topic Re: Can we get the routes from R80? in API / CLI Discussion

Can we get the routes from R80?

Jun_Liang_Seow — Mon, 15 May 2017 06:10:39 GMT

Hi all,

Would like to check if it is possible to find out the routing table in each of the firewall through R80. This includes both static and dynamic routes that can be found in the firewall. Please advise me as I look through the API reference and could not find something that lead me to get the routing table. Thanks.

Regards,

Jun Liang

Re: Can we get the routes from R80?

Marc_Guyard — Thu, 01 Jun 2017 10:57:24 GMT

Hi,

You can use run-script API to do this : Check Point - Management API reference

Send a "show route" command to single/multiple gateway with one API command and retreive result via task content

Re: Can we get the routes from R80?

Brian_Deutmeyer — Fri, 09 Jun 2017 04:01:37 GMT

This isn't via the API, but if you have the monitoring blade enabled, you can view both the static and dynamic routes in SmartConsole...

1. Go to the Gateways and Servers tab

2. Select the device you want to view the routes on

3. Click on Device & License Information...

4. Click on Network Activity

5. Scroll all the way to the bottom and click Routing Table

6. Enjoy

Re: Can we get the routes from R80?

Jun_Liang_Seow — Wed, 02 Aug 2017 04:03:42 GMT

Hi Marc,

Thanks for the reply. I was just testing this recently and I got this error from Postman API. Any idea what this could mean? Thanks. I verified that the target is correct as I have tried to put in a wrong target and it give me a separate set of error. By the way, the response status code is 500 Server Error.

I put the following into the body:

{
"script-name" : "Script to get routes",
"script" : "show route",
"targets": "gateway-dummy",
"set-session-id" : true
}

I got this results:

{
"code": "generic_error",
"message": "Null Pointer exception: null"
}

Re: Can we get the routes from R80?

Ofir_Shikolski — Wed, 02 Aug 2017 10:41:20 GMT

This command will run in "BASH" mode

for clish mode is needed to run clish command .

1. login

2. run-script

{
"script-name" : "show routes",
"script" : "netstat -nr",
"targets" : [ "mgmt" ]
}

Results:
{
"tasks": [
{
"target": "mgmt",
"task-id": "b3ee3851-8c50-47e7-96a5-5b897538bab9"
}
]
}

3. show-task

{
"task-id" : "b3ee3851-8c50-47e7-96a5-5b897538bab9" ,
"details-level" : "full"
}

Results:

{
"tasks": [
{
"uid": "690c8f82-d1d1-4060-96ea-86a99950cfe0",
"name": "mgmt - show routes",
"type": "CdmTaskNotification",
"domain": {
"uid": "41e821a0-3720-11e3-aa6e-0800200c9fde",
"name": "SMC User",
"domain-type": "domain"
},
"task-id": "b3ee3851-8c50-47e7-96a5-5b897538bab9",
"task-name": "mgmt - show routes",
"status": "succeeded",
"progress-percentage": 100,
"start-time": {
"posix": 1501670168404,
"iso-8601": "2017-08-02T13:36+0300"
},
"last-update-time": {
"posix": 1501670170686,
"iso-8601": "2017-08-02T13:36+0300"
},
"suppressed": false,
"task-details": [
{
"uid": "aa1e472e-9a7c-47e1-891a-a060e3b4262a",
"name": null,
"domain": {
"uid": "41e821a0-3720-11e3-aa6e-0800200c9fde",
"name": "SMC User",
"domain-type": "domain"
},
"color": "black",
"statusCode": "succeeded",
"statusDescription": "Kernel IP routing table, Destination Gateway Genmask Flags MSS Window irtt Iface, 1.1.1.0 0.0.0.0 255.255.255.254 U 0 0 0 eth0.3, 10.0.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0, 0.0....",
"taskNotification": "690c8f82-d1d1-4060-96ea-86a99950cfe0",
"gatewayId": "37308a02-7395-0a43-9765-562fabbd76c2",
"gatewayName": "",
"transactionId": 235893072,
"responseMessage": "S2VybmVsIElQIHJvdXRpbmcgdGFibGUKRGVzdGluYXRpb24gICAgIEdhdGV3YXkgICAgICAgICBHZW5tYXNrICAgICAgICAgRmxhZ3MgICBNU1MgV2luZG93ICBpcnR0IElmYWNlCjEuMS4xLjAgICAgICAgICAwLjAuMC4wICAgICAgICAgMjU1LjI1NS4yNTUuMjU0IFUgICAgICAgICAwIDAgICAgICAgICAgMCBldGgwLjMKMTAuMC4wLjAgICAgICAgIDAuMC4wLjAgICAgICAgICAyNTUuMjU1LjAuMCAgICAgVSAgICAgICAgIDAgMCAgICAgICAgICAwIGV0aDAKMC4wLjAuMCAgICAgICAgIDEwLjAuMC4xICAgICAgICAwLjAuMC4wICAgICAgICAgVUcgICAgICAgIDAgMCAgICAgICAgICAwIGV0aDAK",
"responseError": "",
"meta-info": {
"validation-state": "ok",
"last-modify-time": {
"posix": 1501670170723,
"iso-8601": "2017-08-02T13:36+0300"
},
"last-modifier": "admin",
"creation-time": {
"posix": 1501670168688,
"iso-8601": "2017-08-02T13:36+0300"
},
"creator": "admin"
},
"tags": [],
"icon": "General/globalsNa",
"comments": "",
"display-name": "",
"customFields": null
}
],
"comments": "Completed",
"color": "black",
"icon": "General/globalsNa",
"tags": [],
"meta-info": {
"lock": "unlocked",
"validation-state": "ok",
"last-modify-time": {
"posix": 1501670170705,
"iso-8601": "2017-08-02T13:36+0300"
},
"last-modifier": "admin",
"creation-time": {
"posix": 1501670168440,
"iso-8601": "2017-08-02T13:36+0300"
},
"creator": "admin"
},
"read-only": false
}
]
}

