topic Re: Create SIC with API in Firewall and Security Management

Create SIC with API

Moudar — Mon, 08 Jul 2024 07:44:39 GMT

Hello,

I'm trying to figure out how to establish trust (SIC) between a gateway and SMS using API calls.

I've come across commands like reset-sic and test-sic, but I haven't found anything like add-sic or set-sic.

Am I overlooking something? Is it not possible to establish SIC through the API?

Re: Create SIC with API

Alex- — Mon, 08 Jul 2024 09:21:51 GMT

That would be the "one-time-password" value pair of the add simple-gateway/cluster API call.

Re: Create SIC with API

Tomer_Noy — Mon, 08 Jul 2024 09:32:24 GMT

In order to set the sic password, you should use the set-simple-gateway API with the one-time-password parameter:
https://sc1.checkpoint.com/documents/latest/APIs/#cli/set-simple-gateway~v1.9.1%20

I just noticed in the documentation that the field does not have a proper description, which is probably why it was unclear how to use it. I'll ask the R&D team to update that.

Re: Create SIC with API

Moudar — Mon, 08 Jul 2024 10:26:03 GMT

How would the order of api commands look like:

new installed management server and adding new installed gateway to it

something like this?:

mgmt_cli -s sid.txt add simple-gateway name "$GATEWAY_NAME" ipv4-address "$GATEWAY_IP" one-time-password "Admin123" --format json > gateway_response.json

When i run that i get this:

message: "Installation failed. Reason: SIC is not initialized either at the Security Management Server or the peer [ SIC error no. 119 ] check that SIC is configured both on Security Management Server and peer, and that both have valid SIC certificates."

or this:

"sic-message" : "SIC Status: Unknown. Could not get SIC properties from peer object", "sic-status" : "unknown"

to solve this I had to run "cp_conf sic init Admin123" on the gateway manually before running my script!

What I miss here?

Re: Create SIC with API

Alex- — Mon, 08 Jul 2024 12:56:11 GMT

You used the management API which works as it names implies works on the management side. You still need to ensure the gateway are staged one way or the other.

Re: Create SIC with API

Tomer_Noy — Mon, 08 Jul 2024 14:09:23 GMT

First you need to set the sic password on the gateway side (using cp_conf).

Then, you need to set the sic password on the management side. The passwords must match.
This is what creates trust between the gateway and the management.