topic Re: Web API - setting track level in API / CLI Discussion

Web API - setting track level

Vlad_Tonne — Wed, 16 Oct 2019 11:26:54 GMT

Hi CheckMates,

Encountered an issue with Management API while creating a rule via Web API.

Trying to set track level according to https://sc1.checkpoint.com/documents/latest/APIs/index.html#web/set-access-rule~v1.5%20 , track field is able to receive "log" (even though it seems not to be documented).

However, it automatically switches on "Accounting" log feature as well.

Trying to adjust the accounting setting results in an error.

Any thoughts how it can be resolved?

Sent payload that creates a rule with logging enabled plus accounting:

payload_For_API = {
        "layer": "Network",
        "position": "top",
        "name": "API 1",
        "action": "Accept",
        "destination": "hst_dst_1.10.1.100",
        "service": "Kubernetes1",
        "enabled": True,
        "source": "Any",
        "track": "log"
}

Trying to use track.type (as in https://community.checkpoint.com/t5/Policy-Management/change-to-Track-setting-in-policy/m-p/47958#M2929) results in

{'code': 'generic_err_invalid_parameter_name', 'message': 'Unrecognized parameter [track.type]'}

Trying to configure track using additional fields:

{'code': 'generic_err_invalid_parameter', 'message': 'Invalid parameter for [track]. The invalid value [ "accounting" : False }] should be replaced by one of the following values: [none, log, extended log, detailed log]'}

or:

{'code': 'generic_err_invalid_parameter', 'message': 'Invalid parameter for [track]. The invalid value [ "log" , {"accounting" : False }] should be replaced by one of the following values: [none, log, extended log, detailed log]'}

Thanks,

Vlad Tonne

Re: Web API - setting track level

Maarten_Sjouw — Wed, 16 Oct 2019 11:36:27 GMT

try to use "track.accounting true"

Re: Web API - setting track level

Maik — Wed, 16 Oct 2019 11:40:43 GMT

As Maarten mentioned "track.accounting true" should work fine.

The documentation mentions that accounting only accepts boolean values; meaning true or false.

The "type" option can only be used with "Log", "Extended Log", "Detailed Log" or "None".

Re: Web API - setting track level

Vlad_Tonne — Wed, 16 Oct 2019 12:14:06 GMT

Hi,

Usage of "track.accounting" results in error.

"track": "log",
"track.accounting": False

{'layer': 'Network', 'position': 'top', 'name': 'API 1', 'action': 'Accept', 'destination': 'hst_dst_1.10.1.100', 'service': 'Kubernetes1', 'enabled': True, 'source': 'Any', 'track': 'log', 'track.accounting': False}

{'code': 'generic_err_invalid_parameter_name', 'message': 'Unrecognized parameter [track.accounting]'}

BR,

Vlad Tonne.

Re: Web API - setting track level

Maik — Wed, 16 Oct 2019 12:25:00 GMT

Works via management cli:

"add access-rule name 'Test' layer Network position bottom track.accounting true"

My guess is that you cant use both statements with one task:

"track": "log",
"track.accounting": False

Try to create the rule with track log first and afterwards use the set access rule command and enable account via "track.accounting": True.

Re: Web API - setting track level

Vlad_Tonne — Wed, 16 Oct 2019 12:46:55 GMT

Already tried that.
Still same issue when doing the setting via Web API.

BR,
Vlad

Re: Web API - setting track level

Maik — Wed, 16 Oct 2019 14:11:43 GMT

Maybe @Amiad_Stern can help.

Re: Web API - setting track level

Amiad_Stern — Thu, 17 Oct 2019 07:01:42 GMT

@Vlad_Tonne , @Maik ,

Which version are we talking about?

Here are commands that worked for me on R80.30.

mgmt_cli:

mgmt_cli add access-rule layer "Network" position 1 name "Rule 1" track.type "Log" track.accounting true

Web Services:

{
"name": "amiad rule1",
"position" : 1,
"track": {
"accounting": true,
"type": "Log"
},
"layer": "Network"
}

Re: Web API - setting track level

Vlad_Tonne — Thu, 17 Oct 2019 07:53:09 GMT

Rule creation worked without accounting, upon setting:
payload_For_API = {
"name": "amiad rule1",
"position" : 1,
"track": {
"accounting": False,
"type": "Log"
},
"layer": "Network"
}

It might be worthwhile to add in API documentation "required" for "type" when additional flags like "accounting" are to be used.

Thanks,
Vlad