existing network objects
- Group members were being added with the member's imported name even if there is a mapped existing object name.
Added a check if object name is in the mergedObjectsMap and replace userGroupMember with the name in mergedObjectsMap.
Leaving print(userGroupMember) on the line before for logging visibility of the mapping name change in the console output.
- Map network object to correct one found in checkpoint database
if more then one network in res_get_obj_with_ip, map to the one that matches subnet
FirePower support
- In console app and in UI was added a new vendor: FirePower with ASA syntax
- Cisco optimized comments rules optimization support - clarify which rules optimized - comments
- fixed bug with ScreenOS parser removing incorrect values from an array
- To console app was added hidden flag --asa-spread-acl-remarks.
This allows the import of comments in a Cisco configuration to be applied to multiple access control entries. Without this flag, Smartmove would only apply the comment to the first imported rule. This creates a situation where all rules have comments stating which change control request was used to make the policy change.
Usage:
SmartMove.exe -s "D:\config.conf" -v CiscoASA -t E:\cp --asa-spread-acl-remarks true|false
add support for context
added support for context - support for Smatr-1 Cloud https://portal.checkpoint.com/dashboard/smart-1cloud#/overview
User can specify a context for web_api with flag -c/--context.
Usage example:
python smartconnector.py -c
smartconnector support for api_key
SDK updated from the repository
added flag -k/--key for loggin by api key. usage example:
python smartconnector.py -k api_key -f cp_objects.json -m 1.1.1.1
user has 3 ways to login: as root user (flag -r), by user credentials (flags -u -p), by api key (flag -k):
login by root user: python smartconnector.py -r -f cp_objects.json -m 1.1.1.1
login by username and password: python smartconnector.py -u -p -f cp_objects.json -m 1.1.1.1
login by api key: python smartconnector.py -k <api_key> -f cp_objects.json -m 1.1.1.1
Allowed only one method of login at one time
SmartMove command line support- extend the CMD flags
Panorama bug fix - allow running config file form relative paths - previously did not work
added a new interactive flag to the SmartMove command line (-i) - allow disable the progress bar for automation testing