topic Re: ClusterXL - adding interface via CLI not working in Firewall & Security Management

ClusterXL - adding interface via CLI not working

RKinsp — Wed, 27 Jan 2021 14:09:35 GMT

Good morning everyone!

I am trying to add a vlan interface to a Cluster via API / CLI on R81 (open server). The interfaces were configured on the individual gateways via CLI and they are up, but when I try the below command for creating the interface at the cluster level, it gives me the folowwing error: CLINFR0711 Command insecure

I think I might be missing somthing on the command itself but the error does not give me much to go on. What I am doing is SSHing into the SMS and trying the CLI from there:

mgmt login user admin

mgmt set simple-cluster name "ClusterXL" interfaces.add.name "eth1.100" interfaces.add.ip-address "10.1.1.100" interfaces.add.ipv4-mask-length "30" interfaces.add.interface-type "cluster" interfaces.add.topology "INTERNAL" interfaces.add.anti-spoofing "false" interface.add.topology-settings.ip-address-behind-this-interface "SPECIFIC" interface.add.topology-settings.specific-network " ClusterXL-Subnet-1" members.update.1.name "ClusterXL-1" members.update.1.interfaces.name "eth1.100" members.update.1.interfaces.ipv4-address "172.32.0.1" members.update.1.interfaces.ipv4-network-mask "255.255.255.252" members.update.2.name "ClusterXL-2" members.update.2.interfaces.name "eth1.100" members.update.2.interfaces.ipv4-address "172.32.0.2" members.update.2.interfaces.ipv4-network-mask "255.255.255.252" --format json

Reference:

https://sc1.checkpoint.com/documents/latest/APIs/index.html?#clish/set-simple-cluster~v1.7%20

Any thoughts

Output from show-api-versions

mgmt show-api-versions
current-version: "1.7"
supported-versions:
- "1"
- "1.1"
- "1.6.1"
- "1.2"
- "1.3"
- "1.4"
- "1.5"
- "1.6"
- "1.7"

Thanks!

Re: ClusterXL - adding interface via CLI not working

Timothy_Hall — Wed, 27 Jan 2021 15:31:31 GMT

Perhaps this is just an artifact of copy/pasting into your post, but you have a leading space for an object name here, which is not allowed:

" ClusterXL-Subnet-1"

Re: ClusterXL - adding interface via CLI not working

RKinsp — Wed, 27 Jan 2021 16:04:50 GMT

I think that was just a posting issue. I tried copying the exact example on the API page and only changing the object names and still no go. "Command Insecure".

I wonder if naming my cluster ClusterXL might be the issue...

mgmt set simple-cluster name "ClusterXL" interfaces.add.name "eth3" interfaces.add.ip-address "10.10.10.1" interfaces.add.ipv4-mask-length "24" interfaces.add.interface-type "cluster" interfaces.add.topology "INTERNAL" interfaces.add.anti-spoofing "true" members.update.1.name "ClusterXL-1" members.update.1.interfaces.name "eth3" members.update.1.interfaces.ipv4-address "10.10.10.2" members.update.1.interfaces.ipv4-network-mask "255.255.255.0" members.update.2.name "ClusterXL-2" members.update.2.interfaces.name "eth3" members.update.2.interfaces.ipv4-address "10.10.10.3" members.update.2.interfaces.ipv4-network-mask "255.255.255.0" --format json

Re: ClusterXL - adding interface via CLI not working

Timothy_Hall — Wed, 27 Jan 2021 16:11:21 GMT

Very possible that "ClusterXL" is a reserved word when it comes to object naming.

Re: ClusterXL - adding interface via CLI not working

RKinsp — Wed, 27 Jan 2021 16:57:02 GMT

Ok, so I figured it out. It seems there is a command length limit when using SSH into the system. When using partial commands it works, but whenever I go beyond a certain count it gives me the insecure error.

Confirmed by typing in the same command into SmartConsole CLI and it works fine.

Any ideas on turning off this lenght limit?

Example below works in Gaia CLI:

mgmt set simple-cluster name "ClusterXL" interfaces.add.name "eth4.100" interfaces.add.ip-address "10.1.1.100" interfaces.add.ipv4-mask-length "24" interfaces.add.interface-type "cluster" interfaces.add.topology "INTERNAL" interfaces.add.anti-spoofing "false" interfaces.add.topology-settings.ip-address-behind-this-interface "SPECIFIC" interfaces.add.topology-settings.specific-network "VLAN-100-Interface"

Example below works in SmartConsole CLI

set simple-cluster name "ClusterXL" interfaces.add.name "eth4.100" interfaces.add.ip-address "10.1.1.100" interfaces.add.ipv4-mask-length "24" interfaces.add.interface-type "cluster" interfaces.add.topology "INTERNAL" interfaces.add.anti-spoofing "false" interfaces.add.topology-settings.ip-address-behind-this-interface "SPECIFIC" interfaces.add.topology-settings.specific-network "VLAN-100-Interface" members.update.1.name "ClusterXL-1" members.update.1.interfaces.name "eth4.100" members.update.1.interfaces.ipv4-address "172.32.0.1" members.update.1.interfaces.ipv4-mask-length "30" members.update.2.name "ClusterXL-2" members.update.2.interfaces.name "eth4.100" members.update.2.interfaces.ip-address "172.32.0.2" members.update.2.interfaces.ipv4-mask-length "30" --format json

Re: ClusterXL - adding interface via CLI not working

PhoneBoy — Thu, 28 Jan 2021 03:17:43 GMT

Use expert mode?

