topic How to list service object with its advanced settings in Firewall and Security Management

How to list service object with its advanced settings

saitoh — Mon, 07 Apr 2025 01:14:03 GMT

Hi all,

What I would be trying to achieve is to figure out which objects is edited for creating configuration sheet.

I prefer not to include default object list in it due to its large amount of information.

Objects other than service ones are checked manually, but when it comes to service objects, it takes me forever to finish checking, too many for my eyes.

I thought just diffing customer's service objects list with the default one would do, but SmartConsole allows me to export them as CSV only with basic config info like port number, and comments.

Its advanced settings such as "Match for Any" are not subject to print.

Are there any useful tips to list those advanced settings?

Also much appreciated for any empirical comments!

Saitoh

Re: How to list service object with its advanced settings

saitoh — Tue, 01 Apr 2025 07:48:55 GMT

P.S.

I think of time in Last Modified as a sign of configured object, but somehow colleagues of mine will not be satisfied unless actual diff of those settings is done.

They do not trust the value in Last Modified...

Re: How to list service object with its advanced settings

Tal_Paz-Fridman — Tue, 01 Apr 2025 07:51:20 GMT

You might to try Management API, although you will need to run for each type separately.

For example:

mgmt_cli -r true show services-tcp details-level full --format json

https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-services-tcp~v2%20

Re: How to list service object with its advanced settings

the_rock — Tue, 01 Apr 2025 12:48:48 GMT

What @Tal_Paz-Fridman gave is probably your best bet.

Andy

Re: How to list service object with its advanced settings

Bob_Zimmerman — Tue, 01 Apr 2025 14:59:42 GMT

And note that you can use jq to filter output for services which have been modified by a person like so:

[Expert@MyManagement]# mgmt_cli -f json -r true show services-tcp limit 500 details-level full | jq '.objects[]|select(."meta-info"."last-modifier" != "System")|.' { "uid": "...", "name": "Active_Directory_TCP_123", "type": "service-tcp", "domain": {...}, "enable-tcp-resource": false, "sync-connections-on-cluster": true, "use-delayed-sync": false, "delayed-sync-value": 30, "port": "123", "match-by-protocol-signature": false, "override-default-settings": false, "session-timeout": 3600, "use-default-session-timeout": true, "match-for-any": false, "aggressive-aging": { "enable": true, "timeout": 0, "use-default-timeout": true, "default-timeout": 0 }, "keep-connections-open-after-policy-installation": false, "comments": "black", "color": "black", "icon": "Services/TCPService", "tags": [], "meta-info": { "lock": "unlocked", "validation-state": "ok", "last-modify-time": {...}, "last-modifier": "WEB_API", "creation-time": {...}, "creator": "WEB_API" }, "read-only": false, "available-actions": { "edit": "true", "delete": "true", "clone": "true" } } ...

Re: How to list service object with its advanced settings

Henrik_Noerr1 — Tue, 01 Apr 2025 20:29:48 GMT

A side note - when we upgraded to r81.20 we lost all history and most object/rule was tagged as System - with the date of the upgrade being the last modified date. We discovered it a couple of days after, preventing any rollback.

We had most objects modified back to the original date with some work done by Diamond from a backup, but not all.

Just keep it in mind if you are using this for something 'important' 🙂

/Henrik

Re: How to list service object with its advanced settings

saitoh — Mon, 07 Apr 2025 01:13:07 GMT

Dear @Tal_Paz-Fridman,

Thanks for your comment!

I followed your instruction and run mgmt_cli in the appliance with customer's config and default config.

Diffing each result gave me the objects they edited, which is what I would like to know.

I created the macro for this procedure. Much appreciated!

Saitoh

Re: How to list service object with its advanced settings

the_rock — Mon, 07 Apr 2025 01:01:45 GMT

Thanks for letting us know.

Andy

Re: How to list service object with its advanced settings

saitoh — Mon, 07 Apr 2025 01:05:13 GMT

Dear @Bob_Zimmerman,

Thank you for sharing your knowledge!

I did not know of jq command. Having tried, I found it really useful.

It is always good to know something new 🙂

Saitoh

Re: How to list service object with its advanced settings

saitoh — Mon, 07 Apr 2025 01:12:04 GMT

Dear @Henrik_Noerr1,

Thanks for sharing your experience.

Your comments made me want to test if last_modified/modifier were updated or not when making changes, and

found out they were not surprisingly!

I therefore went for extracting all the details of objects in the appliance with customer's config and default one, diffing them just to be sure.

Your comments helped me a lot, much appreciated!

Saitoh