topic Re: Adding networks via API - err_validation_failed" in Firewall and Security Management

Adding networks via API - err_validation_failed"

S_E_ — Thu, 05 Oct 2023 10:26:02 GMT

Hi,

while adding networks via API (R81.10) i see following warning.

mgmt_cli add network name Network_10.1.0.0 subnet 10.1.0.0 subnet-mask 255.255.248.0
code: "err_validation_failed"
message: "Validation failed with 1 warning"
warnings:
- message: "More than one network has the same IP 10.1.0.0/255.255.248.0"

mgmt_cli publish -s id.txt
"Publish operation" succeeded (100%)
tasks:
- task-id: "01234567-89ab-cdef-a85f-a4014fae5873"
task-name: "Publish operation"
status: "succeeded"
progress-percentage: 100
suppressed: false
task-details:
- publishResponse:
numberOfPublishedChanges: 0
mode: "async"
revision: "fc3a7509-1d60-442a-9b3d-77f9b096be31"

mgmt_cli publish -s id.txt

This warning is more an error because the object will not be added.
The warning is correct from the logic. Another object with the same 'content' exists.

In SmartConsole. I would simply click ok and ignore this warning.
How to ignore this via API ?

2.
It looks like that the mgmt_cli command has some issue in terms of amount of objects.
What is the best approach to add ~1000 objects like hosts or networks?

TXS, Regards

Re: Adding networks via API - err_validation_failed"

PhoneBoy — Thu, 05 Oct 2023 12:42:05 GMT

You pass ignore-warnings true to the API call.

For adding objects in bulk, you should use the batch operations instead.
For example: https://sc1.checkpoint.com/documents/latest/APIs/#cli/add-objects-batch~v1.9%20
Another consideration is to ensure you “publish” every 100 operations or so.

Re: Adding networks via API - err_validation_failed"

S_E_ — Mon, 09 Oct 2023 11:57:20 GMT

tried now the batch approach via these call but still get validation error.

mgmt_cli add network --batch /tmp/test3.csv ignore-warnings true ignore-errors true -s id.txt
mgmt_cli publish -s id.txt

[test3.csv]

name,subnet,mask-length,tags,set-if-exists,color,comments,groups
NET-192.168.1.0,192.168.1.0,24,false,red,Net1,PRIVATE1
NET-192.168.2.0,192.168.2.0,24,false,red,Net1,PRIVATE1
NET-192.168.3.0,192.168.3.0,24,false,red,Net1,PRIVATE1

Results in
Line 2: code: "err_validation_failed"
message: "Validation failed with 1 warning"
warnings:
- message: "More than one network has the same IP 192.168.1.0/255.255.255.0"

Line 3: code: "err_validation_failed"
message: "Validation failed with 1 warning"
warnings:
- message: "More than one network has the same IP 192.168.2.0/255.255.255.0"

Line 4: code: "err_validation_failed"
message: "Validation failed with 1 warning"
warnings:
- message: "More than one network has the same IP 192.168.3.0/255.255.255.0"

Any tipp is welcome

Regards

Re: Adding networks via API - err_validation_failed"

_Val_ — Mon, 09 Oct 2023 12:07:12 GMT

Could it be, you already have the same networks defined?

Re: Adding networks via API - err_validation_failed"

Hugo_vd_Kooij — Mon, 09 Oct 2023 13:09:59 GMT

Val, I'm pretty sure he does.

However there is an option to proceed with these warnings to te best of my knowledge.

But the CLI command only tells us about `--ignore-errors true` as valid option:

[--ignore-errors] {true|false}
Ignore errors and continue execution when executing commands from parameters file. See (--batch).
Default {false}
Environment variable: MGMT_CLI_IGNORE_ERRORS

For now yo can use the option '--ignore-erros true'

Re: Adding networks via API - err_validation_failed"

S_E_ — Mon, 09 Oct 2023 14:18:55 GMT

Hi,

yes some network are already defined. But it is definetely with a different object-name. However, via SmartConsole it is not an issue.

