topic Re: R80.10 Add Access-Rule using RESTAPI on policy package in API / CLI Discussion

R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Fri, 12 Jan 2018 19:50:03 GMT

All,

I want to add an access-rule on a specific policy package using REST API on R80.10 management server

I went through the below url, however I don't see, which policy package this rule will be placed in. I have multiple policy packages and want the access-rule to be placed in the right package

https://sc1.checkpoint.com/documents/latest/APIs/index.html#web/add-access-rule~v1.1

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Ron_Izraeli — Fri, 12 Jan 2018 21:52:04 GMT

Hi Chandhrasekar,

access-rule is contained in an access-layer therefore, add-access-rule API command require an access-layer name/uid as parameter.

You could use where-used API command with layer name/uid as parameter to figure out in which policies this layer is being used before/after adding an access-rule.

Would it answer your requirement?

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Fri, 12 Jan 2018 22:20:29 GMT

Thanks very much Ron for the reply. It explains

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Sun, 14 Jan 2018 03:28:44 GMT

Thanks Ron. I was successfully able to create access-rule using REST API and specifying "layer" name placed the rule under correct policy package

however I am facing a different issue now. I was curious, and want to find out the result of "where-used". The output shows only the following "@{used-directly=} . It doesn't provide any more info on the policy , objects, rule , uid etc

I am using power shell to execute my scripts. do you happen to know why I am not getting a detailed result with all the parameters

@{used-directly=}

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Tomer_Sole — Sun, 14 Jan 2018 08:50:40 GMT

the used-directly output value should provide a list of usages. In the case of an objects used in an access control rule, it should specify the rule, layer and policy. If this is not the case, can you provide your request and response syntax here?

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Wed, 17 Jan 2018 01:45:44 GMT

Hi Tomer,

Code below

# Ignore SSL cert Exception

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

# Login to Management server and obtain sid

$URL = "https://xx.xx.xx.xx/web_api"
$Action = "/login"
$URLAnon = "$URL$Action"

$headers = @{ "Content-Type" = "application/json"
}

$login = @{
      "user" = "admin"
      "password" = "YYYYYYYYY"
    }

$login = $login | ConvertTo-Json

$response = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $login

$sid = $response.sid

# Where-Used

$Action = "/where-used"
$URLAnon = "$URL$Action"

$headers = @{
    "Content-Type" = "application/json"
    "X-chkp-sid" = $sid
    }

$WhereUsed = @{

"name" = "MY-WEBSERVERS"

}

$WhereUsed = $WhereUsed | ConvertTo-Json

$result = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $WhereUsed

#$result = $result | Convert-To-Json

Write-Host $result

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Tomer_Sole — Wed, 17 Jan 2018 08:26:14 GMT

thanks, what was the output in this case?

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Wed, 17 Jan 2018 14:01:30 GMT

Below is the output I got

@{used-directly=}

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Tomer_Sole — Wed, 17 Jan 2018 14:10:28 GMT

Are you sure that this host object is placed in the source or the destination of one of your rules? Perhaps it's inside a group inside that rule? If that is the case, you will need to add "indirect: true" to your request and receive indirect usages.

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Robert_Decker — Wed, 17 Jan 2018 15:31:09 GMT

In addition to Tomer's answer, the "indirect-max-depth" field (default is 5) determines the maximum nesting level during indirect usage search.

Robert.

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Wed, 17 Jan 2018 15:44:07 GMT

The Group Object is being used in a access-rule and the output does display correctly

@{used-directly=}

The problem is, I am not able to view all the parameters.

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Robert_Decker — Wed, 17 Jan 2018 15:50:08 GMT

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Sun, 21 Jan 2018 00:52:00 GMT

Hello,

I did try sending 'details-level' in my powershell code. I got the same result

I modified the powershell result to result.'used-directly' now I am getting total but still other output aren't visible

My new output. I still couldn't see whether its used in objects or access-control-rules.

I don't know if this is checkpoint issue or power shell issue. If any one familiar with Power shell, can you please check my code and help.

@{total=1; objects=System.Object[]; threat-prevention-rules=System.Object[]; nat-rules=System.Object[]; access-control-rules=System.Obj

ect[]}

======================================

# Ignore SSL cert Exception

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

# Login to Management server and obtain sid

$URL = "https://xx.xx.xx.xx/web_api"

$Action = "/login"

$URLAnon = "$URL$Action"

$headers = @{ "Content-Type" = "application/json"

}

$login = @{

"user" = "admin"

"password" = "yyyyy"

}

$login = $login | ConvertTo-Json

$response = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $login

$sid = $response.sid

# Where-Used

$Action = "/where-used"

$URLAnon = "$URL$Action"

$headers = @{

"Content-Type" = "application/json"

"X-chkp-sid" = $sid

}

$WhereUsed = @{

"name" = "MY-HOST"

}

$WhereUsed = $WhereUsed | ConvertTo-Json

$result = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $WhereUsed

Write-Host $result.'used-directly'

======================================

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Robert_Decker — Sun, 28 Jan 2018 09:58:59 GMT

Hi,

In order to verify whether this is checkpoint issue or power shell issue, try running the command directly on the management server using mgmt_cli utility and examine the results -

https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/where-used~v1.1

Refer to the examples at the bottom of the page.

Robert.

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Mon, 29 Jan 2018 22:10:55 GMT

Thank you Robert! I was able to use mgmt_cli utility and get the UID and Name of the layer and can now create the access-rule using REST API. I wish I can get them using my power shell code itself, it would enable me to do end to end automation and orchestration...

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Mon, 29 Jan 2018 22:13:49 GMT

Can you please let me know, where do I change the "indirect-max-depth" field .Thanks!

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Chandhrasekar_S — Mon, 29 Jan 2018 22:27:38 GMT

I did change the indirect-max-depth field to 250 to the REST API body I send, but the powershell output is still the same

$WhereUsed = @{

"name" = "xxxxssss-SERVERS"

"indirect-max-depth" = 250

}

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Robert_Decker — Tue, 30 Jan 2018 09:08:14 GMT

Try changing the title of this post to something like - "R80.10 Add Access-Rule using RESTAPI and PowerShell", so that Power Shell experts can notice and assist.

Robert.

Re: R80.10 Add Access-Rule using RESTAPI on policy package

Robert_Decker — Fri, 21 Jun 2019 09:11:29 GMT

In addition, read this thread, maybe you will find it useful -

https://community.checkpoint.com/thread/5684-web-api-issues-with-run-script-and-install-policy-from-powershell-in-r8010

Robert.