topic Re: API commands on gateways in Firewall and Security Management

API commands on gateways

Moudar — Sat, 13 Jul 2024 13:39:20 GMT

If I want to get info with json of my gateway interface I run this command:

mgmt_cli -r true show interface name "eth0" --context gaia_api --version 1.7 --format json

This command should run on mannagement server or gateway it self?

If i run it on management server I get this:

[Expert@SMS-TEST-API:0]# mgmt_cli -r true show interface name "eth0" --context gaia_api --version 1.7 --format json { "code" : "generic_error", "message" : "Error 503. The Management API service is not available. Please check that the Management API server is up and running." }

even if api status is this:

[Expert@SMS-TEST-API:0]# api status ------------ API Settings:oubleshooting data, please run 'api status -s <comment>' --------------------- Accessibility: Require local Automatic Start: Enabled Processes: Name State PID More Information ------------------------------------------------- API Started 17939 CPM Started 17939 Check Point Security Management Server is running and ready FWM Started 17559 APACHE Started 16609 Port Details: ------------------- JETTY Internal Port: 54316 JETTY Documentation Internal Port: 56451 APACHE Gaia Port: 443 Profile: ------------------- Machine profile: Small Medium env resources profile CPM heap size: 1280m Apache port retrieved from: httpd-ssl.conf -------------------------------------------- Overall API Status: Started -------------------------------------------- API readiness test SUCCESSFUL. The server is up and ready to receive connections Notes: ------------ To collect troubleshooting data, please run 'api status -s <comment>'

and gaia api:

[Expert@SMS-TEST-API:0]# gaia_api status API Status: --------------------- Build: cp991255069 Uptime: 2 days, 0:36:33.266998 Current Sessions: Unknown Latest Version: 1.6 Processes: Name State PID --------------------------------- GAIA_API Started 16712 GAIA_API_DOCS Started 16710 APACHE Started 16609 CONFD Started 16607 CLISHD Started 55921 16675 CELERY Started 16674 REDIS Started 16678 Port Details: ------------------- APACHE Gaia Port: 443 -------------------------------------------- Overall API Status: Stopped - Error: Apache server unreachable - Warning: Documentation server is unreachable --------------------------------------------

if irun the command directly on the gateway i get this:

[Expert@A-GW-TEST:0]# mgmt_cli -r true show interface name "eth0" --context gaia_api --version 1.7 --format json Error: Failed to login to the management server

[Expert@A-GW-TEST:0]# gaia_api status API Status: --------------------- Build: cp991255069 Uptime: 0:03:47.452001 Current Sessions: 0 Latest Version: 1.6 Processes: Name State PID --------------------------------- GAIA_API Started 18650 GAIA_API_DOCS Started 18648 APACHE Started 18581 CONFD Started 18579 CLISHD Started 23264 22034 18643 CELERY Started 18642 REDIS Started 18646 Port Details: ------------------- APACHE Gaia Port: 443 -------------------------------------------- Overall API Status: Started --------------------------------------------

So, how and where can I run Gaia API commands?

Re: API commands on gateways

the_rock — Sat, 13 Jul 2024 14:35:20 GMT

Hey bro,

All API commands are ran on the management server.

Andy

Re: API commands on gateways

the_rock — Sat, 13 Jul 2024 14:44:53 GMT

Here is good example buddy.

Andy

https://sc1.checkpoint.com/documents/latest/APIs/#cli/get-interfaces~v1.9.1%20

Re: API commands on gateways

Moudar — Sat, 13 Jul 2024 14:47:35 GMT

The how to run Gaia APIs: !

https://sc1.checkpoint.com/documents/latest/GaiaAPIs/#introduction~v1.7%20

Re: API commands on gateways

the_rock — Sat, 13 Jul 2024 14:49:51 GMT

But you dont run it on the fw, rather management server to get the data.

Re: API commands on gateways

Moudar — Sat, 13 Jul 2024 14:51:20 GMT

running it on SMS i get this:

Re: API commands on gateways

the_rock — Sat, 13 Jul 2024 14:56:21 GMT

Dont worry, I will test it in the lab once home and let you know, just biking/swimming/running now : - )

Andy

Re: API commands on gateways

the_rock — Sat, 13 Jul 2024 17:38:44 GMT

Just ttried get interfaces flag, worked like a charm. Btw, dont see show interfaces option anywhere in API guide. Make sure, though most people would never change that, that web UI port for mgmt is NOT anything but 443.

clish -> show web ssl-port

Command I tested:

[Expert@CP-MANAGEMENT:0]# mgmt_cli get-interfaces target-name "CP-GW" with-topology true

Andy

Re: API commands on gateways

Moudar — Sun, 14 Jul 2024 09:30:51 GMT

so why a command like:

mgmt_cli show interface name "eth0" --context gaia_api --version 1.7 --format json

does not work!

where can i find examples of "target-name" GAIA API or Management API, because i could not find any info there!

