topic GAIA - Easy execute CLI commands from management on gateways! in Scripts

GAIA - Easy execute CLI commands from management on gateways!

HeikoAnkenbrand — Tue, 27 Jan 2026 23:06:39 GMT

169

Re: NEW - Easy execute commands from management on gateways!

Danny — Fri, 12 Apr 2019 17:45:45 GMT

So it‘s basically just a wrapper for cprid_util?

Re: NEW - Easy execute commands from management on gateways!

HeikoAnkenbrand — Fri, 12 Apr 2019 17:54:23 GMT

Hi @Danny

Yes!

It has always bothered me that I have to jump between the systems via ssh when I debugging. So I built this little script on the basis of cprid_util.

Regards

Heiko

Re: NEW - Easy execute commands from management on gateways!

Jul_Kapendale — Fri, 12 Apr 2019 18:11:12 GMT

Hi @HeikoAnkenbrand

That's a good idea!

Thanks

Re: NEW - Easy execute commands from management on gateways!

Tommy_Forrest — Fri, 12 Apr 2019 19:54:17 GMT

I gave this a try.

Created the scripts as defined. When I attempt to run a command I either get a prompt or I get a [NULL] returned.

Do you have to set your MDS environment to the CMA that has the SIC with the target firewall?

Re: NEW - Easy execute commands from management on gateways!

PhoneBoy — Fri, 12 Apr 2019 22:50:26 GMT

Interesting.
I moved this into the Gaia space, though, as it seems more appropriate there.

Re: NEW - Easy execute commands from management on gateways!

HeikoAnkenbrand — Sat, 13 Apr 2019 08:02:07 GMT

Hi@Tommy_Forrest

I have added the two new commands as installation script.

Regards

Heiko

Re: NEW - Easy execute commands from management on gateways!

HeikoAnkenbrand — Sat, 13 Apr 2019 08:02:58 GMT

Hi @Tommy_Forrest

You would have to insert the CMA for the MDS environment. Here the script still a little bit adapt:-)

Re: NEW - Easy execute commands from management on gateways!

HeikoAnkenbrand — Sat, 13 Apr 2019 07:54:26 GMT

Here a small tutorial video:

(view in My Videos)

Re: NEW - Easy execute CLI commands from management on gateways!

Malte_Wienberg — Sat, 13 Apr 2019 08:41:15 GMT

Hello @HeikoAnkenbrand

there is a typo in your command:

CUT>>>

# g_clish <gateway IP> <command> --> for clish commands

<<CUT

That's how it should be:

# g_cli <gateway IP> <command> --> for clish commands

Works perfectly for me.
And thank you very much!

Re: NEW - Easy execute commands from management on gateways!

JozkoMrkvicka — Sat, 13 Apr 2019 13:04:33 GMT

Is port tcp_18208 enabled by default via Implied Rules? In case of no, there is a need to have this port enabled at first:

In case you are using MDS, you need to be inside CMA where the gateway is managed from.

Support for VSX would be really great 🙂

There is a very similar script already mentioned:

How to manage Security Gateway using the "cprid_util" tool

Re: NEW - Easy execute commands from management on gateways!

HeikoAnkenbrand — Sat, 13 Apr 2019 13:44:03 GMT

Hi @JozkoMrkvicka

TCP 18208 (FW1_CPRID) is always included in inplied rules between management and gateway

Regards

Heiko

Re: NEW - Easy execute commands from management on gateways!

HeikoAnkenbrand — Sat, 13 Apr 2019 13:49:00 GMT

Hi @JozkoMrkvicka

More infos to implied rules can you found here in a other article from me:

R80.x Ports Used for Communication by Various Check Point Modules

Regards

Heiko

Re: NEW - Easy execute commands from management on gateways!

HeikoAnkenbrand — Sat, 13 Apr 2019 13:56:20 GMT

I just tested it in a vsx environment. Works also😃!

# g_bash 1.1.1.1 vsenv3; cphaprob stat

Re: NEW - Easy execute CLI commands from management on gateways!

HeikoAnkenbrand — Sat, 13 Apr 2019 16:44:56 GMT

I changed it.

Thanks

Heiko

Re: NEW - Easy execute CLI commands from management on gateways!

Werner_Oberbaue — Sun, 14 Apr 2019 06:45:47 GMT

If I execute this command I become a NULL.

Re: NEW - Easy execute CLI commands from management on gateways!

HeikoAnkenbrand — Sun, 14 Apr 2019 10:40:31 GMT

If you become a NULL it is not a valid gateway IP address.

Re: NEW - Easy execute CLI commands from management on gateways!

JozkoMrkvicka — Sun, 14 Apr 2019 11:00:16 GMT

Maybe in future updates, you can include checks if provided IP is valid IP of any of managed gateways ?

The original script can be slightly modified, but the core logic can be found:

How to get a list of all managed Security Gateways from Multi-Domain Management Server

For SMS, it can be a little bit tricky, as there is only a tool "query" with no option to print the needed parameters (like IP).

Re: NEW - Easy execute CLI commands from management on gateways!

HeikoAnkenbrand — Sun, 14 Apr 2019 11:57:46 GMT

Hi @JozkoMrkvicka,

Yes, I still have some ideas what you can change in this script.

- Check gateway IP's

- Copy files to and from all gateways. For example copy all "/var/log/messages" to the management server.

I still have some crazy ideas. They will follow in the next days.

Re: NEW - Easy execute CLI commands from management on gateways!

HeikoAnkenbrand — Sun, 14 Apr 2019 12:01:36 GMT

I also used $FWDIR here so it would work under all versions.