The log files describe instances where fwconvert
could not directly convert your FireWall-1 policy to an equivalent SunScreen EFS 3.0 policy. After conversion, you should review the contents of the log files to determine further actions that might be necessary for the new SunScreen EFS 3.0 configuration.
The policy.name_Obj.log file lists objects found in your FireWall-1 security policy that were not directly supported in SunScreen EFS 3.0. Table 7-5 lists the FireWall-1 objects and shows whether they were converted to SunScreen EFS.
Table 7-5 How Conversion to SunScreen EFS Affects FireWall-1 Objects
FireWall-1 Object |
EFS Equivalent |
Conversion Status |
---|---|---|
Host |
Host |
Yes. |
Network |
None |
Yes. Does not appear in the GUI but will show up on the command line. To make them visible in the GUI, manually change the NETWORK objects to RANGE objects via the command line. |
Router |
None |
No. See the policy.name_Obj.log file for details. |
Switch |
None |
No. See the policy.name_OBJ log file for details. |
Domain |
None |
No. See the policy.name_OBJ log file for details. |
Group |
Group |
Yes. |
Gateways |
None |
No. However, they are logged in the policy.name_OBJ.log file. Gateways require more configuration within SunScreen EFS to assure that the IP addresses of the gateway are correct. See the ss_interfaces man pages for more information. |
Following is a sample which shows the policy.name_Obj.log file, similar to the file that you can generate from your FireWall-1 policy.
/***** SunScreen EFS 3.0: Firewall-1 conversion log *****/ /***** @(#)ObjStore.java 3.6 99/03/03 Sun Microsystems, Inc. *****/ Objects of type: gateway, need some user decisions You had a gateway with name "skil" ipaddr 205.167.60.13 If this is the gateway on which SunScreen is being installed please refer to the 'ssadm edit' command to enable the interfaces |
This file shows rules generated from FireWall-1 rules that cannot be used in the SunScreen EFS environment without modification. The policy.name_Rule.log file explains why these rules were not added to the SunScreen EFS firewall, for example:
Source, Destination, or Installed on objects are of a type not supported by SunScreen EFS 3.0
FireWall-1 Service is of a type not supported by SunScreen EFS 3.0
FireWall-1 Action is not supported by SunScreen EFS 3.0
SunScreen EFS 3.0 does not support FireWall-1 encryption, user authentication, or client authentication. Encryption in SunScreen EFS 3.0 is accomplished through SKIP, as explained in the SunScreen EFS 3.0 Reference Manual. For more information regarding SKIP, see the SunScreen SKIP 1.5 User's Guide.
All FireWall-1 rules are generated during the conversion. You must manually remove any rules that you do not need.
The following shows a sample of a policy.name_Rule.log file such as you might find after FireWall-1 to SunScreen EFS conversion.
/***** SunScreen EFS 3.0: Firewall-1 conversion log *****/ /***** @(#)RuleStore.java 3.5 99/03/03 Sun Microsystems, Inc. *****/ Rule below not added as the action Encrypt is configured differently in SunScreen EFS. add_nocheck Rule "smtp" "aiims" "*" Encrypt Rule below not added as the action Encrypt is configured differently in SunScreen EFS. add_nocheck Rule "echo" "aiims" "*" Encrypt Rule below not added as the action User Authentication is not valid in SunScreen EFS. add_nocheck Rule "ftp" "*" "aiims" User Rule below not added as the action Client Encryption/Authentication is not valid in SunScreen EFS. add_nocheck Rule "dns" """ "*" Client |
The following lists FireWall-1 objects encountered in your policy that are not supported by SunScreen EFS.
#Invalid Objects from FW-1 #Wed Mar 31 17:40:23 PST 1999 invalidobj1=gateway skil |