The following procedures explain how to generate conversion files.
The fwconvert
utility, located in the /opt/SUNWfwcnv/bin directory, is used to generate files that create the SunScreen EFS 3.0 configuration from the original FireWall-1 configuration. The fwconvert
utility examines the rules and objects in your FireWall-1 security policy and generates new configuration files with commands for configuring SunScreen EFS 3.0.
fwconvert
uses the following FireWall-1 configuration files:
policy.name.W, for FireWall-1, Release 2.1, files
policy.name.pf, for FireWall-1, Release 3.0, files
objects.C, for FireWall-1, Release 2.1 and 3.0 files
where policy.name is either default or the name you have given your policy. These files are located in the /opt/SUNWfw/conf directory.
Verify the location of these files and the name of the policy file (indicated by the .pf or .W extension) before you run fwconvert.
You must run the conversion utility on the FireWall-1 machine, even if you are configuring SunScreen EFS 3.0 on another machine.
Open a terminal window and become root on the FireWall-1 machine, if you are not already.
Run the conversion program by typing:
# /opt/SUNWfwcnv/bin/fwconvert & |
fwconvert
displays the FW-1 Configuration Convertor dialog box with the default values already inserted, as shown in Figure 7-1.
Type the path name where the FireWall-1 conversion files are located, or accept the default, if appropriate.
Type the name of the policy file you want to convert, if different from the default.
Do not type the .pf or .W extension.
Type the name of the directory where you want to store the new configuration files, or accept the /opt/SUNWfwcnv/output default.
Pull down the Version menu and choose the release number of your FireWall-1 software, or accept the default, if appropriate.
Click Proceed to start the conversion.
fwconvert
reads the file policy.name.pf (or policy.name.W) and the objects.C files and generates the files used to generate the SunScreen EFS configuration.
When fwconvert
completes successfully, the FireWall-1 Configuration Convertor dialog box displays a DONE button.
Click DONE to exit fwconvert
.