topic Re: Manipulate Cluster Object with API in API / CLI Discussion

Manipulate Cluster Object with API

JozkoMrkvicka — Sat, 06 Jan 2018 18:04:10 GMT

Hello guys,

I am wondering if there is any way how to modify Cluster object using API tool. I know, that there are few commands to manipulate with "simple-gateway", but I would like to know if there is posibility to change something within Cluster Object, or even member(s) of Cluster. Lets say I want to add new interface (new VLAN) for cluster with 2 members in "Dashboard". Attaching screenshot what I would like to achieve.

Of course I tried to use for example "show-simple-gateway" (see second attached screenshot) for Cluster, but I am getting following error:

{
"code": "generic_error",
"message": "Runtime error: com.checkpoint.objects.classes.dummy.CpmiGatewayCluster incompatible with com.checkpoint.objects.classes.dummy.CpmiGatewayCkp"
}

Is something like that posible ?

Thank you for your answer.

Re: Manipulate Cluster Object with API

Robert_Decker — Sun, 07 Jan 2018 09:38:02 GMT

Hi,

Currently there is no support for Cluster objects via API.

As you mentioned, only "simple_gateway" can be manipulated.

In addition, you can use "show gateways-and-servers" API to display ALL gateways/clusters/servers in your DB.

I assume that we will support Clusters in a future version.

Robert.

Re: Manipulate Cluster Object with API

Tomer_Sole — Sun, 07 Jan 2018 10:07:44 GMT

I would like to add that cluster objects as well as VSX in R80 and R80.10 are fully supported through the dbedit command.

Re: Manipulate Cluster Object with API

JozkoMrkvicka — Sun, 07 Jan 2018 10:48:01 GMT

Hi Robert,

Thank you for your swift and clear answer.

In my opinion, support for Cluster Object should be added ASAP, as most of organizations are using Clusters due to redundancy.

API for R80 is awesome feature, but in this case it is not usable at all to automate for example VLAN creation in case we are using 2 (or more) members.

Re: Manipulate Cluster Object with API

Michael_Pokrovs — Sun, 07 Jan 2018 19:46:32 GMT

Agree. We really need all of the management functions and settings to be exposed through API.

Re: Manipulate Cluster Object with API

Tomer_Sole — Sun, 07 Jan 2018 20:03:49 GMT

As of now, dbedit is your best way for clusters. While not RESTful, it can also be done remotely.

Usually your indication for “does this have R80-style REST API” is whether the GUI for the object or view has an R80 look and feel. With each version we will add more API commands, both for new features and for existing features which haven’t yet got the “R80 treatment”.

Re: Manipulate Cluster Object with API

JozkoMrkvicka — Thu, 01 Feb 2018 22:04:48 GMT

Tomer Sole‌,

Robert Decker‌

So I played with "dbedit" for a while and I am getting into one strange issue. I am using script to create new Cluster interface and update it with all relevant data, attaching all the commands as example:

addelement network_objects GWC interfaces cluster_interface
modify network_objects GWC interfaces:4:ifindex 4
modify network_objects GWC interfaces:4:member_network:ipaddr 10.20.150.0
modify network_objects GWC interfaces:4:member_network:netmask 255.255.255.0
modify network_objects GWC interfaces:4:officialname eth10.150
modify network_objects GWC interfaces:4:ipaddr 10.20.150.1
modify network_objects GWC interfaces:4:netmask 255.255.255.0
modify network_objects GWC interfaces:4:monitored_by_cluster true
modify network_objects GWC interfaces:4:security:netaccess:access this
modify network_objects GWC interfaces:4:security:netaccess:perform_anti_spoofing true
addelement network_objects GW1 interfaces interface
modify network_objects GW1 interfaces:4:ifindex 4
modify network_objects GW1 interfaces:4:officialname eth10.150
modify network_objects GW1 interfaces:4:ipaddr 10.20.150.2
modify network_objects GW1 interfaces:4:netmask 255.255.255.0
modify network_objects GW1 interfaces:4:monitored_by_cluster true
modify network_objects GW1 interfaces:4:security:netaccess:access this
modify network_objects GW1 interfaces:4:security:netaccess:perform_anti_spoofing true
addelement network_objects GW2 interfaces interface
modify network_objects GW2 interfaces:4:ifindex 4
modify network_objects GW2 interfaces:4:officialname eth10.150
modify network_objects GW2 interfaces:4:ipaddr 10.20.150.3
modify network_objects GW2 interfaces:4:netmask 255.255.255.0
modify network_objects GW2 interfaces:4:monitored_by_cluster true
modify network_objects GW2 interfaces:4:security:netaccess:access this
modify network_objects GW2 interfaces:4:security:netaccess:perform_anti_spoofing true
update_all
savedb‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I am using procedure mentioned in sk30383, together with "dos2unix", "sed -i 's/[[:space:]]*$//' <filename>" and at the end executing input file using "dbedit -local -globallock -f <filename>"

Basically all is fine (no errors), cluster and both gateways are updated with correct data (checked with "print network_objects GWC") but in fact in SmartConsole I cannot see this new interface in Network Management.

I have tried also install database and policy, without any difference.

What I am doing wrong ? What else must be updated/modified in order to see this new interface in Network Management tab ?

Thanks everyone who can check it

Re: Manipulate Cluster Object with API

Tomer_Sole — Mon, 05 Feb 2018 16:03:30 GMT

for this question it will be best if you can please open a task for this so that Check Point Support will be able to assist.

Re: Manipulate Cluster Object with API

Bob_Stevens — Wed, 25 Apr 2018 16:46:46 GMT

Did you ever find a fix for this?

Re: Manipulate Cluster Object with API

Robert_Decker — Wed, 25 Apr 2018 18:23:47 GMT

Hi,

Please take a look at this thread - https://community.checkpoint.com/message/14128-dbedit-issue.

And pay attention to my latest answer about an alternative.

Robert.

Re: Manipulate Cluster Object with API

JozkoMrkvicka — Sun, 02 Sep 2018 06:49:41 GMT

Hello Robert Decker‌, Tomer Sole‌

Any update on this matter?

API version 1.2 still doesnt have support for cluster object manipulation.

Do you know ETA for this ?

Thank you.

Re: Manipulate Cluster Object with API

Tomer_Sole — Sun, 02 Sep 2018 06:53:57 GMT

This is not planned for R80.20, but we do have concrete plans for this in the near future.

Re: Manipulate Cluster Object with API

JozkoMrkvicka — Thu, 30 May 2019 20:22:22 GMT

When we can FINALLY expect such a basic feature like manipulating Cluster objects within R80 ? R80.30 is GA, without any single API command for this purpose. What a shame.

Re: Manipulate Cluster Object with API

Harald_Hansen — Tue, 08 Oct 2019 09:32:42 GMT

A bit late, though the answer to this question is R80.40 (probably).

https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/add-simple-cluster-API/m-p/61871

Re: Manipulate Cluster Object with API

Timothy_Hall — Tue, 08 Oct 2019 12:15:01 GMT

Great to see one of the limitations of the API going away, looks like the definitive list of things you can't do in the API vs. the SmartConsole GUI will need to be updated in this thread when R80.40 is released:

https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Functionality-API-vs-SmartConsole/m-p/57563?search-action-id=8515789031&search-result-uid=57563