4. base64 for "responseMessage"

https://www.base64decode.org/

Results:

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
1.1.1.0 0.0.0.0 255.255.255.254 U 0 0 0 eth0.3
10.0.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 eth0

Re: Can we get the routes from R80?

Jun_Liang_Seow — Thu, 03 Aug 2017 06:22:28 GMT

Thanks!

This might not be related but it seems like I'm facing the issue still despite me issuing simple commands like "ls -lh".

I'm using a VSX (77.3) for my gateway - using R80 (not R80.10).

I put the following into the body:

{
"script-name" : "show route",
"script" : "ls -lh",
"targets": "gateway-dummy",
"set-session-id" : true
}

I got this results:

{
"code": "generic_error",
"message": "Null Pointer exception: null"
}

Re: Can we get the routes from R80?

Ofir_Shikolski — Thu, 03 Aug 2017 07:34:18 GMT

In case you are using VSX , you will need to use the vsx_provisioning .

You will need to run the run-script command for the management server as the target .

Please see page 15 "show vd name"

Showing Virtual Device Data
show vd name <vd name>
Parameter : vd name
Value : Name of the Virtual Device
Notes : Required

Comments:
• Only non-automatic routes are displayed. Routes which are automatically created with route propagation are not displayed.
• For Virtual Router and Virtual Switch: automatically created wrpj interfaces which connect to a Virtual System are not displayed.

Re: Can we get the routes from R80?

Hugo_vd_Kooij — Mon, 07 Aug 2017 09:34:10 GMT

I would recommend to get the routing table with:

ip route show

The netstat -nr output will only show 1 default route. And if you had another default route still in place from the initial configuratation you will fail to find it with netstat -nr. The ip route show command however will show you both.

(Finding this at 04:45 after a long night with some failed patch installations was not the best moment I can tell from personal experience.)

Re: Can we get the routes from R80?

Mikesh_Khanal — Thu, 24 Aug 2017 03:57:32 GMT

How would we specify domain in run-script in case of environment with MDM? Is there a mechanism that the script run on all the servers being managed under that domain?

Re: Can we get the routes from R80?

Chandhrasekar_S — Wed, 21 Mar 2018 02:01:11 GMT

Hello,

My RestAPI executes fine but my output only gives the following

{"tasks": [{"target": "mgmt","task-id": "b3ee3851-8c50-47e7-96a5-5b897538bab9"}]}

how do I get to show the entire Results in REST API. Is there a specific method I need to call in power shell to display the entire result

Re: Can we get the routes from R80?

Robert_Decker — Wed, 21 Mar 2018 08:34:03 GMT

What is your REST API request, request body?

Please post here.

Re: Can we get the routes from R80?

Chandhrasekar_S — Wed, 21 Mar 2018 19:52:48 GMT

My PowerShell Code

==========================================================================

# Ignore SSL cert Exception

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

# Login to Management server and obtain sid

$URL = "https://xx.xx.xx.xx/web_api"
$Action = "/login"
$URLAnon = "$URL$Action"

$headers = @{ "Content-Type" = "application/json"
}

$login = @{
      "user" = "myadmin"
      "password" = "mypassword"
    }

$login = $login | ConvertTo-Json

$response = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $login

$sid = $response.sid

# run-as script

$Action = "/run-script"
$URLAnon = "$URL$Action"

$headers = @{
    "Content-Type" = "application/json"
    "X-chkp-sid" = $sid
    }

$ScriptDetails =@{
    "script-name" = "GetRoutes"
    "script" = "clish -c 'show route destination 10.0.0.5'"
    "targets" = "MyINTERNETGW1","MyINTERNETGW2"
    }

