topic Re: Ansible module collection for Check Point host facts and Deployment Agent in Automation and APIs

Ansible module collection for Check Point host facts and Deployment Agent

Duane_Toler — Fri, 11 Sep 2026 19:51:22 GMT

This is an Ansible module collection for additional tasks on Check Point hosts:

https://github.com/Webfargo/ansible-collection-check_point/

webfargo.check_point.da_command: Run arbitrary da_cli commands webfargo.check_point.da_package: Manage Check Point packages via the Deployment Agent webfargo.check_point.da_package_info: Query Check Point Deployment Agent package information webfargo.check_point.da_status: Get Check Point Deployment Agent status webfargo.check_point.gather_facts: Gather Check Point Gaia OS specific facts webfargo.check_point.cp_gateway_vpn_certificate: Renew IPsec VPN certificate on gateway or cluster webfargo.check_point.cp_ia_identity_info: Query Check Point Identity Awareness associations for one IP via the Identity Web API webfargo.check_point.cp_ia_identity: Add or delete Check Point Identity Awareness associations via the Identity Web API

Install from Ansible Galaxy:

ansible-galaxy collection install webfargo.check_point

Direct install from GitHub with ansible-galaxy:

ansible-galaxy collection install git+https://github.com/Webfargo/ansible-collection-check_point.git

The gather_facts module includes these Check Point host facts:

Check Point version (R81.20, R82, R82.10, etc.)
Installed hotfix versions (for all installed products)
Live Patch modules and status for each
Host type (gateway/management/standalone)
OS code name and build number
Deployment Agent build number
SIC certificate info
Hardware platform
VSX status
Cluster/HA status
Check Point SNMP daemon status
Firewall policy status (if gateway)

The Deployment Agent modules include:

Verify, Install, Uninstall packages
Blink and clean-install/upgrade packages
Import packages from local disk
Update package repository
Query package repository
Check Deployment Agent status
Run arbitrary Deployment Agent commands

Package install/uninstall operations will poll the Deployment Agent task continuously to monitor the progress. When the host reboots, the status is monitored to return a successful status rather than dropping the connection. The Ansible module wait_for_connection can be used to monitor the host's reboot operation.

For Blink package upgrades, the multi-stage reboot is monitored by the da_package module to check the stage 2 operation rather than dropping the SSH connection.

Packages can be copied with the Ansible module ansible.builtin.copy and imported to the package repository.

Although R82 has introduced package management with the management API, there may be times when direct package management may be necessary on the remote host. For those without R82 yet, this could help you get there!

Re: Ansible module collection for Check Point host facts and Deployment Agent

Duane_Toler — Thu, 11 Jun 2026 14:10:04 GMT

v0.7.0 has been release, fixing some bugs, install and upgrade state oddities encountered recently:

https://github.com/Webfargo/ansible-collection-check_point/tree/v0.7.0

Change Log included, too: https://github.com/Webfargo/ansible-collection-check_point/blob/v0.7.0/CHANGELOG.md

Re: Ansible module collection for Check Point host facts and Deployment Agent

Duane_Toler — Fri, 11 Sep 2026 19:44:56 GMT

Version 0.9.4 of my module collection for Check Point hosts has been published to Ansible Galaxy:

https://galaxy.ansible.com/ui/repo/published/webfargo/check_point/

The gather_facts module now includes Live Patch facts.

tasks: - name: Gather Check Point facts webfargo.check_point.gather_facts: - name: Check if a specific CVE is covered by a live patch debug: msg: "CVE-2026-85102 is live patched" when: >- ansible_facts.check_point.live_patches | selectattr('comment', 'search', 'CVE-2026-85102') | map(attribute='modules') | flatten | selectattr('cover', 'equalto', 'ok') | list | length > 0

Install or update with:

ansible-galaxy collection install webfargo.check_point

Additional modules include:

cp_gateway_vpn_certificate: Renew VPN certificates on Check Point gateway or cluster objects

- name: Renew VPN certificate on a simple gateway webfargo.check_point.cp_gateway_vpn_certificate: name: gw-prod-01 gateway_type: gateway certificate_name: defaultCert alternate_names: - name_type: fqdn value: gw-prod-01.example.com - name_type: ip address value: 192.0.2.10 - name: Renew VPN certificate on a cluster object webfargo.check_point.cp_gateway_vpn_certificate: name: cluster-prod-01 gateway_type: cluster certificate_name: defaultCert alternate_names: - name_type: fqdn value: cluster-prod-01.example.com - name: Renew without auto-publishing (caller publishes later) webfargo.check_point.cp_gateway_vpn_certificate: name: gw-prod-02 gateway_type: gateway certificate_name: defaultCert auto_publish_session: false alternate_names: - name_type: ip address value: 192.0.2.20
cp_ia_identity_info: Query Check Point Identity Awareness associations for one IP via the Identity Web API
cp_ia_identity: Add or delete Check Point Identity Awareness associations via the Identity Web API
- name: Add an identity association webfargo.check_point.cp_ia_identity: ia_host: "{{ ia_mgmt_host }}" shared_secret: "{{ identity_api_secret }}" ip_address: "10.10.5.23" user: "jdoe" domain: "corp.example.com" user_groups: - "vpn-users" fetch_user_groups: false calculate_roles: true identity_source: "{{ inventory_hostname }}" - name: Look up current identity associations for an IP webfargo.check_point.cp_ia_identity_info: ia_host: "{{ ia_mgmt_host }}" shared_secret: "{{ identity_api_secret }}" ip_address: "10.10.5.23" register: id_result - name: Show whether any records were found ansible.builtin.debug: msg: "{{ id_result.identity_info.found }} ({{ id_result.identity_info.record_count }} records)"