> Source: [sk183856](https://support.checkpoint.com/results/sk/sk183856)

# sk183856 - Policy migration with the "import_export_package.py" script adds a Network Layer with a Cleanup rule that was not in the original policy, causing traffic drops

| Property | Value |
|----------|-------|
| Solution ID | sk183856 |
| Date Created | 2025-09-02 |
| Last Modified | 2025-09-03 |
| Technical Level | Advanced |
| Products | Security Management Server |
| Versions | R81.20 |

## Symptoms

- * After you migrate Firewall policy packages from an old Security Management Server to a new Security Management Server with the `import_export_package.py` script, all network traffic is dropped after policy installation.

* The output of the `fw stat` command contains the expected policy name, but logs show that the Cleanup rule "Any Any Drop" drops all packets.

  Example command output:  

  ```
  
     fw stat
     Policy name: "expected_policy_name"
  ```

  Log example:

  ```
  
     Rule: Cleanup
     Action: Drop
     Source: Any
     Destination: Any
  ```

* The first rule is a Cleanup rule that does not exist in the original policy.

* A new Network Layer is present in the imported policy on the new Security Management Server, which was not present in the original policy.

* Reverting to the old Security Management Server and reinstalling the policy restores normal traffic flow.

## Cause

During migration, if the original policy does not contain layers or is empty, the `import_export_package.py` script automatically creates a new Network Layer with a default Cleanup rule ("Any Any Drop").

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content