migrating zone based address book to global in Juniper SRX

I have written a small script to convert SRX address books which are in zone base format to global. There was already a ready script on juniper forums but I saw they lack duplicate address checks and it couldn’t connect to some SRX devices. Below is the link to the code and how it can be used.

1) First fetch your current zone based addresses from SRX to a Linux host.

2) Download the tool at https://github.com/rtodto/junosrepo/blob/master/srx_migrate_zone2global.py

3) Let’s say your zone based address book file is like this;

4) Run the tool against the legacy address book file as below.
Once you run you will get the new set based commands to be pasted into your SRX box.
If you have a conflict, you will get a message as below but how can a conflict happen?
It is because zone based address books allow you to choose the same address object name
if you blindly convert via another tool it can override your address book entry. In order to
prevent this, tool is simply telling you that address book object “addr1” has more than one
IP address. If both IP addresses are the same, you won’t get a warning.

Once you resolve the conflict i.e rename address book name and update security policies,
simply paste the set/del lines on your SRX command line. Then your address book should be converted.

You have a feedback?

This site uses Akismet to reduce spam. Learn how your comment data is processed.