topic Bash application to find and fix conflicting rules in a SMS in Scripts

topic Bash application to find and fix conflicting rules in a SMS in Scripts https://community.checkpoint.com/t5/Scripts/Bash-application-to-find-and-fix-conflicting-rules-in-a-SMS/m-p/275493#M1544 Hello all,   Sharing my solution for the issue where trying to install a huge policy with more then 13 conflicting rules and getting: {   "tasks" : [ {     "task-id" : "0123....",     "task-name" : "Verify policy operation",     "status" : "failed",     "progress-percentage" : 100,     "suppressed" : false,     "task-details" : [ {       "workSession" : "34e7.....",       "title" : "Verification of policy 'K....' completed with errors",       "notifications" : [ ],       "warnings" : [ ],       "errors" : [ "Error: Layer ......."    Too many errors." ]     } ]   } ] } Documentation: # ============================================================================= # Check Point Rulebase Overlap & Validation Fixer # Version: 2.0 # # Identifies and optionally disables: # 1. Rules failing policy verification (via verify-policy API) # 2. Exact duplicate rules (same source/dest/service/action) # 3. Conflicting rules (overlapping traffic, opposite terminal actions) # 4. Shadowed rules (entirely covered by a preceding Any/Any/Any rule) # 5. Rules with empty source/destination/service # # MODES: # Default (dry-run) : Analyse and report only — no changes made # --disable : Disable flagged rules and publish the session # # USAGE: # ./rulebase_cleanup.sh [OPTIONS] # # OPTIONS: # -H, --host HOST Management server IP/hostname (default: 127.0.0.1) # -u, --user USER API username (default: admin) # -p, --pass PASS API password (prompted if omitted) # -r, --root Use local root credentials, no user/pass needed # -P, --policy NAME Policy package name (default: Standard) # -l, --layer NAME Access layer name (default: Network) # --disable Actually disable flagged rules (default: dry-run) # --skip-verify Skip the verify-policy API call (faster re-runs) # --rules-file FILE Use an existing rules_raw.json (skip fetch) # -h, --help Show this help # # REQUIREMENTS: # - Run on the Check Point Management Server (SMS) # - mgmt_cli must be in PATH # - jq must be installed (yum install jq) # - Python 3 # # OUTPUT FILES (written to ./cp_cleanup_<timestamp>/): # rules_raw.json All rules fetched from the API # validation_errors.json verify-policy raw output # validation_issues.json Parsed conflict/warning list from verify-policy # overlap_analysis.json Duplicates, conflicts, shadows from analysis # all_issues.json Merged, deduplicated findings # flagged_rules.txt UIDs to disable # cleanup_report.txt Human-readable summary # ============================================================================= Mon, 11 May 2026 08:25:29 GMT tomshw 2026-05-11T08:25:29Z Bash application to find and fix conflicting rules in a SMS https://community.checkpoint.com/t5/Scripts/Bash-application-to-find-and-fix-conflicting-rules-in-a-SMS/m-p/275493#M1544 2 Mon, 11 May 2026 08:25:29 GMT https://community.checkpoint.com/t5/Scripts/Bash-application-to-find-and-fix-conflicting-rules-in-a-SMS/m-p/275493#M1544 tomshw 2026-05-11T08:25:29Z