topic Re: How to export policy package to HTML - Show Package Tool sk120342 in Firewall and Security Management

How to export policy package to HTML - Show Package Tool sk120342

Magnus-Holmberg — Sun, 14 Nov 2021 11:17:15 GMT

Hi,

Short video on how show package tool works, described within sk120342

Regards,
Magnus

Re: How to export policy package to HTML - Show Package Tool sk120342

fulvio — Thu, 29 Jun 2023 14:22:04 GMT

Hi Magnus, great video, this is (would be once I get it working) so helpful.

I am using the command this way:

$MDS_FWDIR/scripts/web_api_show_package.sh -k "policy_name" -d "my_domain" -o /home/_nonlocl

and getting:

Script stopped running due to severe error!

Result file location: /home/_nonlocl/show_package-2023-06-29_15-44-12.tar.gz

with extremely low amount of info.

I have tried also to run the same command targeting a different policy, same result. Were can I start troubleshooting?

Many Thanks

Re: How to export policy package to HTML - Show Package Tool sk120342

PhoneBoy — Thu, 29 Jun 2023 18:35:06 GMT

Best to engage with the TAC here: https://help.checkpoint.com

Re: How to export policy package to HTML - Show Package Tool sk120342

dergio — Mon, 03 Jul 2023 08:11:46 GMT

Hi fulvio

Have you ran the script on the Mgmt? Maybe your Mgmt is also running on a different port (default 443 for the script). Checkout the parameter "-n" for the script.

Re: How to export policy package to HTML - Show Package Tool sk120342

just13pro — Mon, 03 Jul 2023 08:45:41 GMT

What is your version?

If I remember correctly, some version has this bug and you need to upgrade JHF or upgrade version.

Re: How to export policy package to HTML - Show Package Tool sk120342

fulvio — Mon, 03 Jul 2023 09:00:02 GMT

Thank you very much for your replies.

The situation has evolved. I am able to run the web_api_show_package.sh now but it does not complete, in the logs I get this error:

com.checkpoint.mgmt_api.examples.MyLogger.debug()DEBUG]: Command [show-access-rulebase] uid d1d3d573-4fe0-4cef-9ac6-735899cc2511 limit 10 offset 1860 FAILED

I am now debugging using this:

java -jar $MDS_FWDIR/api/samples/lib/web_api_show_package-jar-with-dependencies.jar -k "ABC-VPN" -d "ABC_Corp" --query-limit 1

and find out that I am failing on two specif rules. Hope once I fixed this, the web_api_show_package will work fine.

When running java -jar $MDS_FWDIR/api/samples/lib/web_api_show_package-jar-with-dependencies.jar -k

I am getting some other error messages:

[6/30/23 5:36 PM com.checkpoint.mgmt_api.examples.MyLogger.severe()SEVERE]: Failed to run show rulebase (ABC-VPN Security). Error message: java.lang.OutOfMemoryError: Java heap space

looking into that as well

Re: How to export policy package to HTML - Show Package Tool sk120342

Srdjan_B — Tue, 18 Jul 2023 13:26:54 GMT

Hello,

Result tgz file contains one .elg file. This is good starting point for troubleshooting, check it out.

Also, you can add -s switch to generate some debug info.

Last but not least, our customer had issue because they had sublayers name like "to_10.0.0.0/24". The point is that "/" is not escaped somewhere, so the script breaks when trying to create folder which contains slash character in the name.

Best practice: avoid using special characters in names of your objects. If your layers or sublayers contain "/", rename them using dash or underscore ("-" or "_").

Re: How to export policy package to HTML - Show Package Tool sk120342

fulvio — Wed, 19 Jul 2023 07:46:55 GMT

Thanks very muck, I will be looking at that.