topic Re: Creating Firewall Rules per CLI in API / CLI Discussion

Creating Firewall Rules per CLI

Yasushi_Kono1 — Wed, 06 Dec 2017 16:03:30 GMT

Hi eXperts,

I am trying to create Firewall rules completely with CLI commands. I started the following Syntax:

[Expert@A-SMS:0]# mgmt_cli login user cpadmin -p vpn123 > sid.txt

[Expert@A-SMS:0]# mgmt_cli add access-layer name "Bravo_Standard" --format json -s sid.txt

[Expert@A-SMS:0]# mgmt_cli add access-rule layer "Bravo_Standard" position 1 name "NetBIOS rule" service.1 "rip" service.2 "bootp" service.3 "NBT service.4 "udp-high-ports" action "drop" --format json -s sid.txt

[Expert@A-SMS:0]# mgmt_cli publish -s sid.txt

Everything looks fine, but I cannot see any policies just added in SmartConsole. Nor can I install the newly created policy with

[Expert@A-SMS:0]# mgmt_cli install-policy policy-package "Bravo_Standard" targets B-GW

So, what I am doing wrong?

Any hint will highly be appreciated.

Kind regards,

Yasushi

Re: Creating Firewall Rules per CLI

Robert_Decker — Wed, 06 Dec 2017 17:35:27 GMT

Hi,

What are you trying to accomplish?

Are you willing to create a rulebase with inline layers (R80.10 style), or just a flat rulebase (R77.30 style)?

Robert.

Re: Creating Firewall Rules per CLI

Yasushi_Kono1 — Wed, 06 Dec 2017 21:23:09 GMT

Hi Robert,

Thank you for your reply.

I wanted to start with the flat rulebase, But. afterwards, I wanted to learn how to create an inline layer.

Cheers,

Yasushi

Von meinem iPhone mithilfe von TouchDown (www.symantec.com) gesendet

Re: Creating Firewall Rules per CLI

Robert_Decker — Thu, 07 Dec 2017 08:38:31 GMT

Here you go - the FLAT rulebase:

1. create a policy package:

mgmt_cli add package name "my_policy" threat-prevention "false" -s id.txt

2. add the rules to the NETWORK (!!!) layer:

mgmt_cli add access-rule layer "my_policy Network" source "any" destination "h1" service "http" action "accept" track-settings.type "Log" position "1" name "rule1" -s id.txt

3. publish:

mgmt_cli -s id.txt publish

This is the result in SmartConsole:

Please pay attention that the Cleanup Rule is automatically created along with the package creation.

You can also add sections, like in R77:

mgmt_cli add access-section layer "my_policy Network" position 1 name "New Section 1" -s id.txt

mgmt_cli -s id.txt publish

Hope this can assist.

Robert.

Re: Creating Firewall Rules per CLI

Yasushi_Kono1 — Thu, 07 Dec 2017 14:34:22 GMT

I tested that and it worked perfectly for me!

Thanks a lot for sharing your valuable knowledge with us!

Kind regards,

Yasushi

Re: Creating Firewall Rules per CLI

Yasushi_Kono1 — Fri, 02 Feb 2018 12:42:40 GMT

Hello Robert,

now, I am about to write a bash script with which I wanted to create policies interactively. At first sight, no big deal. But, if you wanted to add multiple objects (for source, destination or service), I am struggling with that.

What is the correct syntax for adding another source object into an existing rule?

I tried:

mgmt_cli set access-rule layer "Testpol Network" source Host_A -s id.txt

but then, Host_A replaces the host object instead of being added it.

Thanks a lot in advance!

Kind regards,

Yasushi

Re: Creating Firewall Rules per CLI

Robert_Decker — Fri, 02 Feb 2018 15:32:21 GMT

Use "source.add" syntax. The ".add" allows adding to the existing sources.

https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/set-access-rule~v1.1

Robert.

Re: Creating Firewall Rules per CLI

network_operat2 — Thu, 15 Mar 2018 20:14:26 GMT

the flat rule is not getting added for me through cli command which u have given above

Re: Creating Firewall Rules per CLI

Robert_Decker — Thu, 15 Mar 2018 20:58:12 GMT

please post here the commands you are using.