topic Re: automatic snapshots of all gateways in Firewall and Security Management

automatic snapshots of all gateways

ACSupport — Thu, 09 Mar 2023 17:03:39 GMT

We are a company that uses firewall clusters worldwide.

Now we have the problem that we take a snapshot of about 60-70 gateways.
This means we log on to each gateway via ssh or GAIA GUI and take a snapshot.
This is very time consuming.

Is there a way to automate this, maybe via management API?

Re: automatic snapshots of all gateways

PhoneBoy — Thu, 09 Mar 2023 17:36:43 GMT

You can use something like this to execute the command on multiple gateways at once: https://community.checkpoint.com/t5/SmartConsole-Extensions/Execute-Commands-SmartConsole-Extension/m-p/170383/highlight/true#M268

R81.20 also allows you to schedule snapshots:

Re: automatic snapshots of all gateways

the_rock — Thu, 09 Mar 2023 17:44:25 GMT

What phoneboy gave you is probably your best option, but otherwise, automated snapshot is there in R81.20

Re: automatic snapshots of all gateways

HeikoAnkenbrand — Thu, 09 Mar 2023 20:39:04 GMT

Hi @ACSupport,

@PhoneBoy has already sent you the link.

Maybe the following will help you.

1) Install the SmartConsole extension "Execute Commands"

1a) On SmartConsole, go to Manage & Settings > Preferences > SmartConsole Extensions > +.

    1b) Enter the web-service manifest URL
       https://www.ankenbrand24.de/ex/command.json
           and click OK.


2) On SmartConsole, go to Gateways & Servers > Command

3) Open the menu item "CLISH". The same works with Expert Mode commands in the menu "Expert Mode".

4) Add the Clish command "add snapshot name_of_the_snapshot" and then execute "Execute on all gateways".

Now "add snapshot ..." will be executed on all your 60-70 gateways.

Re: automatic snapshots of all gateways

Hugo_vd_Kooij — Tue, 14 Mar 2023 19:24:24 GMT

While I can see the use of snapshots of gateways during upgrades and such. Most of the times you need a backup in case the unit fails. Which means a snapshot on the machine is not much use to you.

So we don't use them in an automated way. Just as need during an upgrade.

But we run `clish -c "show configuration"` daily from our Ansible Platform towards all our Check Point machines to get the basic backup. And a migrate export on all SmartCenters in order to rebuild the SmartCenter. At present I am woring on that in our Ansible Automation Platform. But any machine wih Ansible installed and some smart crontab jobs could do this.