topic Re: Finding main IP of any managed gateway in Firewall and Security Management

Finding main IP of any managed gateway

Bernhard_Sayer — Thu, 07 Dec 2017 11:55:41 GMT

I am looking for a way to export main IP addresses of all managed gateways on R80.10 SMS, to use this list for some maintenance stuff (cprid_util, ...).

I found sk85621, which is only for MDM, and the command "mgmt_cli show simple-gateways details-level "full"", which shows me all IP addresses of each gateway.

Does anyone have a solution or hint how to create a simple list of the management IP address of each gateway?

Re: Finding main IP of any managed gateway

Robert_Decker — Thu, 07 Dec 2017 13:51:35 GMT

You can do this by specifying a JSON formatted output and then apply a JQ command on the output:

mgmt_cli -r true show simple-gateways details-level full --format json | $CPDIR/jq/jq -r '.objects[]["ipv4-address"]'

You can also redirect the output to a file:

mgmt_cli -r true show simple-gateways details-level full --format json | $CPDIR/jq/jq -r '.objects[]["ipv4-address"]' > iplist

Please refer to this link for more info on JQ and API.

Robert.

Re: Finding main IP of any managed gateway

Bernhard_Sayer — Thu, 07 Dec 2017 14:31:33 GMT

Many thanks Robert! Now I understand the Management API reference a little bit better ☺.

But I only get 23 of 110 gateway IP addresses. When I add “limit 500”, which seems to be maximum, I see 27 gateway IP addresses.

So it seems, that the output is limited to a number of lines ….

Re: Finding main IP of any managed gateway

Robert_Decker — Thu, 07 Dec 2017 15:27:05 GMT

Right, the default limit is 50, so you need to specify a manual upper limit if you need.

This command only returns simple-gateways, there may be non simple-gateways, and they are not returned.

Try the "show gateways-and-servers" command instead. It will return ALL gateways.

Robert.

Re: Finding main IP of any managed gateway

MikaelJohnsson — Fri, 08 Dec 2017 15:08:58 GMT

Maybe not the right place to ask but does anyone know how to do it for R77.X versions?

The information seems to be retrievable via dbedit, but as fas a I can tell I have to go through multiple tables to

get the information.

Querying all the firewalls and then filter for SIC (id_value:) gives the main IP in some cases but not in all ?!?

/Mikael

Re: Finding main IP of any managed gateway

Bernhard_Sayer — Fri, 08 Dec 2017 21:20:27 GMT

You are right - "show gateways-and-servers" shows all gateways.

But unfortunately this command shows also the cluster objects. Is it possible to filter out these cluster objects, so that i get only real gateway IP addresses?

Bernhard

Re: Finding main IP of any managed gateway

Bernhard_Sayer — Fri, 08 Dec 2017 22:06:56 GMT

I found this way working:

Is there a way to filter like grep with json?

Bernhard

Re: Finding main IP of any managed gateway

PhoneBoy — Sat, 09 Dec 2017 07:05:54 GMT

Why not just get the object IP?

That's what the manager actually uses to communicate to the gateway.

Re: Finding main IP of any managed gateway

MikaelJohnsson — Sat, 09 Dec 2017 20:21:58 GMT

Sure, but how? 🙂

In the objects_5_0.C (and via the output of dbedit) there are multiple "IP address" statements, both what seems to be the Main IP but also under the "interfaces-branch". So a grep for "IP address" will return all those. I haven't seen an entry for "Main IP" or some other unique entry besides the value in the "SIC-branch"... Which isn't always there...

Cheers

Mikael

(I'm replying via my phone so the exact name of the IP-field might not be correct)

Re: Finding main IP of any managed gateway

Robert_Decker — Sat, 09 Dec 2017 21:29:47 GMT

No, AFAIK, but you can use the select/contains/not combinations on the output. For Example -

| select(.values[] | contains(\"cluster\") | not)

Robert.

Re: Finding main IP of any managed gateway

Robert_Decker — Mon, 11 Dec 2017 09:45:43 GMT

Here you go, the fully working command -

Enjoy,

Robert.

Re: Finding main IP of any managed gateway

Bernhard_Sayer — Mon, 18 Dec 2017 06:28:18 GMT

But this command displays management server, log server as well as interoperable devices. To catch only managed gateways, only "CpmiClusterMember" and "simple-gateway" (maybe "CpmiSofawareGateway" for embedded appliances) have to filter. Is it possible to use "contains" with OR?

Thanks,

Bernhard

Re: Finding main IP of any managed gateway

Robert_Decker — Thu, 28 Dec 2017 08:26:47 GMT

Hi, sorry for the late reply, I was on vacation.

You can use multiple elements inside contains statement -

contains(["simple", "cluster"])

Robert.

Re: Finding main IP of any managed gateway

Bernhard_Sayer — Thu, 28 Dec 2017 09:31:59 GMT

works - many thanks!!

Re: Finding main IP of any managed gateway

PhoneBoy — Thu, 28 Dec 2017 18:33:18 GMT

It's the main object IP...the one identified by ipaddr (not listed in the interfaces branch).

Re: Finding main IP of any managed gateway

Tomer_Sole — Thu, 28 Dec 2017 19:07:07 GMT

I would upgrade my MGMT to R80.10 for this purpose alone - to use the better API - but maybe that’s just me

either way if you plan to upgrade at some point to R80.10, this R77 script’s shelf life won’t be too long...

Re: Finding main IP of any managed gateway

Olavi_Lentso — Mon, 19 Mar 2018 10:00:45 GMT

In the older versions and even in R80.10 cpmiquerybin tool (cpwiki.net) might be used.

The following query to returns firewalls and cluster members:

cpmiquerybin attr "" network_objects "(type='cluster_member') | (type='gateway') & (location='internal')" -a __name__,ipaddr

It should return

object1 IP
object2 IP

In a Multi-Domain Server either run this query in each CMA or use the next query in the MDS context

cpmiquerybin attr "mdsdb" network_objects "(type='gateway') | (type='cluster_member')" -a __name__,ipaddr

Some awk or sed is necessary to get desired output.

Re: Finding main IP of any managed gateway

Edward_Rule — Thu, 13 Apr 2023 12:31:20 GMT

Hello, i'm having this same issue, i've tried to run this command in the checkpoint command line, but when i do i the the error 'The flag "-r" is not supported within SmartConsole's CLI window.' we are using checkpoint r80.40. Do you know where I'm going wrong?

Re: Finding main IP of any managed gateway

Danny — Thu, 13 Apr 2023 12:59:50 GMT

Don't run it from the SmartConsole's CLI. Login via SSH and go into expert mode. Then run the command.