Checkpoint to AFM migration

Hi,

I'm afraid that 'til today, there's no easy way to migrate from Checkpoint NGFW to BIG-IP AFM.

In BIG-IP AFM you could configure rules Globally, per Route Domain (if you combine this with Partitions it's similar to Cisco VRF/Isolated Zones/etc), per Virtual Server, per Self-IPs...

BIG-IP AFM is a high-performance, stateful, full-proxy security solution, with Geolocation, Protocol Anomaly Detection, Port-misuse protection, DoS and DDoS protection (DDoS auto-threshold), that can remotely triggered black hole filtering.

More information:

F5 BIG-IP Advanced Firewall Manager Operations Guide

This is something i would love to do, but would never get approval for.

Depending on what version you're running your best bet would be to convert outputs from DBedit to TMSH commands.

You can export your Checkpoint FW policy to the Cisco ASA migrator to create a set of files that list policies, address-lists and rules, then change those commands from Cisco ASA-nese to F5 tmsh commands.