$ScriptDetails = $ScriptDetails | ConvertTo-Json

#Write-Host $ScriptDetails

$response = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $ScriptDetails

#Write-Output $response | ConvertTo-Json -Depth 10

Write-Output $response

# PUBLISH to Management Server

$EmptyPayload =@{}
$EmptyPayload = $EmptyPayload | ConvertTo-Json

$Action = "/publish"

$URLAnon = "$URL$Action"

$publish = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $EmptyPayload

# Logout of management server
$Action = "/logout"
$URLAnon = "$URL$Action"
$logout = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $EmptyPayload

==========================================================

Result:

tasks

-----

{@{target=MyINTERNETGW1; task-id=0c403efc-c4e6-4cea-bee1-40d35a9c3992}, @{target=MyINTERNETGW2; task-id=8...}}

============================

I wanted to get the entire output result stream and not just the task-id as result

Re: Can we get the routes from R80?

Chandhrasekar_S — Wed, 21 Mar 2018 19:54:31 GMT

by the way, the script I have executes fine. I added commands like 'set radius server' and they are getting executed properly on the gateway. I just don't know, why I am unable to view the entire output stream as my result.

Re: Can we get the routes from R80?

Robert_Decker — Wed, 21 Mar 2018 21:35:51 GMT

Hi,

The response of run-script API command is a list of async tasks -

https://sc1.checkpoint.com/documents/latest/APIs/index.html#web/run-script~v1.1

You should monitor these tasks using show-task API command -

https://sc1.checkpoint.com/documents/latest/APIs/index.html#web/show-task~v1.1

Take a look at this thread -

https://community.checkpoint.com/message/8439-re-r80-api-set-static-route?commentID=8439#comment-8439

Hope this helps.

Robert.

Re: Can we get the routes from R80?

Chandhrasekar_S — Thu, 22 Mar 2018 02:10:47 GMT

OK. Thank you. This makes lot sense now.

I did execute show-task rest-api and I get more details about the task, but still I am missing the Response message output. I need the response message to take it further

My show-task script

====================

# Ignore SSL cert Exception

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

# Login to Management server and obtain sid

$URL = "https://xx.xx.xx.xx/web_api"
$Action = "/login"
$URLAnon = "$URL$Action"

$headers = @{ "Content-Type" = "application/json"
}

$login = @{
      "user" = "myadmin"
      "password" = "mypassword"
    }

$login = $login | ConvertTo-Json

$response = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $login

$sid = $response.sid

# show-task
$Action = "/show-task"
$URLAnon = "$URL$Action"

$ShowTaskID =@{
    "task-id" = "19a88357-1856-4ce6-9d1a-f3d2a4503903"
    "details-level" = "full"
    }

$ShowTaskID = $ShowTaskID | ConvertTo-Json

$response = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $ShowTaskID

Write-Output $response

# Logout of management server
$EmptyPayload =@{}
$EmptyPayload = $EmptyPayload | ConvertTo-Json

$Action = "/logout"
$URLAnon = "$URL$Action"
$logout = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $EmptyPayload

show-task output

====================

{

"tasks": [

{

"uid": "5e3855cb-36d3-46e6-8476-553bbd594a5a",

"name": "MyINTERNETGW2 - Get-routes",

"type": "CdmTaskNotification",

"domain": "@{uid=41e821a0-3720-11e3-aa6e-0800200c9fde; name=SMC User; domain-type=domain}",

"task-id": "19a88357-1856-4ce6-9d1a-f3d2a4503903",

"task-name": "MyINTERNETGW2 - Get-routes",

"status": "succeeded",

"progress-percentage": 100,

"start-time": "@{posix=1521683386071; iso-8601=2018-03-21T21:49-0400}",

"last-update-time": "@{posix=1521683387988; iso-8601=2018-03-21T21:49-0400}",

"suppressed": false,

"task-details": "",

"comments": "Completed",

"color": "black",

"icon": "General/globalsNa",

"tags": "",

"meta-info": "@{lock=unlocked; validation-state=ok; last-modify-time=; last-modifier=myadmin; creation-t

ime=; creator=myadmin}",

"read-only": false

}

]

}

Re: Can we get the routes from R80?

Robert_Decker — Thu, 22 Mar 2018 09:26:52 GMT

Hi,

I saw that the "task-details" field in you response is empty.

Try to execute the same script in SmartConsole GUI as follows, and see what happens -

Robert.

Re: Can we get the routes from R80?

Robert_Decker — Thu, 22 Mar 2018 09:32:18 GMT

BTW, I also used mgmt_cli tool on my management server to run your script on my gateway, and works fine and returns results as expected...

Second thoughts: try to set only one gateway as a terget for the script.

Re: Can we get the routes from R80?

Ruben_Zimmerman — Sat, 28 Apr 2018 07:38:11 GMT

Hi Chandhrasekar Saravanan‌,

did you finally got what expected? I would like to get CPU, RAM, Disk and perhaps a few "services or deamon" information via REST (PowerShell).

Could you paste the complete script? Any hints or suggestions?

Many thanks in advance

Ruben