topic Re: Ansible rules and sections in Ansible

Ansible rules and sections

NUNO_C — Thu, 01 Apr 2021 01:15:53 GMT

Hi all,

I know and how to create sections through ansible, but my doubt at moment is how to assign rules to sections?

An old version of checkpoint ansible modules it was possible but not now. Can someone give a example how to now?

Cheers,

Nuno

Re: Ansible rules and sections

AlekseiShelepov — Thu, 01 Apr 2021 12:02:46 GMT

You should use position parameter. For example, using Web-API:

- name: Add rule - Admin access uri: url: "https://{{ inventory_hostname }}:443/web_api/add-access-rule" method: POST body_format: json validate_certs: no headers: x-chkp-sid: "{{ cp_mgmt_session.json.sid }}" body: '{ "layer": "{{ cp_mgmt_policy }} Network", "position": { "bottom": "Administration and monitoring" }, "name": "Admin access", "service":[ "SSH", "HTTPS" ], "source": "grp_Admins", "action": "Accept", "track": "Log", "custom-fields": { "field-1": "Ansible automation {{ date }}"} }'

"position": { "bottom": "Administration and monitoring" }

Administration and monitoring is the name of the section in this case.

Re: Ansible rules and sections

NUNO_C — Tue, 06 Apr 2021 10:33:25 GMT

Hi Aleksei,

Thanks for reply, I know it is possible to make those changes via api, but the purpose of my post is to do it via ansible/checkpoint modules. Not to mention this would require 2 extra tasks on ansible to achieve this result (login and logout).

Kind regards,

Re: Ansible rules and sections

AlekseiShelepov — Tue, 06 Apr 2021 11:09:02 GMT

Well, you don't have to use URI module. I'm doing it with Ansible but without CheckPoint modules. I believe CheckPoint modules use the same Web-API calls inside so the parameter position should be there too. It has the parameter in the documentation:

https://docs.ansible.com/ansible/latest/collections/check_point/mgmt/checkpoint_access_rule_module.html

And the cp_mgmt_access_rule module in https://github.com/CheckPointSW/CheckPointAnsibleMgmtCollection includes it too.

I decided not to use any of Check Point modules, as they had a bit confusing situation with namings within documents and were not updated for some time.