topic Re: API disabled on R81 management server in Firewall and Security Management

API disabled on R81 management server

Scott_Paisley — Mon, 09 Aug 2021 09:18:01 GMT

We recently upgraded both our management servers to R81

One is a hardware appliance, one is a VM.

On the VM, the API status appears as Unknown during start up, and then shows as disabled.

On the hardware, it shows as enabled.

We can restart it on the VM and it runs fine, but why does it not start automatically?

Re: API disabled on R81 management server

_Val_ — Mon, 09 Aug 2021 10:17:27 GMT

Hi @Scott_Paisley please make sure you performed all actions mentioned here: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Managing-Security-through-API.htm

Re: API disabled on R81 management server

Scott_Paisley — Mon, 09 Aug 2021 10:20:54 GMT

Yes. The documentation mentions enabling the API, then says it is enabled or disabled automatically. We have more than 4GB RAM.

This was all working prior to the R81 upgrade.

Re: API disabled on R81 management server

_Val_ — Mon, 09 Aug 2021 10:49:21 GMT

The VM MGMT station, is it secondary? It yes, please perform the failover, make sure API is once again enabled via SmartConsol, publish session, and run api restart on CLI

Re: API disabled on R81 management server

_Val_ — Mon, 09 Aug 2021 10:32:41 GMT

Also, API should only be active on your primary/active server. That might be the main cause of the observed situation.

Re: API disabled on R81 management server

Scott_Paisley — Mon, 09 Aug 2021 10:36:37 GMT

We are running on our Active/Secondary server.

This worked fine on R80.40

Re: API disabled on R81 management server

_Val_ — Mon, 09 Aug 2021 10:44:32 GMT

Please elaborate

Re: API disabled on R81 management server

Scott_Paisley — Mon, 09 Aug 2021 10:46:50 GMT

We failed over to our secondary management server, so it is currently the active box.

We have been running that way for over a year. On R80.40 the API started automatically. On R81 it does not.

Re: API disabled on R81 management server

_Val_ — Mon, 09 Aug 2021 11:42:13 GMT

So, if I understand correctly, you are currently running the secondary management as active. Did you try to re-activate API on it, from SmartConsole, as mentioned above?

Did you try enabling api from the CLI? Run the following:

api start

api reconfigure

api restart

and check if it stays UP after those commands.

Re: API disabled on R81 management server

Scott_Paisley — Mon, 09 Aug 2021 11:55:18 GMT

There is no enable option in smartconsole. see screenshot attached.

We can start from the CLI. I will try the commands listed

Re: API disabled on R81 management server

_Val_ — Mon, 09 Aug 2021 12:42:47 GMT

You are right, in R81 the API start is automatic. Did you originally install your VM with just 4 GB of RAM?

Re: API disabled on R81 management server

Scott_Paisley — Mon, 09 Aug 2021 12:44:46 GMT

No, it always had more than 8GB

Re: API disabled on R81 management server

_Val_ — Mon, 09 Aug 2021 14:50:49 GMT

Okay, try the CLI. If it is still disabled after reboot, please open a support call.

Re: API disabled on R81 management server

Scott_Paisley — Tue, 10 Aug 2021 06:32:04 GMT

No change. After a restart the API state is disabled until I restart it manually.

Re: API disabled on R81 management server

_Val_ — Tue, 10 Aug 2021 06:59:30 GMT

Okay, that's too bad. Please take it with TAC

Re: API disabled on R81 management server

Omer_Kleinstern — Tue, 10 Aug 2021 10:10:57 GMT

Hi @Scott_Paisley ,

Can you run the following commands:

mgmt_cli show api-settings -r true -d "System Data" -f json | jq '."automatic-start"'

$CPDIR/bin/cpprod_util CPPROD_GetValue Products MGMTAPI 1

Thanks,

Omer

Re: API disabled on R81 management server

Scott_Paisley — Tue, 10 Aug 2021 10:51:37 GMT

# mgmt_cli show api-settings -r true -d "System Data" -f json | jq '."automatic-start"'
true

# $CPDIR/bin/cpprod_util CPPROD_GetValue Products MGMTAPI 1
Failed to find the value

Re: API disabled on R81 management server

Omer_Kleinstern — Tue, 10 Aug 2021 14:04:24 GMT

Please open a TAC case for further investigation.

Re: API disabled on R81 management server

Scott_Paisley — Fri, 13 Aug 2021 16:36:35 GMT

TAC were able to resolve the issue.

There was a problem with one of the files on the server

Re: API disabled on R81 management server

PhoneBoy — Fri, 13 Aug 2021 18:11:22 GMT

What files did they precisely fix?
Did they give you an SK?