Re: ClusterXL - adding interface via CLI not working

RKinsp — Wed, 03 Feb 2021 10:33:52 GMT

Thanks Phoneboy.

Expert mode works, but still did not find a way to do it straight in Gaia. It is just an extra step we were trying to avoid, but it solves to problem.

Re: ClusterXL - adding interface via CLI not working

PhoneBoy — Thu, 04 Feb 2021 05:44:27 GMT

Is it possible to break that up into multiple commands?
I think the issue is the command line is longer than clish allows.

Re: ClusterXL - adding interface via CLI not working

genisis__ — Sat, 15 May 2021 17:15:35 GMT

Query Guys,

If I have an existing cluster and a number of interfaces how do I set anti-spoofing to detect on each of these interfaces using the mgmt_cli?

If I can prep this in advanced it would save me time later.

Re: ClusterXL - adding interface via CLI not working

RKinsp — Mon, 17 May 2021 01:21:06 GMT

Hello,

I think the following would set it to detect, but I have not tested it

mgmt_cli set simple-cluster name "cluster1" interfaces.update.name "eth-1" interfaces.update.anti-spoofing-settings.action "detect" --format json

You would need a line per interface. You would probably use the login method so you wouldnt need to user and password per line.

ex.

mgmt_cli login user admin password adminpass > id.txt

mgmt_cli set simple-cluster name "cluster1" interfaces.update.name "eth-1" interfaces.update.anti-spoofing-settings.action "detect" -s id.txt

mgmt_cli set simple-cluster name "cluster1" interfaces.update.name "eth-2" interfaces.update.anti-spoofing-settings.action "detect" -s id.txt

etc...

mgmt_cli publish -s id.txt

Re: ClusterXL - adding interface via CLI not working

genisis__ — Mon, 17 May 2021 08:13:22 GMT

Thanks - I'll give it a go.

Re: ClusterXL - adding interface via CLI not working

genisis__ — Mon, 17 May 2021 08:16:19 GMT

I assume if I did this through the smartconsole command prompt I would need a username/password.

Re: ClusterXL - adding interface via CLI not working

genisis__ — Mon, 17 May 2021 09:37:34 GMT

Just tried it but it did not work:

set simple-cluster name "CLUSTER1" interfaces.update.name "bond5" interfaces.update.anti-spoofing-settings.action "detect"

code: "generic_err_invalid_parameter"
message: "Invalid parameter for [interface-type]. Mandatory to specify interface type

The found "interface-type" here:

https://sc1.checkpoint.com/documents/latest/APIs/?#cli/set-simple-cluster~v1.7%20

and then tried this:

set simple-cluster name "CLUSTER1" interfaces.update.name "bond5" interfaces.update.anti-spoofing-settings.action "detect" interfaces.update.interface-type "cluster"

and then got this:

code: "generic_err_missing_required_parameters"
message: "Missing parameter: [ip-address or ipv4-address or ipv6-address]"

Its looking like a number of mandatory fields are required.

Re: ClusterXL - adding interface via CLI not working

RKinsp — Mon, 17 May 2021 13:23:13 GMT

I assumed if you were editing a current interface you could just use a single value... Try the example below just adding the anti-spoofing section. Please note this does not work for adding an interface, there is another example for that.

https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/set-simple-cluster~v1.7%20

mgmt_cli set simple-cluster name "cluster1" interfaces.update.name "eth-1" interfaces.update.ip-address "1.2.2.203" interfaces.update.network-mask "255.255.255.0" interfaces.update.interface-type "cluster" interfaces.update.topology "INTERNAL" interfaces.update.topology-settings.ip-address-behind-this-interface "network defined by the interface ip and net mask" interfaces.update.topology-settings.interface-leads-to-dmz false --format json

Re: ClusterXL - adding interface via CLI not working

genisis__ — Mon, 17 May 2021 13:36:38 GMT

The challenge here is I only want to update the Anti-Spoofing part, and leave everything else untouched.

Re: ClusterXL - adding interface via CLI not working

PhoneBoy — Tue, 18 May 2021 01:43:00 GMT

Unfortunately, there are some API calls that require multiple things to be specified even though it may not seem...necessary.
Not exactly sure if this is a bug or not.
@Omer_Kleinstern any thoughts?

Re: ClusterXL - adding interface via CLI not working

genisis__ — Tue, 18 May 2021 16:49:33 GMT

Thanks, in this case its just quickier and safer to do it the old fashion way 😉

Re: ClusterXL - adding interface via CLI not working

PhoneBoy — Tue, 18 May 2021 21:01:32 GMT

Apparently, the need for the parameters via the API is by design (not a bug, exactly).
We'll work to improve this in an upcoming release.

Re: ClusterXL - adding interface via CLI not working

genisis__ — Wed, 19 May 2021 01:50:01 GMT

Thanks.

b.t.w is it possible to failover gateways using API?