topic Re: How to merge database in R80.10 in API / CLI Discussion

How to merge database in R80.10

Vishnu_Kumar — Sat, 02 Feb 2019 09:44:48 GMT

Hi All,

Currently we are using 5 managment server having os R77.30.

Each management server is managing 1 HA pair of secuity gateways.

Now I am palnning to merge the database of all Managment server, so that we can manat all gateways from single managment server.

Can anybody help me to know how we can merge the database of these managment servers.

As CP_merge is has been obsolute in R80.10.

Re: How to merge database in R80.10

PhoneBoy — Mon, 20 May 2019 02:51:58 GMT

https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Python-tool-for-exporting-importing-a-policy-package-or-parts-of/td-p/41100

Re: How to merge database in R80.10

G_W_Albrecht — Tue, 05 Feb 2019 12:01:42 GMT

I would suggest to first unite the R77.30 management servers using CP_merge, then run the pre-upgrade verifier on the R77.30 SMS. After performing the needed changes, you can do a migrate export with R80.20 tools (i would suggest R80.20) and a migrate import into a fresh R80.20 SMS.

Re: How to merge database in R80.10

Vishnu_Kumar — Tue, 12 Feb 2019 12:59:58 GMT

Hi Dameon and Günther,

Thanks for an update.

Firstly Apologies for a typo mistake in my initial query. Actually All management Server's current OS is R80.10.

Earlier by mistake I mentioned R77.30.

So I think, I will not be able to follow the procedure suggested by Mr. Gunther.

So now available option is :

Python tool for exporting/importing a policy package or parts of it

During follow this option I have done following steps:

1. have downloaded the ZIP file from the link "https://github.com/CheckPointSW/ShowPolicyPackage"

2. Now "cp_mgmt_api_python_sdk" is blank by default.

As per instructions I will need to manually download and copy the [Check Point API Python SDK] (https://github.com/CheckPoint-APIs-Team/cpapi-python-sdk) content into this folder.

PROBLEM:

1. From this link, I am not able to locate the "Check Point API Python SDK" file. So that I can manually download it.

2. "import_export_package.py " script is not executing.

Can any one share exact steps or relevant artical which i can follow.

Re: How to merge database in R80.10

PhoneBoy — Tue, 12 Feb 2019 18:05:06 GMT

The Python SDK consists of the files in the lib directory on that github repository.

They would need to be copied somewhere your Python interpreter will look for them.

That will likely fix the issue you are having executing the import_export_package.py script.

Re: How to merge database in R80.10

Vishnu_Kumar — Fri, 15 Feb 2019 17:41:44 GMT

Hi Dameon,

Thanks for update. Now donloaded all relavant files and import_export_package.py script is exeting from my PC.

But now once I fill all required details into interactive session to export the policy package. In last script gets termanated automatically with following error message:

============== ===========++++++++++++++++=======================

Login to management server failed. lib::APIResponse
{
    "data": null,
    "error_message": "APIResponse received a response which is not a valid JSON.",
    "res_obj": {},
    "status_code": 403,
    "success": false
}

==============XXXXXXXXXXXXXXXXXXXXXXXX====================

Please also veryfybelow mentioned the procedure, which I followed during Intactive session (Script execution)

I hope i need to run this scrip on PC machine, not on managmnet Server.

==================== ============================================

Welcome to the Policy Package Import/Export Tool.
What would you like to do?
1. Import a package
2. Export a package
99. Exit
2
Please enter a Policy Package name to export:
Policy_Package_1
Please select a login method:
1. Enter user credentials manually
2. Login as Root
3. Use an existing session file
4. Use an existing session UID
99. Back
1
The script will run with the following parameters:
Export Access-Control layers = True
Export Threat-Prevention layers = False
Output-file name = None
Management Server IP = 127.0.0.1
Management Server Port = 443
Management Server Domain = None
1. Change Settings
2. Run
99. Back
1
Please select a setting to change:
1. Disable export of Access-Control Rulebases
2. Enable export of Threat-Prevention Rulebases
3. Output file name
4. Change Management Server IP
5. Change Management Server Port
6. Change the domain name
99. Back
4
Please enter the IP address of the management server:
172.16.1.221
The script will run with the following parameters:
Export Access-Control layers = True
Export Threat-Prevention layers = False
Output-file name = None
Management Server IP = 172.16.1.221
Management Server Port = 443
Management Server Domain = None
1. Change Settings
2. Run
99. Back
2
Please enter your username:
admin