Re: API commands on gateways

the_rock — Sun, 14 Jul 2024 15:53:27 GMT

I dont see show interfaces anywhere in API guide, sorry. Below is what I ran yesterday.

Andy

Re: API commands on gateways

Alex- — Sun, 14 Jul 2024 17:01:11 GMT

@the_rock your reference is the Management API, the question here is about the GAIA API.

You run the GAIA API on the gateway with an enabled user used to log into it. This is all described here:

https://sc1.checkpoint.com/documents/latest/GaiaAPIs/index.html#mgmt_cli~v1.7%20

Re: API commands on gateways

Moudar — Sun, 14 Jul 2024 17:03:26 GMT

what about these commands, so where do you run these commands?

Re: API commands on gateways

the_rock — Sun, 14 Jul 2024 17:08:44 GMT

@Alex- You are 100% correct, my bad.

@Moudar Let me test one you have issue with, you run it on the gateway.

Andy

Re: API commands on gateways

Moudar — Sun, 14 Jul 2024 17:10:28 GMT

So, if i run this command on a gateway:

[Expert@A-GW-TEST:0]# mgmt_cli -r true show hostname --context gaia_api Error: Failed to login to the management server

or this:

[Expert@A-GW-TEST:0]# mgmt_cli show asset --context gaia_api --version 1.7 --format json Username: admin Password: code: "generic_err_command_not_found" errors: "Requested API command": [v1.7/login] not found' message: "Command Not Found"

So, why I am getting these errors!? Version 81.20

Re: API commands on gateways

the_rock — Sun, 14 Jul 2024 17:11:05 GMT

Stand by, will test it soon in the lab.

Re: API commands on gateways

the_rock — Sun, 14 Jul 2024 17:24:32 GMT

I get different error, will troubleshoot later once Euro cup final game is done 🙂

Andy

[Expert@CP-GW:0]# mgmt_cli show interface name "eth0" --context gaia_api --version 1.7 --format json
Username: admin
Password:
Couldn't connect to server
If you need to use a proxy server, add the '--proxy' parameter
[Expert@CP-GW:0]# mgmt_cli show interfaces --context gaia_api --version 1.7 --format json
Username: amdin
Password:
Couldn't connect to server
If you need to use a proxy server, add the '--proxy' parameter
[Expert@CP-GW:0]#

Re: API commands on gateways

Alex- — Sun, 14 Jul 2024 17:52:25 GMT

Make sure you allow your user to use the GAIA API, logging in is not enough.

To grant a user with GAIA API access, use the following command in expert mode:

[Expert@hostname]# gaia_api access --user <user> --enable true

https://sc1.checkpoint.com/documents/latest/GaiaAPIs/index.html#api_access~v1.7%20

Re: API commands on gateways

the_rock — Sun, 14 Jul 2024 18:15:34 GMT

I tested again, same issue, will see what else could be the problem...

Andy

[Expert@CP-GW:0]# gaia_api access -u admin --enable true
[Expert@CP-GW:0]# mgmt_cli show interface name "eth0" --context gaia_api --version 1.7 --format json
Username: admin
Password:
Couldn't connect to server
If you need to use a proxy server, add the '--proxy' parameter
[Expert@CP-GW:0]#

Re: API commands on gateways

the_rock — Sun, 14 Jul 2024 18:23:59 GMT

I think I got it now...not sure if it was command @Alex- gave, though gaia api was enabled for admin, but I realized I was using port 4434 for web UI, changed it to 443, installed policy, ran command he provided, good now...so give it a try @Moudar

Andy

See below:

[Expert@CP-GW:0]# gaia_api access -u admin --enable true [Expert@CP-GW:0]#

[Expert@CP-GW:0]# mgmt_cli show interface name "eth0" --context gaia_api --version 1.7 --format json
Username: admin
Password:
{
"comments": "",
"enabled": true,
"ipv4-address": "172.16.10.249",
"ipv4-mask-length": "24",
"ipv6-address": "Not-Configured",
"ipv6-autoconfig": "Not configured",
"ipv6-local-link-address": "Not Configured",
"ipv6-mask-length": "Not-Configured",
"name": "eth0",
"type": "physical"
}

[Expert@CP-GW:0]# clish
CLINFR0771 Config lock is owned by admin. Use the command 'lock database override' to acquire the lock.
CP-GW> show web ssl
ssl-port - Web configuration tool SSL port number
ssl3-enabled - Allow using SSL3 to access the web configuration tool
CP-GW> show web ssl-p
CP-GW> show web ssl-port
web-ssl-port 443
CP-GW>

Re: API commands on gateways

Tal_Paz-Fridman — Sun, 14 Jul 2024 18:45:09 GMT

In Gaia API context you cannot use -r true flag.

Try running without it to see if works, for example:

mgmt_cli -u <Gaia username> -p <Gaia password> show asset --version 1.7 --context gaia_api