Importing config from the "other" freebsd firewall?

sporkme

Hi,

Is this still an option? I know when I moved from pfsense to opn, with some light editing of the xml file I was able to pull in some of the things that would be time-consuming, like aliases. I'd like to come back to pfsense for awhile to see how things compare, but would like to import as much of the config as I can. What's the current status of this?

Also what's the countdown on the AES-NI thing? Looks to be at least a year before this is forced, correct? I'm on a perfectly fine Core2Duo SFF Dell that remains healthy and has more than enough CPU for my needs.

provels

@sporkme If they were once that similar, I think I'd build a base pfSense and export the config and do a side-by-side. Re. AES-NI that has been skipped for the present in both the current release and development versions.

sporkme

Thanks - I'm installing pfsense in a VM with a matching number of ethernet interfaces and then I'll do some diffing of stuff after creating a basic config.

Great news on the AES-NI thing. Might actually buy new hardware by the time that rolls around.

sporkme

Hmmm, they are diverging, but migrating chunks is possible.

Here's the opn format for aliases. Of note, it's nested within the firewall section. There is also a UUID attached, but that's simply ignored on input. Also "description" is "descr" and wrapped in CDATA tags, "content" needs to be combined to a single line and changed to "address", and the fields for "update frequency", "counter" and "enabled" can be removed:

<Firewall>
  <Alias version="1.0.0">
    <aliases>
      <alias uuid="e64c76f3-49bb-4b8c-8f77-440bbe964e61">
                  <enabled>1</enabled>
                  <name>voip</name>
                  <type>host</type>
                  <proto/>
                  <counters>0</counters>
                  <updatefreq/>
                  <content>10.3.2.19
      10.3.2.20
      10.3.2.21
      10.3.2.51</content>
                  <description>voip devices</description>
                </alias>
   </aliases>
  </Alias>
</Firewall>

And the same after some massaging:

<aliases>  
<alias uuid="e64c76f3-49bb-4b8c-8f77-440bbe964e61">
	<enabled>1</enabled>
	<name>voip</name>
	<type>host</type>
	<address>10.3.2.19 10.3.2.20 10.3.2.21 10.3.2.51</address>
	<descr><![CDATA[voip devices]]></descr>
  </alias>
</aliases>

sporkme

Well, with a small amount of work I was able to grab the most time-consuming stuff for import: IP aliases and DHCP config (including all the reservations). Works great so far.

Now to continue testing and see if the panics I was seeing on the other firewall are hardware-related or (my suspicion) HardenedBSD-related.

If I had more time I'd be a true nerd and make a configuration transmogrifier that lets you flip-flop between these two vendors.. :)