topic Re: Leveraging the R80.10 API to Automate and Streamline Security Operations in API / CLI Discussion

Leveraging the R80.10 API to Automate and Streamline Security Operations

PhoneBoy — Fri, 21 Jun 2019 08:57:03 GMT

On 15th August 2017 we did a webinar with Ryan Darst‌ about the automation and orchestration capabilities you can achieve with the R80.10 API. Specifically, this session covered:

Introduction to using the R80.10 APIs using a variety of tools from Postman to Ansible
Tips on leveraging the API from both the R80.10 CLI and from the RESTful API to do simple tasks from adding objects and services to adding rules
Additional use cases for using other features in the R80 API from policy verification to running scripts on gateways
A demonstration of a complete Check Point cloud auto-scaling environment using Ansible and the R80.10 APIs

The content presented is below:

Slides: How to use R80.10 API for Automation and Streamlined Security (PPT)‌

Video: How to use R80.10 API for Automation and Streamlined Security (Video)

Scripts: CheckMates_Aug15_Demos.zip‌

Q&A: https://community.checkpoint.com/docs/DOC-2181?sr=search&searchId=a87f1f36-8fe9-4b5a-ac48-837a0d545793&searchIndex=1

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

Muazzam_Saeed — Tue, 15 Aug 2017 18:07:39 GMT

It was really a great presentation and demo by Ryan Darst.

Question-1: Is this automation limited to cloud or can we create objects, rules etc in VSX environment?

Question-2: Any suggestions on integration with ticketing systems - to get the source, destination, ports and create objects and rules based on that information?

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

PhoneBoy — Tue, 15 Aug 2017 18:21:13 GMT

Automation can be done with on-premise gateways with VSX as well (though creation and some configuration of VS still requires a CLI command)

Integration with ticketing systems requires some business-specific logic.

I know (in general) we are working on specific integrations with some of these systems to assist with that.

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

Ofir_Shikolski — Tue, 15 Aug 2017 18:24:21 GMT

q1 : You can use the API's put-file and run-script:

Check Point - Management API reference 
put-file file-path "/home/admin/" file-name "vsx_conf" file-content "vs ip 192.0.2.1\nvs2 ip 192.0.2.2" targets.1 "corporate-gateway" --format json
Check Point - Management API reference 
run-script script-name "Script Example: run /home/admin/vsx_conf" script "/home/admin/vsx_conf" targets.1 "corporate-gateway" --format json

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

Stefan_Stefanov — Wed, 16 Aug 2017 21:59:40 GMT

Webinar was absolutely fantastic!

We want to test automation in our company so I downloaded a trial R80.10 version. Seems like Management API is not available there (nothing in Manage & Settings). Is it available only in licensed versions?

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

Ofir_Shikolski — Thu, 17 Aug 2017 06:12:26 GMT

Management API Settings

Startup Settings
- Select Automatic start to automatically start the API server when the Security Management Server starts.
  In these environments, Automatic start is selected by default:
  - Distributed Security Management Servers (without gateway functionality) with at least 4GB of RAM
  - Standalone Security Management Servers (with gateway functionality) with at least 8GB of RAM
In other environments, to reduce the memory consumption on the management server, Automatic start is not selected by default.
Access Settings
Configure IP addresses from which the API server accepts requests:
- Management server only (default) - API server will accept scripts and web service requests only from the Security Management Server. You must open a command line interface on the server and use the mgmt_cli utility to send API requests.
- All IP addresses that can be used for GUI clients - API server will accept scripts and web service requests from the same devices that are allowed access to the Security Management Server.
- All IP addresses - API server will accept scripts and web-service requests from any device.

To apply changes, you must publish the session, and run the api restart command on the Security Management Server.

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

Václav_Brožík — Thu, 17 Aug 2017 09:46:40 GMT

The options mentioned by Ofir Sh can be found here in the SmartConsole:

MANAGE & SETTINGS > Blades > Management API > Advanced Settings...

