topic Re: Write multiple clish commands in Ansible task in Ansible

Write multiple clish commands in Ansible task

Hugo_vd_Kooij — Fri, 14 Apr 2023 07:36:40 GMT

Hi,

I treied to use the shell with the clish interpreter to execute multiple clish commands.

But so far it did not result in a working setup. The tasks itself gives no errors.

- name: AddHostClish
  ansible.builtin.shell: |
    add host hostname {{ inventory_hostname }} ipv4-address ipv4-address ansible_default_ipv4.address
    add host hostname {{ inventory_hostname }}.local ipv4-address ipv4-address ansible_default_ipv4.address
    save config
  args:
    executable: /usr/bin/clish

Re: Write multiple clish commands in Ansible task

PhoneBoy — Fri, 14 Apr 2023 16:29:23 GMT

You realize there is an Ansible collection for Gaia itself, right?
https://galaxy.ansible.com/check_point/gaia

Re: Write multiple clish commands in Ansible task

Hugo_vd_Kooij — Mon, 17 Apr 2023 05:49:43 GMT

Yes, I am aware of them. But they don't cover all of my use cases.

To be honest not all firewall are up to spec.(R77.30 is pre API anyway.) And some features are not implemented. And some implemented in an impractical way.

For example cp_gaia_put_file only allows you to insert a file with the text as variable. Not a very practical job in my view.

So as it stands I have to rely on running clich commands by a user that has bash as it's default shell.

THe actual clish command's are just a test case.

Re: Write multiple clish commands in Ansible task

Hugo_vd_Kooij — Mon, 17 Apr 2023 14:54:26 GMT

Somehow I had to use the long form commands with `clish -c` in front of each command and skip the use of clish as interpretor.

Re: Write multiple clish commands in Ansible task

Erik_Lagzdins — Tue, 25 Jul 2023 14:24:25 GMT

As mentioned previously, using the Gaia modules is the preferred method to accomplish the task.

If using Gaia modules is not possible, then you can use the shell module and expand on the example I've provided below.

- name: "Apply Clish DNS Configurations" shell: "{{ item }}" with_items: - clish -c 'set dns primary 1.1.1.1' -s - clish -c 'set dns secondary 2.2.2.2' -s

Re: Write multiple clish commands in Ansible task

FWA-BD — Tue, 12 Dec 2023 12:37:59 GMT

Hi Erik,

if I try your approach, the I get following error:

/bin/bash: line 1: clish: command not found.

My playbook:

--- # version 2312121007 - name: Set LLDP to on hosts: FW tasks: - name: Set LLDP on management server ansible.builtin.shell: "{{item}}" with_items: - clish -c "set lldp state on" - clish -c "save config" args: executable: /bin/bash

My host file:

[FW] x.x.x.x [FW:vars] ansible_connection=httpapi ansible_httpapi_use_ssl=True ansible_httpapi_validate_certs=False ansible_network_os=checkpoint

What am I doing wrong?

Thanks!

Re: Write multiple clish commands in Ansible task

Ofir_Shikolski — Wed, 13 Dec 2023 15:14:03 GMT

you will need to load the profiles.

try to load one of the below:

source /etc/rc.d/init.d/functions

source /etc/profile.d/CP.sh

source /opt/CPshared/5.0/tmp/.CPprofile.sh

source /opt/CPshared/5.0/tmp/.CPprofile.sh && clish -c "command"

Re: Write multiple clish commands in Ansible task

FWA-BD — Thu, 14 Dec 2023 07:33:50 GMT

Thanks for the quick response. I have a look into that next week

Re: Write multiple clish commands in Ansible task

Erik_Lagzdins — Fri, 15 Dec 2023 16:45:42 GMT

This error is happening because of your FW:vars. Remove "ansible_connection=httpapi" and it should work.

I recommend adding the "ansible_connection=httpapi" variable only to specific playbooks that use the Check Point Gaia/Mgmt Ansible modules. When using a built-in basic Ansible module like command or shell, it's not needed.

Re: Write multiple clish commands in Ansible task

FWA-BD — Mon, 18 Dec 2023 06:13:06 GMT

Hi Erik,

thanks for the answer. This is what you get if you don't have your caffeine levels right