topic I Like to run a python script to install the 1000 policies on firewall. in API / CLI Discussion

I Like to run a python script to install the 1000 policies on firewall.

vaidehi — Mon, 23 Dec 2019 20:24:03 GMT

Hello,

I want to install 1000 polices on Checkpoint firewall. However, I am not familiar with the Infra environment. Anyone can please guide me to any document or explain it to me that how can I set a python environment to run a python script?

I am using GAIA R80.30

Thanks!

Re: I Like to run a python script to install the 1000 policies on firewall.

PhoneBoy — Mon, 23 Dec 2019 21:09:04 GMT

In Check Point, we refer to a policy as a collection of rules (Access Control, Threat Prevention).
The API is REST-based and you can use any programming language to interact with the API, including Python.
Several Python programs are referred to in the API/CLI Discussion space: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/bd-p/codehub

Re: I Like to run a python script to install the 1000 policies on firewall.

vaidehi — Mon, 23 Dec 2019 21:15:44 GMT

Thank you for your response.
I am still confused. I am new to checkpoint firewall therefore really sorry , i might ask you really basic questions.

For instance, in which mode i can write a python script?
[Chkptfw]# python
bash: python: command not found
I see this error in expert mode

Re: I Like to run a python script to install the 1000 policies on firewall.

PhoneBoy — Tue, 24 Dec 2019 00:44:17 GMT

On R80.30 Management (with the 3.10 kernel), python is in the path (specifically in /bin).
On R80.x Gateways or Standalone, the python interpreter is $FWDIR/Python/bin/python.

Note that the python interpreter installed only includes the specific libraries we use in the product.
We do not support installing additional libraries or otherwise updating the interpreter beyond what is installed.
Highly recommend using a different system if Python is your choice of language.

If you want to run things directly on the management, you're better off calling mgmt_cli via shell scripts.

Re: I Like to run a python script to install the 1000 policies on firewall.

vaidehi — Tue, 24 Dec 2019 18:46:03 GMT

What do you mean by "different system"? Can I install polices (Access rules) using any other device? OR
Is there any script which is already installed in the management server which i can use to install polices (access rule?)?

Thanks!

Re: I Like to run a python script to install the 1000 policies on firewall.

PhoneBoy — Tue, 24 Dec 2019 19:34:22 GMT

Different system, meaning a system that is NOT your gateway or management.
mgmt_cli is a CLI command that can be used from the management server to modify the access policy.
It's basically an API client and you have to interact with it in a similar way to be effective.
While this is an older TechTalk, a lot of the concepts still apply: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Leveraging-the-R80-10-API-to-Automate-and-Streamline-Security/m-p/5381
The API (and mgmt_cli) docs: https://sc1.checkpoint.com/documents/latest/APIs/index.html#~v1.5

Re: I Like to run a python script to install the 1000 policies on firewall.

vaidehi — Thu, 02 Jan 2020 22:40:42 GMT

Thank you for your help!

Re: I Like to run a python script to install the 1000 policies on firewall.

Václav_Brožík — Fri, 03 Jan 2020 14:44:07 GMT

Note that R80.20 and newer contain also Python 3! (I am not sure about R80.10) The python executable in path is Python 2.

There is the relatively new version 3.7.4 at $FWDIR/Python/bin/python3

Certainly I would not recommend using Python 2 to write any new code as it will be unsupported just in 4 months and after that its use will pose a security risk!