topic Re: Change cloning group features with a script in Firewall and Security Management

Change cloning group features with a script

oconnork — Fri, 22 Oct 2021 16:00:57 GMT

Hello Team,

Please could you help, I don't know how to change a cloning group feature from the Multidomain server ?

When i do the following :

$CPDIR/bin/cprid_util -server <IP_address_of_Security_Gateway> -verbose rexec -rcmd /bin/clish -s -c 'set config-lock on override'

$CPDIR/bin/cprid_util -server <IP_address_of_Security_Gateway> -verbose rexec -rcmd /bin/clish -s -c 'set 'cloning-group-management on'

$CPDIR/bin/cprid_util -server <IP_address_of_Security_Gateway> -verbose rexec -rcmd /bin/clish -s -c 'delete allowed-client host ipv4-address x.X.X.X'

I have this error : This Command is only available in Cloning Group Mode, please login as cadmin in order to use it

It seems the 'set cloning-group-management on' run before doesn't work.

Do you please have any advice on how to work around this problem ?

Re: Change cloning group features with a script

PhoneBoy — Mon, 25 Oct 2021 01:40:22 GMT

clish -c runs a single command and exits afterwords.
Which means the way you're doing this won't work.
You need to put the relevant commands in a script and run clish against that script instead.

Re: Change cloning group features with a script

oconnork — Mon, 25 Oct 2021 07:20:03 GMT

Well actually this commands is already within a script and usually it works well as long as I don't need to be in a specific mode like the cloning group mode.

Can you please advise how I could make multiples commands in one session ?

I have read about the command start transaction/commit. I will try this way and let you know the results.

Re: Change cloning group features with a script

PhoneBoy — Mon, 25 Oct 2021 07:26:15 GMT

Instead of making three separate calls to clish as you are doing now, which literally creates three separate sessions, you will make a single call.
That single call will be something like: clish -f scriptfile
The script file will contain all the necessary commands and will be run in a single session.

Re: Change cloning group features with a script

oconnork — Tue, 26 Oct 2021 11:26:45 GMT

Many thanks @PhoneBoy

The solution was to create a script from mds to the firewall, Run the remote script and remove the script

I used the following commands for that :

mgmt_cli put-file file-path "/home/admin/" file-name "tmp_commands" file-content @commands --treat-value-as-file-by-prefix @ targets "$1" -s sid.txt`
mgmt_cli run-script script-name "script_firewall" script "clish -f /home/admin/tmp_commands" targets "MyGTW" -s sid.txt`
mgmt_cli run-script script-name "remove_script" script "rm /home/admin/tmp_commands" targets "MyGTW" -s sid.txt`

My commands line are located within the file "commands" which will be write inside file tmp_commands on the firewall MyGTW
The content of the file commands is :

set cloning-group-management on
delete allowed-client host ipv4-address A.B.C.D
delete allowed-client host ipv4-address A.B.C.D
save config
set cloning-group-management off