Importing firewall objects from FG to FMG

[aagrafi]

Hello,

I'm having the following issue while adding an FG 1000D (5.6.3) to an FMG (5.6.2): The FG is brand new with no firewall policy configured. During device add, I also imported firewall policies, in hope to import all the service and address objects of the FG into the FMG. But no object was imported. Then, while tried to install a firewall policy from FMG to FG, all the objects of the FG were overwritten by the FMG's objects and all objects which were unique in the FG, were deleted.

I have two questions:

a. Is this how FMG treats the objects from a FG?

b. What can I do if I want to preserve all the FG's objects and import them to FMG?

If I'm not mistaken, older FMG versions were giving you the choice to import these objects or not.

Thanks

Andreas

[ergotherego]

When doing an import, you probably want to select import all objects, not just referenced ones.

FMG will delete unused (unreferenced) objects from the FGT itself. It will keep those things in the FMG database (the ADOM database). Things like firewall addresses that aren't used in firewall policies for example.

When you assign a policy package to a firewall, that is *the* set of firewall rules and such to define on that firewall. FMG becomes the master of the configuration for a firewall it manages. So anything you want to keep on a FGT, needs to be defined on the FMG. And any changes you want to make, need to be done from FMG first.

You may want to look at running your ADOM in backup only mode. That way you can make local changes to the FGT, and it will push those changes up to FMG. In that case, FMG is basically a glorified configuration revision system. It gives you central visibility into changes, just not central management.

[emnoc]

FMG will delete unused (unreferenced) objects from the FGT itself

I think you can over-ride that  function and  keep  all objects regardless if they are or are-not in use.

Ken

[chall_FTNT]

emnoc wrote:

FMG will delete unused (unreferenced) objects from the FGT itself

I think you can over-ride that  function and  keep  all objects regardless if they are or are-not in use.

No, it is not an option.  But it is also not a problem since the FMG ADOM has all the objects in case they are never needed for a policy configuration.

[emnoc]

But it is also not a problem since the FMG ADOM has all the objects in case they are never needed for a policy configuration

/QUOTE]

If that's true than how can it craft a fwpolicy if the object does not exist? I'm questioning you but I  think I remember we had the option during the initial  import for the policy.pkg to import all objects regardless if they where applied in a fw.policy ?

If the FG has at least one policy, even a fake one, then the import allows you to import the FG objects, either all of them or only those used.

I believe your right and that was experience also, but iirc this happen during the initial import.

Ken

[chall_FTNT]

Yes, that is an option during Import (which applies to what is added to the ADOM).  Your intial comment seemed to be about Install & what is deleted from the FGT.

[aagrafi]

Here are my findings after some more testing:

- If the FG has no policy, the import does not proceed at all and there is no way to add any of its objects into FMG.

- If the FG has at least one policy, even a fake one, then the import allows you to import the FG objects, either all of them or only those used.

So, in order to preserve all FG's objects into the ADOM database, I had to create a fake policy, just to import the objects. I can live with this workaround :)

Backup ADOM is not an option. I do want to manage the FG from FMG, but I had already created 250 address objects in the FG and I wouldn't  like to lose all that work and re-create them in the FMG from scratch.

My point is: I would expect that the FMG should allow you to import objects, even if there is no firewall policy configured.

Thanks for your answer.