Please enter your password:

(((((( AFTER IT SCRIPT GETS CLOSED AUTOMATICALLY)

=======================XXXXXXXXXXXXXXXXXX ========================

Below is the API Status (even after restart API service, IP is 127.0.0.1)

[As some online document reflecting that it should not be 127.0.0.1 to resolve this issue]

------------- ----------------------------------

[Expert@MGMT-1:0]# api stat
Usage: api {start [-d]|stop|restart [-d]|status|reconf|logging [on|off|warn|info |debug|trace]|fingerprint}
[Expert@MGMT-1:0]# api status

API Settings:
---------------------
Accessibility: Require ip 127.0.0.1
Automatic Start: Enabled

Processes:

Name      State     PID       More Information
-------------------------------------------------
API       Started   3611
CPM       Started   3369      Check Point Security Management Server is running                                                                                         and ready
FWM       Started   2922

Port Details:
-------------------
JETTY Internal Port:      50276
APACHE Gaia Port:         443
                          Apache port retrieved from: httpd-ssl.conf

--------------------------------------------
Overall API Status: Started
--------------------------------------------

API readiness test SUCCESSFUL. The server is up and ready to receive connections

Notes:
------------
To collect troubleshooting data, please run 'api status -s <comment>'

Re: How to merge database in R80.10

PhoneBoy — Fri, 15 Feb 2019 20:34:38 GMT

There was a bug in early versions of R80.10 where even if you set the allowed IPs for the API to something other than 127.0.0.1, it would remain that way.

Re: R80.10 API bug: fallback to "SmartCenter Only" after reboot‌

Please install the latest Jumbo Hotfix and try again

Re: How to merge database in R80.10

Vishnu_Kumar — Wed, 20 Feb 2019 06:49:24 GMT

Hi Dameon,

Thanks for your last input. Now that issue is resolved, but now facing below error in last

============XXXXX######################

Exporting Access Control layers

Exporting Access Layer [Policy_Package_1 Network]

Traceback (most recent call last):
File "D:\GIT_HUB\SCRIPT\import_export_package.py", line 45, in <module>
export_package(client, args)
File "D:\GIT_HUB\SCRIPT\exporting\export_package.py", line 39, in export_package
= export_access_rulebase(show_package.data["name"], access_layer["name"], access_layer["uid"], client, timestamp, tar_file)
File "D:\GIT_HUB\SCRIPT\exporting\export_access_rulebase.py", line 16, in export_access_rulebase
get_query_rulebase_data(client, "access-rulebase", {"name": layer, "uid": layer_uid, "package": package})
File "D:\GIT_HUB\SCRIPT\exporting\export_objects.py", line 38, in get_query_rulebase_data
if compare_versions(client.api_version, "1.1") != -1:
File "D:\GIT_HUB\SCRIPT\utils.py", line 126, in compare_versions
v1_nums = version1.split('.')
AttributeError: 'NoneType' object has no attribute 'split'

#################XXXXXXXXXXXXXXXXXXXXXXX#####################

Also request you to please verify my below given procedure as well, which I am following to export a policy

======== ==============

D:\GIT_HUB\SCRIPT>
D:\GIT_HUB\SCRIPT>import_export_package.py

Please enter your password:

Exporting Access Control layers

Exporting Access Layer [Policy_Package_1 Network]

D:\GIT_HUB\SCRIPT>

Re: How to merge database in R80.10

Vishnu_Kumar — Wed, 20 Feb 2019 07:45:23 GMT

With this error, a <Policy-Package-Name>.tar.tgz file is exported but having only 1 KB size.

