topic Re: Automate your R80 Management Server using Ansible in Ansible

Automate your R80 Management Server using Ansible

Uri_Bialik — Tue, 27 Sep 2016 07:35:21 GMT

Overview

Ansible (www.ansible.com) is a popular automation tool.

The Check Point Management Ansible module brings the ability to automate Check Point R80 management tasks (e.g. adding objects, manipulate the rulebase, push policy) into the Ansible automation platform.

Description

Provide Ansible "playbooks" with simple access to all available Check Point R80 Management APIs.

The ansible module is written in Python and its source code is available - you're welcome to review code, suggest enhancements or modify it.

Instructions

Refer to our GitHub repo (the link below) for detailed instructions.

Tested on version

R80.10, API version 1.1

Source Code Availability

The source code is now public on GitHub repository:

https://github.com/CheckPoint-APIs-Team/cpAnsible

NOTICE: By using this sample code you agree to terms and conditions in this Terms and Conditions

...

Re: Automate your R80 Management Server using Ansible

Jon_Spriggs — Thu, 29 Sep 2016 07:54:39 GMT

Looks interesting - thanks to Don Paterson for pointing me at this

In the commands you have add-host and add-group - would add-network behave similarly? Can we also do delete actions in the same way?

I don't currently have an R80 build stood up to test it, but it's edging closer and closer to being a perfect fit for the automation I'm in the process of standing up.

Re: Automate your R80 Management Server using Ansible

Uri_Bialik — Thu, 29 Sep 2016 11:28:10 GMT

Yes, "add-network" and delete actions are also available.

Check the API reference for the complete list of API commands and their parameters.

Re: Automate your R80 Management Server using Ansible

Donald_Paterson — Fri, 30 Sep 2016 09:19:51 GMT

Just in case it helps. Have a look at this one 🙂 :

Adding members to a group

Re: Automate your R80 Management Server using Ansible

Joan_Miquel_Luq — Fri, 18 Nov 2016 15:41:24 GMT

Hi all,

Is this the last version of the module? Is this module available on ansible repository?

I'm trying to run it on ansible 2.0.1.0 and I found some problems. I've saw you specify that python 2.7.9 is needed, but someone has tested it with python 2.7.5?

Thanks in advance,

Re: Automate your R80 Management Server using Ansible

Arnfinn_Strand — Tue, 14 Feb 2017 09:33:16 GMT

Looks great

Do Check Point plan to create something similar for Puppet?

Re: Automate your R80 Management Server using Ansible

Eugene_Grybinny — Wed, 15 Feb 2017 11:51:23 GMT

Hi Arnfinn,

Currently we do not have plans to support Puppet.

But if there will be a demand for Puppet from multiple customers, we will consider developing a similar solution.

Re: Automate your R80 Management Server using Ansible

Alex_Alborzfard — Thu, 16 Feb 2017 17:56:34 GMT

Does this work w. Mac & R77.30?

Re: Automate your R80 Management Server using Ansible

Eugene_Grybinny — Tue, 21 Feb 2017 06:12:48 GMT

Hi Alex,

No, this won't work with R77.30 because the solution is based on the new API that was introduced only in R80.

I don't see any limitations for Mac as long as you can run Ansible on it.

Re: Automate your R80 Management Server using Ansible

Venkatesh_Banda — Mon, 24 Apr 2017 01:28:32 GMT

Has anyone faced an issue with not able to find the module mgmt_api_lib while working on ansible

Re: Automate your R80 Management Server using Ansible

Jon_Spriggs — Fri, 28 Apr 2017 06:59:23 GMT

Without knowing your setup, you need to check that the modules are where they should be for the library. Ansible checks in the following places:

In directories defined by ANSIBLE_LIBRARY if set
If not set, in directories defined by library in configuration file
In ./library directory relative to location of playbook in use
(I suspect, although I didn't spot it, you might also find that it's in ./roles/<rolename>/library and /etc/ansible/roles/<rolename>library)
In /etc/ansible/library
In /usr/lib/python2.7/site-packages/ansible/modules

Realistically, your libraries should be somewhere sensible. If you're using Version Control (and if you're not... why not?!?!) then they should be included in your VCS tree, which means either tracking /etc/ansible or the path to where you're running your playbook from.

Hope that helps!

