topic Use of MGMT_CLI - 4 eyes review in API / CLI Discussion

Use of MGMT_CLI - 4 eyes review

pnorman821 — Thu, 07 May 2020 10:48:15 GMT

Hi,

I have been doing some work on the use of the MGMT_CLI API as a means of creating objects, rules & services etc. We have a process whereby changes an admin makes have to get reviewed by another admin in the team before they are published.

Is there a way how I can get changes reviewed easily by a fellow administrator before they are published via the GUI or would it be case of publishing the changes then discarding them via 'Revisions' in SmartConsole. Just trying to work out if there is a better way.

We used to use SmartWorkflow and understand this may be reintroduced in future versions.

Thanks

Paul Norman

Re: Use of MGMT_CLI - 4 eyes review

Martin_Valenta — Thu, 07 May 2020 12:22:01 GMT

session changes can be kept unpublished and then somebody else from your team can takeover your session and publish those changes.
In our team we had process that one person edited and published rules and second person on team just verified and install policies..

Re: Use of MGMT_CLI - 4 eyes review

PhoneBoy — Sat, 09 May 2020 06:27:48 GMT

R80.40 has SmartTasks, which could be used to potentially automate some of these "four eyes" checks.
As for something built in, not yet.

Re: Use of MGMT_CLI - 4 eyes review

pnorman821 — Tue, 12 May 2020 07:51:44 GMT

Thanks all, I shall test this.

Re: Use of MGMT_CLI - 4 eyes review

Dima_M — Thu, 14 May 2020 06:57:52 GMT

@pnorman821

Hi Paul et al,

We recently released a solution that allows 4 eyes review, it consists of two elements:

1. Changes Report - developed using our new SmartConsole Extensions technology, this feature allows review of changes before publishing and comparison between revisions.

2. Approval Cycle (4 eyes principal) - Peer review before publishing the session.

This release is focused on SmartConsole changes and once turned on, it blocks admin from publishing until another admin approves the session
Behavior is similar for API sessions:
If user A does API changes, he/she will have to have another user B to tag their session, user B can use "show-changes" API to view the changes.

In order to get this solution, please approach Solution Center via your account team. Should you have any question or feedback, please feel free to contact me directly mailto:dimam@checkpoint.com

Re: Use of MGMT_CLI - 4 eyes review

PhoneBoy — Fri, 10 Jan 2025 18:36:48 GMT

The functionality you're looking for is called SmartWorkflow (or at least that's what it used to be called in R77.x days).
Requires R81.20 or above, no special license needed.
It should have API (and thus CLI) support.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Session-flow-for-Administrators.htm