Re: How to merge database in R80.10

PhoneBoy — Thu, 21 Feb 2019 06:59:47 GMT

What version of Python?

Note I’ve only run this on Linux myself.

Believe you also need to install this: Python library for using R80 management server APIs‌

Re: How to merge database in R80.10

Vishnu_Kumar — Fri, 22 Feb 2019 12:08:41 GMT

Hi Dameon,

Currently, python version is 2.7.9 on my Windows 10 machine. May I know which Linux OS you used for it.

Please let me know whether I need to install python Library “ Python library for using R80 management server APIs <https://community.checkpoint.com/docs/DOC-1091> ”on Windows machine or on checkpoint Management Server.

Currently I am trying to install it on Management server. Here “pip install command is not working. Is it possible to install it locally after upload the library using WinSCP.

Re: How to merge database in R80.10

PhoneBoy — Fri, 22 Feb 2019 14:00:16 GMT

I used an Ubuntu variant but any modern distribution should work.

The libraries must be on the machine running the Python interpreter.

Have no idea if you can copy the libraries over to a Windows version of Python.

Re: How to merge database in R80.10

Dawei_Ye — Tue, 26 Feb 2019 07:55:08 GMT

Hi Dameon,

How could this script deal with the same name object when I import the old exported rules into a new SMC?

We are facing a huge problem when we merge a old SSG (with 1400 objects and 1200 policies)to Check Point.

Regards,

Dawei Ye

Re: How to merge database in R80.10

PhoneBoy — Tue, 26 Feb 2019 14:15:34 GMT

The API won't (or shouldn't) allow you to create objects of the same name.

Which means, as is, the script will probably fail on import with duplicate objects in your existing management.

Then again, because the script is Open Source, you could probably enhance it to deal with this situation.

Re: How to merge database in R80.10

Vishnu_Kumar — Fri, 01 Mar 2019 11:04:30 GMT

Hi Dameon,

Thanks very much, Now i am able to exucure script scussfully on ubuntu.

I was able to export policy scusfully from source managmnet server.

Also able to import it on target Managmnet server. All the thinkg liooking fine except VPN cummunities.

VPN communities are not imorting, getting below error message:

Failed to import vpn-community-meshed with name [HO-to-Brach-VPN]. Error: message: Invalid parameter for [shared-secrets]. Invalid value

code: generic_err_invalid_parameter.

Re: How to merge database in R80.10

PhoneBoy — Sat, 02 Mar 2019 00:30:59 GMT

The parameter should be called shared-secret (without the s on the end).

Which means it's possible there is a bug in the script.

Re: How to merge database in R80.10

Vishnu_Kumar — Mon, 04 Mar 2019 06:49:13 GMT

Hi Dameon,

Actually i wanted to know using this scripts is it possiblle to import VPN cummuniteis or not.

Re: How to merge database in R80.10

PhoneBoy — Mon, 04 Mar 2019 10:18:38 GMT

Like I said to your previous comment, it looks like there is a bug in the script related to shared secrets.

Amiad Stern‌ can you have someone look at Python tool for exporting/importing a policy package or parts of it‌ and confirm?

Re: How to merge database in R80.10

Amiad_Stern — Mon, 04 Mar 2019 11:12:58 GMT

Hi Vishnu Kumar‌ , we will check Dameon Welch-Abernathy‌ comment to see if there is a bug. Meanwhile, if you're interested in only in exporting VPN communities (and not the whole package), try this repository GitHub - CheckPointSW/ExportObjects: Check Point ExportObjects tool enables you to export specific types of objects from…

Re: How to merge database in R80.10

Vishnu_Kumar — Mon, 04 Mar 2019 17:26:59 GMT

Hi Amiad,

Actually I need VPN communities as well as rest of the database also.

Now just for an update, If I am removing pre-shared-key from the cummunities then able to import VPN communities sucessfully with rest of VPN parameters.

But if i dont remove the pre-shared-key then not able to import VPN communities completely.