Regards

Re: Adding networks via API - err_validation_failed"

Hugo_vd_Kooij — Mon, 09 Oct 2023 14:37:05 GMT

Well, it isn't in the sense that you have to validate that the duplication is not an issue. but --ignore-warnings doen't work or R80.20

[Expert@LAB-NLLAB1VP-CPSMS-MGMT:0]# mgmt_cli -r true add network name Mgmt_NET subnet 192.168.198.0 subnet-mask 255.255.255.0

---------------------------------------------
Time: [16:29:57] 9/10/2023
---------------------------------------------
"Publish operation" in progress (10%)

---------------------------------------------
Time: [16:30:08] 9/10/2023
---------------------------------------------
"Publish operation" succeeded (100%)

[Expert@LAB-NLLAB1VP-CPSMS-MGMT:0]# mgmt_cli -r true add network name NET-MGMT subnet 192.168.198.0 subnet-mask 255.255.255.0
code: "err_validation_failed"
message: "Validation failed with 1 warning"
warnings:
- message: "More than one network has the same IP 192.168.198.0/255.255.255.0"

Executed command failed. Changes are discarded.

[Expert@LAB-NLLAB1VP-CPSMS-MGMT:0]# mgmt_cli -r true --ignore-warnings true add network name NET-MGMT subnet 192.168.198.0 subnet-mask 255.255.255.0
Error: The parameters of --ignore-warnings command should be provided in pairs (key and value). You have provided an odd number of parameters which suggests that you are probably missing a parameter.
[Expert@LAB-NLLAB1VP-CPSMS-MGMT:0]# mgmt_cli --ignore-warnings true -r true add network name NET-MGMT subnet 192.168.198.0 subnet-mask 255.255.255.0
Error: The parameters of --ignore-warnings command should be provided in pairs (key and value). You have provided an odd number of parameters which suggests that you are probably missing a parameter.

[Expert@LAB-NLLAB1VP-CPSMS-MGMT:0]# mgmt_cli --ignore-errors true -r true add network name NET-MGMT subnet 192.168.198.0 subnet-mask 255.255.255.0
code: "err_validation_failed"
message: "Validation failed with 1 warning"
warnings:
- message: "More than one network has the same IP 192.168.198.0/255.255.255.0"

Ignore errors is turned on. Publishing changes despite of command execution errors.

---------------------------------------------
Time: [16:32:27] 9/10/2023
---------------------------------------------
"Publish operation" succeeded (100%)

Re: Adding networks via API - err_validation_failed"

PhoneBoy — Mon, 09 Oct 2023 21:25:57 GMT

The batch API calls do not support using ignore-warnings true...at least directly.
You have to add this to the CSV file (ignore-warnings to the header, true to the value for each row).

Re: Adding networks via API - err_validation_failed"

S_E_ — Tue, 10 Oct 2023 07:00:51 GMT

That did the trick. Great. Thanks.

And it works with huge number of networks.

name,subnet,mask-length,set-if-exists,color,comments,groups,ignore-warnings
NET-192.168.1.0,192.168.1.0,24,true,red,Net1,PRIVATE1,true
NET-192.168.2.0,192.168.2.0,24,true,red,Net1,PRIVATE1,true
NET-192.168.3.0,192.168.3.0,24,true,red,Net1,PRIVATE1,true
NET-192.168.4.0,192.168.4.0,24,true,red,Net1,PRIVATE1,true
NET-192.168.5.0,192.168.5.0,24,true,red,Net1,PRIVATE1,true
NET-192.168.6.0,192.168.6.0,24,true,red,Net1,PRIVATE1,true
NET-192.168.7.0,192.168.7.0,24,true,red,Net1,PRIVATE1,true
NET-192.168.8.0,192.168.8.0,24,true,red,Net1,PRIVATE1,true

Thanks

Regards