topic Re: How to add access rule using CLI in r80.30 in API / CLI Discussion

How to add access rule using CLI in r80.30

vaidehi — Thu, 02 Jan 2020 22:43:21 GMT

Hello,

I want to add an access rule using CLI in firewall r80.30.

Can anyone please guide me to any document or provide the commands?

Thanks!

Re: How to add access rule using CLI in r80.30

Maarten_Sjouw — Thu, 02 Jan 2020 23:12:15 GMT

Access roles can only be added on the management, not directly on the gateway.
Also when you run a standalone setup the only way is to add the access role in the policy on the management and then push the policy to the gateway. Check Point does not use a ACL type rulebase on the gateway, it is compiled on the management server and then sent to the gateway.

To add a rule in a policy on the management server you can use the API of which you can find all documentation online and lotst of information here on the forum.

Re: How to add access rule using CLI in r80.30

vaidehi — Thu, 02 Jan 2020 23:16:36 GMT

I am sorry, in my context, "Access rule" means "policy". I was wondering is there a way to add a policy on management server using CLI?

Re: How to add access rule using CLI in r80.30

PhoneBoy — Thu, 02 Jan 2020 23:41:33 GMT

Like Maarten said, this is possible with mgmt_cli add access-rule.
For documentation: https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.5

There are several examples on the community.
One that allows you to build the policy that exists in Demo Mode: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/My-Security-Management-Setup-Script/td-p/40239

Re: How to add access rule using CLI in r80.30

vaidehi — Fri, 03 Jan 2020 17:51:10 GMT

Thank you so much for helping!

Re: How to add access rule using CLI in r80.30

vaidehi — Fri, 03 Jan 2020 18:11:16 GMT

Sorry I have one more doubt on same topic. I was able to create a policy using mgmt_cli. I used this syntax:

mgmt_cli add access-rule layer "my_policy Network" source "43.1.1.3" destination "27.1.1.2" service "any" action "accept" track-settings.type "Log" position "1" name "rule1" install-on "chkpt" --port 4434

My doubt: Can i create a source/destination ip address using cli. Because in this scenario, policy gets install if i have already added a source/destination ip. otherwise throws me an error
code: "generic_err_object_not_found"
message: "Requested object [43.1.1.3] not found"

Re: How to add access rule using CLI in r80.30

Maarten_Sjouw — Fri, 03 Jan 2020 18:13:45 GMT

Nope, for that you first need to create the host object:
mgmt_cli add host name Myhost ip_address 43.1.1.3
Then use Myhost as the source in your access rule.

Re: How to add access rule using CLI in r80.30

vaidehi — Fri, 03 Jan 2020 18:17:17 GMT

Thank you for your quick response Maarten. Okay So correct me if I am wrong, if I have to create 1000 policies (working on a script) with 1000 different source ip, i have to create 1000 host object manually first?

Re: How to add access rule using CLI in r80.30

PhoneBoy — Fri, 03 Jan 2020 22:05:26 GMT

Correct.
Note that a given rule can contain multiple source/destination objects.
Also, you can create objects for networks as well.
That might simplify the policy that gets created.

Re: How to add access rule using CLI in r80.30

vaidehi — Fri, 03 Jan 2020 22:07:58 GMT

Got it. Thanks

Re: How to add access rule using CLI in r80.30

Security_Consul — Mon, 13 Jul 2020 09:48:44 GMT

I added multi rule but got error

Line 2: code: "generic_err_invalid_parameter_name"
message: "Unrecognized parameter [action]"

Following this Guide in action field is correct "accept" Why I got still error invalid parameter?

https://sc1.checkpoint.com/documents/latest/APIs/index.html?#cli/add-access-rule~v1.6%20

Re: How to add access rule using CLI in r80.30

PhoneBoy — Mon, 13 Jul 2020 17:55:46 GMT

Try it as Accept instead of accept.
Some of the API calls are case sensitive.

Re: How to add access rule using CLI in r80.30

Security_Consul — Tue, 14 Jul 2020 05:04:11 GMT

Thank you!!