topic Re: Purpose of the Transaction Mode in Firewall and Security Management

Purpose of the Transaction Mode

Nick_Doropoulos — Sat, 23 Mar 2019 22:20:15 GMT

According to this link (http://dl3.checkpoint.com/paid/28/2811d2a6f319e35036886d1e1e464fb3/CP_R80.10_Gaia_AdminGuide.pdf?HashKey=1553386123_14c383dc4ce07ed9f397e97a0ae709ea&xtn=.pdf), there is a transaction mode of the CLI whereby:

"All changes made
using commands in transaction mode are applied at once or none of the
changes are applied based on the way transaction mode is terminated."

My question is though, why would anybody use the said mode? I haven't seen it used personally so I was wondering if anybody who has could share their experiences.

Many thanks in advance.

Re: Purpose of the Transaction Mode

PhoneBoy — Sun, 24 Mar 2019 05:30:54 GMT

This is a better link to the docs: https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_Gaia_AdminGuide/html_frameset.htm

In practical terms, it's exactly how the R80.x Management API works: you make configuration changes, but they are not implemented until you commit. Considering that some operating system changes require multiple commands to implement and the configuration between the commands may, in some cases, cause temporary connectivity issues, you may want to use this mode to limit this impact.

Re: Purpose of the Transaction Mode

Nick_Doropoulos — Sun, 24 Mar 2019 07:39:03 GMT

Thank you!

Re: Purpose of the Transaction Mode

Timothy_Hall — Sun, 24 Mar 2019 13:22:52 GMT

Another good use of transaction mode from clish would be trying to copy/paste a large number of commands directly into a SSH-based clish session. When copy/pasting very large sets of commands I have seen situations where characters get dropped and cause a syntax error with some of the commands. Rather than having some of them take effect instantly and others not work (leading to strange problems), one could paste them in transaction mode (thus delaying their activation), scroll back up to ensure they were no errors displayed, then commit them if everything looks OK. If there were errors just rollback the transaction, start a new one then paste a smaller number of commands (or correct whatever legit syntax errors you had in what you were pasting).

Or better yet just use load configuration and avoid copy/pasting entirely...