topic Re: Connecting CheckPoint Management Server using SOCKS Proxy in API / CLI Discussion

Connecting CheckPoint Management Server using SOCKS Proxy

BALAJIRAJAH_PB — Tue, 02 Jun 2020 21:12:57 GMT

Hi,

I'm trying to connect to checkpoint Web API using socks proxy. Would CheckPoint support request via SOCKS Proxy?

Re: Connecting CheckPoint Management Server using SOCKS Proxy

PhoneBoy — Tue, 02 Jun 2020 22:49:36 GMT

Provided what comes toward the management server is a regular HTTPS connection, I don't see why not.
Note that none of Check Point's standard tools support usage via a SOCKS proxy.

Re: Connecting CheckPoint Management Server using SOCKS Proxy

BALAJIRAJAH_PB — Wed, 03 Jun 2020 13:04:35 GMT

API is running on management server

# api status

API Settings:
---------------------
Accessibility: Require ip 127.0.0.1
Automatic Start: Enabled

Processes:

Name State PID More Information
-------------------------------------------------
API Started 10699
CPM Started 5938 Check Point Security Management Server is running and ready
FWM Started 3905
APACHE Started 5043

Port Details:
-------------------
JETTY Internal Port: 50276
APACHE Gaia Port: 443
Apache port retrieved from: httpd-ssl.conf

--------------------------------------------
Overall API Status: Started
--------------------------------------------

API readiness test SUCCESSFUL. The server is up and ready to receive connections

Notes:
------------
To collect troubleshooting data, please run 'api status -s <comment>'

POST https ://<managementserverip>/web_api/v1.3/login and https ://<managementserverip>/web_api/login

request header and body are set appropriately.

response body show the below error

"You don't have permission to access"

Note: Management API has been set to "All IP address that can be used for GUI Clients"

What additional setting that I miss?

Re: Connecting CheckPoint Management Server using SOCKS Proxy

PhoneBoy — Mon, 08 Jun 2020 04:13:19 GMT

The output of API status suggests that all IPs are not, in fact, allowed to access the API server.
Did you publish the change and restart the API server afterwords?