topic Re: policyCleanUp.py issue in API / CLI Discussion

policyCleanUp.py issue

Shawn_Fletcher — Wed, 26 Jun 2019 02:47:35 GMT

Hi there, Pretty new to Checkpoint API/Scripting but was trying to do a policy cleanup and this looks like it could be a huge help.

-Running directly on SMS R80.20 M2
-Check Point API Python SDK added and variable set

Ran policyCleanUp.py multiple ways - but to keep it simple examples below

as User

# python policyCleanUp.py -op plan
[2019-06-25 22:39:10] Failed to login. Error: APIResponse received a response which is not a valid JSON.

User has access to management api in user settings, API is set to accept from all IP addresses

using the root flag

# python policyCleanUp.py -op plan -r true
Traceback (most recent call last):
File "policyCleanUp.py", line 1118, in <module>
main()
File "policyCleanUp.py", line 989, in main
check_validation_for_mds(client, user_args.domain)
File "policyCleanUp.py", line 935, in check_validation_for_mds
if int(api_res.data.get('total')) != 0:
AttributeError: 'NoneType' object has no attribute 'get'

Any ideas? This seemed like it would be really helpful to run for me.
thanks!

Re: policyCleanUp.py issue

PhoneBoy — Wed, 26 Jun 2019 03:07:56 GMT

Most likely you have not enabled the API to be usable from hosts other than localhost.
You can confirm this with the command api status on the management server.
To fix this problem, see: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Enabling-web-api/m-p/32641/highlight/true#M2011

Re: policyCleanUp.py issue

Shawn_Fletcher — Wed, 26 Jun 2019 03:20:51 GMT

i think i did but let me know if this is wrong.

# api status

API Settings:
---------------------
Accessibility: Require all granted
Automatic Start: Enabled

Processes:

Name State PID More Information
-------------------------------------------------
API Started 9954
CPM Started 7079 Check Point Security Management Server is running and ready
FWM Started 24951
APACHE Started 7453

Port Details:
-------------------
JETTY Internal Port: 50277
APACHE Gaia Port: 4434 (a non-default port)
When running mgmt_cli commands add '--port 4434'
When using web-services, add port 4434 to the URL

--------------------------------------------
Overall API Status: Started
--------------------------------------------

API readiness test SUCCESSFUL. The server is up and ready to receive connections

Notes:
------------
To collect troubleshooting data, please run 'api status -s <comment>'

Re: policyCleanUp.py issue

PhoneBoy — Wed, 26 Jun 2019 04:35:36 GMT

You'll probably have to modify the script to use a non-standard port.
While I'm not familiar with the script, it probably assumes port 443, not 4434.

Re: policyCleanUp.py issue

Sigbjorn — Wed, 26 Jun 2019 07:54:13 GMT

You need to add "--port 4434" when running the script to connect to non-default port.

By default, it will connect to port 443.

/Sigbjorn

Re: policyCleanUp.py issue

Shawn_Fletcher — Wed, 26 Jun 2019 13:32:34 GMT

thank you both, clearly i should have caught that but definitely the solution