I would also like to add that you can use the API over HTTPS also in the cloud demo. You have to: set an administrator's password, enable the API access, publish the session, copy the demo server's IP address.

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

Stefan_Stefanov — Thu, 17 Aug 2017 10:06:10 GMT

Guys, I know how to read documentation. I said I don't have such option on a trial license:

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

PhoneBoy — Thu, 17 Aug 2017 17:55:14 GMT

By trial license, do you mean the built-in 15-day one you get on install?

I know it works with ones generated from User Center.

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

PhoneBoy — Fri, 21 Jun 2019 08:57:06 GMT

Even so I did a fresh install with R80.10, using the built-in license, and found the GUI option there.

Another way to enable the API is through the CLI, which I describe here: https://community.checkpoint.com/thread/1082‌

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

Ofir_Shikolski — Sat, 19 Aug 2017 20:36:41 GMT

are you using MDM (MDS)?

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

Tomer_Sole — Tue, 26 Sep 2017 18:37:11 GMT

From your screenshot I see it's a Multi-Domain deployment and you have logged into one of your domain. API settings are managed in the MDS domain since it's one process for the server (since it has no inner state).

Please log into your MDS domain and set the settings.

Dameon Welch Abernathy‌ Ofir Sh Václav Brožík I challenge u to spot my proof for that being a multi-domain screenshot

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

PhoneBoy — Tue, 26 Sep 2017 21:10:07 GMT

Challenge accepted

The key appears to be here:

In an MDM (or at least the screenshot Stefan Stefanov‌), there is no Permissions & Administrators and Sync with UserCenter options.

The above screenshot is from my standalone (not MDM) manager.

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

Amit_Chaubey — Fri, 14 Sep 2018 11:37:13 GMT

Hi,

I am using Terraform for infrastructure provisioning and Ansible for configuration in AWS to deploy checkpoint FIrewall R80, I am stuck on few points below,

1. How to add URL for Egress filtering. We need to policy through Ansible so that Internal subnet can access the Some URL on the Internet and rest should be blocked.

2. How to add gateways in the Management server.

3.How to enable other blades(IPS etc.) if required.

4. How to config for lag management, I am planning to send to Splunk server.

4. How we can define instance as the Management server. For Gateway I am using below in user data file.

my_user_data: |
#!/bin/bash
clish -c 'set user admin shell /bin/bash' -s
clish -c 'set static-route {{ aws_lb1_subnet_cidr }} nexthop gateway address {{ aws_internal_route }} on' -s
clish -c 'set static-route {{ aws_lb2_subnet_cidr }} nexthop gateway address {{ aws_internal_route }} on' -s
clish -c 'set static-route {{ aws_webserver_subnet_cidr }} nexthop gateway address {{ aws_internal_route }} on' -s
clish -c 'set static-route {{ aws_database_subnet_cidr }} nexthop gateway address {{ aws_internal_route }} on' -s
config_system -s 'install_security_gw=true&install_ppak=true&gateway_cluster_member=false&install_security_managment=false&ftw_sic_key=vpn12345';shutdown -r now;

Any help would be highly appreciable.

Re: Leveraging the R80.10 API to Automate and Streamline Security Operations

PhoneBoy — Fri, 14 Sep 2018 14:55:44 GMT

Questions 1-3 can be answered by reading the API documentation: Tip of the Day: Local R80.x API Documentation‌

I would search for and ask the specific API questions as seperate thread(s) here: Developers (Code Hub)‌

Question 4 should be solved with Log Exporter, see: Log Exporter guide‌ and Log Exporter - Splunk Integration Update‌

Question 5, you need to (at a minimum) modify the config_system line, see: How to run the First Time Configuration Wizard through CLI in Gaia R76 and above

You probably need to do other things as well and it might be worth reviewing the CloudFormation script for installing Management in AWS.