Re: Automate your R80 Management Server using Ansible

Venkatesh_Banda — Fri, 05 May 2017 05:59:45 GMT

Thank you.I will check that and keep this thread posted.Thank you for your reply

Re: Automate your R80 Management Server using Ansible

Jon_Spriggs — Thu, 29 Jun 2017 15:43:38 GMT

I've finally had a chance to look at this (and sought advice from the #Ansible channel on irc.freenode.net).

So, it looks like the path specified by Checkpoint is very distribution specific, and doesn't fly with Ubuntu 16.04. Frankly, there's not enough to this library to mess around with it too much, and I ended up pulling the various elements of the library apart and making it into one single file. This then can be placed into [/path/to/your/ansible/playbook/or/role]/library (e.g. /etc/ansible/library or /home/useraccount/customer-a/library - where /home/useraccount/customer-a also has your inventory file and your playbook).

I was going to go into a deep-dive on how to make the merged file, but I've instead put it into a secret gist at github.com - please can the developers advise whether this can be made public?

check_point_mgmt.py combined into a single script, based on check_point_mgmt.py version 1.0.1 - PROPERTY OF CHECK POINT …

One thing that would be useful would be if there is some way from the command line to enable the API, so then I don't need to open the management UI at all.....

Thanks!

Re: Automate your R80 Management Server using Ansible

Jon_Spriggs — Mon, 03 Jul 2017 15:43:54 GMT

The key thing I have noticed about this script at the moment is that it is not idempotent. As such, you can't have your playbook run multiple times against the same host. I don't know whether to work around this, or to leave it as a concern for the reader.

I have also updated the gist I linked to before to add the ability to use the omit value (e.g. "{{ item.source|default('omit')}}") which is a fairly common pattern in my ansible use.

Realistically, the python script should check for the presence of a line item (e.g. host, network, group, etc) before trying to add it. It does not currently do this.

Re: Automate your R80 Management Server using Ansible

Michal_Taratuta — Thu, 27 Jul 2017 14:03:47 GMT

Thanks for providing the module, I have 2 questions:
Is this an opensource, can the community contribute to the code?

Can you provide GIT repository address?

Re: Automate your R80 Management Server using Ansible

Jon_Spriggs — Tue, 01 Aug 2017 07:38:22 GMT

Hey Michal,

I discussed this with a couple of the team involved in creating this - they are happy for changes to be contributed, but it's not in a public git repo as yet (there was talk of a Check Point github account, although I can't find it ). Your best bet would be to do as I did - take the code, and put it in your own Git repo and share to this thread. The team are keen to improve things! I spent 1h30 on the phone with them discussing how to improve things, and they were very receptive.

Of course, the proof of the pudding is in the eating (as we say here!) and so I'd hope to see something change in the next few months, but I can't confirm or deny anything - aside from anything else, I don't work for Check Point, I'm just a consumer

Re: Automate your R80 Management Server using Ansible

Erik_Jacobsen — Thu, 10 Aug 2017 18:25:11 GMT

Is the current Ansible repository compatible with R80.10?

Re: Automate your R80 Management Server using Ansible

Jon_Spriggs — Mon, 14 Aug 2017 06:54:52 GMT

I've found it works for my usecases, but your mileage may vary!

Re: Automate your R80 Management Server using Ansible

James_Tidwell — Thu, 17 Aug 2017 17:51:23 GMT

Has anyone used the add-simple-gateway command yet? Can anyone provide the list of parameters for that command? I tried to use what was in the api doc, but I must have something wrong.

Re: Automate your R80 Management Server using Ansible

Arnfinn_Strand — Thu, 17 Aug 2017 18:40:05 GMT

I use this command in my PowerShell script that creates a GW in Azure or AWS and then add objects, a GW object, Policy and pushes the policy at the end.

mgmt_cli add simple-gateway name vsecgwr8010 ipv4-address 10.0.0.10 application-control true data-awareness true firewall true one-time-password vpn12345 version R80.10 url-filtering true interfaces.1.name ext-gw interfaces.1.ipv4-address 10.5.0.10 interfaces.1.ipv4-mask-length 24 interfaces.1.topology external interfaces.1.anti-spoofing false interfaces.2.name int-gw interfaces.2.ipv4-address 10.5.1.10 interfaces.2.ipv4-mask-length 24 interfaces.2.topology internal interfaces.2.anti-spoofing false interfaces.2.topology-settings.ip-address-behind-this-interface specific interfaces.2.topology-settings.specific-network web-subnet -s sid.txt

The API doc should be fine.

Arnifnn